WO2021080050A1

WO2021080050A1 - Electronic security system in unmanned aerial vehicle, for high-speed encryption/decryption processing

Info

Publication number: WO2021080050A1
Application number: PCT/KR2019/014139
Authority: WO
Inventors: 김강산; 박병관
Original assignee: 단암시스템즈 주식회사
Priority date: 2019-10-25
Filing date: 2019-10-25
Publication date: 2021-04-29

Abstract

An electronic security system in an unmanned aerial vehicle, for high-speed encryption/decryption processing, according to the present invention, can comprise: a main processor unit for performing input/output processing on plaintext data to be transmitted to a ground control station of the unmanned aerial vehicle and/or on ciphertext data received from the ground control station; a buffer unit for temporarily storing the plaintext data and/or the ciphertext data in a plurality of queues; an extended memory interface control unit for generating a write completion signal when the plaintext data and/or the ciphertext data is completely stored, and reading the plaintext data or the ciphertext data stored in some of the plurality of queues when a read command is received; an encryption/decryption control unit for generating an encryption command or a decryption command for the data stored in the some of the queues when the write completion signal is generated, and generating a read command for the read when an encryption completion signal or a decryption completion signal for the data is received; and an encryption/decryption unit which encrypts, when the encryption command is received, the plaintext data through an encryption/decryption engine unit by using a decrypted security key, temporarily stores the encryption-completed ciphertext data, and then generates the encryption completion signal, and which decrypts, when the decryption completion signal is received, the ciphertext data through the encryption/decryption engine unit by using the decrypted security key, temporarily stores the decryption-completed plaintext data, and then generates the decryption completion signal.

Description

Electronic security system in unmanned aerial vehicle for high-speed encryption/decryption processing

The present invention is a high-speed arm for encrypting/decrypting transmission/reception data in a data-link communication system of an unmanned aerial vehicle (hereinafter referred to as “UAV”). It relates to an electronic security system for decryption processing.

UAVs were developed for military purposes, but thanks to recent technological advances, the market is rapidly expanding into industrial and private sectors such as broadcasting shooting, communication relay, agriculture, traffic surveillance, disaster response, reconnaissance, delivery, and leisure. UAV uses wireless communication technology to perform a mission through remote control or automatic control, and in order to properly perform a given mission, the high reliability of a wireless communication system that continuously connects the UAV and the ground control system is very important. The UAV's wireless communication channel uses a wireless network that is always open, so it is highly susceptible to wireless security attacks, and it physically damages the UAV by mobilizing security threat technologies related to UAV such as communication hacking, controller hacking, and sensor hacking. It is in an environment where it is very likely to be stolen or stolen and exploited for other purposes. In particular, with regard to communication security using wireless, data link spoofing can be said to be a more serious security problem since it can completely take control of the UAV.

The conventional UAV data link security technology uses encryption algorithms such as DES (Digital Encryption Standard), AES (Advanced Encryption Standard), ARIA (Academy, Research Institute, Agency), and SEED to encrypt data and then modulate and demodulate the modem. It is implemented in a structure that transmits and receives through. The transmitter encrypts the transmitted data, modulates it through a modem, and transmits it wirelessly, and the receiver demodulates and decrypts the received data to restore the data. At this time, data encryption is implemented by being built-in together with a data processing unit, which is a modem unit that performs modulation/demodulation in a data link, or is interfaced with an external encryption device to encrypt/decrypt transmission/reception data. In addition, the encryption key is transmitted from the control device that controls the data link or from an external storage medium and is stored internally, and it is common to use a fixed encryption key of a symmetric key method in which the UAV and the control station or radio station use the same key. It is a type of data link transmission/reception data encryption key management and operation.

In general, UAV data link transmission/reception data is UAV tele-command (TC), telemetry (TM) or observation image information from the ground control system.In particular, TC/TM data are within the system standard. Since it has a pattern that repeats in a certain pattern, the possibility of guessing or estimating the original data is relatively higher than that of general communication when a third party collects or observes data repeatedly transmitted and received over the radio.

As described above, in the conventional general UAV data link security structure, the characteristics of transmission/reception data, encryption application method, and key management structure provide a high level of security in terms of confidentiality, integrity, and availability from a security perspective. It is difficult to be satisfied or maintained, and in addition to the possibility of observation of a radio channel by a third party, if the UAV is stolen, the security system is exposed and the operation of the existing UAV must be stopped or the structure must be changed.

In the conventional UAV data link security technology, as data is encrypted or decrypted in one direction (Half-Duplex), it is difficult to process data at a high speed or delay data processing due to an encryption/decryption process.

[Patent Literature]

(Patent Document 1) Korean Patent Publication No. 10-2015-0001206 (Publication)

The present invention has been devised in accordance with the above-described necessity, and the present invention provides a high-speed encryption/decryption system for transmission/reception data in an unmanned aerial vehicle data link communication system. In addition, the present invention provides an electronic security system for providing a unique identification that cannot be physically replicated in an unmanned aerial vehicle data link, and for securing encryption key management and security of an encryption device. In addition, the present invention provides an electronic security system in an unmanned aerial vehicle capable of high-speed encryption/decryption processing by parallel processing of data in an input/output (Full-Duplex) direction.

