Identity authentication method for inter-satellite networking of low-orbit broadband satellites

Abstract

The invention provides an inter-satellite networking identity authentication method for low-orbit broadband satellites, which comprises three parts, namely a system initialization stage, an inter-satellite networking authentication stage and a session key negotiation stage, in the system initialization stage, the low-orbit broadband satellites interact with a ground key management center to complete registration of identity information; parameters such as a public key matrix, a satellite identity label and an ID certificate are preset in the low-orbit broadband satellites, and in the inter-satellite networking authentication stage, identity authentication is carried out between the low-orbit broadband satellites of adjacent orbits, and in the session key negotiation stage, key negotiation is carried out by using the parameters generated in the authentication process.

Description

Technical Field

[0001] The present invention relates to satellite communications, and in particular to an identity authentication method for low-orbit broadband satellite inter-satellite networking. Background Art

[0002] In the existing low-orbit satellite inter-satellite networking authentication scheme, lightweight networking authentication protocols are often more suitable for communication equipment with relatively limited computing power and resources. However, in the integrated space-ground information network, most methods focus on improving the performance and security of the authentication process, without considering the scenario of satellite addition and replacement. Since the original satellite cannot pre-set the identity key information of the supplementary satellite, it is impossible to use the pre-set key method based on symmetric cryptography to perform inter-satellite identity authentication. In addition, traditional asymmetric cryptography is generally implemented using public key infrastructure, which requires digital certificates to participate in identity authentication and public key binding. The management of digital certificates requires the construction of complex trusted certificates. During the authentication process, online authentication of trusted certificates is required, which brings too much overhead to the identity authentication process.

[0003] Therefore, in view of the uncertainty of launching satellites and the complexity of digital certificate management, the present invention proposes a method for inter-satellite networking identity authentication for low-orbit broadband satellites, which mainly includes three parts: system initialization stage, inter-satellite networking authentication stage, and session key negotiation stage. In the system initialization stage, the low-orbit broadband satellite interacts with the ground key management center to complete the registration of identity information, and presets parameters such as the public key matrix, satellite identity, and ID certificate in the low-orbit broadband satellite. In the inter-satellite networking authentication stage, identity authentication is performed between low-orbit broadband satellites in adjacent orbits. In the session key negotiation stage, key negotiation is performed using the parameters generated during the authentication process. Summary of the invention

[0004] In view of the above problems, the purpose of the present invention is to propose an identity authentication method for inter-satellite networking of low-orbit broadband satellites, reduce the dependence of inter-satellite networking authentication on third parties, and more efficiently perform identity authentication between low-orbit broadband satellites.

[0005] In order to achieve the above object, the technical solution adopted by the present invention is: a method for identity authentication of low-orbit broadband satellite inter-satellite networking, comprising the following steps:

[0006] Step 1: System initialization is performed in the preparation stage before the satellite launch, including the allocation of cryptographic identifiers, derivation of combined keys, and generation and distribution of ID certificates. A combined public key system is used to allocate cryptographic identifiers and generate public-private key pairs for low-orbit broadband satellites. Through a specific mapping algorithm, such as a hash mapping algorithm, the satellite's cryptographic identifier can be mapped into n mapping values. The key management center will generate a public-private key pair for each satellite through the combined principle, generate an ID certificate, and distribute it to satellite nodes through a secure channel;

[0007] Step 2: Intersatellite network authentication is the process of identity authentication between low-orbit broadband satellites. It is also the central link of the integrated space-ground information network access control. The authentication model of the asymmetric cryptographic system based on combined encryption technology establishes communication between two low-orbit broadband satellites A and B, and performs mutual identity authentication, including: A generates a timestamp, a temporary identity, and sends an authentication request to B, B verifies the timestamp; calculates the plaintext, generates the ciphertext, constructs a response data packet resp and sends it to A; A verifies the timestamp; calculates the plaintext, generates the ciphertext, constructs a response data packet resp and sends it to B; B verifies the timestamp and compares the verification function and f N (R 1 ) are consistent, if they are consistent, the identity authentication of A is completed; A verifies the timestamp and compares the verification function and f N (R 2 ) are consistent, if they are consistent, the identity authentication of B is completed;

[0008] Step 3: During the identity authentication process, the two parties negotiate the key. Each satellite presets the system's elliptic curve parameters (a, b, G, n, p), including: A generates a random number R A , calculate the temporary variable T A Send to B; B generates a random number R B , calculate the temporary variable T B Send to A to calculate the negotiated key K; after A receives B's message, it calculates the negotiated key K.

