DE102021001294B3 - Methods for the adaptive protection of airborne weapon systems - Google Patents

Abstract

A method for the adaptive protection of weapon systems, in particular airborne weapon systems, which are at least partially left behind in an area of operation, includes presetting a protection level for at least one system component of the weapon system for a planned use of the weapon system in the area of operation, with the protection level specifying protection measures which are a control device of the system component are to be carried out independently if the system component of the weapon system remains in the area of operation; determining by the controller of the system component that at least the system component remains in the deployment area; and execution of the safeguarding measures by the control device of the system component.

Description

The present invention relates to a method for adaptive protection of airborne weapon systems and an airborne weapon system with a manipulation protection system.

When using airborne weapon systems, missiles, drones and/or unmanned aerial vehicles (UAV), the respective device or components dropped from it can be recovered after use and/or after incidents, with the aim of high-value components (e.g. seekers, sensors ) to recover and reuse and/or read out data obtained during the respective mission. On the one hand, unauthorized persons should be prevented from gaining possession of the system, for example in order to read out confidential data or to gain insights into the respective system through reverse engineering. On the other hand, it should be possible for authorized persons to safely recover the system components, e.g. in the event that parts of the weapon system land on foreign territory.

The publication US 2017 / 0 270 314 A1 describes the implementation of data backups using an unmanned aerial vehicle, e.g. a drone. Depending on a defined privacy policy, the drone can destroy the user data if an unauthorized user tries to gain access to the user data, e.g. if the drone is damaged or intercepted.

The pamphlet US 2004/0 193 334 A1 describes the remote control of a military unmanned aerial vehicle from a control station using a wireless command link.

Document US 2014/0 020 123 A1 describes an always available embedded subsystem for theft prevention.

Against this background, the object of the present invention is to find solutions for protecting reusable weapon system parts.

According to the invention, this object is achieved by a method having the features of patent claim 1 and by an airborne weapon system having the features of patent claim 8.

Accordingly, a method is provided for the adaptive protection of airborne weapon systems, which are at least partially left behind in an area of operation. The method includes presetting a protection level for at least one system component of the weapon system for a planned use of the weapon system in the area of operation, the protection level specifying safeguarding measures which are to be carried out independently by a control device of the system component if the system component of the weapon system remains in the area of operation; determining by the controller of the system component that at least the system component remains in the deployment area; and execution of the safeguarding measures by the control device of the system component.

Furthermore, an airborne weapon system is provided with a manipulation protection system for adaptive protection of the weapon system in the event that at least parts of it remain behind in an area of operation. The manipulation protection system comprises a control device which is designed to store a preset protection level for at least one system component of the weapon system for a planned use of the weapon system in the area of operation, the control device also being designed to determine if at least the system component remains in the area of operation, and in this case, independently carry out security measures corresponding to the preset protection level.

One of the ideas on which the present invention is based is to define a protection level together with associated security measures for a weapon system, which are then carried out by the weapon system or at least one component of the weapon system if it is left behind during or after an operation. For example, a drone or another unmanned aerial vehicle, a missile or another airborne, i.e. airworthy, weapon system can be landed in a controlled manner in a designated area (comparable to a bomb disposal area) after use. Likewise, one or more system components of the weapon system can be dropped into this area in flight. In addition, there may be an unforeseen and/or uncontrolled decline of the system component(s) and/or the entire weapon system in the area (e.g. crash, launch, system failure, etc.).

The present approach to securing weapon systems should now enable high-quality system components to be reused and sensitive data obtained or recovered in the course of a mission to be recovered. The invention can equally be used when the entire weapon system remains behind or only components have to be salvaged. With the before On the one hand, appropriate countermeasures can be taken to prevent hostile forces from taking possession of the system, for example to read out confidential data or to try to evaluate properties of the system via reverse engineering. On the other hand, the invention enables one's forces to carry out a safe recovery. The level of protection and the security measures associated therewith can advantageously be selected and, if necessary, adjusted according to the respective weapon systems, mission objectives and/or mission conditions.