An electronic security system in an unmanned aerial vehicle for high-speed encryption/decryption processing according to an embodiment of the present invention for achieving the above object includes: Plaintext data to be transmitted to the ground control station of the unmanned aerial vehicle and the ground control station. A main processor configured to input/output at least one of the ciphertext data received from the input/output; A buffer unit temporarily storing the at least one data in a plurality of queues; An extended memory interface control unit for generating a write completion signal when storing of the at least one data is completed, and reading the plaintext data or the ciphertext data stored in some of the plurality of queues when a read command is received; When the write completion signal is generated, an encryption command or a decryption command for the data stored in the partial queue is generated, and when an encryption completion signal or a decryption completion signal for the data is received, a read command for the read is issued. Generated encryption/decryption control unit; And upon receiving the encryption command, encrypting the plaintext data using an encryption/decryption engine unit using a decrypted security key, temporarily storing the encrypted data, and generating an encryption completion signal, and the decryption command Upon receiving, include an encryption/decryption unit that decrypts the encrypted text data using the decrypted security key through an encryption/decryption engine unit, temporarily stores the decrypted plaintext data, and generates a decryption completion signal. I can.

In accordance with an embodiment of the present invention described above, a security technology at the link layer for eavesdropping, observation, and hijacking of transmission/reception data by unauthorized third parties in an unmanned aerial vehicle data link wireless communication system is proposed, through which the unmanned aerial vehicle data link It provides an electronic security system that can improve the security of the communication system.

According to the embodiment of the present invention, the electronic security system of the UAV can be implemented with hardware separate from the data processing unit, thereby increasing the degree of security for a unique security key, and improving the encryption/decryption processing speed of data. have.

The electronic security system of the UAV according to the above-described embodiment of the present invention has an effect of reducing a problem that occurs in the unmanned aerial vehicle system (system) due to a delay caused by the encryption/decryption process.

The electronic security system of the UAV according to the above-described embodiment of the present invention has an effect of providing the advantage of low-latency processing by shortening the time required for data processing due to encryption/decryption.

1 is a block diagram of an electronic security system in an unmanned aerial vehicle according to an embodiment of the present invention.

2 is a diagram illustrating a process of encrypting plain text data to be transmitted to a ground control station according to an embodiment of the present invention.

3 is a diagram illustrating a process of decrypting Cyphertext data transmitted from a ground control station according to an embodiment of the present invention.

FIG. 4 is a diagram for explaining a process in which a security key management unit transmits an encrypted security key to the encryption/decryption processor 160 according to an embodiment of the present invention.

5 is a diagram illustrating a process of processing plain text data to be transmitted to a ground control station according to an embodiment of the present invention.

6 is a diagram illustrating a process of processing encrypted text data transmitted from a ground control station according to an embodiment of the present invention.

7 is a diagram illustrating a simultaneous processing process of plain text data and encrypted text data for high-speed encryption/decryption processing according to an embodiment of the present invention.

8 is a diagram illustrating a configuration example of an electronic security system according to an embodiment of the present invention.

9 is a diagram illustrating a configuration example of an electronic security system according to another embodiment of the present invention.

The following content merely exemplifies the principles of the present invention. Therefore, those skilled in the art can implement the principles of the present invention and invent various devices included in the concept and scope of the present invention, although not clearly described or illustrated herein. In addition, all conditional terms and examples listed in this specification are, in principle, clearly intended only for the purpose of understanding the concept of the present invention, and should be understood as not limiting to the embodiments and states specifically listed as described above. do.

In addition, it is to be understood that all detailed descriptions listing specific embodiments as well as principles, aspects and embodiments of the present invention are intended to include structural and functional equivalents of these matters. It should also be understood that these equivalents include not only currently known equivalents, but also equivalents to be developed in the future, that is, all devices invented to perform the same function regardless of the structure.

Thus, for example, the block diagrams herein are to be understood as representing a conceptual perspective of exemplary circuits embodying the principles of the invention. Similarly, all flowcharts, state transition diagrams, pseudocodes, etc. are understood to represent the various processes performed by a computer or processor, whether or not the computer or processor is clearly depicted and that can be represented substantially in a computer-readable medium. It should be.

The functions of the various elements shown in the drawings, including a processor or functional block represented by a similar concept, may be provided by the use of dedicated hardware as well as hardware having the ability to execute software in association with appropriate software. When provided by a processor, the function may be provided by a single dedicated processor, a single shared processor, or a plurality of individual processors, some of which may be shared.

In addition, the explicit use of terms presented as processor, control, or similar concepts should not be interpreted exclusively by quoting hardware capable of executing software, and without limitation, digital signal processor (DSP) hardware, ROM for storing software. It should be understood to implicitly include (ROM), RAM (RAM) and non-volatile memory. Other commonly used hardware may also be included.

In the claims of the present specification, components expressed as means for performing the functions described in the detailed description include all types of software including, for example, combinations of circuit elements or firmware/microcodes that perform the above functions. It is intended to include all methods of performing a function to perform the function, and is combined with suitable circuitry for executing the software to perform the function. Since the invention defined by these claims is combined with the functions provided by the various enumerated means and combined with the manner required by the claims, any means capable of providing the above functions are equivalent to those conceived from this specification. It should be understood as.

The above-described objects, features, and advantages will become more apparent through the following detailed description in connection with the accompanying drawings, whereby those of ordinary skill in the technical field to which the present invention pertains can easily implement the technical idea of the present invention. There will be. In addition, in describing the present invention, when it is determined that a detailed description of a known technology related to the present invention may unnecessarily obscure the subject matter of the present invention, a detailed description thereof will be omitted.

The present invention relates to a hardware-based encryption/decryption apparatus and method for encrypting/decrypting transmission/reception data in an unmanned aerial vehicle (UAV) data-link communication system. . In particular, data link transmission/reception data is high-speed encrypted/decrypted using a queue, which is a multi-data buffer implemented on hardware, and multi-encryption/decryption algorithm engine to minimize transmission delay due to encryption/decryption operation. In addition, it is characterized by improving the security of encryption/decryption function and security key management in unmanned aerial vehicles by using a unique identifier generated through a physically unclonable function (PUF) circuit that cannot be physically duplicated.

Hereinafter, various embodiments of the present invention will be described in detail with reference to the accompanying drawings.

