An anonymous compliance verification method for privacy protection of a UAV flight path

Abstract

The application relates to the technical field of unmanned aerial vehicle route supervision, in particular to an anonymous compliance verification method for unmanned aerial vehicle route privacy protection. The method comprises the following steps: an unmanned aerial vehicle end is registered by a registration center, an identity label is generated, and a registration qualification certificate is issued; a route is audited and declared by a supervision party, and a randomizable anonymous route certificate is issued for the meta information, the identity label and the route set corresponding to the approved route; the unmanned aerial vehicle end randomizes the anonymous route certificate during flight, generates a one-time encrypted identity label, a coefficient commitment and a zero-knowledge proof; a monitoring station completes local verification based on the current grid and an online presented message, does not need to obtain a complete route or a real identity, and if the current position belongs to the approved route, the verification is passed; if the certificate and the proof are valid but the current position is out of bounds, an audit record is generated and a controllable accountability process is entered, so that the deployability and safety of unmanned aerial vehicle route supervision are effectively improved.

Description

Technical Field

[0001] The embodiments of this application relate to the field of drone flight path monitoring technology, and in particular to an anonymous compliance verification method for drone flight path privacy protection. Background Technology

[0002] With the rapid development of applications in low-altitude economy, logistics and distribution, inspection and mapping, emergency communications, and urban governance, drone flight activities are gradually moving from closed testing environments into complex public airspace. To ensure the safety of low-altitude airspace, regulators typically require drones to declare their flight routes in advance and undergo identification, location reporting, and boundary crossing checks during flight. Traditional regulatory approaches emphasize identifiability and traceability, i.e., confirming the drone's identity, location, and operational status through remote identification, broadcast messages, flight records, and centralized auditing platforms.

[0003] However, drone flight paths can be highly sensitive. For example, the flight paths of logistics drones may reflect warehousing nodes and delivery strategies; the flight paths of inspection drones may expose the locations of critical infrastructure; and the flight paths of security or emergency drones may reveal mission areas and operational intentions. If ordinary monitoring stations, bystanders, or non-essential regulatory bodies can obtain complete flight paths or long-term identification, it could lead to information leaks beyond the scope of regulation. Therefore, drone regulation needs to shift from "completely disclosing identity and flight paths" to a privacy-enhancing model of "verification on demand, minimal disclosure, and accountability for violations."

[0004] Anonymous credentials, zero-knowledge proofs, Pedersen commitments, and geographic grid indexes provide the technological foundation for the aforementioned objectives. Anonymous credentials can prove that an entity holds legitimate status without revealing its true identity; zero-knowledge proofs can prove that a set of secret values ​​satisfies a specific relation without disclosing the secret values ​​themselves; Pedersen commitments can bind hidden values ​​and support certain homomorphic operations; and geographic grid indexes such as H3 can discretize continuous geographic space into a computable set of grids. Combining these technologies and applying them to drone flight path monitoring can transform the approved flight path set into verifiable mathematical relations, allowing monitoring stations to determine whether the current location is compliant without possessing the complete flight path, thereby protecting flight path privacy.

[0005] Existing drone route regulation and privacy protection solutions still have significant shortcomings: while remote identification and location broadcasting solutions can improve drone visibility and trackability, they easily expose drone identity, real-time location, and flight trajectory; anonymous remote identification solutions mainly address the anonymity issue but struggle to directly verify whether the current location belongs to an approved route; zero-knowledge path proof solutions, while protecting path privacy, typically rely on complex circuits, resulting in high proof generation costs and making them unsuitable for the lightweight online verification needs of drones; anonymous credentials and H3 grid indexes address qualification verification and spatial discretization issues respectively, but lack an effective combination of route approval, hidden route set verification, and accountability for violations. Therefore, existing technologies cannot simultaneously meet the practical regulatory needs of route privacy protection, current location compliance verification, and controllable accountability after violations. Summary of the Invention

[0006] To address the aforementioned technical issues, embodiments of this application propose an anonymous compliance verification method for protecting the privacy of drone flight routes. This method enables monitoring stations to verify whether a drone's current location falls within the range of routes approved by regulators, without disclosing the drone's complete declared flight route or exposing its long-term true identity. Furthermore, it allows for auditable and controllable identity-based accountability in the event of violations.

[0007] To achieve the above objectives, embodiments of this application propose an anonymous compliance verification method for drone flight route privacy protection. This method is implemented based on an anonymous compliance verification system composed of a registration center, a regulator, a drone terminal, and a monitoring station. The method includes: the drone terminal submitting a registration request to the registration center, which completes the drone terminal's identity registration, identity tag generation, and registration qualification certificate issuance; the drone terminal submitting a flight route approval request to the regulator and presenting the registration qualification certificate, which is then reviewed by the regulator. The regulator designates the approved flight route as the approved flight route and issues a randomizable anonymous flight route certificate for the corresponding metadata, identity tag, and flight route set; the drone terminal broadcasts its current location, timestamp, and corresponding flight route metadata during flight, and randomly... Anonymized flight route credentials are generated by creating a one-time encrypted identity tag and coefficient commitment, which in turn generates a zero-knowledge proof. Upon receiving an online presentation message, the monitoring station verifies its zero-knowledge proof. If the zero-knowledge proof verification fails, the online presentation message is rejected. If the zero-knowledge proof verification succeeds, local verification is performed based on the current location, timestamp, and flight route metadata. If the current location belongs to an approved flight route, the verification succeeds. If the current location does not belong to an approved flight route, an accountable violation record is generated and submitted to the regulator for review. Upon receiving the accountable violation record, the regulator reviews it. If it confirms that the zero-knowledge proof verification has succeeded and the current location does not belong to an approved flight route, it submits the reasons for accountability and an identity unlocking request to the registration center. The registration center then executes the identity unlocking, achieving controllable accountability.

[0008] To achieve the above objectives, embodiments of this application also propose an electronic device, including a processor and a memory, wherein the memory stores instructions executable by the processor, and the processor is configured to execute the instructions such that the electronic device can implement an anonymous compliance verification method for protecting the privacy of drone flight routes as described above.

[0009] To achieve the above objectives, embodiments of this application also propose a computer-readable storage medium storing a computer program that, when executed by a processor, enables an anonymous compliance verification method for protecting the privacy of unmanned aerial vehicle (UAV) flight paths as described above.

[0010] Optionally, before the drone submits a registration request to the registry center, the following steps are also included: Initialize the anonymous compliance verification system by selecting a prime-order bilinear group. The group order is a prime number. , , , All are multiplicative cyclic groups, bilinear mappings Represented as ; Select two independent generators used in the Pedersen commitment and , , and select Generators in , ; Set hash function , and , , , , It is a finite field. Used to map route metadata to a finite field Used to generate the Coconut credential signature base. Fiat-Shamir transform used in zero-knowledge proofs; The registration center generates an accountability key pair, where the accountability private key is represented as follows: The public key for accountability is represented as , ; The Coconut signing private key is generated by the regulator. and publish verification public keys. ; in, , , , , , , .

[0011] Optionally, the drone submits a registration request to the registration center, which then completes the drone's identity registration, identity tag generation, and registration qualification certificate issuance, including: The drone submits its real identity information to the registration center. To submit a registration request; among them, Used to complete real-name registration and qualification verification of devices; After the registration center approves the application, it generates an identity tag for the drone. and establish and Mapping relationship between ; The registration center issues registration qualification certificates for drone terminals. In the subsequent route approval stage, the drone operator presented the following documents to the regulator: To prove their eligibility to apply for flight routes, regulators only need to verify... The legality and validity of it do not need to be known. .