The protection level defines, among other things, which measures are automatically triggered by the system if it stays behind in the operational area. Here, measures can be triggered, for example, immediately or after a specific time window, as soon as it is clear that the system is lagging or will lag behind in the operational area. On the other hand, control sequences can be set up that specify when and how the system has to react after remaining in the operational area. Furthermore, it can be specified which configuration the system assumes under these circumstances, e.g. a selection of certain parameter sets for a security system of the weapon system, encryption and/or authentication specifications, etc.

The system can be designed in such a way that parts that are to be recovered can also survive a hard landing or a crash. Accordingly, the system components can be provided with an appropriate physical robustness. On the one hand, this allows high-quality components to be used again, but also sensitive data and information that was obtained during the mission and could not yet be transmitted via a communication connection or a data connection to be read out.

An area of use within the meaning of the invention covers any type of spatial area in which at least system components of the weapon system can remain and are to be at least secured there, possibly even salvaged. For example, this can be a spatially restricted area that is released for the actual use (e.g. flight) of the weapon system (single sortie). For example, in the case of an aircraft, it can be an area within which a pilot may remotely control the aircraft (e.g. a drone), or within which the aircraft can independently select and optimize flight paths. However, areas of use within the meaning of the invention are not limited to these examples, but can also include more extensive spatial areas. For example, in a more general sense, this can be a general operational area, e.g. of armed forces, or the entire enemy territory, whereby self-controlled areas can also fall into the operational area as well as unsafe areas or territories with an unclear situation.

Advantageous refinements and developments result from the further dependent claims and from the description with reference to the figures.

According to one development, the system can also include an operating device for operating the system component by an operator and/or a data memory. The security measures can include activation of multi-factor authentication for access to the operating device of the system component and/or data encryption of the data memory of the system component.

For example, strong multi-factor authentication, e.g. B. authentication token + code used to secure the system component or the entire weapon system against unauthorized access. Alternatively or additionally, data stored by the system or the system component can be encrypted in an automated manner, e.g. immediately after the system component has been dropped and/or landed in the operational area. In principle, any sufficiently secure encryption approach can be used for this purpose, e.g. B. according to the Advanced Encryption Standard such as symmetric AES-256 encryption.

In addition, it can be provided that the protection level and/or associated security measures are adjusted if the authentication is successful. For example, security measures provided in addition to the authentication can be blocked as soon as a positive authentication has taken place.

In a specific example, it can be specified as a security measure that an external movement of the system component or the system is evaluated as an attempt at manipulation. However, in order to recover the system component or system, it must be moved. For this reason, an authentication can be specified which blocks the assessment of the foreign movement, ie when salvaging, the specified authentication on the system must first be carried out, e.g. B. a token can be carried out. If the authentication is successful, the detection of motion as Manipula attempt is blocked and the system (or the system component) can be transported.

According to one development, the control device can be designed to detect an unauthorized attempt to access the system component and to adjust the protection level and/or to carry out associated security measures when an unauthorized access attempt is detected. Accordingly, the method can include detecting an unauthorized access attempt to the system component by the control device of the system component and adjusting the protection level and/or executing an associated security measure when an unauthorized access attempt is detected.

For example, failed authentication can be detected on an operating device of the weapon system. An automated and scalable system reaction to this manipulation detection can then be triggered. For example, only a limited number of failed authentications may be allowed before the system e.g. locks down or self-destructs. Likewise, further access attempts can be delayed exponentially or confidential data can be encrypted and/or deleted.

It goes without saying that not only a failed authentication on an operating device (i.e. a system login) can be evaluated as an unauthorized access attempt, but also other types of manipulation attempts can be taken into account and detected, for example manipulation attempts on a housing, loosening of seals or the attempt to manipulate the protective device yourself.