FIG. 1 shows an electronic security system 130 for hardware-based encryption/decryption in order to enhance security with a ground control station performing wireless communication with an unmanned aerial vehicle or a ground control station including a radio station.

In FIG. 1, the flight controller 110 controls the flight of the UAV according to the command received from the ground control station, and serves to collect various types of information. The data processing unit 120 demodulates the encrypted data received from the ground control station and transmits it to the flight control unit 110, modulates the encrypted data generated by the flight control unit 110 and transmits it to the ground control station.

In addition, the electronic security system 130 performs interfacing of data transmitted between the flight control unit 110 and the data processing unit 120, and performs encryption/decryption of the interfacing data.

The first serial interface control unit 140a, the main processor 140b, and the second serial interface control unit 140c are included in the main processor unit 140.

Specifically, the first serial interface control unit 140a converts parallel data processed by the main processor 140b and serial data processed by the flight control unit 110 to each other, so that the main processor 140b and the flight control unit The first serial interface is controlled to communicate bidirectional high-speed serial data with (110) in a full-duplex manner. The second serial interface controller 140c controls a second serial interface for communicating bidirectional high-speed serial data between the main processor 140b and the data processing unit 120 in a full-duplex manner.

The first serial interface control unit 140a and the second serial interface control unit 140c include serial communication controllers such as Ethernet MAC, UART Controller, SPI, I2C, CAN Controller, and USB Controller, and include Ethernet, RS232, RS422, It inputs and outputs transmission/reception data through serial communication such as CAN and USB.

The main processor 140b may be implemented as a single core or a multi core, and data transmitted and received at high speed through the first serial interface 140a and the second serial interface 140c The encryption/decryption processor 160 is controlled to perform encryption/decryption of the.

The encryption/decryption processor 160 may be implemented in a hardware form such as a Field Programmable Gate Array (FPGA), and includes an extension memory interface controller 162 and a plurality of queues. It includes a buffer unit 164, an encryption/decryption control unit 170, an encryption/decryption unit 172, a security key decryption unit 174, and an encryption/decryption engine unit 176 including a plurality of encryption engines. .

The extended memory interface control unit 162 accesses the queues 164a 164b, 164c, 164d and the encryption/decryption control unit 170 included in the buffer unit 164 by the main processor 140b through a memory address. To be able to do it. The extended memory interface control unit 162 manages addresses in which data input through the main processor 140b is stored in the queues 164a 164b, 164c, 164d of the buffer unit 164, and the queues 164a 164b, 164c, 164d) and transmits the queue status signal to the encryption/decryption control unit 170.

The queue status signal includes a storage space of the queues 164a 164b, 164c, 164d or a read/write signal for the queues 164a 164b, 164c, 164d.

In addition, the extended memory interface control unit 162 outputs information on the operation state of the encryption/decryption control unit 170 to the main processor 140b.

The information on the operation state of the encryption/decryption control unit 170 includes information on the operation state of the encryption/decryption engines included in the encryption/decryption engine unit 176, and the encryption/decryption engines encrypt Includes a busy signal when the decryption operation is in progress, a Ready signal when preparing, and a complete signal when encryption/decryption is completed.

In addition, the extended memory interface control unit 162 performs data reading and data writing operations for queues 164a 164b, 164c, and 164d included in the buffer unit 164. When writing data to the queues 164a 164b, 164c, 164d included in the buffer unit 164 is completed, the extended memory interface control unit 162 Generates a write completion signal including the size and memory address in which the data is stored.

Accordingly, the extended memory interface control unit 162 stores data input through the main processor 140b in the

queues

164a, 164b, 164c, 164d, or data stored in the

queues

164a, 164b, 164c, 164d. Is read and output to the main processor 140b.

The buffer unit 164 includes a plurality of

queues

164a, 164b, 164c, 164d, and the

queues

164a, 164b, 164c, 164d are plain text data and ciphertext input from the main processor 140b. A memory having a first in first out (FIFO) structure for storing data, data encrypted by the encryption/decryption unit 172 or decrypted data.

As shown in FIG. 1, the main processor 140b transfers plaintext data transmitted from the flight control unit 110 through the first serial interface control unit 140a to the buffer unit 164 through the extended memory interface control unit 162. It outputs, and receives the encrypted data of the plaintext data, Cyphertext data, through the extended memory interface control unit 162, and transmits the received data to the data processing unit 120 through the second serial interface control unit 140c.

In FIG. 1, the first queue 164a stores plaintext data input from the main processor 140b, and the second queue 164b stores encrypted data for the plaintext data stored in the first queue 164a. . The fourth queue 164d stores the encrypted text data input from the main processor 140b, and the third queue 164c is the decrypted plaintext data of the encrypted data stored in the fourth queue 164c. Is saved.

As described above, in an embodiment of the present invention, by separating data input/output through the main processor 140b from queues storing encrypted/decrypted data, the time for storing plain text data in the queue and the time for storing plain text data are encrypted. It is possible to smooth the data processing flow by buffering the time synchronization collision and data overhead between the time periods performing the operation, and thus, the high-speed encryption/decryption operation can be sustained.

According to an embodiment of the present invention, the encryption/decryption control unit 170 stores the memory address of the queue in which plaintext data to be encrypted is stored, the size of the stored data or the memory address of the queue in which the ciphertext data to be decrypted is stored, and the stored data size information. When the included write completion signal is received from the extended memory interface control unit 162, an encryption command or a decryption command is transmitted to the encryption/decryption unit 172. In this case, the encryption command or decryption command includes the size of the data to be encrypted/decrypted and the stored memory address.

