# Cross-Domain Authentication Technology of UAV Based on Alliance Chain

Authors: Tao Xia; Jun He; Haifeng Liu
Journal: Mobile Information Systems
 (2022)

---

## Abstract

As the application scope of UAV expands, the demand for the cross-domain mission execution capability of UAV is increasing, which also puts forward higher requirements for the cross-domain certification capability of UAV. This paper proposes and verifies a cross-domain authentication scheme based on alliance chain technology. The experimental results show that compared with the original scheme, it greatly improves the efficiency of cross-domain authentication while solving the problem of trust between control stations.


---

## Body

## 1. Introduction

As technology advances, drones can carry a variety of sensors that collaborate to complete related tasks [1, 2]. Various applications [3] and the ability to work efficiently have increased the demand for the ability of drones to work across domains. In order to achieve the trust between the control stations and ensure the efficient cross-domain authentication of the UAV, this paper designs a cross-domain authentication scheme based on the alliance chain technology.


### 1.1. Related Work

With the development of science and technology, more demands are raised for the ability of UAV to perform missions across domains. In order to ensure the capability of cross-field work, the design of cross-field certification mechanism with high certification efficiency and high-security guarantee has become the focus of UAV safety technology research.At present, there are three main cross-domain authentication technologies used for drones, as shown in Table1.Table 1
Related work.
ParameterIllustrationRelated referencesTemporary cross-domain authentication mechanismTemporary cross-domain authentication means to verify the validity of the authenticator identity by transmitting relevant data to the registration domain.Literature [4] and literature [5]Long-term authorized cross-domain authentication mechanismLong-term authorization of cross-domain authentication means that one CA stores the standardized information provided by the other CA as login information for a long time.NoneCross-domain authentication mechanism based on blockchainIt refers to the cross-domain authentication technology based on blockchain technology. Blockchain technology is a new application mode of computer technology such as consensus mechanism, distributed data storage, and encryption algorithm.Literature [7], literature [8], andliterature [9]Literature [4] uses hash and other algorithms to realize the identity information protection of cross-domain authentication UAV, and literature [5] uses the Dijkstra algorithm to improve the transmission efficiency between the registration domain and the receiving domain. However, both have two problems. One is the low authentication efficiency because the communication between the distant two-side domain control stations needs to pass through the relay station, and it is extended and easy for interference. Second, the success rate of certification cannot be guaranteed. When the registration domain control station is invaded or damaged or the communication between the control stations is strongly disturbed, the relevant legal UAV will fail temporarily or even permanently certification.Long-term authorization of cross-domain authentication means that one CA stores the standardized information provided by the other CA as login information for a long time. In this case, there are often overdue information caused by delayed update problems [6]. This method cannot quickly reach a consensus between control stations and meet the requirements of low latency and high credibility between UAV control stations, so it is not suitable for cross-domain authentication.Blockchain technology is a new application mode of computer technology such as consensus mechanism, distributed data storage, and encryption algorithm. It has the characteristics of decentralization, tamper-proof, antiforgery prevention and high reliability and can be divided into public chain, alliance chain, and private chain. The characteristics of high efficiency, strong scalability, and small power consumption meet the efficiency and power needs of UAV cross-domain certification. At present, the research of blockchain in the field of cross-domain authentication has attracted more attention. On the basis of changing the blockchain certificate format, document [7] proposes an efficient cross-domain authentication scheme based on blockchain technology. Literature [8] proposes a blockchain-based authentication scheme across a heterogeneous domain. Document [9] applies blockchain technology to the cross-domain certification of cars. However, the above three methods all lack the protection mechanism of node privacy. Literature [10] proposes an anonymous identity and access control based on the alliance chain. However, in this design, for the calculation of every cross-domain request on the chain, the communication overhead is too expensive, and the authentication nodes need to store too much authentication data, which does not meet the needs of lightweight UAV nodes. This paper will improve the real-time cross-domain authentication technology (such as literature [4]) based on the alliance chain technology and design an efficient and high-security UAV cross-domain authentication scheme.