According to one development, the control device can be designed to carry out at least one of the following security measures: increased delay in time of possible access to the system component after an unauthorized access attempt; blocking possible access to the system component; Deletion and/or irreversible encryption of at least sensitive data on a data memory of the system component; data storage self-destruct; self-destruct of the system component; and ignite an active charge of the system component.

These measures may be tailored to the relevant weapon system and system component, as well as mission objectives and mission conditions, to prevent enemy forces from spying and/or reconstructing the system's capabilities.

In a specific example, it can already be determined during mission planning that a return to an area under self-control is not possible or not desired. After the mission has been carried out or if the mission is aborted, the weapon system or at least one information technology-sensitive or security-relevant component (eg by activating a warhead, an explosive charge, etc.) can self-destruct. At the same time, a physical destruction mechanism for a memory controller and/or for high-value components can be triggered to ensure the destruction of these components regardless of the effectiveness of the weapon system's self-destruct mechanism, thus making component recycling, data access and reverse engineering impossible close.

According to one development, the control device can be designed to carry out the security measures as a function of a number of detected unauthorized attempts to access the system component.

For example, after a failed access attempt, further access (e.g. via an operating device) can be denied for a specified period of time. In the event of another incorrect entry, this period can be further extended or access can be completely blocked. As a further escalation level, relevant data can be deleted or the underlying data storage device can be physically destroyed. In principle, provision can even be made for the system component and/or the entire weapon system to be physically destroyed or at least rendered unusable, for example by automatically detonating one or more explosive charges.

Furthermore, it can be provided that the system or the system component should act as part of its mission with an active charge against a target, e.g. a ground target at the landing site. When this active charge is ignited, the system can self-destruct, which simultaneously prevents critical data and/or technical know-how from getting into the hands of unauthorized persons.

It goes without saying that the control device can also be designed to carry out the security measures depending on and/or based on the type and scope of a detected unauthorized attempt to access the system component.

According to one development, the control device can be designed to carry out the safeguarding measures depending on whether the system component remains within a recovery area in the operational area from which the system component is to be recovered.

For example, when the system lands outside of such a recovery area, it can be provided that the system automatically destroys itself and access is thus made impossible from the outset. If, on the other hand, the system lands in the recovery area, the associated protection level can provide that at least several access attempts are permitted before the system destroys itself.

According to one development, the control device can be designed to determine whether the system component remains within an externally controlled area in the area of use.

For example, a higher level of protection with correspondingly associated security measures can be provided in an externally controlled area than in an internally controlled area. For example, in the event of an airborne platform failure in a foreign-controlled area, a single failed attempt to access the system may trigger self-destruct, while multiple failed accesses are permitted in a friendly-controlled area.

According to the invention, the control device is designed to adapt the protection level during use based on a current position of the system component within the area of use. In this case, the position is determined based on navigation data from the weapon system and/or an external position determination system.

In addition to the protection level preset with the mission planning, the adaptive manipulation protection mechanism also has a configurable position-based automated adjustment. In this way, the system can react in a particularly advantageous manner to specific developments during an operation and independently adapt the protection level or the safeguarding measures. On the one hand, navigation data from the weapon system can be used for this purpose. On the other hand, further available navigation and/or position data can be used, e.g. from a global navigation satellite system (e.g. GPS or GLONASS). For example, a target area, a recovery area, a foreign-controlled area, a front line, etc. can be specified during mission planning. For example, at the time of dropping, the system or the system component can then increase or decrease its position and the protection level based thereon, or initiate suitable measures.

It goes without saying here that an adjustment of the protection level can alternatively or additionally also be initiated by an external device, which is connected to a communication device of the weapon system via a wireless communication link, for example, and commands the weapon device via this. For example, a command post can initiate an adjustment during the mission. This can happen, for example, during a replanning if a mission goal and possibly also an operational area are changed during the ongoing operation.

