Method and system for securely authorising the activation of a critical function on a drone

METHOD AND SYSTEM FOR SECURELY AUTHORISING THE ACTIVATION OF A CRITICAL FUNCTION ON A DRONE

The field of the invention is that of robot platforms of the air or ground drone type.

The invention relates in general to the insertion of secure functions within complex systems. It relates more

5. specifically to the authorisation of the activation of a critical function requiring a high level of security, for implementation within a complex system such as a drone system comprising one or more robot platforms. By way of non-limiting example of a critical function, mention will 10 be' made of the triggering of a firing of munitions from such a platform.

Within complex systems, some particular functions require high levels of security due to the nature of the actions that they deliver, for example for their direct 15 contribution to the security of the system. These functions are thus commonly referred to as critical functions .

In particular, the object here is to prevent the inopportune activation of these critical functions. The terminology authorisation of the critical function is therefore used. The non-performance of the function is not deemed to be critical; on the other hand, the untimely performance thereof is deemed to be critical. For the cited use example, the firing of the munition is not per se deemed to be critical with regard to security, but the unauthorised activation thereof is deemed to be critical.

In order to guarantee the security of their operation, and to facilitate the theoretical demonstration thereof, the conventional approach is to isolate these functions and also their entire command and control chain. This may prove to be a severe handicap when these functions are to be inserted within systems which¹either already exist or are too complex to be able to be developed integrally with the intended high levels of security. The invention deals with this problem, and in particular aims to make it possible to insert such functions without having to justify the robustness of each link in the^; control. chain of the function in question.

Returning to the case of robot drones, there is a tendency to want to equip these drones with a missile system. However, these drones were initially developed without any security objective with regard to missile security.

Although in a conventional aeronautical system it is the pilot who is responsible for releasing a safety lock which makes it possible to authorise the triggering of the firing of the missile (final security authorisation), 5 it will be understood that, in the context of a robot drone, the task of releasing this safety lock has to be handed over to the system control centre (in this case a ground station housing the people operating the system).

However, it is then necessary to ensure, with a 10 . particularly high level of security, that the activation of the critical function missile firing״ is not triggered inopportunely.

An immediate solution to this problem of integrating the critical function of the missile firing type is shown 15 in figure 1.

This figure 1 shows a ground station 10 and a deployed robot drone 20 which is controlled from the ground station 10 via a radio link 32.

As shown schematically, the ground station 10 20 comprises a central command and control module, referred to as the core, module 11, and a transmission module 12 which is connected to the core module 11.

The drone 20 comprises a central command and control module, referred to as the core module 21, a missile 25 system 23 which is connected to the core module 21, and a transmission module 22 which is also connected to the core module 21.

The radio link 32 provides the functional link between the core modules 11, 21 of the station 10 and the drone 20, via the transmission modules 12, 22.

These elements 11, 12, 32, 22, 21, 23, which are 5 conventional per se and which have just been presented, are shown in solid lines in this figure 1.

The chain of critical elements, referred to as the firing authorisation chain, which transmits the firing authorisation to the missile system 23, is shown in 10 dashed lines in this same figure 1. This segregated architecture is one possible solution to the problem of

<td> integrating the</td><td> activation</td><td> of the</td><td> missile</td><td> firing</td>

<td> operation. The firing</td><td> authorisation</td><td> chain</td><td> comprises</td><td> secure</td>

<td colspan="2"> 15 modules (i.e. modules formed</td><td> with a</td><td colspan="2"> sufficiently high</td>

level of criticality for the function in question) which are connected to one another by a dedicated link. Thus the station 20 comprises a firing authorisation module 14 .and the drone comprises a firing authorisation module 24, 20 these modules 14, 24 being connected by a dedicated link illustrated by the bold arrow bearing reference 34.

It will therefore be understood that, in this architecture, a choice has been made to segregate the chain for authorising the activation of the critical 25 function, by separating this chain from the rest of the system.

Although this architecture proves useful to demonstrate rigorously and with reasonable effort the overall security of operation of the firing chain, it nevertheless has certain disadvantages.

For multiple drones (controlling a fleet of drones from the ground station and deploying multiple systems in a theatre of war), this solution makes it necessary to implement and to house together multiple additional links, which proves to be relatively difficult to envisage in an operational context.

The object of the invention is to propose another solution for integrating a critical function, for example commanding the firing of a missile, in a complex system, and in particular a solution which does not have the disadvantages of the solution in figure 1 which uses an additional dedicated link.