### 1.2. Motivations

Due to the wireless communication between drones and control stations, there are urgent security challenges in the cross-domain process. Specifically, UAV communication networks are vulnerable to man-in-the-middle attacks, replay attacks, and other attack methods [11]. Therefore, a secure cross-domain authentication scheme is needed that enables the registered and authorized UAVs to safely communicate with the control stations in the nonregistered domain, thereby protecting their privacy and security. In particular, the identity of the communicating party can be verified by mutual authentication between the UAV and the control station before exchanging secret and sensitive information on the insecure communication channel. Several important factors need to be considered in designing cross-domain identity authentication schemes. First, the proposed scheme should be robust to different types of attacks, including middleman attacks, replay attacks, and eavesdropping attacks. In addition, due to the limited resources available for drones, expensive authentication (such as digital certificates) is necessary. Finally, it is necessary to achieve mutual trust between the different control stations to facilitate the information transmission between the control stations. Drones have limited energy resources [12], so need lightweight authentication solutions. Therefore, the method of carrying alliance chain certificate at the authentication node is not applicable for drones, such as literature [7–9]. Traditional cross-domain authentication schemes represented by the literature [4] do not solve the problem of mutual trust between control stations, and they are also not applicable to the cross-domain certification of UAV. Blockchain technology can create a trust environment [13] and effectively address trust issues in the cross-domain process. Combining the two methods is a good choice. Alliance chain technology is used between the control stations to achieve mutual trust, and the traditional methods of authentication between the UAV and the control stations can achieve the trust between the control stations, and there is no need to store the expensive data such as digital certificates on the UAV.


### 1.3. Contributions

In order to achieve the trust between the control stations and ensure the efficient cross-domain authentication of the UAV, this paper designs a cross-domain authentication scheme based on the alliance chain technology. The main work is as follows:(1)
A cross-domain authentication scheme for UAV is designed based on alliance chain technology. The scheme adopts alliance chain technology between control stations to achieve mutual trust environment and the identity authentication of secret information between drones and control stations.(2)
Security analysis was performed based on the Dolev–Yao threat model to demonstrate the security of this cross-domain authentication scheme.(3)
In order to prove the high authentication efficiency of this scheme, the cross-domain authentication scheme proposed by literature [4] is compared through simulation experiments, and the authentication efficiency of the proposed authentication scheme is improved compared with the UAV cross-domain authentication scheme represented by literature [4].


## 1.1. Related Work

With the development of science and technology, more demands are raised for the ability of UAV to perform missions across domains. In order to ensure the capability of cross-field work, the design of cross-field certification mechanism with high certification efficiency and high-security guarantee has become the focus of UAV safety technology research.At present, there are three main cross-domain authentication technologies used for drones, as shown in Table1.Table 1
Related work.
ParameterIllustrationRelated referencesTemporary cross-domain authentication mechanismTemporary cross-domain authentication means to verify the validity of the authenticator identity by transmitting relevant data to the registration domain.Literature [4] and literature [5]Long-term authorized cross-domain authentication mechanismLong-term authorization of cross-domain authentication means that one CA stores the standardized information provided by the other CA as login information for a long time.NoneCross-domain authentication mechanism based on blockchainIt refers to the cross-domain authentication technology based on blockchain technology. Blockchain technology is a new application mode of computer technology such as consensus mechanism, distributed data storage, and encryption algorithm.Literature [7], literature [8], andliterature [9]Literature [4] uses hash and other algorithms to realize the identity information protection of cross-domain authentication UAV, and literature [5] uses the Dijkstra algorithm to improve the transmission efficiency between the registration domain and the receiving domain. However, both have two problems. One is the low authentication efficiency because the communication between the distant two-side domain control stations needs to pass through the relay station, and it is extended and easy for interference. Second, the success rate of certification cannot be guaranteed. When the registration domain control station is invaded or damaged or the communication between the control stations is strongly disturbed, the relevant legal UAV will fail temporarily or even permanently certification.Long-term authorization of cross-domain authentication means that one CA stores the standardized information provided by the other CA as login information for a long time. In this case, there are often overdue information caused by delayed update problems [6]. This method cannot quickly reach a consensus between control stations and meet the requirements of low latency and high credibility between UAV control stations, so it is not suitable for cross-domain authentication.Blockchain technology is a new application mode of computer technology such as consensus mechanism, distributed data storage, and encryption algorithm. It has the characteristics of decentralization, tamper-proof, antiforgery prevention and high reliability and can be divided into public chain, alliance chain, and private chain. The characteristics of high efficiency, strong scalability, and small power consumption meet the efficiency and power needs of UAV cross-domain certification. At present, the research of blockchain in the field of cross-domain authentication has attracted more attention. On the basis of changing the blockchain certificate format, document [7] proposes an efficient cross-domain authentication scheme based on blockchain technology. Literature [8] proposes a blockchain-based authentication scheme across a heterogeneous domain. Document [9] applies blockchain technology to the cross-domain certification of cars. However, the above three methods all lack the protection mechanism of node privacy. Literature [10] proposes an anonymous identity and access control based on the alliance chain. However, in this design, for the calculation of every cross-domain request on the chain, the communication overhead is too expensive, and the authentication nodes need to store too much authentication data, which does not meet the needs of lightweight UAV nodes. This paper will improve the real-time cross-domain authentication technology (such as literature [4]) based on the alliance chain technology and design an efficient and high-security UAV cross-domain authentication scheme.