The above configurations and developments can be combined with one another as desired, insofar as this makes sense. Further possible configurations, developments and implementations of the invention also include combinations of features of the invention described above or below with regard to the exemplary embodiments that are not explicitly mentioned. In particular, the person skilled in the art will also add individual aspects as improvements or additions to the respective basic form of the present invention.

• 1 schematische Seitenansicht eines luftgestützten Waffensystems gemäß einer Ausführungsform der Erfindung;
• 2 schematische Ansicht eines Einsatzgebietes des Waffensystems aus 1; und
• 3 schematisches Ablaufdiagramm eines Verfahrens zur adaptiven Absicherung des Waffensystems aus 1.

The present invention is explained in more detail below with reference to the exemplary embodiments given in the schematic figures. They show:

• 1 schematic side view of an airborne weapon system according to an embodiment of the invention;
• 2 schematic view of an area of application of the weapon system 1 ; and
• 3 schematic flowchart of a method for adaptive protection of the weapon system 1 .

The accompanying figures are intended to provide a further understanding of embodiments of the invention. They illustrate embodiments and, together with the description, serve to explain principles and concepts of the invention. Other embodiments and many of the foregoing advantages will become apparent by reference to the drawings. The elements of the drawings are not necessarily shown to scale with respect to one another.

In the figures of the drawing there are identical, functionally identical and identically acting elements, features and components - unless otherwise stated is carried out - each provided with the same reference numerals.

1 shows a schematic side view of an airborne weapon system 1 according to an embodiment of the invention.

In the specific exemplary embodiment, the airborne weapon system 1 is a drone. For example, this can be a small drone, a reconnaissance drone, an unmanned military reconnaissance aircraft, an escort aircraft (e.g. a Remote Carrier of the Future Combat Air System, FCAS) and/or a combat drone or the like. In principle, the drone 1 can be used for completely different purposes, such as military operations, including airborne reconnaissance and air surveillance, as well as tactical attack operations.

The drone 1 is equipped with a manipulation protection system for adaptive protection in the event that the drone 1 or parts of it remain in an area of operation 4, at least in part. 4 shows an example of such an application 2 the use of drone 1 over a rural area with several small towns.

The drone 1 can have the system components known to those skilled in the art, such as drives, weapon systems, sensor systems (radar, optical, infrared, laser-based, GPS, etc.), control systems (e.g. for active attitude and position control), navigation instruments and communication systems. Examples are in 1 a sensor device 10 and a communication device 11.

The drone 1 has a head in 1 characterized as a system component 2, in which, among other things, a control device 3 for controlling the drone 1 and in particular the manipulation protection system is embedded. Further safety-sensitive technology of the drone 1 can also be accommodated in the system component 2 . Examples are in 1 an operating device 5 and a data memory 6 marked. For example, reconnaissance data and other mission information obtained from the drone 1 in the course of an operation can be stored on the data memory. As far as possible, this data can already be communicated to a command post and/or an operator during the operation by means of the communication device 11 .

However, the particular circumstances of the operation and/or a mission objective of the drone 1 can provide that it remains completely or at least in components in the operational area 4, either because a malfunction and/or a downing caused the drone 1 to crash occurs, either because the drone 1 is brought to the ground in a controlled manner and/or components are dropped in a controlled manner in the hope that they can be recovered later.

For example, the head as system component 2 of the drone 1 in 1 be intended to be dropped in a designated area, e.g. in the event of a malfunction of the drone 1 and/or in the event that it becomes unfit to fly, in order to avoid as far as possible that it is discovered by enemy forces and thereby possibly sensitive data or technology can be spied on.

In the example of 2 For example, the operational area 4 is divided into several partially overlapping areas: an internally controlled area 7, an externally controlled area 9 and a rescue area 8, which is partly in the internally controlled area 7 and the externally controlled area 9. Depending on which of these areas the drone 1 or at least the system component 2 lands in, different measures can be provided to protect the technology and the data of the drone against unauthorized access.