The encryption/decryption unit 172 controls the encryption/decryption engines included in the encryption/decryption engine unit 176 and monitors operation states of each engine. In addition, by receiving the decrypted security key from the security key management unit 150, the encryption/decryption engines control the encryption/decryption of data stored in the buffer unit 164 using the security key.

As described above, in an embodiment of the present invention, by separately configuring the extended memory interface control unit 162 and the encryption/decryption unit 172, the main processor 140b directly accesses and states the encryption/decryption engine unit 176. Monitoring can be blocked, so confidentiality from the outside can be maintained.

As a remedy, the encryption/decryption unit 172 uses a plurality of encryption/decryption algorithm engines included in the encryption/decryption engine unit 176 according to the encryption command or decryption command. Encryption/decryption is performed on the data stored in, and when encryption/decryption is completed, the encrypted data or decrypted data is stored in the buffer unit 164, and then an encryption completion or decryption completion signal is generated. It transmits to the encryption/decryption control unit 170.

In an embodiment of the present invention, the encryption/decryption engine unit 176 includes an encryption/decryption engine using a plurality of encryption/decryption algorithms or multiple cryptographic hash functions, and encrypts data. / Responsible for the decryption operation. In addition, the encryption/decryption engine unit 176 may be implemented as hardware logic for high-speed encryption operation processing, and the encryption/decryption algorithm is AES (Advanced Encryption Standard) 128/256, DES (Digital Encryption Standard). , SEED, ARIA (Academy, Research Institute, Agency). It can be composed of various encryption algorithms such as LEA (Lightweight Encryption Algorithm), and if necessary, encryption/decryption can be performed using only a single encryption/decryption engine, or parallel encryption using multiple encryption/decryption engines /You can also perform decryption.

The security key decryption unit 174 decrypts the security key encrypted by the security key management unit 150 and transmits the decryption to the encryption/decryption unit 172. The encryption/decryption unit 172 may perform encryption/decryption through the encryption/decryption engine unit 176 using the security key decrypted by the security key decryption unit 174. In the present invention, it is assumed that the security key decryption unit 174 stores in advance a security key encryption key, which is a key encrypted by the security key management unit 150.

The security key management unit 150 includes a Physically Unclonable Function (PUF) circuit 150a, a non-volatile memory 150b, and a security key encryption unit 150c.

The PUF circuit 150a generates a unique key, which is an unpredictable digital value, using a process variation in a semiconductor manufacturing process, and stores it in the nonvolatile memory 150b. At this time, the generated unique key is used as a secure key used in the present invention. The security key encryption unit 150c encrypts the security key, which is a unique key stored in the nonvolatile memory 150b, with an encryption key, and outputs the encrypted key to the security key decryption unit 174. In this case, the encryption key is a nonce (Number used ONCE), which is a random number used once, and a hash value generated through a hash function for the nonce. In an embodiment of the present invention, since the security key decryption unit 174 knows the security key encryption key in advance, the encrypted security key transmitted from the security key management unit 150 is converted to the security key encryption key ( By decrypting using Secure Key Encryption Key), you can obtain a security key.

As described above, in the present invention, the encryption/decryption processor 160 implemented as an FPGA performs encryption/decryption of data through the internal encryption/decryption engine unit 176, and the security key management unit 150 The unique security key generated by the PUF circuit 150a in the nonvolatile memory 150b is encrypted with an encryption key and transmitted to the encryption/decryption processor 160 to prevent physical exposure to the security key. By doing so, airtightness can be improved.

In FIG. 2, it is shown that the electronic security system 130 outputs the encrypted plaintext data 210 input from the flight control unit 110 and the encrypted text data 220 to the data processing unit 120. The data processing unit 120 receiving the ciphertext data 220 modulates the ciphertext data 220 and transmits the modulated ciphertext data 220 to a control station on the ground.

Referring to FIG. 2, when the plaintext data 210 is received through the first serial interface controller 140a, as shown by reference numeral 250, the main processor 140b, the extended memory interface controller of the encryption/decryption processor 160 ( 162, and the extended memory interface control unit 162 stores the plaintext data in the first queue 164a of the buffer unit 164. In FIG. 2, reference numeral 230 denotes the plain text data stored in the first queue 164a.

When the storage of the plaintext data in the first queue 164a is completed, the extended memory interface control unit 162 determines the size of the plaintext data 230 stored in the first queue 164a and the first queue 164a. A write completion signal including the memory address stored in) is output to the encryption/decryption control unit 170.

After receiving the write completion signal from the extended memory interface control unit 162, the encryption/decryption control unit 170 uses the encryption/decryption unit 172 to store the plaintext data 230 in the first queue 164a. Outputs an encryption command instructing to perform encryption for the data. In this case, the encryption command may include the size and memory address of the plaintext data 230 stored in the first queue 164a.

When the encryption/decryption unit 172 receives the encryption command, the plaintext data 230 stored in the first queue 164a is encrypted through the encryption/engine unit 176.

At this time, the encryption/decryption engine unit 176 encrypts the plaintext data 230 through the security key decrypted by the security key decryption unit 174.

The encryption/decryption engine unit 176 may be composed of N encryption/decryption engines, and may perform encryption using only one of the N encryption/decryption engines. , Parallel encryption processing on the plain text data may be performed using a plurality of encryption/decryption engines.

When the encryption/decryption unit 172 completes encryption of the plaintext data 230 by the encryption/engine unit 176, the encrypted encrypted text data is stored in the second queue 164b (240), and , The encryption completion signal is output to the encryption/decryption control unit 170. In this case, the encryption completion signal may include a size of the ciphertext data 240 stored in the second queue 164b and a memory address of the ciphertext data stored in the second queue 164b.

In addition, the encryption/decryption control unit 170 may determine an encryption/decryption engine to be used by the encryption/decryption unit 172 and determine various parameters of the determined encryption/decryption engine.