## 1.2. Motivations

Due to the wireless communication between drones and control stations, there are urgent security challenges in the cross-domain process. Specifically, UAV communication networks are vulnerable to man-in-the-middle attacks, replay attacks, and other attack methods [11]. Therefore, a secure cross-domain authentication scheme is needed that enables the registered and authorized UAVs to safely communicate with the control stations in the nonregistered domain, thereby protecting their privacy and security. In particular, the identity of the communicating party can be verified by mutual authentication between the UAV and the control station before exchanging secret and sensitive information on the insecure communication channel. Several important factors need to be considered in designing cross-domain identity authentication schemes. First, the proposed scheme should be robust to different types of attacks, including middleman attacks, replay attacks, and eavesdropping attacks. In addition, due to the limited resources available for drones, expensive authentication (such as digital certificates) is necessary. Finally, it is necessary to achieve mutual trust between the different control stations to facilitate the information transmission between the control stations. Drones have limited energy resources [12], so need lightweight authentication solutions. Therefore, the method of carrying alliance chain certificate at the authentication node is not applicable for drones, such as literature [7–9]. Traditional cross-domain authentication schemes represented by the literature [4] do not solve the problem of mutual trust between control stations, and they are also not applicable to the cross-domain certification of UAV. Blockchain technology can create a trust environment [13] and effectively address trust issues in the cross-domain process. Combining the two methods is a good choice. Alliance chain technology is used between the control stations to achieve mutual trust, and the traditional methods of authentication between the UAV and the control stations can achieve the trust between the control stations, and there is no need to store the expensive data such as digital certificates on the UAV.


## 1.3. Contributions

In order to achieve the trust between the control stations and ensure the efficient cross-domain authentication of the UAV, this paper designs a cross-domain authentication scheme based on the alliance chain technology. The main work is as follows:(1)
A cross-domain authentication scheme for UAV is designed based on alliance chain technology. The scheme adopts alliance chain technology between control stations to achieve mutual trust environment and the identity authentication of secret information between drones and control stations.(2)
Security analysis was performed based on the Dolev–Yao threat model to demonstrate the security of this cross-domain authentication scheme.(3)
In order to prove the high authentication efficiency of this scheme, the cross-domain authentication scheme proposed by literature [4] is compared through simulation experiments, and the authentication efficiency of the proposed authentication scheme is improved compared with the UAV cross-domain authentication scheme represented by literature [4].


## 2. Design of the UAV Cross-Domain Authentication Scheme Based on Alliance Chain

Drawing on the cross-domain authentication method of the Internet of Things, compared with the forwarding and authentication of the UAV authentication information in the authentication process, the secret information such as identification information can be directly distributed in the initialization stage. This can both reduce one round of communication and improve the robustness of the scheme. Based on this idea, this paper designs a cross-domain UAV authentication scheme based on the alliance chain technology. The cross-domain authentication scheme based on alliance chain technology designed in this paper can complete the transmission and endorsement of identity authentication information in the initialization stage, reduce the number of communication rounds, and improve the cross-domain authentication efficiency of UAV on the premise of ensuring the security of cross-domain authentication.


### 2.1. Parameter Representation

In this paper, the parameters and their corresponding meanings are shown in Table2.Table 2
Parameter control table.
ParameterIllustrationUAVOne of the drones requires cross-domain missionspkuPublic key obtained by the UAV at the registration domain control stationskuPrivate key obtained by the UAV at the registration domain control stationregstationThe control station for identity registration participates in the consensus of the alliance chain as nodepeer0.org1 and stores some ledger data.accstationThe control station that receives cross-domain requests participates in the consensus of the alliance chain as nodepeer0.org2 and stores some ledger dataIVThe registration domain gives the certification direction to the UAVIDnThe identity information given to the drone by the control stationCAThe digital certificate certification center in the alliance chain system is mainly responsible for user information registration, digital certificate issuance, and the extension and revocation of digital certificateindThe index of the UAV identity information on the chain is the random numberRANDh generated by the registration domainpeer x.org yWherex and y are all integers and peer x.org y is the alliance chain node corresponding to each UAV control stationSmartcontractAlliance chain smart contract based on go language, including encrypted smart contract and access control smart contract, realizes the encryption of upper link identification information, and the access control of shared dataTuCorresponding system time when the UAV sends the informationpeerx.orgyThex node of the y organization under the alliance chain (both x and y are integers)channelChannel involves private communication layers between specific organizations. Each channel consists of separate ledgers that can only be read and written by members in the channel.chaincodeExtending from the concept of smart contract, responsible for responding to sent requests, executing code logic, and realizing interaction with the ledger andcompliance with the elliptical curvesH(.)The SM3 hashing algorithmTcCorresponding system time when the acc station receives the UAV information∆tThet is a built-in parameter with 2∗t (interval)> t (time for transfer) + t max (longest time for transmission) and 2∗t (interval) <t (time for transfer) + t c (time for replay attack)


### 2.2. Initialization

The initialization stage of this scheme mainly includes the initialization of the alliance chain between the control stations and the UAV.