For this purpose, the control device 3 is designed to store a preset protection level at least for the system component 2 of the weapon system 1 for a planned use of the weapon system 1 in the area of use 4 . The control device 3 is also designed to determine if at least the system component 2 remains in the deployment area 4 and, in this case, to independently carry out security measures corresponding to the preset protection level.

Different measures and precautions can be combined here as part of a protection level definition in order to prevent the most comprehensive possible protection against the removal and manipulation of data and technical know-how by unauthorized persons, tailored to the respective mission and the respective weapon system.

In principle, the weapon system 1 or at least the system component 2 can be designed with a suitable physical robustness so that the storage of the data and the reusability of parts is ensured even after high accelerations (g forces on impact) and temperatures. For example, a housing that is particularly resistant to deformation be provided for the system component 2 or at least the data memory 6, so that it can withstand high loads. For rapid localization, the system component 2 or the weapon system 1 can also include one or more direction-finding transmitters, which allow location even under adverse conditions.

In principle, the weapon system 1 can meet the tamper-proof requirements of “tamperproof” and/or “anti-tamper” (AT) weapon systems for this purpose. Tamper security refers to the approach of preventing, deterring and/or detecting unauthorized access to a device or circumvention of a security system ("tamper resistance, tamper detection, tamper response, tamper evidence", i.e. tamper resistance, tamper detection, tamper reaction and tamper evidence) . AT's mission is to prevent (or delay) reverse engineering of critical military technology, critical program information and/or critical data in order to complicate technology transfer and modification of system characteristics and prevent the development of countermeasures.

For example, the system component 2 can be designed with a tamper-proof film. For example, at least certain sensitive electronic parts of the system (e.g. a memory board) can be wrapped and/or covered with such a film. The film can, for example, have an electrically conductive grid structure which makes it possible for stored data to be decrypted only if the film is completely intact. If the grid is damaged during operation, this can automatically initiate the deletion of critical information such as cryptographic keys.

• - Aktivieren einer Multi-Faktor-Authentisierung für den Zugriff auf die Bedieneinrichtung 5 der Systemkomponente 2,
• - Datenverschlüsselung es Datenspeichers 6 der Systemkomponente 2,
• - zeitlich gesteigertes Verzögern von möglichen Zugriffen auf die Systemkomponente 2 nach einem unbefugten Zugriffsversuch,
• - Sperren eines möglichen Zugriffs auf die Systemkomponente 2,
• - Löschen und/oder irreversible Verschlüsselung zumindest sensibler Daten auf einem Datenspeicher 6 der Systemkomponente 2,
• - Selbstzerstören des Datenspeichers 6,
• - Selbstzerstören der Systemkomponente 2, und
• - Zünden einer Wirkladung (nicht abgebildet) der Systemkomponente 2.

The security measures for the corresponding protection level of the present system 1 can include, among other things:

• - Activation of a multi-factor authentication for access to the operating device 5 of the system component 2,
• - data encryption of the data memory 6 of the system component 2,
• - Increased time delay of possible access to system component 2 after an unauthorized access attempt,
• - blocking possible access to system component 2,
• - Deletion and/or irreversible encryption of at least sensitive data on a data memory 6 of the system component 2,
• - Datastore 6 self-destruct,
• - self-destruct of system component 2, and
• - Ignition of an active charge (not shown) of the system component 2.

For this purpose, the control device 3 can also be designed to detect an unauthorized attempt to access the system component 2 and, if necessary, to adjust the protection level if an unauthorized attempt to access is detected. As an alternative or in addition, the control device 3 can also carry out corresponding safety measures as a reaction. In this case, the security measures can be carried out as a function of a number of detected unauthorized access attempts to the system component 2 .