Upon receiving the encryption completion signal, the encryption/decryption control unit 170 outputs a read command for the encrypted text data 240 stored in the second queue 164b to the extended memory interface control unit 162.

After receiving the read command, the extended memory interface control unit 162 reads the encrypted text data 240 stored in the second queue 164b and outputs it to the main processor 140b. The encrypted text transmission data packet 220 is output to the data processing unit 120 through the interface control unit 140c (reference numeral 260).

FIG. 3 is a diagram illustrating a decryption process of a ciphertext data 310 transmitted from a ground control station according to an embodiment of the present invention. In FIG. 3,

reference numerals

350, 360, and 370 denote plaintext data 320 obtained by decrypting the ciphertext data 310 input from the data processing unit 120 by the electronic security system 130. 110) shows the process of printing.

The data processing unit 120 receiving the encrypted text data 310 demodulates the encrypted text data 310 and outputs it to the electronic security system 130.

Referring to FIG. 3, as shown by reference numeral 350, when the encrypted text data 310 is received through the second serial interface controller 140c, the extended memory interface controller of the encryption/decryption processor 160 ( 162, and the extended memory interface control unit 162 stores the encrypted text data in the fourth queue 164d of the buffer unit 164. In FIG. 3, reference numeral 350 denotes the encrypted text data stored in the fourth queue 164d.

When the storage of the encrypted text data in the fourth queue 164d is completed, the extended memory interface control unit 162 determines the size of the encrypted text data 350 stored in the fourth queue 164d and the fourth queue 164d. A write completion signal including the memory address stored in) is output to the encryption/decryption control unit 170.

Upon receiving the write completion signal from the extended memory interface control unit 162, the encryption/decryption control unit 170 uses the encryption/decryption unit 172 to store the encrypted text data 350 in the fourth queue 164d. Outputs a decryption command instructing to perform decryption for it. In this case, the decryption command may include the size and memory address of the encrypted text data 350 stored in the fourth queue 164d.

Upon receiving the decryption command, the encryption/decryption unit 172 decrypts the encrypted text data 350 stored in the fourth queue 164d through the encryption/decryption engine unit 176.

At this time, the encryption/decryption unit 172 transmits the secure key decrypted by the security key decryption unit 174 to the encryption/engine unit 176, and the encryption/decryption engine unit 176 includes the The cryptographic data 350 is decrypted through a security key.

The encryption/decryption engine unit 176 may be composed of N encryption/decryption engines, and decryption may be performed using only one of the N encryption/decryption engines. In addition, a plurality of encryption/decryption engines may be used to perform parallel decryption processing on the encrypted text data.

The encryption/decryption unit 172 stores the decrypted plaintext data in the third queue 164c when decryption of the encrypted text data 350 is completed by the encryption/engine unit 176 (360). Then, the decryption completion signal is output to the encryption/decryption control unit 170. In this case, the decryption completion signal may include a size of the plaintext data 340 stored in the third queue 164c and a memory address of the plaintext data stored in the third queue 164c.

Upon receiving the decryption completion signal, the encryption/decryption control unit 170 outputs a read command for the plain text data 340 stored in the third queue 164c to the extended memory interface control unit 162.

Receiving the read command, the extended memory interface controller 162 reads the plain text data 340 stored in the third queue 164c and outputs it to the main processor 140b, and the main processor 140b receives the first serial The plaintext reception data packet 320 is output to the flight control unit 110 through the interface control unit 140a (reference number 370).

In the above-described embodiment of the present invention, a queue in which plaintext data is stored, a queue in which encrypted data of plaintext data is stored, a queue in which ciphertext data is stored, and a queue in which decrypted data of ciphertext data is stored are respectively specified and described. This is only an exemplary embodiment, and in the actual implementation process, it is of course possible to change it to be stored in different queues that are distinguished from each other by those skilled in the art.

FIG. 4 is a diagram for explaining a process in which the security key management unit 150 transmits an encrypted security key to the encryption/decryption processor 160 according to an embodiment of the present invention. The security key described in the present invention is an encryption key used for encryption/decryption in wired/wireless communication, and includes a master key, a session key, a derived key, and the like.

The security key management unit 150 includes a PUF (Physical Unclonable Function) circuit 150a, a nonvolatile memory 150b, and a security key encryption unit 150c.

The PUF (Physical Unclonable Function) circuit 405 is a circuit that generates at least one Secure Key that is physically unclonable, and the nonvolatile memory 150b is a security key generated by the PUF circuit. Save 410.

The security key encryption unit 150c encrypts the security key 410 stored in the nonvolatile memory 150b using an encryption key (reference numeral 430). At this time, the security key encryption unit 150c generates an encryption key to encrypt the security key through a nonce (Number used ONCE), which is a random number used once, and a hash value generated through a hash function for the nonce. Generate. Then, the security key encryption unit 150c transmits the encrypted security key 430 to the security key decryption unit 174 of the encryption/decryption processor 160.

The security key decryption unit 174 decrypts the encrypted security key 430 transmitted from the security key management unit 150 through a secure key encryption key previously stored (reference number 450), The decrypted security key is transmitted to the encryption/decryption engine unit 176 through the encryption/decryption unit 172 (460). In addition, the encryption/decryption engine unit 176 performs encryption/decryption through the received security key 470.

As shown in FIG. 4, in an embodiment of the present invention, a security key is encrypted and transmitted from the security key management unit 150 to the encryption/decryption processor 160, so that a third party encrypts/decrypts the security key management unit 150 The interface between the processor 160 is monitored or probed in hardware so that the security key cannot be stolen or guessed. In addition, in an embodiment of the present invention, the security key management unit 150 encrypts and outputs the security key, thereby maintaining the confidentiality of the security key.