#### 2.2.1. Alliance Chain Initialization

After the CA authentication of each control station, the nodes peer0.org1, peer0.org2, peer0.org3, and peer0.org4 corresponding to the UAV control stations in different domains add the same channels corresponding to the control station requiring cross-domain authentication, such as peer0.org1 and peer0.org2 accession channel channnel1 and peer0.org2 and peer0.org4 accession channel channnel2. This paper illustrates the examples of peer0.org1 and channel channnel1 added by peer0.org3 in Figure1. Call the official supplied Smart contract in the channel, and the corresponding chain code is packaged and installed.Figure 1
Chain code call process.


#### 2.2.2. Initialization of the UAV Identity Information

The initialization of UAV identity information in this scheme is divided into two parts: the upper link of identity authentication and related information in the registration domain.Identity authentication in the registration domain selects the identity authentication scheme based on the ECC algorithm.regstation selects G=x,yas the basis of the E. Generate the random numbers rand0,rand1,rand2⋯randn∈1,n−1 as the private key, and calculate P0=x0,y0=d0x,y,P1=x1,y1=d1x,y⋯ as the corresponding public key.Subsequently,regstation generates six random numbers RANDn for each pair of public-private key as its ind in the key table, selects P0,d0] as the public-private key of regstation, selects the public-private key in the remaining public-private key pairs, and passes the parameters RAND,n,E,G,H.,P0,pku,sku. Transfer to the regstation and other UAVs into the network authentication and two-way identity authentication and obtain generation.The upper chain of the relevant information is mainly implemented by using the way of calling the chain code, and theregstation in the corresponding channel call chaincode will give IDnpku to the ind.The specific steps are shown in Figure 1.Theregstation creates the proposal as a transaction and signs the signed proposal generation.The signed proposal is sent to the peer0.org1 node for endorsement processing, which returns the proposal response message after successfully successful chain code call transaction.Create a signed transaction sigenedTX based on the message returned by the peer0.org1 node.Transaction information is sent to the order node for network sorting and broadcasting to all the peer nodes of the channel (such as the peer0.org1 and peer0.org3 nodes listed in this article) for confirmation.


### 2.3. Cross-Domain Authentication

The main steps of the cross-domain authentication process are shown in Figure2.Figure 2
The main process for cross-domain authentication.UAV transfers toaccstation {Tu, IDn}.accstation verifies the parameter Tu. if Tc-Tu<∆t, and then queries the information according to the indinIDn corresponding chain code on the alliance chain in.Ifaccstation successfully obtains pku||IDn from the chain code, and if it is the same, the authentication is successful.accstation generates IDn+1 and updates the chain code on the corresponding channel by using pku||IDn+1, then IDn+1 calculation is (1)IDn+1=indHIDn,IV,accstation uses pku building secure communication channels with UAV.After the UAV has successfully communicated with theaccstation, the UAV updates the local machine IDn to generate IDn+1 in the same calculation way.


## 2.1. Parameter Representation

In this paper, the parameters and their corresponding meanings are shown in Table2.Table 2
Parameter control table.
ParameterIllustrationUAVOne of the drones requires cross-domain missionspkuPublic key obtained by the UAV at the registration domain control stationskuPrivate key obtained by the UAV at the registration domain control stationregstationThe control station for identity registration participates in the consensus of the alliance chain as nodepeer0.org1 and stores some ledger data.accstationThe control station that receives cross-domain requests participates in the consensus of the alliance chain as nodepeer0.org2 and stores some ledger dataIVThe registration domain gives the certification direction to the UAVIDnThe identity information given to the drone by the control stationCAThe digital certificate certification center in the alliance chain system is mainly responsible for user information registration, digital certificate issuance, and the extension and revocation of digital certificateindThe index of the UAV identity information on the chain is the random numberRANDh generated by the registration domainpeer x.org yWherex and y are all integers and peer x.org y is the alliance chain node corresponding to each UAV control stationSmartcontractAlliance chain smart contract based on go language, including encrypted smart contract and access control smart contract, realizes the encryption of upper link identification information, and the access control of shared dataTuCorresponding system time when the UAV sends the informationpeerx.orgyThex node of the y organization under the alliance chain (both x and y are integers)channelChannel involves private communication layers between specific organizations. Each channel consists of separate ledgers that can only be read and written by members in the channel.chaincodeExtending from the concept of smart contract, responsible for responding to sent requests, executing code logic, and realizing interaction with the ledger andcompliance with the elliptical curvesH(.)The SM3 hashing algorithmTcCorresponding system time when the acc station receives the UAV information∆tThet is a built-in parameter with 2∗t (interval)> t (time for transfer) + t max (longest time for transmission) and 2∗t (interval) <t (time for transfer) + t c (time for replay attack)