[0012] Optionally, the drone operator submits a route approval request to the regulator and presents its registration certificate. The regulator reviews the request and designates the approved routes as the approved routes, including: The drone operator submitted a route approval request to the regulator and provided the following documents: ; The regulatory authorities review and verify the route approval requests. The issuing authority, validity period, equipment type, and eligibility of the applicant must be confirmed, and the identity tag used in this route approval request must be verified. If the identity tags bound in the system are consistent, and the verification is successful and the identity tags are consistent, then the route corresponding to the approved route approval request will be the approved route. The drone terminal uses the preset H3 resolution. The approved routes are discretized into H3 grid sets. and according to Constructing the root polynomial ;in, , The number of approved routes An H3 grid in The representation in the text, For any current H3 grid Whether it belongs to the conversion of approved routes .

[0013] Optionally, the regulator may issue randomizable anonymous route credentials representing the metadata, identity tags, and route set corresponding to the approved routes, including: The regulator generates metadata for approved routes. , , Indicates the validity period of the route. Indicates the approval strategy number; Regulators calculate metadata summary , and to , , Issuance of anonymous flight credentials ;in, , , , As the Coconut signature base, the drone end ultimately holds , , , .

[0014] Optionally, the drone broadcasts its current location, timestamp, and metadata corresponding to the flight path during flight, randomizes the anonymous flight path credentials, generates a one-time encrypted identity tag and coefficient commitment, and then generates a zero-knowledge proof, including: During flight, the drone broadcasts its current location, timestamp, and corresponding metadata about the flight path. The monitoring station then uses the H3 resolution metadata from the drone's broadcast location and flight path information. Independently calculate the current H3 mesh , , The current longitude of the drone. The latitude of the drone is currently displayed; the timestamp is [data missing]. ; Select random number on the drone side right Randomization is performed to obtain randomized anonymous flight route credentials. , making , ;in, ; Select random number on the drone side ,based on Generate Coconut voucher verification auxiliary quantity and based on and calculate ;in, , , ; The drone terminal selects a one-time identity encryption random number. and based on Generate one-time encrypted identity tag ;in, , , , ; The drone-side generates Pedersen commitments based on the root polynomial coefficients. , To ensure that the promised random items at legal locations cancel each other out, the drone terminal sets the random numbers to satisfy... That is, first select a random number. , and then ; Zero-knowledge proof generation on drone This proves that the drone knows , , , , and prove , and All are based on the same identity tag and the coefficients of the same set of roots polynomials Correctly generated, The Fiat-Shamir Challenge is tied to online context. Thus preventing It is copied to another location or used at another time; in, .

[0015] Optionally, the monitoring station receives Afterwards, check Whether it is valid, For the monitoring station's local timestamp, If the preset time difference threshold is met, then according to... Recalculate and based on examine Is it within the validity period of the route? Inside; like lie in Inside, the monitoring station is based on , , Independent calculation and verify Does it meet the requirements? If the conditions are not met, then refuse. ; If satisfied, then verify. If the verification fails, it means... A lack of consistency between the credentials, identity encryption tags, or coefficient commitments in the data necessitates rejection. If the verification passes, then calculate the polynomial zero-value verification quantity. , ,like Then accept ,Sure The route is an approved air route and has passed verification. like If so, it means that the drone has a valid route certificate, but the current location does not belong to the approved route. It is necessary to generate a record of the violation that can be traced and submit it to the regulator for review.

[0016] Optionally, the monitoring station generates an audit chain upon detecting a boundary breach. , represented as: ; in, To verify the results, For the monitoring station's ID; After receiving the audit chain, the regulator will review the Coconut credential verification results, zero-knowledge proof verification results, timestamp validity, route validity period, metadata consistency, polynomial zero-value check results, and monitoring station record completeness. If the regulator confirms that the credentials and proofs are valid, and the current location is indeed not on an approved flight route, then the identity unlocking process will begin, and the application will be submitted to the registration center. , Reasons for holding accountable ; The registry center uses the accountability private key for calculation. , ,based on Query the real identity based on the registry and return the signed accountability results to the regulator. , represented as: .

[0017] Optionally, if joint approval across regions or multiple departments is required, a single regulatory body can be expanded into multiple regulatory bodies. , For the first One regulatory body, The total number of regulators, each holding a shard of the Coconut signing key. The Coconut signing key fragment held is denoted as Each regulator generates partial route vouchers. The generated partial route voucher is recorded as follows ; ; ; ; After collecting at least a threshold number of partial flight route vouchers on the drone side, the Lagrange coefficient is used. Generate complete vouchers , Still satisfied .

[0018] This application proposes an anonymous compliance verification method for drone flight path privacy protection, which achieves the following improvements compared with traditional drone flight path supervision and privacy protection schemes.

[0019] First, it enhances the protection of flight route privacy. This application uses an H3 grid to discretize the approved flight routes on the UAV side and further constructs a root polynomial, transforming the judgment of "whether the current position belongs to an approved flight route" into a polynomial zero-value verification problem. During the verification phase, the monitoring station only needs to calculate the current H3 grid based on the broadcast position of the UAV side and combine it with the coefficient commitment to calculate the zero-value verification quantity to determine whether the current position belongs to an approved flight route, without needing to obtain the complete set of flight routes or access the plaintext flight route database. Therefore, compared with the scheme of directly reporting the complete flight route, continuously broadcasting the trajectory, or querying the background plaintext, this application significantly reduces the sensitive flight route information that the monitoring station can obtain, and reduces the risk of commercial flight routes, inspection routes, and mission flight trajectories being inferred.

[0020] Second, it reduces the risk of long-term identity association. This application employs randomizable anonymized flight route credentials and one-time encrypted identity tags. Each time the credential is presented online, the drone terminal randomizes the flight route credential and generates an encrypted identity tag using a new random number. This ensures that presentation messages from the same drone at different times or monitoring stations do not present a fixed credential identifier or a fixed encrypted identity. Therefore, ordinary monitoring stations cannot associate the drone's multiple flight behaviors with recurring identity identifiers, credential content, or encrypted formats, thereby reducing the risk of long-term identity tracking and flight behavior profiling.

[0021] Third, ensuring the credibility of route approval results. This application involves the regulatory authority issuing an anonymous route certificate jointly based on the route's metadata, traceable identity tag, and root polynomial coefficients. During the online presentation phase, zero-knowledge proofs are used to confirm the certificate's hidden attributes, and the one-time encrypted identity tag and polynomial coefficients confirm that they use the same identity tag and the same set of root polynomial coefficients. Therefore, the monitoring station can confirm that the set of routes used by the drone for compliance verification truly originates from regulatory approval, rather than a fake set of routes temporarily constructed or replaced by the drone, thereby improving the credibility of the online verification results.

[0022] Fourth, it improves online verification efficiency and deployment feasibility. This application does not encode the entire flight path, complex airspace policies, or continuous geographical constraints into a generic zero-knowledge proof circuit. Instead, it utilizes root polynomials and Pedersen commitments to transform current location compliance into commitment aggregation and zero-value checks. The monitoring station only needs to perform time checks, credential pairing verification, zero-knowledge proof verification, and one commitment aggregation calculation to complete the local determination. Therefore, compared to schemes that construct complex proof circuits for the entire path, this application reduces the computational complexity of online verification and the difficulty of system implementation, making it more suitable for deployment in distributed monitoring stations or low-altitude surveillance scenarios.

[0023] Fifth, this application achieves a balance between anonymity, accountability, and scalability. During the normal flight verification phase, this application conceals the drone's true identity and complete flight path, providing only the minimum information required for the monitoring station to complete the compliance assessment of its current location. When both the credentials and zero-knowledge proofs are valid, but the polynomial zero-value check fails, the monitoring station generates an audit chain, which is then reviewed by the regulator before requesting the registry center to unlock the one-time encrypted identity tag. Thus, this application avoids the excessive exposure of legitimate flight privacy caused by full-process real-name supervision, and also avoids the problem of lack of accountability associated with completely anonymous solutions. Furthermore, this application can be extended to multi-regulatory joint approval scenarios through threshold Coconut credentials, reducing the risk of single points of failure and unilateral over-authorization, and improving the adaptability of cross-regional and cross-departmental low-altitude airspace supervision. Attached Figure Description

[0024] To more clearly illustrate the technical solutions in the embodiments or related technologies of this application, the accompanying drawings used in the description of the embodiments or related technologies of this application will be briefly introduced below. Obviously, the following drawings are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. The drawings described herein are only used to explain this application and are not intended to limit this application.