5 is an operation of simultaneously processing full-duplex data input and output from the flight control unit 110 and the data processing unit 120 in the electronic security system of the unmanned aerial vehicle, and the plain text data to be transmitted to the ground control station Indicate the processing process.

The plain text data output from the flight control unit 110 is encrypted by the encryption engine unit 176 through a specific queue among the plurality of queues, and then transmitted to the data processing unit 120 and transmitted to the ground control station.

The flight control unit 110 transmits plain text data (Paintext) to the main processor 140b through the first serial interface under the control of the first serial interface control unit 140a.

The main processor 140b temporarily stores plain text data in some of the plurality of queues. Here, the plain text data may be stored in the first queue 164a.

When the storage of the plain text data is completed, the extended memory interface control unit 162 generates a write completion signal.

When a write completion signal is generated from the extended memory interface controller 162, the encryption/decryption control unit 170 generates an encryption command for plain text data stored in a partial queue (first queue).

When receiving the encryption command, the encryption/decryption unit 172 encrypts the plaintext data through the encryption/decryption engine unit using the decrypted security key. The encryption/decryption unit 172 temporarily stores the encrypted text data in some of the plurality of queues and then generates an encryption completion signal. Here, the encrypted text data by encrypting the plain text data may be stored in the second queue 164b.

When the encryption/decryption control unit 170 receives an encryption completion signal for plain text data, the encryption/decryption control unit 170 generates a read command for reading.

When a read command is received, the extended memory interface control unit 162 reads out the encrypted text data stored in some queues (second queue) to the data processing unit 120 through the main processor 140b and the second serial interface control unit 140c. Deliver.

6 is an operation of simultaneously processing full-duplex data input and output from the flight control unit 110 and the data processing unit 120 in an electronic security system in an unmanned aerial vehicle, Indicate the processing process.

Ciphertext data input to the data processing unit 120 is decrypted by the encryption engine unit 176 through a specific queue among a plurality of queues, and then transmitted to the flight control unit 110 and transmitted to the unmanned aerial vehicle.

The data processing unit 120 transmits the encrypted text data to the main processor 140b through the second serial interface under the control of the second serial interface controller 140c.

The main processor 140b temporarily stores the encrypted text data in some of the plurality of queues. Here, the encrypted text data may be stored in the fourth queue 164d.

When the storage of the encrypted text data is completed, the extended memory interface control unit 162 generates a write completion signal.

When a write completion signal is generated from the extended memory interface controller 162, the encryption/decryption control unit 170 generates a decryption command for the encrypted text data stored in some queues (fourth queue).

Upon receiving the decryption command, the encryption/decryption unit 172 decrypts the encrypted text data through the encryption/decryption engine unit using the decrypted security key. The encryption/decryption unit 172 temporarily stores the decrypted plaintext data in some of the plurality of queues and then generates a decryption completion signal. Here, the plaintext data obtained by decrypting the ciphertext data may be stored in the third queue 164b.

When the encryption/decryption control unit 170 receives the decryption completion signal for the encrypted text data, it generates a read command for reading.

When the read command is received, the extended memory interface control unit 162 reads out the plain text data stored in some queues (third queue), and passes through the main processor 140b and the first serial interface control unit 140a to the flight control unit 110. Deliver.

7 shows a simultaneous processing process of simultaneously processing full-duplex data input/output from the flight control unit 110 and the data processing unit 120 in an electronic security system in an unmanned aerial vehicle.

The electronic security system according to the present embodiment can simultaneously process plaintext data and ciphertext data input through both

ports

110 and 120, so that encryption/decryption processing can be accelerated. In addition, the electronic security system can provide the advantage of low-delay processing by shortening the time required for data processing, and can minimize the effect of delay occurrence through encryption/decryption.

The electronic security system according to the present embodiment encrypts the plaintext data output from the flight control unit 110 through a specific queue among a plurality of queues, and transmits it to the data processing unit 120 after encryption by the encryption engine unit 176 to be transmitted to the ground control station. The operation and the operation of transferring the encrypted text data input to the data processing unit 120 to the flight control unit 110 after being decrypted by the encryption engine unit 176 through a specific queue among the plurality of queues and transmitting it to the unmanned aerial vehicle are processed in parallel. Processing at the same time.

The electronic security system performs parallel processing of plaintext data and encrypted text data (queue storage and encryption/decryption processing, etc.), thereby simultaneously processing the encryption/decryption data of unmanned aerial vehicle transmission/reception data, thereby enabling high-speed processing. Here, the electronic security system must apply the same encryption algorithm to the encryption/decryption engine for simultaneous processing.

Meanwhile, the main processor 140b of the electronic security system processes data in an orderly manner, and performs parallel processing from the step of storing data in some of the plurality of queues through the extended memory interface controller 162.

The main processor 140b of the electronic security system may change the processing order according to the set priority when priorities for plain text data and encrypted text data are set. For example, the main processor 140b stops processing the plaintext data when ciphertext data having a higher priority than the plaintext data comes in while processing plaintext data, and processes the ciphertext data to be stored in some of the plurality of queues. I can.

The main processor unit 140 inputs/outputs at least one of plain text data to be transmitted to the ground control station of the unmanned aerial vehicle and encrypted text data received from the ground control station.

The flight control unit 110 transmits plain text data (Paintext) to the main processor 140b through a first serial interface under the control of the first serial interface control unit 140a, and the data processing unit 120 is a second serial interface control unit. Under the control of 140c, the encrypted text data is transmitted to the main processor 140b through the second serial interface.

The main processor unit 140 sequentially transfers one of the plaintext data and the ciphertext data to some of the plurality of queues through the extended memory interface control unit 162 according to the input order to be temporarily stored.