## 2.2. Initialization

The initialization stage of this scheme mainly includes the initialization of the alliance chain between the control stations and the UAV.


### 2.2.1. Alliance Chain Initialization

After the CA authentication of each control station, the nodes peer0.org1, peer0.org2, peer0.org3, and peer0.org4 corresponding to the UAV control stations in different domains add the same channels corresponding to the control station requiring cross-domain authentication, such as peer0.org1 and peer0.org2 accession channel channnel1 and peer0.org2 and peer0.org4 accession channel channnel2. This paper illustrates the examples of peer0.org1 and channel channnel1 added by peer0.org3 in Figure1. Call the official supplied Smart contract in the channel, and the corresponding chain code is packaged and installed.Figure 1
Chain code call process.


### 2.2.2. Initialization of the UAV Identity Information

The initialization of UAV identity information in this scheme is divided into two parts: the upper link of identity authentication and related information in the registration domain.Identity authentication in the registration domain selects the identity authentication scheme based on the ECC algorithm.regstation selects G=x,yas the basis of the E. Generate the random numbers rand0,rand1,rand2⋯randn∈1,n−1 as the private key, and calculate P0=x0,y0=d0x,y,P1=x1,y1=d1x,y⋯ as the corresponding public key.Subsequently,regstation generates six random numbers RANDn for each pair of public-private key as its ind in the key table, selects P0,d0] as the public-private key of regstation, selects the public-private key in the remaining public-private key pairs, and passes the parameters RAND,n,E,G,H.,P0,pku,sku. Transfer to the regstation and other UAVs into the network authentication and two-way identity authentication and obtain generation.The upper chain of the relevant information is mainly implemented by using the way of calling the chain code, and theregstation in the corresponding channel call chaincode will give IDnpku to the ind.The specific steps are shown in Figure 1.Theregstation creates the proposal as a transaction and signs the signed proposal generation.The signed proposal is sent to the peer0.org1 node for endorsement processing, which returns the proposal response message after successfully successful chain code call transaction.Create a signed transaction sigenedTX based on the message returned by the peer0.org1 node.Transaction information is sent to the order node for network sorting and broadcasting to all the peer nodes of the channel (such as the peer0.org1 and peer0.org3 nodes listed in this article) for confirmation.


## 2.2.1. Alliance Chain Initialization

After the CA authentication of each control station, the nodes peer0.org1, peer0.org2, peer0.org3, and peer0.org4 corresponding to the UAV control stations in different domains add the same channels corresponding to the control station requiring cross-domain authentication, such as peer0.org1 and peer0.org2 accession channel channnel1 and peer0.org2 and peer0.org4 accession channel channnel2. This paper illustrates the examples of peer0.org1 and channel channnel1 added by peer0.org3 in Figure1. Call the official supplied Smart contract in the channel, and the corresponding chain code is packaged and installed.Figure 1
Chain code call process.


## 2.2.2. Initialization of the UAV Identity Information

The initialization of UAV identity information in this scheme is divided into two parts: the upper link of identity authentication and related information in the registration domain.Identity authentication in the registration domain selects the identity authentication scheme based on the ECC algorithm.regstation selects G=x,yas the basis of the E. Generate the random numbers rand0,rand1,rand2⋯randn∈1,n−1 as the private key, and calculate P0=x0,y0=d0x,y,P1=x1,y1=d1x,y⋯ as the corresponding public key.Subsequently,regstation generates six random numbers RANDn for each pair of public-private key as its ind in the key table, selects P0,d0] as the public-private key of regstation, selects the public-private key in the remaining public-private key pairs, and passes the parameters RAND,n,E,G,H.,P0,pku,sku. Transfer to the regstation and other UAVs into the network authentication and two-way identity authentication and obtain generation.The upper chain of the relevant information is mainly implemented by using the way of calling the chain code, and theregstation in the corresponding channel call chaincode will give IDnpku to the ind.The specific steps are shown in Figure 1.Theregstation creates the proposal as a transaction and signs the signed proposal generation.The signed proposal is sent to the peer0.org1 node for endorsement processing, which returns the proposal response message after successfully successful chain code call transaction.Create a signed transaction sigenedTX based on the message returned by the peer0.org1 node.Transaction information is sent to the order node for network sorting and broadcasting to all the peer nodes of the channel (such as the peer0.org1 and peer0.org3 nodes listed in this article) for confirmation.