[0025] Figure 1 This is a flowchart of an anonymous compliance verification method for protecting drone flight route privacy, provided in one embodiment of this application; Figure 2 This is a schematic diagram of the structure of an anonymous compliance verification system provided in one embodiment of this application; Figure 3 This is a schematic diagram of the structure of an electronic device provided in another embodiment of this application. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the various embodiments of this application will be described in detail below with reference to the accompanying drawings. Those skilled in the art will understand that many technical details have been provided in the embodiments of this application to facilitate better understanding. However, the technical solutions claimed in this application can be implemented even without these technical details and various variations and modifications based on the following embodiments. The division of the following embodiments is for ease of description and should not constitute any limitation on the specific implementation of this application. The following embodiments can be combined with and referenced by each other without contradiction.

[0027] With the widespread application of drones in various scenarios such as low-altitude logistics, inspection and mapping, emergency communication, and urban governance, how to achieve identity recognition, location monitoring, route compliance verification, and privacy protection during flight has become a crucial issue for drone regulation. Existing solutions mainly focus on remote identification, anonymous remote identification, location privacy protection, zero-knowledge path proof, anonymous credentials, and geographic grid indexing. These solutions address issues such as drone identifiability, location tracking, anonymous authentication, path hiding proof, and spatial discretization, but a complete technical closed loop for approved routes—"route approval—route set hiding—current location local verification—boundary violation audit and accountability"—has not yet been formed.

[0028] In 2018, Uber Technologies and others proposed and open-sourced the H3 geospatial indexing system. H3 uses a hierarchical hexagonal grid to discretize geospatial data, mapping latitude and longitude locations to defined H3 grid cells and supporting spatial aggregation, neighborhood queries, and region coverage at different resolutions. This approach is suitable for scenarios such as map analysis, regional statistics, and spatial indexing, and can also provide a basic tool for discretizing drone flight paths. However, H3 is essentially a geospatial indexing method that only solves the problem of "how to convert continuous geographic locations into discrete grid numbers," without providing cryptographic capabilities for flight path approval verification, hidden set membership verification, or anonymous compliance verification. If the complete H3 grid flight path set is directly provided to the monitoring station, the station can recover or infer the complete drone flight path; if only the current grid number is provided, the monitoring station cannot determine whether the grid belongs to the approved flight path set. Therefore, this approach cannot solve the local compliance verification problem under the condition of hidden flight path sets.

[0029] In 2019, Sonnino et al. proposed Coconut, an anonymous credential system supporting threshold issuance and selective disclosure. This scheme supports joint issuance of credentials by multiple issuers, allows credentials to contain both public and hidden attributes, and supports credential randomization, reducing the correlation between different credential presentations. Coconut is suitable for scenarios such as distributed anonymous authentication, anonymous qualification verification, and blockchain credentials, proving that a user holds legitimate credentials without exposing all user attributes. However, Coconut's core functionality is anonymous credential issuance and selective disclosure; it does not define a representation method for drone flight path sets, nor does it directly support verifying whether the current location belongs to a hidden set of approved flight paths. If flight paths are treated as public attributes, it will lead to flight path leakage; if flight paths are treated as hidden attributes, additional mechanisms are still needed to prove the membership relationship between the current location and the hidden flight path set. Therefore, this scheme can serve as the basis for drone registration qualification verification or flight path approval credentials, but it cannot independently complete the process of hidden flight path set verification, boundary violation auditing, and identity accountability.

[0030] In 2021, the U.S. Federal Aviation Administration (FAA) released a rule for Remote Identification of Unmanned Aircraft (UAVs). This rule requires eligible UAVs to provide remote identification information during flight, enabling regulators, law enforcement, or nearby receiving devices to identify the UAV and obtain its operational status. Standard Remote ID UAVs typically broadcast information such as the UAV identifier, location, altitude, speed, control station location, timestamps, and emergency status. This approach significantly improves the visibility and traceability of UAV operations, aiding in airspace safety management and accountability. However, the basic idea behind this approach is to provide identity and location information to external receivers, primarily addressing the question of "who is the UAV and where is it," without addressing route privacy protection. For commercial routes, sensitive inspection routes, or mission-oriented flight scenarios, external observers can infer UAV flight trajectories, mission patterns, or operating entities through continuous reception and correlation analysis, posing risks of route exposure and long-term identity association. Therefore, this approach cannot enable ordinary monitoring stations to locally determine whether their current location belongs to an approved route without disclosing the complete flight path.

[0031] In 2021, Tedeschi et al. proposed the ARID anonymized remote identification scheme. This scheme, designed for Remote ID scenarios, uses temporary aliases to anonymously broadcast drone information, preventing ordinary recipients from directly obtaining the long-term identity of the drone and its operator. Only trusted organizations can associate the temporary alias with the real identity. ARID also introduces a message authentication mechanism to prevent the forgery or impersonation of drone remote identification messages. This scheme reduces the risk of long-term tracking of fixed identities in traditional Remote ID and achieves a balance between anonymity and accountability. However, ARID primarily addresses the problem of "how to make the identity in remote identification messages anonymous and verifiable," not "whether the current location belongs to an approved set of flight routes." Even if a drone uses an anonymous alias for broadcasting, the monitoring station still needs additional information to determine whether the drone's current location is compliant. If the monitoring station needs to query complete flight routes, access centralized platforms, or receive flight route boundary information, it may still lead to the leakage of flight route sets or mission patterns. Therefore, this scheme cannot directly achieve local compliance verification of the current location under a hidden flight route set.

[0032] In 2022, ASTM International released ASTM F3411-22a, a standard specifying performance requirements, message formats, transmission methods, and minimum performance standards for Remote ID and Tracking of unmanned aerial vehicle (UAV) systems. This standard defines two forms: broadcast Remote ID and network Remote ID. Broadcast Remote ID involves the UAV directly transmitting a wireless signal to a nearby receiving device, while network Remote ID involves a network service provider publishing and querying remote identification information for the UAV. The standard aims to improve the traceability of responsibility for remote UAV pilots and support more complex UAV operation scenarios such as beyond-visual-range (BVR) flight and flight over personnel. However, this standard remains a framework for remote identification and tracking, focusing on how UAV identity, location, and status information is standardized for publication and reception, rather than providing compliance proof when flight path sets are not publicly available. Therefore, while this standard can support identification and tracking capabilities in UAV regulation, it cannot prevent ordinary recipients from inferring flight trajectories through long-term collection of Remote ID messages, nor can it directly provide cryptographic proof that "the current location belongs to an approved but hidden flight path set."

[0033] In 2022, Brighente et al. proposed a location privacy protection scheme called Hide and Seek. This scheme addresses the issue of drone tracking due to precise location broadcasts in Remote IDs by introducing differential privacy concepts such as Geo-Indistinguishability to perturb the broadcast location of drones, thereby hiding their true location to some extent. This scheme attempts to strike a balance between location privacy and security detection, allowing critical infrastructure operators to still detect drone incursions into no-fly zones while reducing the ability of external observers to obtain precise trajectories. When perturbation leads to disputes, authorized agencies can restore the true location and handle subsequent related matters. While this scheme mitigates the tracking risks associated with precise location broadcasts, its primary goal is to "hide or obscure the current location," rather than proving that the current location belongs to an approved flight path. Location perturbation also leads to accuracy loss, potentially causing false alarms and missed alarms, and usually still requires authorized agencies to restore the true location afterward. Therefore, this scheme cannot solve the problem of monitoring stations performing local compliance verification without knowing the complete set of flight paths, nor can it directly form a closed loop between flight path approval credentials and accountability for overstepping boundaries.