In addition to a presetting of the protection level that can be selected during mission planning, this protection against manipulation can also have an optional, configurable, position-based automated adjustment, e.g. by combining it with a GNSS (e.g. GPS or GLONASS) or based on the navigation data of the weapon system 1. The system Based on this, 1 can also independently adjust the protection level during the operation depending on a current position, e.g. a drop position. At the time of release, the system 1 determines its position and can increase or decrease the level of protection based on this.

Furthermore, the level of protection and the measures to be taken can be made dependent on the area in which the system component 2 is dropped or where the system 1 hits the ground. The control device 3 can therefore be designed to carry out the security measures depending on whether the system component 2 remains within a recovery area 8 in the operational area 4 from which the system component 2 is to be recovered and/or whether the system component 2 is within an externally controlled area 9 in the operational area 4 remains.

Below are some small example scenarios with reference to 2 described, which should clarify the different measures of the system 1.

Scenario 1: Rescue in self-controlled area 7 according to plan

The system component 2 (corresponding to the case of a landing of the whole system 1) is in the self-controlled area 7 (dashed line in 2 ) in a salvage area 8 (dotted line in 2 ) crashed and/or landed or jettisoned (position P1 in 2 ). Sensitive data is now encrypted as the first measure at the time of the drop. A default setting for the protection level was made in the mission planning, which takes into account that own forces are likely to reach component 2 first. A subsequent adjustment of the protection level by the system 1 is not necessary.

Own forces reach system component 2 first. System component 2 survived the crash or landing to a sufficient degree so that parts can be reused. The own forces are in possession of the authentication key (token) and know the right code to deactivate the tamper protection. After entering the wrong code once, the time for a repeated entry is delayed. The code is entered correctly on the next attempt and the tamper protection is deactivated. High-value components can be successfully recovered and important operational data can be read out.

Scenario 2: Rescue in self-controlled area 7 initially by unauthorized personnel

The system component 2 is brought down and/or landed or dropped in the self-controlled area 7 in the recovery area 8 (position P1). Sensitive data is now encrypted as a first measure at the time of the drop. A default setting for the protection level was made in the mission planning, which takes into account that own forces are likely to reach component 2 first. A subsequent adjustment of the protection level by the system 1 is not necessary.

However, neutral unauthorized forces reach the system first. System component 2 survived the crash or landing to a sufficient degree so that parts can be reused. Since the forces are not in possession of the authentication token, they try to gain access to system component 2 by force, thereby triggering a security measure: Due to the concrete presetting of the protection level, access to the confidential data is only blocked.

Shortly thereafter, own forces reach system component 2 and claim it. They can then salvage the still functional high-value components for reuse and unlock locked access to the data.

Scenario 3: Rescue in the foreign-controlled area 9 by enemy forces

In the mission planning, it is already determined that the system 1 or the system component 2 may not be able to land or crash in the self-controlled area 7 and a corresponding presetting for the protection level is made. However, it is assumed that the system component 2 is to be salvaged, i.e. this is to be in the salvage area 8 within the externally controlled area 9 (dash-dotted line in 2 ) lands (position P2).

The data is encrypted at the time of the crash or drop. System component 2 then actually falls on enemy territory. The control device 3 increases the protection level adaptively. The enemy forces do not have the authentication token and therefore cannot disable the tamper protection. They try to avoid him and thereby trigger him.

Due to the concrete default, the confidential data is immediately deleted (or alternatively irreversibly encrypted with a random key) and the storage controller is physically destroyed. In a second step, the high-value components are also destroyed in such a way that enemy use becomes impossible and reverse engineering cannot be carried out either.

Scenario 4: Rescue in the externally controlled area 9 by own forces

In the mission planning, it is already determined that the system 1 or the system component 2 may not be able to land or crash in the self-controlled area 7 and a corresponding presetting for the protection level is made. However, it is assumed that the system component 2 is to be recovered, i.e. it lands in the recovery area 8 within the externally controlled area 9 (position P2).