[0009] The step 2 comprises the following steps:

[0010] Step 2.1: The onboard clock generates a timestamp Time based on the current time, and calculates a temporary identity ID based on the generated timestamp Time and the preset identity protection key K temp =f(K,Time,ID A ) is sent to B;

[0011] Step 2.2: After receiving the authentication request, B first verifies whether the timestamp Time meets the freshness requirement, and then extracts A's password ID A , check whether the ID exists in the local database A The corresponding session key is verified to be within the validity period. If the session key corresponding to A exists and is valid, the identity authentication of both parties is successful.

[0012] Step 2.3: B uses the preset public key matrix PKM and A's cryptographic identification ID A , use the mapping algorithm to calculate the public key cpk A , and generate a random number R1 and initialization vector IV, and then use the agreed change f to change the random number R 1 Transform to get Generate timestamp T using the onboard clock B , construct plaintext data msg = IV∥T B ∥R 1 , generate the response ciphertext Constructing ciphertext And the response data packet resp = ID B ∥sign B Send to A;

[0013] Step 2.4: After receiving the resp returned by B, A extracts B's password ID B , based on the preset public key matrix and B's cryptographic ID B , use the mapping algorithm to calculate B's public key cpk B Sign B Decrypt using your own private key csk A Decrypt the response cipher to get the random number R 1 and timestamp T B , verify timestamp T B Whether the freshness verification is met;

[0014] Step 2.5: A changes the random number R according to the pre-set agreed change f 1 Transform to get the verification function f N (R 1 ), used for verification by the other party, and using the random number generator to generate a challenge random number R 2 Generate a validation function The time stamp T is calculated using the onboard clock A , construct plaintext data Calculate the response ciphertext Constructing ciphertext And the response data packet resp = ID A ∥sign A Send to B;

[0015] Step 2.6: B receives the resp from A and first uses its own public key to sign A Decrypt it, and then use your own private key csk B Decrypt the cipher and get the timestamp T A , check function f N (R 1 ), verify whether the timestamp meets the freshness requirement, and check the validation function and f N(R 1 ) are consistent, and the received random number R 2 Perform f transformation;

[0016] Step 2.7: B uses the satellite clock to calculate the current time and generate a timestamp T sat , calculate the plaintext data msg = IV∥T sat ∥f N (R 2 ), using A's public key cpk A Encrypt the plaintext data msg and calculate the response ciphertext Use your own private key csk B Encrypt the response cipher and calculate the ciphertext Construct response data packet resp=ID B ∥sign B ;

[0017] Step 2.8: A receives the plaintext data msg from B and uses B's public key to sign B Decrypt and then use your own private key csk A Decrypt the cipher and get the timestamp T sat , check function f N (R 2 ), verify the timestamp T sat Check whether the freshness requirement is met, check the verification function and f N (R 2 ) are consistent. If they are consistent, the identity authentication is passed, satellite B is recognized as legitimate, and a secure channel is established.

[0018] The step 3 comprises the following steps:

[0019] Step 3.1: A generates a random number R using a random number generator A , using the public parameters G and B's combined public key cpk B Calculate the temporary variable T A =R A ·(G+cpk B ) and send it to B;

[0020] Step 3.2: B generates a random number R using a random number generator B , using the public parameters G and A's combined public key cpk A Calculate the temporary variable T B =R B ·(G+cpk A ), sent to A, and calculate the session key K,

[0021] K=RB ·T A ·(csk B +1) -1 =R B ·R A ·(G+cpk B )·(csk B +1) -1 =R B ·T A ·

[0022] (G+G·csk B )·(csk B +1) -1 =R B R A G;

[0023] Step 3.3: After receiving the message from B, A calculates the session key K.