[0034] In 2025, Naziri et al. proposed the ZAPS zero-knowledge proof protocol for drone security authentication and flight path privacy protection. This scheme utilizes zk-SNARK technology, enabling drones to generate cryptographic proofs that demonstrate compliance with predefined flight strategies or path constraints without exposing precise path and location information. This type of scheme demonstrates that zero-knowledge proofs can resolve the conflict between drone path privacy and compliance verification, allowing the verifier to confirm certain constraints without knowing the complete path. However, general path proofs based on zk-SNARK typically require encoding specific flight strategies, geographical constraints, and authentication logic into specialized circuits. Different airspace rules and flight path constraints may require different circuit designs, resulting in high proof generation costs and system implementation complexity. For resource-constrained drone terminals, frequently generating complex zero-knowledge proofs can impose significant computational and energy consumption pressures. Furthermore, this type of scheme typically focuses on "whether the path meets the predefined strategy" and does not inherently include regulatory processes such as registration qualification credentials, regulatory route approval, hiding the membership of flight path sets, local monitoring station verification, and identity unlocking after violations. Therefore, this scheme still struggles to directly form a complete flight path approval and privacy compliance verification system.

[0035] In summary, existing drone regulatory solutions typically rely on remote identification, flight plan declaration, real-time location reporting, and trajectory auditing. While these solutions can improve airspace regulatory capabilities, they have significant shortcomings in terms of privacy protection: on the one hand, if drones continuously broadcast fixed identities, complete flight routes, or high-precision trajectories, commercial flight routes, mission objectives, operator identities, and sensitive activity areas may be leaked; on the other hand, if only anonymous identities or anonymous remote identification mechanisms are used, it is difficult to ensure that monitoring stations can verify that the current location indeed belongs to an approved flight route, and it is also difficult to form effective evidence for accountability when drones fly beyond their permitted boundaries.

[0036] This application addresses the following technical issues by algebraizing the approved route set, credentializing the route approval results, anonymizing the online verification process, and conditionalizing the accountability process for violations.

[0037] First, how to convert approved drone flight routes into verifiable but not directly disclosed mathematical expressions so that monitoring stations can complete compliance verification of the current location without obtaining the complete set of flight routes.

[0038] Second, how can we prove that the set of flight routes used for online verification was indeed approved by regulators, and not fabricated or temporarily constructed by the drones themselves?

[0039] Third, how to prevent drones from being associated with fixed identities, fixed credentials, or fixed encrypted messages by ordinary monitoring stations during multiple online presentations.

[0040] Fourth, how to form a complete audit chain when the credentials are valid but the current location is out of bounds, and how to allow the registration center to reveal the real identity under authorized conditions, so as to achieve anonymity for legitimate flights and accountability for illegal flights.

[0041] Fifth, how to support joint approval by multiple regulators or cross-regional regulatory scenarios, so as to form a closed-loop system with separation of duties and controlled authority between route approval and identity accountability.

[0042] To address the aforementioned issues, this application proposes an anonymous compliance verification method for protecting drone flight path privacy. This method involves a registration center establishing a traceable identity tag for the drone, and a regulatory authority issuing an anonymous flight path certificate bound to the flight path's polynomial coefficients after reviewing the flight path. The drone generates a randomized certificate, a one-time encrypted identity tag, a coefficient commitment, and a zero-knowledge proof during flight. A monitoring station only verifies whether the current location belongs to the approved flight path set. If a certificate is valid but the current location does not belong to an approved flight path, the regulatory authority reviews the audit chain and requests the registration center to unlock the identity. Based on this design, this application balances flight path privacy, identity anonymity, online compliance verification, and post-violation accountability within a single technical solution.

[0043] In view of this, one embodiment of this application proposes an anonymous compliance verification method for protecting drone flight path privacy, based on an anonymous compliance verification system composed of a registration center, regulator, drone terminal, and monitoring station. The implementation details of the anonymous compliance verification method for protecting drone flight path privacy proposed in this embodiment are described below. The following details are provided for ease of understanding and are not essential for implementing this solution.

[0044] This embodiment proposes a privacy-protected verification method for approved drone flight routes. This method enables local verification of whether a current location belongs to a set of approved flight routes without disclosing the complete declared flight routes or exposing the drone's long-term true identity. The method discretizes drone flight routes into an H3 grid set and constructs a verifiable representation of the flight route set. By combining registration qualification certificates, flight route approval certificates, certificate randomization, encrypted identity tags, and zero-knowledge proofs, monitoring stations can verify the compliance of the current location without obtaining the complete flight route. Furthermore, when a drone with valid credentials engages in boundary violations, controllable accountability can be achieved through audit records and identity unlocking mechanisms. Compared to existing technologies, this embodiment balances flight route privacy protection, verification efficiency, and regulatory auditability, reducing the risk of ordinary monitoring parties obtaining excessive sensitive information and improving the deployability and security of the drone flight route monitoring system. This method involves the registration center completing drone identity registration, identity tag generation, and registration qualification certificate issuance; the regulatory authority reviews the declared flight routes and issues randomizable anonymous flight route certificates based on the metadata, identity tags, and flight route set representations corresponding to the approved routes; during drone flight, the certificate is randomized, generating a one-time encrypted identity tag, coefficient commitment, and zero-knowledge proof; the monitoring station completes local verification based solely on the current grid and online displayed messages, without needing to obtain the complete flight route or real identity. If the current location belongs to an approved flight route, the verification passes; if the certificate and proof are valid but the current location is outside the designated area, an audit record is generated and a controllable accountability process is initiated.

[0045] The core principles of this embodiment include algebraization of route sets, issuance of anonymous route certificates, one-time identity encryption, polynomial coefficient commitment, zero-knowledge consistency proof, and opening of unauthorized identities.

[0046] 1) Algebraization of route sets.

[0047] The inputs to the algebraization of flight path sets are the drone's declared flight path and the preset H3 resolution. The output is an H3 grid set. and the corresponding root polynomial The purpose is to convert continuous geographic routes into discrete grid sets, and further into polynomial zero-value verification relations, so that the monitoring station can determine whether the current position of the UAV belongs to an approved route without obtaining the complete set of routes.

[0048] The calculation process for the algebraization of the route set is as follows: According to the UAV terminal or ground control terminal Discretize the declared route into , , Indicates the first H3 grid.

[0049] System selects finite field And map all H3 meshes to middle.

[0050] according to Build , .

[0051] For any current H3 grid Whether it belongs to the approved route , can be converted .

[0052] Therefore, the monitoring station only needs to verify whether the polynomial zero-value relationship holds at the current location to complete the compliance determination, without needing to obtain the complete set of flight routes.

[0053] 2) Issuance of anonymous route certificates.

[0054] The input for anonymous route certificate issuance is the route validity period. Approval Strategy Number H3 resolution Identity tags Root polynomial coefficients The output is an anonymous flight ticket. The purpose is to bind the validity period of the flight route, the approval strategy, the H3 resolution, the traceable identity label, and the set of approved flight routes to the same anonymous credential, so that the drone can prove that it holds a legal flight route authorization without revealing its real identity and the complete flight route.

[0055] The calculation process for issuing anonymous flight pass documents is as follows: Assume the regulator generates route metadata. , .

[0056] Regulators calculate metadata summary , .

[0057] Regulators on hidden or semi-hidden attributes , , Coconut flight pass issued, in the form of a pass. , , .thus, , coefficients of the root polynomial Bound to the same credential, drones can anonymously present the credential using a randomized one. The monitoring station can verify the validity of the credential, but cannot directly obtain the drone's true identity and complete flight path set.

