面向无人机通信的认证和密钥协商协议

Authentication and Key Agreement Protocol for UAV Communication

针对无人机通信中密钥配置的安全性和轻量化需求,面向不同计算性能的无人机系统分别提出了基于椭圆曲线密码算法的认证和密钥协商协议DroneSec,以及基于对称密码算法的认证和密钥协商协议DroneSec-lite。所提协议实现了无人机和地面站之间的双向身份认证和通信密钥配置功能,其中DroneSec协议通过结合使用ECDH(Elliptic-Curve Diffie-Hellman)和消息认证码,在保证前向安全性的情况下减小了计算开销,适用于较高性能的计算平台;DroneSec-lite协议仅使用了对称密码算法,因而计算开销极低,适用于低性能平台。使用安全协议形式化验证工具ProVerif验证了协议在加强的Dolve-Yao威胁模型下进行双向认证和密钥配置的安全性,并通过仿真环境实验对协议的性能进行了对比测试和分析。结果显示,协议的计算、通信开销和安全性优于已有协议。

In order to achieve the requirement for security and lightweight in unmanned aerial vehicle(UAV)communication,two authentication and key agreement protocols targeted for UAVs with different computational performance are proposed,including an ECC based protocol,DroneSec,and a symmetric cipher based protocol,DroneSec-lite.The two protocols achieve secure mutual authentication and key configuration between ground stations and UAVs.DroneSec protocol achieves relatively low computational overhead while ensuring forward secrecy through combining ECDH and MAC,which is suitable for relatively high-performance platforms.DroneSec-lite protocol achieves extremely low computational overhead through using only symmetric ciphers,which is suitable for low-performance platforms.The security of the proposed protocols under the enhanced Dolve-Yao model is verified using ProVerif,a formal protocol verification tool,and the performance of the protocols is analyzed in the simulation environment.The results show that it is superior to existing protocols in terms of computation overhead,communication overhead and security.