## 2.3. Cross-Domain Authentication

The main steps of the cross-domain authentication process are shown in Figure2.Figure 2
The main process for cross-domain authentication.UAV transfers toaccstation {Tu, IDn}.accstation verifies the parameter Tu. if Tc-Tu<∆t, and then queries the information according to the indinIDn corresponding chain code on the alliance chain in.Ifaccstation successfully obtains pku||IDn from the chain code, and if it is the same, the authentication is successful.accstation generates IDn+1 and updates the chain code on the corresponding channel by using pku||IDn+1, then IDn+1 calculation is (1)IDn+1=indHIDn,IV,accstation uses pku building secure communication channels with UAV.After the UAV has successfully communicated with theaccstation, the UAV updates the local machine IDn to generate IDn+1 in the same calculation way.


## 3. Safety Analysis

Data transmitted over wireless channels is vulnerable to theft [14, 15], so UAV communication networks using wireless communications face serious security threats. The Dolev–Yao model [16] is an analytical model widely recognized by the industry, and this chapter will demonstrate the security for cross-domain authentication schemes based on this model (because the security of alliance chain technology has been widely recognized by the industry, and this default control stations are in a secure communication environment).


### 3.1. Antireplay Attack Analysis

The current time stamp is enclosed in the message structure transmitted between the UAV,accstation, and reg station during authentication. The control station and the UAV can test the time stamp, that is, whether the inequality Tc-Tu<∆t is satisfied. Because the attacker consumes more time to forward the message, they can judge whether a replay attack.


### 3.2. Antimiddleman Attack

During the authentication process, after each verification process, it needs to be updated, namely,IDn+1=indHIDn,IV.Therefore, in the case of intermediate interception, the same can only complete a single authentication and cannot be used for the second authentication and can guarantee the security of the channel.


### 3.3. Forward Safety and Backward Safety ofIDn

The identity information IDn of this scheme has forward security and backward security, IDn+1=indHIDn,IV. The unidirectional of SM3 algorithm ensures that the attacker cannot infer IDn through IDn+1 in polynomial time.Since IV is a parameter that the attacker cannot obtain, the attacker can also not get IDn+1 through IDn.


## 3.1. Antireplay Attack Analysis

The current time stamp is enclosed in the message structure transmitted between the UAV,accstation, and reg station during authentication. The control station and the UAV can test the time stamp, that is, whether the inequality Tc-Tu<∆t is satisfied. Because the attacker consumes more time to forward the message, they can judge whether a replay attack.


## 3.2. Antimiddleman Attack

During the authentication process, after each verification process, it needs to be updated, namely,IDn+1=indHIDn,IV.Therefore, in the case of intermediate interception, the same can only complete a single authentication and cannot be used for the second authentication and can guarantee the security of the channel.


## 3.3. Forward Safety and Backward Safety ofIDn

The identity information IDn of this scheme has forward security and backward security, IDn+1=indHIDn,IV. The unidirectional of SM3 algorithm ensures that the attacker cannot infer IDn through IDn+1 in polynomial time.Since IV is a parameter that the attacker cannot obtain, the attacker can also not get IDn+1 through IDn.


## 4. Experimental Design and Analysis

After the initialization of UAV,accstation, and regstation, the alliance chain-based cross-domain authentication scheme and the traditional temporary cross-domain authentication scheme were conducted, respectively.


### 4.1. Experimental Environment

The experimental environment is mainly divided into UAV environment and acc station environment and communication environment. The UAV is configured as Intel (R) Core (TM) i7-7700HQ CPU @ 2.80 GHz 2.81 GHz with 3 GB memory, Linux version 4.15.0–171-generic operating system with the flight control module and communication module. Among them, the flight control system module adopts the four-rotor UAV simulation model built based on the gazebo platform, and the communication module is built based on the PyCharm 2021.1.1 x64 platform, using the python 3.9 interpreter. The acc station is specifically configured as Intel (R) Core (TM) i7-7700HQ CPU @ 2.80 GHz 2.81 GHz, 4 GB of memory, Linux version 5.13.0–35-generic operating system, internal alliance chain peer0.org1, and the communication module. Alliance chain peer0.org1 is implemented in hyperledger fabric 2.2 version, and the communication module is built based on the PyCharm 2021.1.1 x64 platform, using the python3.9 interpreter. Since the mainstream communication chip adopts 2.4 GHz band [17], the communication environment adopts 2.4 GHz band communication, which is realized through the stocket () function used in the UAV communication module such as DJI tello.The comparison scheme of simulation experiments is the temporary cross-domain authentication scheme used in literature [4]. Since the relevant experiments were not conducted in the original literature, the comparison scheme is run in the experimental environment of this paper. The steps are shown in Figure 3.Figure 3
Overview of the experimental environment.