[0058] 3) One-time identity encryption.

[0059] The input for one-time identity encryption is an identity tag. Registration Center Accountability for Public Keys and one-time random numbers The output is a one-time encrypted identity tag. The purpose is to hide the traceable identity tag of the drone during the online verification stage, preventing the monitoring station from showing the tag multiple times through multiple flights. At the same time, in the event of a violation, the registration center can open the identity tag with the private key for traceability, thus enabling controllable accountability.

[0060] The calculation process for one-time identity encryption is as follows: The drone randomly selects a random number each time it is presented online. , .

[0061] Calculate encrypted identity tags , , , .

[0062] Because each online presentation requires a new selection Therefore, even identity tags Unchanged, generated in different rounds They are also different; monitoring stations cannot rely solely on... Multiple flights were linked and presented.

[0063] When a culpable violation occurs, the registry center uses the culpability private key. Enable identity tags, meaning the registry center uses the accountability private key for calculations. , ,based on The system queries the real identity based on the locally stored mapping relationship, thereby completing the accountability for violations.

[0064] 4) Polynomial coefficient commitment.

[0065] The input for the polynomial coefficient commitment is the root polynomial coefficients. Current H3 grid and commitment random numbers The output is a set of coefficient commitments. and polynomial zero-value verification quantity The purpose is to hide the commitment to the root polynomial coefficients so that the monitoring station cannot obtain the complete set of routes; at the same time, by utilizing the homomorphic property of the commitment, whether the current position belongs to the approved set of routes is transformed into a zero-value verification relationship on the commitment.

[0066] The calculation process for the polynomial coefficient commitment is as follows: The drone generates Pedersen commitments for each root polynomial coefficient. , , and These are two independent generators used in the Pedersen commitment. and These represent the approved H3 mesh and the current H3 mesh in the finite domain, respectively. The representation in the text.

[0067] To ensure that the committed random terms at legal positions cancel each other out, the random numbers must satisfy the following condition: First, select randomly. , and then .

[0068] The monitoring station calculates based on the received set of commitments. , ,Will Substituting, we can obtain If the current location is within an approved flight route, then And the random item satisfies Therefore, there is .

[0069] If both the credential and the zero-knowledge proof pass verification, but This indicates that the drone holds a valid route certificate, but its current location does not belong to the approved route bound to that certificate. An audit record can be generated and the accountability process can begin.

[0070] 5) Zero-knowledge consistency proof.

[0071] Zero-knowledge consistency proofs are used to ensure that all cryptographic objects in a message presented online by a drone use the same set of secret attributes. Specifically, during the online verification phase, the drone needs to simultaneously present an anonymous flight path verification aid, a one-time encrypted identity tag, and a polynomial coefficient commitment. Without consistency proofs, malicious drones may construct messages using different credentials, different identity tags, or different combinations of flight path coefficients, thereby compromising the credibility of the verification results. Therefore, this invention introduces zero-knowledge proofs, enabling the drone to prove that all the aforementioned objects are correctly generated from the same identity tag and the same set of root polynomial coefficients without revealing the identity tag and the complete flight path set.

[0072] The input to zero-knowledge consistency proof is an identity tag. Root polynomial coefficients Blinding random numbers for vouchers Identity encryption random number and promised random numbers The output is a zero-knowledge proof. Its purpose is to prove the consistency between anonymous flight credentials, one-time encrypted identity tags, and multinomial coefficient commitments, enabling monitoring stations to confirm that online presented messages correspond to the same legitimate flight credential, the same traceable identity tag, and the same set of approved flights, while being unable to obtain the identity tag. Root polynomial coefficients And a complete set of flight routes.

[0073] The calculation process for zero-knowledge consistency proof is as follows: Drone-generated Coconut credential verification auxiliary quantity , , For route metadata summary, For identity tags, The coefficients of the root polynomial, Auxiliary random number for credential verification.

[0074] Drones generate zero-knowledge proofs This proves that they know the secret value. , , , , Furthermore, these secret values ​​simultaneously satisfy the following relationship.

[0075] First, the hidden attribute relationship of the credential holds true, that is... This relationship proves The hidden attribute bound to it is indeed an identity tag. coefficients of the root polynomial .

[0076] Second, the one-time encrypted identity tag relationship is established, that is... , This relationship proves a one-time encrypted identity label. The encryption is the same identity tag. Furthermore, the encryption process used random numbers. .

[0077] Third, the polynomial coefficient commitment relation holds, that is... The proof coefficients of this relationship are indeed root polynomial coefficients. And with the hidden attributes of the credential Maintain consistency.

[0078] Monitoring station verification Afterwards, it can only be confirmed that the above relationships hold simultaneously, that is, the anonymous flight credential, the one-time encrypted identity tag, and the coefficient commitment use the same identity tag and the same set of root polynomial coefficients, but the identity tag cannot be obtained. The specific values ​​cannot be used to recover the coefficients of the root polynomial. Alternatively, a complete set of flight routes. Through this mechanism, this application successfully achieves a balance between identity anonymity, flight route privacy, and message consistency while ensuring the correctness of online compliance verification.

[0079] This embodiment proposes an anonymous compliance verification method for protecting drone flight route privacy, based on an anonymous compliance verification system comprised of a registration center, regulators, drones, and monitoring stations. The registration center is responsible for drone registration, identity tag generation, issuance of registration qualification certificates, and identity verification during the accountability phase. Registrants are responsible for flight route approval and issuance of anonymous flight route certificates. Drones hold flight route certificates and generate online presentation messages. Monitoring stations verify whether the drone's current location belongs to an approved flight route set and submit audit records in case of anomalies. The entire system workflow is divided into the following stages: system initialization, device registration, flight route approval and set algebraization, anonymous flight route certificate issuance, online anonymous presentation, monitoring station verification, audit accountability, and multi-regulatory party expansion.

[0080] The specific process of the anonymous compliance verification method for drone flight path privacy protection proposed in this embodiment can be described as follows: Figure 1 As shown, it includes: Step 11: The drone submits a registration request to the registration center, which then completes the drone's identity registration, identity tag generation, and registration qualification certificate issuance.

[0081] Before registering a device, an anonymous compliance verification system (such as...) is required. Figure 2 Initialization (as shown).

[0082] First, choose a bilinear group of prime order. The group order is a prime number. , , , All are multiplicative cyclic groups, bilinear mappings Represented as .

[0083] Next, we select the two independent generators used in the Pedersen commitment. and , , and select Generators in , .

[0084] Next, three hash functions need to be set, with chalk as the first one. , and .in, , , , It is a finite field. Used to map route metadata to a finite field Used to generate the Coconut credential signature base. Fiat-Shamir Transform used in zero-knowledge proofs.

[0085] Subsequently, the registration center generates an accountability key pair, where the accountability private key is represented as... The public key for accountability is represented as , .

[0086] Finally, the regulator generates the Coconut signing private key. and publish verification public keys. .

[0087] in, , , , , , , .

[0088] When registering the device, the drone submits its real identity information to the registration center. To submit a registration request. Used to complete real-name registration and qualification verification of devices; After the registration center approves the application, it generates an identity tag for the drone. and establish and Mapping relationship between Subsequently, a registration certificate will be issued for the drone terminal. In the subsequent route approval stage, the drone operator presented the following documents to the regulator: To prove their eligibility to apply for flight routes, regulators only need to verify... The legality and validity of it do not need to be known. .

[0089] Step 12: The drone submits a route approval request to the regulator and presents its registration qualification certificate. The regulator reviews the request and designates the approved route as the approved route. The regulator then issues a randomizable anonymous route certificate for the metadata, identity tag, and route set corresponding to the approved route.

[0090] After completing identity registration, the drone operator submits a route approval request to the regulator and provides the required documentation. .