The data is encrypted at the time of the crash or drop. System component 2 then actually falls on enemy territory. The control device 3 increases the protection level adaptively. Although the system component 2 is in foreign territory, it can be rescued by its own forces. The own forces are in possession of the authentication key (token) and know the right code to deactivate the tamper protection. The code is entered correctly and the tamper protection is deactivated. The high quality components can successfully recovered and important operational data read out.

Scenario 5: Descending in the externally controlled area 9 without salvage

In the mission planning it is already determined that a return to the self-controlled area is not possible or not desired and that a rescue is accordingly out of the question (position P3 in the externally controlled area 9 outside the rescue area 8). A corresponding default for the protection level is selected.

After completing the mission or aborting the mission, z. B. simultaneously with the weapon system self-destruct (e.g. by activating a warhead, an explosive device or similar), physical destruction mechanisms for the memory controller and the high-value components are triggered in order to ensure the destruction of these components regardless of the effectiveness of the self-destruct mechanism of the weapon system and thus a make component recycling, data access and reverse engineering impossible.

Scenario 6: Descend in the foreign controlled area 9 and with ground effect

In the mission planning it is already determined that the system 1 should act against a ground target as the last component of its mission (position P3). Therefore, a default setting has already been made for the protection level, which includes the ignition of an active charge. For example, a modular active charge can be brought in to engage the enemy upon completion of the mission.

After the end of the mission, system component 2 self-destructs at the same time as an active charge in the target. Recycling components, accessing data and reverse engineering becomes impossible.

3 summarizes a corresponding method M as a flowchart. The method M includes, under M1, presetting the protection level for at least one system component 2 of the weapon system 1 for a planned use of the weapon system 1 in the operational area 4. The method M also includes, under M2, determination by the control device 3 that at least the system component 2 in the Operational area 4 remains. The method M also includes under M3 execution of the security measures by the control device 3 of the system component 2. The method M also includes under M4 detecting an unauthorized access attempt to the system component 2. The method M also includes under M5 adjusting the protection level and / or executing an associated Safeguard measure when an unauthorized access attempt is detected. The method M also includes, under M6, adjusting the protection level during use by the control device 3 based on a current position of the system component 2 within the area of use 4, the position being determined based on navigation data from the weapon system 1 and/or an external position determination system.

In the foregoing Detailed Description, various features have been grouped together in one or more examples to improve the rigor of presentation. However, it should be understood that the above description is merely illustrative and in no way restrictive. It is intended to cover all alternatives, modifications, and equivalents of the various features and embodiments. Many other examples will be immediately and immediately apparent to those skilled in the art in view of the above description.

The exemplary embodiments were selected and described in order to be able to present the principles on which the invention is based and its possible applications in practice in the best possible way. This enables those skilled in the art to optimally modify and use the invention and its various exemplary embodiments in relation to the intended application. In the claims and the description, the terms “including” and “having” are used as neutral terms for the corresponding terms “comprising”. Furthermore, the use of the terms “a”, “an” and “an” should not fundamentally exclude a plurality of features and components described in this way.

Reference List

1

weapon system

2

system component

3

control device

4

operation area

5

operating device

6

data storage

7

self-controlled area

8th

recovery area

9

foreign controlled area

10

sensor device

11

communication facility

M

procedure

M1-M6

process steps

P1-P3

landing positions

Claims (14)