According to a first aspect, the invention relates to a system for authorising the activation of a critical function, such as the triggering of a firing of munitions, by a robot drone of the air or ground type which is able to communicate with a ground station via a radio link, the system being characterised in that the station comprises an activation module and the drone comprises at least one effector module, the activation module comprising .generation means for generating a critical function activation message signed for a designated effector module, and each effector module comprising authentication means for authenticating signed activation messages coming from the station via the radio link, said authentication means being able to verify whether a received message is a genuine message signed for said effector module, and where appropriate to authorise the activation of the critical function.

Some preferred, but non-limiting, aspects of this system are as follows:

a system comprising a signature key and an authentication key is used by the activation module and each effector module in order to respectively sign and authenticate an activation message, a different signature key/authentication key pair being associated with each activation module/effector module pair;

the signature key/authentication key pair , is defined for a use that is limited with regard to time or for a use that is limited to a certain number of uses;

- the system of keys is a system of asymmetrical keys in which the activation module (for sending an order) uses a private signature key selected as a function of the designated effector module, and each effector module is designated by a public authentication key;

- each effector module may in turn use a specific internal private key to send its status (activated or not) back to the activation module. For this, the activation module has a public authentication key which is specific to it;

- the activation module comprises a memory which stores each of the signature keys designed to be used by the generation means to sign a critical function activation message for a designated effector module;

each effector module comprises a memory which stores authentication keys designed to be used by the authentication means to verify whether a received message is a genuine message, and to code in return the status of the effector module.

According to a second aspect, the invention relates to a method for authorising the activation of a critical function, such as the triggering of a firing of munitions׳, by a robot drone of the air or ground type which is able to communicate with a ground station via a radio link., the ground station comprising an activation module and the drone comprising at least one effector module, characterised in that said method comprises the following steps:

- generation, by the activation module of the ground station, of a critical function activation message signed for a designated effector module;

.- transmission of the message via the radio link from the activation module to the designated effector module;

- authentication, by the designated effector module, of the signed activation message in order to verify whether the received message is a genuine message signed for said module, and authorisation, ־ where appropriate, of the activation , of the critical function by the designated effector module.

^,Some preferred, but non-limiting, aspects of this method are as follows:

- it uses a system comprising a signature key and an authentication key in order to respectively sign and authenticate an activation message, with a different signature key/authentication key pair for each activation module/effector module pair;

- the system of keys is a system of asymmetrical keys, the activation module using a private signature key selected as a function of the designated effector module, and each effector module using a public authentication key;

- it activates the critical function upon receipt of the order, according to which the activation message is permanently transmitted to the designated effector module, and any break in the transmission of the activation message deactivates the critical function after a given delay;

- it also comprises a step of return transmission to the station of a message concerning the status of the designated effector module, comprising in a symmetrical manner the operations of signing of said message by the effector module and authentication of said message by the activation module of the station.

According to other aspects, the invention relates to a -ground control station and a robot drone for a system according to the first aspect.

Other aspects, objects and advantages of the present invention-will becomemore clearly apparent upon reading the . following detailed description of preferred embodiments thereof, said description being given by way of non-limiting example and with reference to the appended drawings, in which, besides figure 1 which has already been discussed:

figure 2 shows a diagram of a system for activating a critical function according to one possible

<td colspan="3"> embodiment of the first aspect</td><td rowspan="2"> of the diagram</td><td rowspan="2"> invention; of one</td><td rowspan="2"> possible</td>

<td> figure</td><td> 3</td><td> shows a</td>

<td> embodiment of</td><td> an</td><td> activation</td><td> module</td><td> according</td><td> to the</td>

<td> invention; figure</td><td> 4 </td><td> shows a</td><td> diagram</td><td> of one</td><td> possible</td>

<td> embodiment of</td><td> an</td><td> effector</td><td> module</td><td> according</td><td> to the</td>

<td> invention. Figure 2</td><td> shows</td><td> a diagram</td><td colspan="3"> of a system for activating</td>

a critical function,. for example a firing of munitions, by a robot platform of the air or ground drone type, the system comprising a ground control station 100 and a fleet of platforms consisting of at least one robot platform (here two platforms 200, 300) deployed from the station 100 and linked to the station.

The ground - station 100 comprises a core command and control module 110 and . also a transmission module 120 which, is connected to the core module 110.

Each of the drones 200, 300 comprises a core command and control module 210, 310, a missile system (not shown) which is connected to the core module 210, 310, and also a transmission module 220, 320 which is likewise connected to the core module 210, 310.

The radio link 32 provides the link between the core module 110 of the station 100 and each of the core modules 210, 310 of the drones 200, 300, via the transmission modules 120, 220, 320.

In the same way as in figure 1, the critical elements of the firing chains are shown in dashed lines. The station 100 thus comprises one (or more) activation module (s) 130 for activating the critical function; and each of the drones 200, 300 comprises one (or more) effector module(s) 230, 240, 330.