[0024] K=R A ·T B ·(csk A +1) -1 =R A ·R B ·(G+cpk A )·(csk A +1) -1 =R A ·T B ·

[0025] (G+G·csk A )·(csk A +1) -1 =R A R B G.

[0026] Compared with the prior art, the technical solution disclosed in the present invention has the following technical effects:

[0027] 1. Aiming at the complex challenges of short orbital life, dynamic changes in inter-satellite network topology, and accidental satellite damage, etc., a highly flexible inter-satellite network authentication protocol is designed to ensure that the network can still operate stably in a changing environment;

[0028] 2. Support dynamic addition and rapid replacement of satellites to effectively respond to emergencies such as satellite failure or damage, and ensure network continuity and stability;

[0029] 3. The intersatellite network authentication significantly reduces the dependence on the ground control center, and is not restricted by external conditions such as transmission bandwidth, database, and equipment level. The authentication process is simple and efficient;

[0030] 4. A combined public key cryptographic system is adopted to combine the identification key and the random key to form a complete combined private key, thus realizing the randomization of the key. In addition, its key management mode is to adopt the method of centralized production and distribution, decentralized storage and use, and write the private key of each low-orbit broadband satellite into the corresponding ID certificate, which greatly reduces the management burden of the key center. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 The present invention is a flowchart of the identity authentication method for low-orbit broadband satellite inter-satellite networking.

[0032] Figure 2 The figure is a flow chart of the intersatellite networking authentication phase in the present invention.

[0033] Figure 3 It is a schematic diagram of the key negotiation phase flow in the present invention. DETAILED DESCRIPTION

[0034] The embodiments of the present invention are described in detail below, and examples of the embodiments are given in the accompanying drawings, wherein the same or similar symbols throughout represent the same or similar components or components with the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and cannot be interpreted as limiting the present invention.

[0035] A method for authenticating identity in a low-orbit broadband satellite inter-satellite network according to this embodiment is as follows: Figure 1 As shown, it is divided into the system initialization phase, the inter-satellite network authentication phase and the key negotiation phase.

[0036] System initialization phase

[0037] System initialization is carried out in the preparation stage before the satellite launch. A combined public key system is used to allocate cryptographic identifiers and generate public-private key pairs for low-orbit broadband satellites. Through a specific mapping algorithm, the satellite's cryptographic identifier can be mapped into n mapping values. The key management center will calculate the public-private key pair for each satellite through the combination principle, generate an ID certificate, and distribute it to satellite nodes through a secure channel.

[0038] Intersatellite network certification stage

[0039] The onboard clock generates a timestamp Time, and calculates a temporary identity ID based on the generated timestamp Time and the preset identity protection key K temp =f(K,Time,ID A ) is sent to B;

[0040] After receiving the authentication request, B first verifies whether the timestamp Time meets the freshness requirement. Then it extracts A's password ID A, check whether the ID exists in the local database A The corresponding session key is verified and whether the session key is within the validity period. If the session key corresponding to A exists and is valid, the identity authentication of both parties is successful;

[0041] B is based on the preset public key matrix PKM and A's cryptographic identification ID A , use the mapping algorithm to calculate the public key cpk A , and generate a random number R 1 and initialization vector IV, and then use the agreed change f to change the random number R 1 Transform to get the verification function Generate timestamp T using the onboard clock B , construct plaintext data msg = IV∥T B ∥R 1 , generate the response ciphertext Calculate ciphertext And the response data packet resp = ID B ∥sign B Send to A;

[0042] After receiving the resp returned by B, A extracts B's password ID B , based on the preset public key matrix PKM and B's cryptographic identifier ID B , use the mapping algorithm to calculate B's public key cpk B Sign B Decrypt using your own private key csk A Decrypt the response cipher to get the random number R 1 , timestamp T B , verify whether the timestamp satisfies the validity verification;

[0043] A changes the random number R according to the pre-set agreement 1 Transform to get the verification function f N (R 1 ), used for verification by the other party, and using the random number generator to generate a challenge random number R 2 Generate a validation function The time stamp T is calculated using the onboard clock A , construct plaintext data Calculate the response ciphertext Constructing ciphertext And the response data packet resp = ID A ∥sign A Send to B;