### 4.2. Experimental Content and Results

The initialization of the drone and the alliance chain needs to be completed first before conducting all the tests. The standby screenshot of the UAV completed after initialization is shown in Figure4. The screenshot of the alliance chain after its initialization is shown in Figure 5.Figure 4
Standby screenshot of the drone model.Figure 5
Alliance chain peer0.org2 initialization screenshot.


#### 4.2.1. Certification Time Test Comparison

The operation UAV communication module initiates cross-domain identity authentication to the acc station. After the authentication reception, the operation screenshot after the UAV model receives the take-off command, as shown in Figure6:Figure 6
Screenshot of the drone's operation.The two schemes are run ten times each, and the output time of the UAV communication module is recorded. The results are shown in Figure7.Figure 7
Certification time comparison.The main difference between the scheme and the document [4] process is that the scheme does not require data transmission between control stations. Since reg station uploads and endorses the UAV information in the process of building the chain code between reg station and acc station, acc station can query the UAV information on the chain code locally. In contrast, the scheme adopted by document [4] needs to transmit information to reg station to judge the process. The information transmission mode between the control stations is also wifi communication. In the case of relay without using the satellite system, the wireless signal transmission in the atmosphere can be negligible, but the signal decoding and coding process of the control station consumes more time. If the control station environment is more complex or remote, we need to borrow the satellite system for relay transmission, transmission distance, and satellite signal processing between the control station data transmission time cost which will be greatly increased; in this case, using the scheme proposed in this paper, the certification efficiency will be far more than expected in this paper.


#### 4.2.2. Communication Overhead Comparison

This paper mainly compares the traffic in the cross-domain authentication stage after the initialization of the UAV and other equipment. To ensure the validity of experimental comparison, IDn of both experiments uses the same string, time stamp lengthT, IDn length ID, control station return command c, and reg station return to acc station result r, and the results are shown in Table 3.Table 3
Communication overhead comparison.
Communication between the two sidesOur schemeControlled experimentUAV and acc stationT + ID + cT + ID + cAcc station and reg station0ID +rTotal communication volumeT + ID + cT + ID∗2 + c + rIt can be seen from the table that the scheme communication overhead adopted in this paper can reduce the communication overhead between control stations, and the IDn can still be verified when the acc station and reg station are interrupted to complete cross-domain authentication.


## 4.1. Experimental Environment

The experimental environment is mainly divided into UAV environment and acc station environment and communication environment. The UAV is configured as Intel (R) Core (TM) i7-7700HQ CPU @ 2.80 GHz 2.81 GHz with 3 GB memory, Linux version 4.15.0–171-generic operating system with the flight control module and communication module. Among them, the flight control system module adopts the four-rotor UAV simulation model built based on the gazebo platform, and the communication module is built based on the PyCharm 2021.1.1 x64 platform, using the python 3.9 interpreter. The acc station is specifically configured as Intel (R) Core (TM) i7-7700HQ CPU @ 2.80 GHz 2.81 GHz, 4 GB of memory, Linux version 5.13.0–35-generic operating system, internal alliance chain peer0.org1, and the communication module. Alliance chain peer0.org1 is implemented in hyperledger fabric 2.2 version, and the communication module is built based on the PyCharm 2021.1.1 x64 platform, using the python3.9 interpreter. Since the mainstream communication chip adopts 2.4 GHz band [17], the communication environment adopts 2.4 GHz band communication, which is realized through the stocket () function used in the UAV communication module such as DJI tello.The comparison scheme of simulation experiments is the temporary cross-domain authentication scheme used in literature [4]. Since the relevant experiments were not conducted in the original literature, the comparison scheme is run in the experimental environment of this paper. The steps are shown in Figure 3.Figure 3
Overview of the experimental environment.


## 4.2. Experimental Content and Results

The initialization of the drone and the alliance chain needs to be completed first before conducting all the tests. The standby screenshot of the UAV completed after initialization is shown in Figure4. The screenshot of the alliance chain after its initialization is shown in Figure 5.Figure 4
Standby screenshot of the drone model.Figure 5
Alliance chain peer0.org2 initialization screenshot.