The activation module 130 makes it possible to generate different critical function activation orders for each of the effector modules 230, 240, ,330, and the aim of the system, is to propagate these orders to the relevant effector module.

Each effector module 230, 240, 330 receives its activation order but does not authorise the performance of the function, which is expected (deemed) to be critical, until it has been authenticated that the order is indeed intended for it.

In the example shown here, and on the order of the ground station, the effector module 230 of the drone 200 can authorise the performance of the function A_1B, the module 240 of the drone 200 can authorise the performance of the function A_2B, and the module 330 of the drone 300 can authorise the performance of the function A_1C.

It will be understood that the desired objective is to make secure the functions A_1B, A_2B, A_1C since the inopportune (i.e. not intentionally commanded) activation thereof would cause great damage.

The propagation of the authorisation orders by the system is not critical since only receipt of the correct order, signed for a specific effector, can authorise this effector module to allow the intended function.

The non-propagation of the authorisation orders is also not critical since, as noted in the preamble, only an inopportune activation of the function is deemed to be undesirable.

The activation module 130 and the effector modules 10 230, 240, 330 are thus formed with the desired level of criticality (therefore relatively high) for the desired level of security of the function. The rest of the system may have a much lower level of criticality, without any effect on the overall security of the function (from the 15 point of view of its inopportune activation).

The activation module 130 comprises means for generating a critical function activation message which is signed, and therefore specific, for each of the possible effector modules. This might involve for example 20 generating a message for activating the function A_1B, this message then being explicitly signed for the effector module 230 of the platform 200.

As indicated, the activation message is signed for a designated effector module. This effectively involves 25 sending a order that has been made secure by using a signature, so as to guarantee that only the activation module 130 is able to generate valid orders for the intended effector, and that only the addressed effector module (the designated module 230 in the example shown here) is able to confirm the validity of these orders, by authenticating these orders as being intended for it, and therefore to be able then to activate the function A_1B.

In order to sign the activation message, a cryptographic signature algorithm is used for example which makes it possible to guarantee mathematically, with a high level of security, the integrity of the information contained in the message and also the authentication of this information.

More specifically, a system comprising a signature key and an authentication key is used respectively by the activation module and each effector module in order to respectively sign and authenticate an activation message, a different signature key/authentication key pair being associated with each activation module/effector module pair.

This signature key/authentication key pair may be defined for a permanent use (for example throughout the whole of a mission), or for a use that is limited with regard to time or for a use that is limited to a certain, number of uses (for example a single use).

According to one preferred embodiment, the selected solution uses a system of asymmetrical keys. A signature key of the private key type is used by the activation module 130׳ to sign the message transmitted by the ground station 100 for a designated effector module. A signature key of the public key type, which is different from the private key, is used in each effector module 230, 240,

330 to validate the authenticity of the message coming from the activation module.

The private key used by the activation module 130 is specific to each effector module to be designated, and the public key used by an effector module may be specific to this effector module (in other words, each effector module then has its own public key) or may be identical for all or some of the effector modules.

There is therefore a different public key/private key pair for each. effector module. This enables each effector module to be rigorously, differentiated.

Furthermore, compromising the public key present in an effector module has no effect on the security of the system since it does not make it possible to generate signatures but only to verify them. In particular, it is understood that, by recovering a drone, a malevolent person would at most be able to obtain the public key(s) or the effector module (s) of this drone. However, this person would not be able to obtain the private key which makes it possible to generate the activation messages.

This preferred embodiment proves to be advantageous since it makes it possible to rigorously differentiate different systems (thus with several activation modules, and other effector modules) in the same theatre of war. This is partially of interest since multiple systems in the presence of one another are always faced with the risk .of interfering with one another, due to operator error; or a technical fault.

It will be understood that, in the context of the invention, the size of the signature keys used is dimensioned in such a way as to avoid the risks of inopportune message errors/distortions in the non-secure intermediate part of the system. The use of cryptographic algorithms according to the prior art makes it possible in particular to guarantee that the generation of a signature in a random manner can be valid only with a largely negligible probability.

The activation of the critical function will be described in greater detail below, in particular . with reference to Figs. 3 and 4 which respectively show one possible embodiment of an activation module 130 and of an effector module 230.

The activation module 130 comprises a memory 131 in which the private key associated with each effector module 230, 240, 330 is stored.

Upon receipt of an order E identifying the effector module that is to perform the critical function (effector module designated by the activation), the memory 131 presents at its output the private key C_P associated with the designated effector module.