[0091] The regulatory authorities review and verify the route approval requests. The issuing authority, validity period, equipment type, and eligibility of the applicant must be confirmed, and the identity tag used in this route approval request must be verified. If the identity tags bound to the data are consistent, and the verification is successful and the identity tags are consistent, then the route corresponding to the approved route approval request will be taken as the approved route.

[0092] The drone terminal uses the preset H3 resolution. The approved routes are discretized into H3 grid sets. and according to Constructing the root polynomial ;in, , The number of approved routes An H3 grid in The representation in the text, For any current H3 grid Whether it belongs to the conversion of approved routes .

[0093] As a result, the membership relationship of the route set is transformed into a polynomial zero-value relationship at the current location, providing a basis for subsequent monitoring stations to complete local compliance verification without obtaining the complete route set.

[0094] The regulator needs to generate metadata for the approved routes. , , Indicates the validity period of the route. Indicates the approval strategy number.

[0095] Regulators calculate metadata summary , and to , , Issuance of anonymous flight credentials ;in, , , , As the Coconut signature base, the drone end ultimately holds , , , .

[0096] At this point, the route validity period, approval strategy, H3 resolution, identity tag, and the root polynomial coefficients corresponding to the approved route set are all bound to the same anonymous route certificate.

[0097] Step 13: During flight, the drone broadcasts its current location, timestamp, and metadata corresponding to the flight path, randomizes the anonymous flight path credentials, generates a one-time encrypted identity tag and coefficient commitment, and then generates a zero-knowledge proof.

[0098] When the drone is in flight, it needs to broadcast its current location, timestamp, and metadata corresponding to the flight path. The monitoring station then uses the H3 resolution metadata of the current location and flight path broadcast by the drone to determine the flight path. Independently calculate the current H3 mesh , , The current longitude of the drone. This represents the current latitude of the drone. The timestamp is [data missing]. .

[0099] Select random number on the drone side right Randomization is performed to obtain randomized anonymous flight route credentials. , making , .in, .

[0100] Select random number on the drone side ,based on Generate Coconut voucher verification auxiliary quantity and based on and calculate .in, , , .

[0101] The drone terminal selects a one-time identity encryption random number. and based on Generate one-time encrypted identity tag .in, , , , .

[0102] The drone-side generates Pedersen commitments based on the root polynomial coefficients. , To ensure that the promised random items at legal locations cancel each other out, the drone terminal sets the random numbers to satisfy... That is, first select a random number. , and then .

[0103] Zero-knowledge proof generation on drone This proves that the drone knows , , , , and prove , and All are based on the same identity tag and the coefficients of the same set of roots polynomials Correctly generated, The Fiat-Shamir Challenge is tied to online context. Thus preventing It can be copied to other locations or used at other times.

[0104] in, .

[0105] For more granular post-audit and boundary tolerance assessment, the online message can also include the offset relative to the grid center. It is used by regulators to review position deviations during the audit phase.

[0106] Step 14: After receiving the online presentation message, the monitoring station verifies its zero-knowledge proof. If the zero-knowledge proof verification fails, the online presentation message is rejected directly. If the zero-knowledge proof verification passes, local verification is performed based on the metadata of the current location, timestamp, and route. If the current location belongs to the approved route, the verification passes. If the current location does not belong to the approved route, an accountable violation record is generated and submitted to the regulator for review.

[0107] The monitoring station received Afterwards, check Whether it is valid, For the monitoring station's local timestamp, If the preset time difference threshold is met, then according to... Recalculate and based on examine Is it within the validity period of the route? Inside.

[0108] like lie in Inside, the monitoring station is based on , , Independent calculation and verify Does it meet the requirements? If the conditions are not met, then refuse. .

[0109] If satisfied, then verify. If the verification fails, it means... A lack of consistency between the credentials, identity encryption tags, or coefficient commitments in the data necessitates rejection. If the verification passes, then calculate the polynomial zero-value verification quantity. , ,like Then accept ,Sure It is an approved route and has passed verification.

[0110] like If so, it means that the drone has a valid route certificate, but the current location does not belong to the approved route. It is necessary to generate a record of the violation that can be traced and submit it to the regulator for review.

[0111] Step 15: After receiving the record of the culpable violation, the regulator reviews the record. If it confirms that the zero-knowledge proof verification is successful and the current location does not belong to the approved flight route, it submits the reasons for culpability and the identity unlocking request to the registry center, which then executes the identity unlocking to achieve controllable culpability.

[0112] The monitoring station generates an audit chain after detecting a boundary breach. , represented as: ; in, To verify the results, This is the ID of the monitoring station.

[0113] After receiving the audit chain, the regulator reviews the Coconut credential verification results, zero-knowledge proof verification results, timestamp validity, route validity, metadata consistency, polynomial zero-value check results, and monitoring station record completeness.

[0114] If the regulator confirms that the credentials and proofs are valid, and the current location is indeed not on an approved flight route, then the identity unlocking process will begin, and the application will be submitted to the registration center. , Reasons for holding accountable .

[0115] The registry center uses the accountability private key for calculation. , ,based on Query the real identity based on the registry and return the signed accountability results to the regulator. , represented as: .

[0116] If joint approval is required across regions or multiple departments, a single regulatory body can be expanded into multiple regulatory bodies. , For the first One regulatory body, The total number of regulators, each holding a shard of the Coconut signing key. The Coconut signing key fragment held is denoted as Each regulator generates partial route vouchers. The generated partial route voucher is recorded as follows .

[0117] ; ; .

[0118] After collecting at least a threshold number of partial flight route vouchers on the drone side, the Lagrange coefficient is used. Generate complete vouchers , Still satisfied .

[0119] In one example, regarding the spatial discretization of flight routes, this embodiment uses H3 grids to convert continuous flight routes into a set of discrete grids. Alternatively, Geohash, S2 Geometry, administrative airspace grids, predefined airspace unit numbers from regulators, or custom hexagonal, square, or triangular grids can be used. All of these methods can map continuous latitude and longitude positions to defined discrete spatial units, representing UAV-reported flight routes as a finite set, and enabling monitoring stations to calculate the spatial unit number corresponding to the current position based on the broadcast location. As long as the discretization method can guarantee that the same location is mapped to a defined number under the same resolution or regulatory rules, and can convert that number into an element in a finite field, it can replace H3 to complete the construction of the flight route set and the verification of the current position membership in this invention.

[0120] Regarding the privacy representation of the route set, this embodiment uses a root polynomial to represent the approved grid set, transforming the question of whether the current position belongs to the approved route set into a polynomial zero-value verification problem. As alternatives, Merkle tree commitments, cryptographic accumulators, KZG polynomial commitments, or other set commitment mechanisms can also be used. The Merkle tree scheme can prove that the current position belongs to the committed set through member path proof; the accumulator scheme can prove that the current position is in the set through member witness proof; the KZG commitment scheme can commit to the set polynomial and complete the membership verification through polynomial opening proof. All of the above schemes can complete the set membership proof without disclosing the complete route set, but they differ in terms of proof size, verification overhead, trusted initialization requirements, and dynamic update capabilities.

[0121] Regarding anonymous route authorization, this embodiment uses Coconut credentials to bind route metadata, traceable identity tags, and root polynomial coefficients to the same randomizable anonymous credential. Alternatively, CL signatures, BLS short signatures, or other anonymous credential mechanisms that support hidden attribute proof, selective disclosure, and credential randomization can be used. These mechanisms allow the drone to prove it holds a legitimate route authorization issued by the regulatory authority without revealing its true identity and complete route, and can ensure consistency between route metadata, identity tags, and the route set representation through hidden attribute proof. As long as the alternative credential mechanism can guarantee the authenticity of the credential source, the consistency of hidden attributes, and the non-linkability of multiple presentations, it can replace Coconut to implement the anonymous route credential function in this embodiment.