[0044] B receives the response packet resp from A and first uses its own public key to encrypt the ciphertext signA Decrypt it, and then use your own private key csk B Decrypt the response cipher to get the timestamp T A and check function f N (R 1 ), verify the timestamp T A Check whether the validity is met, check the verification function and f N (R 1 ) are consistent, and the received random number R 2 Perform f transformation;

[0045] B uses the satellite clock to calculate the current time and generate a timestamp T sat , calculate the plaintext data msg = IV∥T sat ∥f N (R 2 ), using A's public key cpk A Encrypt msg and calculate the response ciphertext Use your own private key csk B Encrypt the response cipher and calculate the ciphertext Construct response data packet resp=ID B ∥sign B ;

[0046] A receives the plaintext data msg from B and uses B's public key to encrypt the ciphertext sign B Decrypt and then use your own private key csk A Decrypt the response cipher and get the timestamp T sat , check function f N (R 2 ), verify the timestamp T sat Check whether the validity requirements are met, check the verification function and f N (R 2 ) are consistent. If they are consistent, the identity authentication is passed, satellite B is recognized as legitimate, and a secure channel is established.

[0047] Key negotiation phase

[0048] During the authentication process, the two parties negotiate the key, and each satellite presets the system's elliptic curve parameters (a, b, G, n, p);

[0049] A uses a random number generator to generate a random number R A , using the public parameters G and B's combined public key cpk B Calculate the temporary variable T A =RA ·(G+cpk B ) and send it to B;

[0050] B uses the random number generator to generate a random number R B , using the public parameters G and A's combined public key cpk A Calculate the temporary variable T B =R B ·(G+cpk A ), sent to A, and calculate the session key K,

[0051] K=R B ·T A ·(csk B +1) -1 =R B ·R A ·(G+cpk B )·(csk B +1) -1 =R B ·T A ·

[0052] (G+G·csk B )·(csk B +1) -1 =R B R A G;

[0053] After A receives the message from B, it calculates the session key K.

[0054] K=R A ·T B ·(csk A +1) -1 =R A ·R B ·(G+cpk A )·(csk A +1) -1 =R A ·T B ·

[0055] (G+G·csk A )·(csk A +1) -1 =R A R B G;

[0056] A person of ordinary skill in the art can understand that all or part of the steps carried out in the method of the above-mentioned embodiment can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium. When the program is executed, it includes one of the steps of the method embodiment or a combination thereof.

[0057] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for identity authentication in low-orbit broadband satellite inter-satellite networking, characterized in that: The following steps are involved: Step 1: System initialization: System initialization is performed in the preparation phase before satellite launch, including the allocation of cryptographic identifiers, derivation of combined keys, and generation and distribution of ID certificates; Step 2: Inter-satellite network authentication: The process of identity authentication between low-orbit broadband satellites. Based on the authentication model of asymmetric cryptographic system with combined encryption technology, communication is established between two low-orbit broadband satellites A and B, and mutual identity authentication is performed; Specifically: A generates a timestamp, a temporary identity, and sends an authentication request to B, who verifies the timestamp; Calculate the plaintext, generate the ciphertext, construct the response ciphertext resp and send it to A; A check timestamp; Calculate the plaintext, generate the ciphertext, construct the response ciphertext resp and send it to B; B check timestamp, compare check function and f N (R1) Whether they are consistent, if they are consistent, the identity authentication of A is completed; A check timestamp, comparison check function and f N (R2) Whether they are consistent, if they are consistent, the identity authentication of B is completed; Step 3: During the identity authentication process, both parties negotiate a key. Each satellite presets the system's elliptic curve parameters (a, b, G, n, p), including: A generates a random number R A , calculate the temporary variable T A Send to B; B generates a random number R B , calculate the temporary variable T B Send to A to calculate the negotiated key K; after A receives B's message, it calculates the negotiated key K.

2. According to claim 1, a method for identity authentication for low-orbit broadband satellite inter-satellite networking, characterized in that: The step 1 is specifically as follows: A combined public key system is used to allocate cryptographic identifiers for low-orbit broadband satellites. The satellite's cryptographic identifier is mapped into n mapping values ​​through a mapping algorithm. The key management center will calculate the public-private key pair for each satellite through the combination principle, generate an ID certificate, and distribute it to satellite nodes through a secure channel.