### 4.2.1. Certification Time Test Comparison

The operation UAV communication module initiates cross-domain identity authentication to the acc station. After the authentication reception, the operation screenshot after the UAV model receives the take-off command, as shown in Figure6:Figure 6
Screenshot of the drone's operation.The two schemes are run ten times each, and the output time of the UAV communication module is recorded. The results are shown in Figure7.Figure 7
Certification time comparison.The main difference between the scheme and the document [4] process is that the scheme does not require data transmission between control stations. Since reg station uploads and endorses the UAV information in the process of building the chain code between reg station and acc station, acc station can query the UAV information on the chain code locally. In contrast, the scheme adopted by document [4] needs to transmit information to reg station to judge the process. The information transmission mode between the control stations is also wifi communication. In the case of relay without using the satellite system, the wireless signal transmission in the atmosphere can be negligible, but the signal decoding and coding process of the control station consumes more time. If the control station environment is more complex or remote, we need to borrow the satellite system for relay transmission, transmission distance, and satellite signal processing between the control station data transmission time cost which will be greatly increased; in this case, using the scheme proposed in this paper, the certification efficiency will be far more than expected in this paper.


### 4.2.2. Communication Overhead Comparison

This paper mainly compares the traffic in the cross-domain authentication stage after the initialization of the UAV and other equipment. To ensure the validity of experimental comparison, IDn of both experiments uses the same string, time stamp lengthT, IDn length ID, control station return command c, and reg station return to acc station result r, and the results are shown in Table 3.Table 3
Communication overhead comparison.
Communication between the two sidesOur schemeControlled experimentUAV and acc stationT + ID + cT + ID + cAcc station and reg station0ID +rTotal communication volumeT + ID + cT + ID∗2 + c + rIt can be seen from the table that the scheme communication overhead adopted in this paper can reduce the communication overhead between control stations, and the IDn can still be verified when the acc station and reg station are interrupted to complete cross-domain authentication.


## 4.2.1. Certification Time Test Comparison

The operation UAV communication module initiates cross-domain identity authentication to the acc station. After the authentication reception, the operation screenshot after the UAV model receives the take-off command, as shown in Figure6:Figure 6
Screenshot of the drone's operation.The two schemes are run ten times each, and the output time of the UAV communication module is recorded. The results are shown in Figure7.Figure 7
Certification time comparison.The main difference between the scheme and the document [4] process is that the scheme does not require data transmission between control stations. Since reg station uploads and endorses the UAV information in the process of building the chain code between reg station and acc station, acc station can query the UAV information on the chain code locally. In contrast, the scheme adopted by document [4] needs to transmit information to reg station to judge the process. The information transmission mode between the control stations is also wifi communication. In the case of relay without using the satellite system, the wireless signal transmission in the atmosphere can be negligible, but the signal decoding and coding process of the control station consumes more time. If the control station environment is more complex or remote, we need to borrow the satellite system for relay transmission, transmission distance, and satellite signal processing between the control station data transmission time cost which will be greatly increased; in this case, using the scheme proposed in this paper, the certification efficiency will be far more than expected in this paper.


## 4.2.2. Communication Overhead Comparison

This paper mainly compares the traffic in the cross-domain authentication stage after the initialization of the UAV and other equipment. To ensure the validity of experimental comparison, IDn of both experiments uses the same string, time stamp lengthT, IDn length ID, control station return command c, and reg station return to acc station result r, and the results are shown in Table 3.Table 3
Communication overhead comparison.
Communication between the two sidesOur schemeControlled experimentUAV and acc stationT + ID + cT + ID + cAcc station and reg station0ID +rTotal communication volumeT + ID + cT + ID∗2 + c + rIt can be seen from the table that the scheme communication overhead adopted in this paper can reduce the communication overhead between control stations, and the IDn can still be verified when the acc station and reg station are interrupted to complete cross-domain authentication.


## 5. Conclusion

In this paper, we propose a UAV cross-domain authentication scheme based on alliance chain technology. Under the premise of completing the security analysis of the scheme, the simulation experiments prove that the scheme has the advantages of small communication cost and high authentication efficiency, which meets the expectations of the cross-domain authentication scheme. However, due to the small number of UAVs, the large-scale UAV communication network cannot be simulated, and the complex network electromagnetic environment cannot be simulated due to the limitations of computer simulation experiments. The later work is mainly to study the multithreaded processing process of multiple drones for cross-domain authentication, and the simulation aspects of the complex environment is based on the artificial intelligence technology.



---

*Source: 3067280-2022-09-21.xml*