[0122] Regarding identity unlocking and accountability mechanisms, this embodiment uses the registry center's accountability public key to generate a one-time encrypted identity tag. The registry center unlocks the identity tag after the violation has been verified by the regulator. Alternatively, ElGamal encryption, threshold ElGamal, Paillier encryption, group signature unlocking mechanisms, or multi-party joint decryption mechanisms can be used. For example, a threshold encryption scheme can require multiple institutions to participate in identity unlocking, preventing a single institution from abusing its accountability authority; a group signature scheme allows the drone to anonymously present its identity as a group member, and in case of violation, the designated unlocking institution restores the signer's identity. All of the above schemes can hide the true identity during the normal verification phase and restore the accountable identity after meeting preset audit conditions.

[0123] Regarding zero-knowledge proofs and online interaction methods, this embodiment employs a Schnorr-type non-interactive zero-knowledge proof, binding the proof to contexts such as current location, timestamp, flight route metadata, randomized credentials, encrypted identity tags, and coefficient commitments through the Fiat-Shamir transformation. Alternatively, Bulletproofs, zk-SNARK, zk-STARK, or PLONK-type proof systems can be used, or an interactive proof mode can be employed where the monitoring station first sends a random nonce, and the drone then returns a nonce bound to it. The non-interactive mode is suitable for broadcast surveillance and scenarios involving passive reception by multiple monitoring stations, while the interactive mode further enhances the freshness of the proof and reduces the risk of replay attacks. As long as the consistency between anonymous flight route credentials, one-time encrypted identity tags, and flight route set commitments can be proven without revealing the identity tag and the complete flight route set, it can serve as an alternative implementation to the zero-knowledge consistency proof and online presentation mechanism of this embodiment.

[0124] This embodiment proposes an anonymous compliance verification method for drone flight path privacy protection, which achieves the following improvements compared with traditional drone flight path supervision and privacy protection schemes.

[0125] First, it enhances the protection of flight route privacy. This embodiment uses an H3 grid to discretize the approved flight routes on the UAV side and further constructs a root polynomial, transforming the judgment of "whether the current position belongs to an approved flight route" into a polynomial zero-value verification problem. During the verification phase, the monitoring station only needs to calculate the current H3 grid based on the broadcast position of the UAV side and combine it with the coefficient commitment to calculate the zero-value verification quantity to determine whether the current position belongs to an approved flight route, without needing to obtain the complete set of flight routes or access the plaintext flight route database. Therefore, compared with the scheme of directly reporting the complete flight route, continuously broadcasting the trajectory, or querying the background plaintext, this embodiment significantly reduces the sensitive flight route information that the monitoring station can obtain, and reduces the risk of commercial flight routes, inspection routes, and mission flight trajectories being inferred.

[0126] Second, it reduces the risk of long-term identity association. This embodiment uses randomizable anonymized flight route credentials and one-time encrypted identity tags. Each time the credential is presented online, the drone terminal randomizes the flight route credential and generates an encrypted identity tag using a new random number. This ensures that the presentation messages generated by the same drone at different times or different monitoring stations do not present a fixed credential identifier or a fixed encrypted identity. As a result, ordinary monitoring stations cannot associate the drone's multiple flight behaviors with recurring identity identifiers, credential content, or encrypted forms, thereby reducing the risk of long-term identity tracking and flight behavior profiling.

[0127] Third, ensuring the credibility of route approval results. In this embodiment, the regulatory authority jointly issues anonymous route certificates based on the route's metadata, traceable identity tags, and root polynomial coefficients. During the online presentation phase, zero-knowledge proofs are used to confirm the certificate's hidden attributes, the one-time encrypted identity tags, and the commitment that the polynomial coefficients use the same identity tag and the same set of root polynomial coefficients. Therefore, the monitoring station can confirm that the set of routes used by the drone for compliance verification truly originates from regulatory approval, rather than a fake set of routes temporarily constructed or replaced by the drone, thereby improving the credibility of the online verification results.

[0128] Fourth, it improves online verification efficiency and deployment feasibility. This embodiment does not encode the entire flight path, complex airspace policies, or continuous geographical constraints into a generic zero-knowledge proof circuit. Instead, it utilizes root polynomials and Pedersen commitments to transform current location compliance into commitment aggregation and zero-value checks. The monitoring station only needs to perform time checks, credential pairing verification, zero-knowledge proof verification, and one commitment aggregation calculation to complete the local determination. Therefore, compared to schemes that construct complex proof circuits for the entire path, this embodiment reduces the computational complexity of online verification and the difficulty of system implementation, making it more suitable for deployment in distributed monitoring stations or low-altitude surveillance scenarios.

[0129] Fifth, this embodiment achieves a balance between anonymity, accountability, and scalability. During the normal flight verification phase, this embodiment hides the drone's true identity and complete flight path, providing only the minimum information required to complete the compliance assessment of its current location to the monitoring station. When both the credentials and zero-knowledge proofs are valid, but the polynomial zero-value check fails, the monitoring station generates an audit chain, which is then reviewed by the regulator before requesting the registry center to unlock the one-time encrypted identity tag. Thus, this embodiment avoids the excessive exposure of legitimate flight privacy to full-process real-name supervision and also avoids the problem of lack of accountability in completely anonymous schemes. Furthermore, this embodiment can be extended to multi-regulatory joint approval scenarios through threshold Coconut credentials, reducing the risk of single points of failure and unilateral over-authorization, and improving the adaptability of cross-regional and cross-departmental low-altitude supervision.

[0130] The steps described above are merely for clarity in describing the technical solution. In actual implementation, they can be combined into one step, or certain steps can be broken down into multiple steps, as long as they involve the same logical relationship, they are all within the scope of protection of this application. Any insignificant modifications or designs added to the algorithm or process, as long as they do not change the core of the algorithm or process, are also within the scope of protection of this application.

[0131] Another embodiment of this application proposes an electronic device, such as Figure 3As shown, it includes a processor 21 and a memory 22. The memory 22 stores instructions that the processor 21 can execute. When the processor 21 is configured to execute the instructions, the electronic device can implement an anonymous compliance verification method for protecting the privacy of drone flight routes as described in the above method embodiment.

[0132] The memory and processor are connected via a bus, which includes any number of interconnecting buses and bridges. The bus can connect various circuits of one or more processors and memories, as well as other circuits such as peripherals, voltage regulators, and power management circuits—all well-known in the art and therefore not described further herein. The bus interface provides an interface between the bus and the transceiver. The transceiver can be a single component or multiple components, such as multiple receivers and transmitters, providing a unit for communicating with various other devices over a transmission medium. Data processed by the processor is transmitted over the wireless medium via an antenna, which also receives and transmits data to the processor.

[0133] The processor manages the bus and handles general processing, providing various functions, including but not limited to timing, peripheral interfaces, voltage regulation, power management, and other control functions. Memory, on the other hand, is used to store data used by the processor during operation.

[0134] Another embodiment of this application proposes a computer-readable storage medium storing a computer program that, when executed by a processor, enables an anonymous compliance verification method for protecting the privacy of unmanned aerial vehicle (UAV) flight paths as described in the above method embodiments.

[0135] That is, those skilled in the art will understand that all or part of the steps in the above method embodiments can be implemented by a program instructing related hardware. The program is stored in a storage medium and includes several instructions to cause a device (such as a microcontroller, chip, etc.) or processor to execute all or part of the steps of the method described in the method embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory, random access memory, magnetic disks, or optical disks.

[0136] It will be understood by those skilled in the art that the above embodiments are specific implementations of this application, and various changes in form and detail can be made in practical applications without departing from the spirit and scope of this application. For those skilled in the art, several improvements and modifications can be made without departing from the principles of this application, and these improvements and modifications are also considered to be within the scope of protection of this application.