3. According to claim 1, a method for identity authentication for low-orbit broadband satellite inter-satellite networking, characterized in that: The step 2 comprises the following steps: Step 2.1: The onboard clock generates a timestamp Time based on the current time, and calculates a temporary identity ID based on the generated timestamp Time and the preset identity protection key K temp =f(K,Time,ID A ) is sent to B; Step 2.2: After receiving the authentication request, B first verifies whether the timestamp Time meets the freshness requirement, and then extracts A's password ID A , check whether the ID exists in the local database A The corresponding session key is verified to be within the validity period. If the session key corresponding to A exists and is valid, the identity authentication of both parties is successful. Step 2.3: B uses the preset public key matrix PKM and A's cryptographic identification ID A , use the mapping algorithm to calculate the public key cpk A , and generate a random number R1 and an initialization vector IV, and then use the agreed change f to transform the random number R1 to obtain Generate timestamp T using the onboard clock B , construct plaintext data msg = IV∥T B ∥R1, generate response ciphertext Constructing ciphertext And the response data packet resp = ID B ∥sign B Send to A; Step 2.4: After receiving the resp returned by B, A extracts B's password ID B , based on the preset public key matrix and B's cryptographic ID B , use the mapping algorithm to calculate B's public key cpk B Sign B Decrypt using your own private key csk A Decrypt the response cipher to obtain the random number R1 and timestamp T B , verify timestamp T B Whether the freshness verification is met; Step 2.5: A transforms the random number R1 according to the pre-set agreed change f to obtain the verification function f N (R1) is used for verification by the other party, and uses the random number generator to generate a challenge random number R2 to generate the verification function The time stamp T is calculated using the onboard clock A , construct plaintext data msg = IV∥T A ∥R2∥ Calculate the response ciphertext Constructing ciphertext And the response data packet resp = ID A ∥sign A Send to B; Step 2.6: B receives the resp from A and first uses its own public key to sign A Decrypt it, and then use your own private key csk B Decrypt the cipher and get the timestamp T A , check function f N (R1), verify whether the timestamp meets the freshness requirement and check the verification function and f N (R1) is consistent, and the received random number R2 is transformed by f; Step 2.7: B uses the satellite clock to calculate the current time and generate a timestamp T sat , calculate the plaintext data msg = IV∥T sat ∥f N (R2), using A's public key cpk A Encrypt the plaintext data msg and calculate the response ciphertext Use your own private key csk B Encrypt the response cipher and calculate the ciphertext Construct response data packet resp=ID B ∥sign B ; Step 2.8: A receives the plaintext data msg from B and uses B's public key to sign B Decrypt and then use your own private key csk A Decrypt the cipher and get the timestamp T sat , check function f N (R2), verify timestamp T sat Check whether the freshness requirement is met, check the verification function and f N (R2) Are they consistent? If they are consistent, the identity authentication is passed, satellite B is recognized as legitimate, and a secure channel is established.

4. The identity authentication method for low-orbit broadband satellite inter-satellite networking according to claim 1 is characterized in that: The step 3 comprises the following steps: Step 3.1: A generates a random number R using a random number generator A , using the public parameters G and B's combined public key cpk B Calculate the temporary variable T A =R A ·(G+cpk B ) and send it to B; Step 3.2: B generates a random number R using a random number generator B , using the public parameters G and A's combined public key cpk A Calculate the temporary variable T B =R B ·(G+cpk A ), sent to A, and calculate the session key K, K=R B ·T A ·(csk B +1) -1 =R B ·R A ·(G+cpk B )·(csk B +1) -1 =R B ·T A · (G+G·csk B )·(csk B +1) -1 =R B R A G; Step 3.3: After receiving the message from B, A calculates the session key K. K=R A ·T B ·(csk A +1) -1 =R A ·R B ·(G+cpk A )·(csk A +1) -1 =R A ·T B · (G+G·csk A )·(csk A +1) -1 =R A R B G。

Images