The buffer unit 164 includes a plurality of queues 164a 164b, 164c, 164d, and temporarily stores at least one data such as plain text data and cipher text data. Here, the plain text data may be stored in the first queue 164a, and the encrypted text data may be stored in the fourth queue 164d.

When the storage of at least one data such as plain text data and encrypted text data is completed, the extended memory interface control unit 162 generates a write completion signal.

Here, the write completion signal includes the size of the plaintext data stored in the first queue 164a, the memory address of the first queue 164a in which the plaintext data is stored, and the size of the ciphertext data stored in the fourth queue 164d and the encrypted text data. It may include the memory address of the stored fourth queue 164d.

The extended memory interface controller 162 manages addresses stored so that the plaintext data and the ciphertext data are stored in different queues included in the buffer unit 164 so that the plaintext data and the ciphertext data are processed in parallel.

The extended memory interface controller 162 may control the plain text data to be temporarily stored in the first queue 164a, and the encrypted text data to be temporarily stored in the fourth queue 164d. That is, the extended memory interface controller 162 stores plain text data and encrypted text data in parallel in each of the first queue 164a and the fourth queue 164d so that they are processed simultaneously.

When a write completion signal is generated from the extended memory interface controller 162, the encryption/decryption control unit 170 generates an encryption command or a decryption command for at least one data stored in some queues.

When a write completion signal is generated from the extended memory interface controller 162, the encryption/decryption control unit 170 generates an encryption command for plain text data stored in some queues (first queue), and partially queues (fourth queue). Generates a decryption instruction for the encrypted text data stored in.

The encryption/decryption control unit 170 generates an encryption command for the plaintext data stored in the first queue 164a when a write completion signal for each of the plaintext data and the encrypted text data is generated, and is stored in the fourth queue 164d. Generates decryption instructions for ciphertext data. The encryption/decryption control unit 170 may simultaneously generate an encryption command and a decryption command when a write completion signal for each of the plain text data and the encrypted text data is simultaneously generated.

When receiving the encryption command, the encryption/decryption unit 172 encrypts the plaintext data using the decrypted security key through the encryption/decryption engine unit, temporarily stores the encrypted data, and generates an encryption completion signal. , Upon receiving the decryption command, the encrypted text data is decrypted through the encryption/decryption engine unit using the decrypted security key, the decrypted plaintext data is temporarily stored, and a decryption completion signal is generated.

When receiving the encryption command, the encryption/decryption unit 172 encrypts the plaintext data stored in the first queue using the decrypted security key through the encryption/decryption engine unit. The stored encrypted text data is decrypted through the encryption/decryption engine unit using the decrypted security key. Here, the encryption/decryption unit 172 preferably encrypts plain text data and decrypts the encrypted text data using different encryption/decryption engine units, but is not limited thereto. For example, in the case of an encryption/decryption engine unit capable of parallel processing, a single encryption/decryption engine unit may encrypt plain text data and decrypt the encrypted text data.

Meanwhile, the encryption/decryption unit 172 may simultaneously process plaintext data and ciphertext data by using different encryption/decryption engine units each using the same encryption/decryption algorithm. For example, each of the different encryption/decryption engine units is AES (Advanced Encryption Standard) 128/256, DES (Digital Encryption Standard), SEED, ARIA (Academy, Research Institute, Agency). By applying the same encryption/decryption algorithm, such as LEA (Lightweight Encryption Algorithm), both plaintext data and ciphertext data can be processed at the same time.

The encryption/decryption unit 172 temporarily stores the encrypted text data in some of the plurality of queues and then generates an encryption completion signal. Here, the encrypted text data by encrypting the plain text data may be stored in the second queue 164b. The encryption completion signal may include a size of encrypted data stored in the second queue 164b and a memory address of the second queue 164b in which the encrypted data is stored.

Meanwhile, at the same time as the encryption process, the encryption/decryption unit 172 temporarily stores the decrypted plaintext data in some of the plurality of queues and generates a decryption completion signal. Here, the plaintext data obtained by decrypting the ciphertext data may be stored in the third queue 164b. The decryption completion signal may include a size of decrypted plaintext data stored in the third queue 164b and a memory address of the third queue 164b in which decrypted plaintext data is stored.

When the encryption/decryption control unit 170 receives an encryption completion signal or a decryption completion signal for at least one data such as plain text data or encrypted text data, it generates a read command for the reading.

When the encryption/decryption control unit 170 receives the encryption completion signal for the plaintext data, the encryption/decryption control unit 170 generates a read command for reading the encrypted text data, and when the decryption completion signal for the ciphertext data is received, the decryption completion signal for the plaintext data is received. Issue a read order. Reading commands for reading encrypted text data and reading plain text data may occur simultaneously in parallel.

When a read command is received, the extended memory interface controller 162 reads plain text data or encrypted text data stored in some of the plurality of queues. When a read command is received, the extended memory interface control unit 162 reads out the encrypted text data stored in some queues (second queue) and transfers the encrypted text data to the data processing unit 120 through the main processor 140b and the second serial interface control unit 140c. The transfer operation and the operation of reading the plaintext data stored in some queues (third queue) and transferring them to the flight control unit 110 through the main processor 140b and the first serial interface control unit 140a are simultaneously processed.

8 shows that the electronic security system 130 is connected between the flight control unit 810 and the data processing unit 820 through serial interfaces, respectively, and performs encryption/decryption of transmitted/received data.

9 is a diagram illustrating a configuration example of an electronic security system according to another embodiment of the present invention. The electronic security system 130 according to FIG. 9 shows that it is included as a component of the data processing unit 920 and operates. In FIG. 9, the electronic security system 130 is located at the front end of the modem 940, Communication is performed with the flight control interface 930 through a serial interface, and the flight control interface 930 performs an interface with the flight control unit 910. In addition, in FIG. 9, the modem 940 modulates the ciphertext data output from the electronic providing system 1360 and outputs it through the RF unit 950, or demodulates the ciphertext data received through the RF unit 950 to electronically modulate the ciphertext data. Output to the security system 130.