Method (M) for the adaptive protection of airborne weapon systems (1) which remain at least partially behind in an area of operation (4), the method (M) comprising: Presetting (M1) a protection level for at least one system component (2) of the weapon system (1) for a planned use of the weapon system (1) in the operational area (4), the protection level specifying security measures which are controlled by a control device (3) of the system component ( 2) are to be carried out independently if the system component (2) of the weapon system (1) remains in the area of operation (4); Determination (M2) by the control device (3) of the system component (2), that at least the system component (2) remains in the area of use (4); Execution (M3) of the safeguarding measures by the control device (3) of the system component (2); and Adaptation (M6) of the protection level during use by the control device (3) based on a current position of the system component (2) within the area of use (4), the position being determined based on navigation data from the weapon system (1) and/or an external position determination system becomes. Procedure (M) according to claim 1 , wherein the security measures include activation of a multi-factor authentication for access to an operating device (5) of the system component (2) and / or data encryption of a data memory (6) of the system component (2). Procedure (M) according to claim 2 , whereby the protection level and/or the security measures are adjusted in the event of successful authentication. Process (M) according to any one of Claims 1 until 3 , furthermore with: detection (M4) of an unauthorized attempt to access the system component (2) by the control device (3) of the system component (2); and adjusting (M5) the protection level and/or performing an associated security measure when an unauthorized access attempt is detected. Process (M) according to any one of Claims 1 until 4 , wherein at least one of the following security measures is carried out: temporally increased delay of possible accesses to the system component (2) after an unauthorized access attempt; blocking possible access to the system component (2); Deletion and/or irreversible encryption of at least sensitive data on a data memory (6) of the system component (2); self-destructing of the data memory (6); self-destruct of the system component (2); and igniting an active charge of the system component (2). Process (M) according to any one of Claims 1 until 5 , The security measures depending on a number of detected unauthorized access attempts and / or based on the type and scope of a detected attempt to access the system component (2) are performed. Process (M) according to any one of Claims 1 until 6 , the safeguarding measures being carried out depending on whether the system component (2) remains within a salvage area (8) in the operational area (4) from which the system component (2) is to be salvaged, and/or whether the system component (2) within an externally controlled area (9) in the operational area (4). Airborne weapon system (1) with a manipulation protection system for adaptive protection of the weapon system (1) in the event that at least parts of it remain behind in an area of operation (4), comprising: a control device (3) which is designed to store a preset protection level for at least one system component (2) of the weapon system (1) for a planned use of the weapon system (1) in the operational area (4), the control device (3) also is designed to determine if at least the system component (2) remains in the deployment area (4) and in that case to independently carry out security measures corresponding to the preset protection level, wherein the control device (3) is designed to adjust the protection level during the mission based on a current position of the system component (2) within the mission area (4), the position being based on navigation data from the weapon system (1) and/or an external position determination system is detected. Weapon system (1) after claim 8 , further comprising: an operating device (5) for operating the system component (2) by an operator; and/or a data memory (6); wherein the security measures include activation of multi-factor authentication for the Include access to the operating device (5) of the system component (2) and / or data encryption of the data memory (6) of the system component (2). Weapon system (1) after claim 9 , wherein the control device (3) is designed to adapt the protection level and/or the security measures in the event of successful authentication. Weapon system (1) according to one of Claims 8 until 10 , wherein the control device (3) is designed to detect an unauthorized attempt to access the system component (2) and to adapt the protection level and/or to carry out associated security measures when an unauthorized access attempt is detected. Weapon system (1) according to one of Claims 8 until 11 , wherein the control device (3) is designed to carry out at least one of the following security measures: temporally increased delay of possible accesses to the system component (2) after an unauthorized access attempt; blocking possible access to the system component (2); Deletion and/or irreversible encryption of at least sensitive data on a data memory (6) of the system component (2); self-destructing of the data memory (6); self-destruct of the system component (2); and igniting an active charge of the system component (2). Weapon system (1) according to one of Claims 8 until 12 , wherein the control device (3) is designed to carry out the security measures depending on a number of detected unauthorized access attempts and / or based on the type and scope of a detected unauthorized attempt to access the system component (2). Weapon system (1) according to one of Claims 8 until 13 , wherein the control device (3) is designed to carry out the safeguarding measures depending on whether the system component (2) remains within a recovery area (8) in the operational area (4) from which the system component (2) is to be recovered, and /or whether the system component (2) remains within an externally controlled area (9) in the operational area (4).

Images