The .activation module 130 also comprises a signature module 132 which receives as input an order A to activate (or to deactivate) the function - for example a manual or secure order - for a designated effector module, and the private key ־ C_P associated with this effector module. The signature module 132 then generates a message Ma to activate (or deactivate) the function, signed for the designated effector.

This signed activation message Ma is then conveyed by the system to the designated effector module (for example to the module 230, passing via an interface module 133 for dialoguing with the station, the core module 110 and the transmission module 120 of the station 100, the radio link 32, and the transmission module 220 and the core module 210 of the drone 200).

As shown in figure 4, the effector module 230 comprise means 231 for verifying the signature of the signed message, said means receiving as input the signed activation message Ma and the public key C_pu which it has in a memory 232, these signature verification means 231 making it possible to verify whether the message is indeed intended for said effector module and whether it authorises said effector module to activate the function that it assumes (function A_1B in the case of effector module 230).

In other words, the signature verification means 231 make it possible to authenticate a message received by the effector module 230, thus verifying whether it is a genuine message, effectively signed for this effector module.

The effector module 230 also comprises an interface module 233 for dialoguing with the missile system, which is able to transmit to the latter the result of the signature verification, namely an information item which does or does not authorise it to perform the critical function (triggering of a missile firing operation).

All the effector modules are based on the same model, so that any effector module (in the example, modules 240, 330) other than the designated effector module (module 230) which receives the same message but which is associated with a different private key/public key pair will conclude a false signature and will not trigger the function that it controls (the functions A_2B and A_1C will therefore not be able to be performed).

Furthermore, any transmission error or alteration of the activation messages via the message-carrying chain, or any generation of a message due to a malfunction of the system, will produce a message which will not be recognised by the effector module since it is not correctly signed.

It will be understood that, in order to securely address a plurality of effector modules, it is sufficient to differentiate the keys of these modules by providing a key specific to each module (permanently loaded within each module or loaded by manual preparation before a mission, depending on the desired versatility).

It will be noted that the invention is not limited to the use of an asymmetrical cryptography system, and that it is also possible, particularly if the compromise aspect is deemed not to be critical, to use a symmetrical cryptography system for which the same key is used by the activation module and the designated effector module (this key of course being valid only for one particular activation module/effector module pair).

It has been seen above that, in order to ensure that an effector module is able to act only when the correct order is received, the order transmitted by the activation module is signed using the signature method described above.

Different variant embodiments will be described below.

- In order to ensure at all times that the function is activated only upon receipt of . the order, the activation message is transmitted permanently to the designated effector module, and any break in transmission of the activation message deactivates the critical function after a given delay (fail-safe mode).

- Securing the return of information regarding the status of the function (status of the effector module) can similarly be carried out by the reverse method, with different keys (one signature key, for example a private key, in each effector module), signing of the information (sending of a signed message concerning the status of the effector module), transmission of the signed message by the effector module to the activation module, and authentication of said message by the activation module of the station. Consolidated information about the status of the effector module is thus available on the ground. Its active (or inactive) state can thus be transmitted with a very good level of security, which is also very important for monitoring the system from the ground station.

- It will also be mentioned that, in the context of the invention, the guaranteed level of security can very easily be adapted as a function of the environment encountered, for example by restricting the use of the keys to a single use, a use limited with regard to time, etc.

The invention described above therefore makes it possible to address, securely and independently, several sub-assemblies within a complex system (for example an air drone within a fleet of air drones, a munition within a set of munitions on one or more drones).

The invention also makes it possible for several systems of the same type to be located in the same zone without any risk .of security interference (even in the event of a common frequency), by making specific the signatures of each system and each sub-system.

The invention also offers a high level of security against adverse deception, since simply knowing the public key does not make it possible to activate the functions, and since the pair of keys can be defined for a limited use or even a single use (by then multiplying the keys for each munition, or each drone, or each request for action).

Moreover, it will be understood that the invention is not limited to authorising the activation of the triggering of a missile firing operation, but rather extends more widely to authorising the activation of all functions deemed critical or relevant to security. By way of non-limiting examples, the following will be mentioned:

delivering or authorising the delivery of a munition within a system;

- activating particular items of equipment with potentially hazardous effects for the system or its environment (laser equipment, radar transmissions, lighting of pyrotechnic devices, etc.);

activating/neutralising the security chain for implementing the secure mode of a system: interrupting the flight of an aircraft or missile by activating a chain for recovering, stopping the propulsion, neutralising/destroying in flight, inhibiting the nominal recovery chain, inhibiting a security device such as the transponder;

- activating functions which are essential to the security of operation: redeploying wings, controlling flaps, deploying air brakes.

Of course, the invention also extends to the .different elements of the system taken separately, and in particular to a ground station equipped with an activation module and to a drone equipped with an effector module.