In addition, the operation method according to various embodiments of the present invention described above may be implemented as a program and stored in various non-transitory computer readable media and provided. The non-transitory readable medium refers to a medium that stores data semi-permanently and can be read by a device, rather than a medium that stores data for a short moment, such as a register, a cache, and a memory. Specifically, the above-described various applications or programs may be provided by being stored in a non-transitory readable medium such as a CD, DVD, hard disk, Blu-ray disk, USB, memory card, ROM, or the like.

In addition, although the preferred embodiments of the present invention have been illustrated and described above, the present invention is not limited to the specific embodiments described above, and the technical field to which the present invention belongs without departing from the gist of the present invention claimed in the claims. In addition, various modifications are possible by those of ordinary skill in the art, and these modifications should not be individually understood from the technical spirit or prospect of the present invention.

[Explanation of code]

110: flight control unit 120: data processing unit

130: electronic security system 140: main processor unit

140a: first serial interface control unit

140b: main processor

140c: second serial interface control unit

150: security key management unit 150a: PUF circuit

150b: non-volatile memory 150c: security key encryption unit

160: encryption/decryption processor

162: extended memory interface control unit

164: buffer unit 164a: first queue

164b: second queue 164c: third queue

164d: fourth queue 170: encryption/decryption control unit

172: encryption/decryption unit 174: security key decryption unit

176: encryption/decryption engine unit

Claims

In an electronic security system in an unmanned aerial vehicle for high-speed encryption/decryption processing,

A main processor for input/output processing at least one of plaintext data to be transmitted to the ground control station of the unmanned aerial vehicle and ciphertext data received from the ground control station;

A buffer unit temporarily storing the at least one data in a plurality of queues;

An extended memory interface control unit for generating a write completion signal when storing of the at least one data is completed, and reading the plaintext data or the ciphertext data stored in some of the plurality of queues when a read command is received;

When the write completion signal is generated, an encryption command or a decryption command for the data stored in the partial queue is generated, and when an encryption completion signal or a decryption completion signal for the data is received, a read command for the read is issued. Generated encryption/decryption control unit; And

Upon receiving the encryption command, the plaintext data is encrypted through an encryption/decryption engine unit using a decrypted security key, and after temporarily storing the encrypted data that has been encrypted, an encryption completion signal is generated,

Upon receiving the decryption command, the encrypted text data is decrypted through the encryption/decryption engine unit using the decrypted security key, and the decryption completion signal is generated after temporarily storing the decrypted plain text data. stoker

Electronic security system in an unmanned aerial vehicle comprising a.
The method of claim 1,

The main processor unit,

An electronic security system in an unmanned aerial vehicle that sequentially transfers one of the plaintext data and the ciphertext data to the plurality of queues through the extended memory interface control unit and stores them temporarily according to an input order.
The method of claim 2,

The extended memory interface control unit,

An electronic security system in an unmanned aerial vehicle, characterized in that managing addresses stored so that the plaintext data and the ciphertext data are stored in different queues included in the buffer unit so that the plaintext data and the ciphertext data are processed in parallel. .
The method of claim 3,

The extended memory interface control unit,

In the case of the plain text data, it is controlled to be temporarily stored in the first queue, and in the case of the encrypted text data, it is controlled to be temporarily stored in the fourth queue,

The electronic security system in an unmanned aerial vehicle, characterized in that the plain text data and the encrypted text data are stored in parallel in each of the first queue and the fourth queue to be processed simultaneously.
The method of claim 4,

The encryption/decryption control unit,

When the write completion signal for each of the plain text data and the encrypted text data is generated, an encryption command for the plain text data stored in the first queue is generated, and a decryption command for the encrypted text data stored in the fourth queue is generated, and And generating the encryption command and the decryption command at the same time when the write completion signal for each of the plain text data and the encrypted text data is simultaneously generated.
The method of claim 4,

The encryption/decryption unit,

Upon receiving the encryption command, the plaintext data stored in the first queue is encrypted through an encryption/decryption engine unit using a decrypted security key,

When receiving the decryption command, the encrypted text data stored in the fourth queue is decrypted through an encryption/decryption engine unit using a decrypted security key.
The method of claim 6,

The encryption/decryption unit,

An electronic security system for an unmanned aerial vehicle, comprising encrypting the plaintext data and decrypting the ciphertext data by using different encryption/decryption engine units respectively.
The method of claim 7,

The encryption/decryption unit,

An electronic security system in an unmanned aerial vehicle, characterized in that the plaintext data and the ciphertext data are simultaneously processed using each of the different encryption/decryption engine units using the same encryption/decryption algorithm.
The method of claim 4,

The encryption/decryption unit,

When the encryption of the plaintext data is completed, the encrypted data is stored in the second queue, and the encryption completion signal is generated,

When decryption of the encrypted text data is completed, the decrypted plain text data is stored in the third queue, and the decryption completion signal is generated.
The method of claim 1,

The write complete signal,

The size of the plaintext data stored in the first queue, the memory address of the first queue in which the plaintext data is stored, the size of the ciphertext data stored in the fourth queue, and the memory address of the fourth queue in which the ciphertext data are stored Electronic security system in an unmanned aerial vehicle, characterized in that it comprises.
The method of claim 1,

The encryption completion signal includes a size of encrypted data stored in the second queue and a memory address of the second queue in which the encrypted data is stored, and the decryption completion signal is decrypted and completed stored in the third queue. An electronic security system for an unmanned aerial vehicle, comprising: a size of plain text data and a memory address of the third queue in which the decrypted plain text data is stored.