Claims

1. An anonymous compliance verification method for protecting drone flight path privacy, based on an anonymous compliance verification system composed of a registration center, regulator, drone terminal, and monitoring station, characterized in that... include: The drone submits a registration request to the registration center, which then completes the drone's identity registration, identity tag generation, and registration qualification certificate issuance. The drone submits a route approval request to the regulator and presents its registration qualification certificate. The regulator reviews the request and designates the approved route as the approved route. The regulator then issues a randomizable anonymous route certificate for the metadata, identity tag and route set corresponding to the approved route. During flight, the drone broadcasts its current location, timestamp, and metadata corresponding to the flight path, randomizes the anonymous flight path credentials, generates a one-time encrypted identity tag and coefficient commitment, and then generates a zero-knowledge proof. After receiving the online presentation message, the monitoring station verifies its zero-knowledge proof. If the zero-knowledge proof verification fails, the online presentation message is rejected directly. If the zero-knowledge proof verification passes, the station performs local verification based on the current location, timestamp, and route metadata. If the current location belongs to an approved route, the verification passes. If the current location does not belong to an approved route, an accountable violation record is generated and submitted to the regulator for review. After receiving a record of a violation that can be traced, the regulator will review it. If it confirms that the zero-knowledge proof verification is successful and the current location does not belong to the approved flight route, it will submit the reasons for tracing the violation and the request to open the identity to the registry center. The registry center will then open the identity to achieve controllable tracing.

2. The anonymous compliance verification method for protecting drone flight path privacy as described in claim 1, characterized in that, Before the drone submits a registration request to the registration center, it also includes: Initialize the anonymous compliance verification system by selecting a prime-order bilinear group. The group order is a prime number. , , , All are multiplicative cyclic groups, bilinear mappings Represented as ; Select two independent generators used in the Pedersen commitment and , , and select Generators in , ; Set hash function , and , , , , It is a finite field. Used to map route metadata to a finite field Used to generate the Coconut credential signature base. Fiat-Shamir transform used in zero-knowledge proofs; The registration center generates an accountability key pair, where the accountability private key is represented as follows: The public key for accountability is represented as , ; The Coconut signing private key is generated by the regulator. and publish verification public keys. ; in, , , , , , , .

3. The anonymous compliance verification method for protecting drone flight path privacy as described in claim 2, characterized in that, The drone submits a registration request to the registration center, which then completes the drone's identity registration, identity tag generation, and registration qualification certificate issuance, including: The drone submits its real identity information to the registration center. To submit a registration request; among them, Used to complete real-name registration and qualification verification of devices; After the registration center approves the application, it generates an identity tag for the drone. and establish and Mapping relationship between ; The registration center issues registration qualification certificates for drone terminals. In the subsequent route approval stage, the drone operator presented the following documents to the regulator: To prove their eligibility to apply for flight routes, regulators only need to verify... The legality and validity of it do not need to be known. .

4. The anonymous compliance verification method for protecting drone flight route privacy as described in claim 3, characterized in that, The drone operator submits a route approval request to the regulator and presents its registration certificate. The regulator reviews the request and designates the approved routes as the approved routes, including: The drone operator submitted a route approval request to the regulator and provided the following documents: ; The regulatory authorities review and verify the route approval requests. The issuing authority, validity period, equipment type, and eligibility of the applicant must be confirmed, and the identity tag used in this route approval request must be verified. If the identity tags bound in the system are consistent, and the verification is successful and the identity tags are consistent, then the route corresponding to the approved route approval request will be the approved route. The drone terminal uses the preset H3 resolution. The approved routes are discretized into H3 grid sets. and according to Constructing the root polynomial ;in, , The number of approved routes An H3 grid in The representation in the text, For any current H3 grid Whether it belongs to the conversion of approved routes .

5. The anonymous compliance verification method for protecting drone flight path privacy as described in claim 4, characterized in that, The regulator issues randomizable, anonymous route credentials for the metadata, identity tags, and route set corresponding to the approved routes, including: The regulator generates metadata for approved routes. , , Indicates the validity period of the route. Indicates the approval strategy number; Regulators calculate metadata summary , and to , , Issuance of anonymous flight credentials ;in, , , , As the Coconut signature base, the drone end ultimately holds , , , .

6. The anonymous compliance verification method for protecting drone flight route privacy as described in claim 5, characterized in that, During flight, the drone broadcasts its current location, timestamp, and metadata corresponding to the flight path. It then randomizes and anonymizes the flight path credentials, generates a one-time encrypted identity tag and coefficient commitment, and subsequently generates a zero-knowledge proof, including: During flight, the drone broadcasts its current location, timestamp, and corresponding metadata about the flight path. The monitoring station then uses the H3 resolution metadata from the drone's broadcast location and flight path information. Independently calculate the current H3 mesh , , The current longitude of the drone. The latitude of the drone is currently displayed; the timestamp is [data missing]. ; Select random number on the drone side right Randomization is performed to obtain randomized anonymous flight route credentials. , making , ;in, ; Select random number on the drone side ,based on Generate Coconut voucher verification auxiliary quantity and based on and calculate ;in, , , ; The drone terminal selects a one-time identity encryption random number. and based on Generate one-time encrypted identity tag ;in, , , , ; The drone-side generates Pedersen commitments based on the root polynomial coefficients. , To ensure that the promised random items at legal locations cancel each other out, the drone terminal sets the random numbers to satisfy... That is, first select a random number. , and then ; Zero-knowledge proof generation on drone This proves that the drone knows , , , , and prove , and All are based on the same identity tag and the coefficients of the same set of roots polynomials Correctly generated, The Fiat-Shamir Challenge is tied to online context. Thus preventing It is copied to another location or used at another time; in, .

7. The anonymous compliance verification method for protecting drone flight route privacy as described in claim 6, characterized in that, The monitoring station received Afterwards, check Whether it is valid, For the monitoring station's local timestamp, If the preset time difference threshold is met, then according to... Recalculate and based on examine Is it within the validity period of the route? Inside; like lie in Inside, the monitoring station is based on , , Independent calculation and verify Does it meet the requirements? If the conditions are not met, then refuse. ; If satisfied, then verify. If the verification fails, it means... A lack of consistency between the credentials, identity encryption tags, or coefficient commitments in the data necessitates rejection. If the verification passes, then calculate the polynomial zero-value verification quantity. , ,like Then accept ,Sure The route is an approved air route and has passed verification. like If so, it means that the drone has a valid route certificate, but the current location does not belong to the approved route. It is necessary to generate a record of the violation that can be traced and submit it to the regulator for review.

8. The anonymous compliance verification method for protecting drone flight route privacy as described in claim 7, characterized in that, The monitoring station generates an audit chain after detecting a boundary breach. , is represented as: ； in, To verify the results, For the monitoring station's ID; After receiving the audit chain, the regulator will review the Coconut credential verification results, zero-knowledge proof verification results, timestamp validity, route validity period, metadata consistency, polynomial zero-value check results, and monitoring station record completeness. If the regulator confirms that the credentials and proofs are valid, and the current location is indeed not on an approved flight route, then the identity unlocking process will begin, and the application will be submitted to the registration center. , Reasons for holding accountable ; The registry center uses the accountability private key for calculation. , ,based on Query the real identity based on the registry and return the signed accountability results to the regulator. , is represented as: 。 9. The anonymous compliance verification method for protecting drone flight path privacy as described in claim 8, characterized in that, If joint approval is required across regions or multiple departments, a single regulatory body can be expanded into multiple regulatory bodies. , For the first One regulatory body, The total number of regulators, each holding a shard of the Coconut signing key. The Coconut signing key fragment held is denoted as Each regulator generates partial route vouchers. The generated partial route voucher is recorded as follows ; ； ； ； After collecting at least a threshold number of partial flight route vouchers on the drone side, the Lagrange coefficient is used. Generate complete vouchers , Still satisfied .

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it can implement an anonymous compliance verification method for protecting the privacy of unmanned aerial vehicle routes as described in any one of claims 1 to 9.

Images