Identity authentication networking method between low earth orbit satellite and ground control center

Abstract

The invention provides an identity authentication networking method between a low earth orbit satellite and a ground control center. The method mainly comprises three parts of system initialization, networking authentication and key switching. In a system initialization process, a low-orbit broadband satellite can interact with a node of a ground control center through a secure channel to complete registration of identity information, and a secret key is preset between the satellite and a satellite networking authentication system; in the satellite-ground networking authentication stage, the low-orbit broadband satellite and the satellite networking authentication system perform identity authentication through preset key information. In the key switching process, a strict switching time sequence process is designed to provide guarantee for key switching.

Description

Technical Field

[0001] The present invention relates to the field of low-orbit satellite communications, and in particular to an identity authentication networking method between a low-orbit satellite and a ground control center. Background Art

[0002] The low-orbit satellite network is networked by launching a certain scale of low-orbit satellites to build a space communication system with real-time signal processing capabilities, which can provide access and other communication services to ground and air terminals. However, since satellites operate in an open outer space environment, the physical distance between satellites and between satellites and the ground is far, and the communication links are highly open, which makes the low-orbit broadband satellite network extremely vulnerable to various network attacks and security threats.

[0003] Due to the high openness of satellite-to-ground and intersatellite links, attackers can easily monitor and intercept conversation data between satellites and ground control centers. This may not only lead to the leakage of sensitive information, but also enable attackers to obtain satellite node operation information and confidential data through replay attacks, man-in-the-middle attacks or entity impersonation, thereby damaging the entire satellite network.

[0004] The present invention proposes an identity authentication networking method suitable for low-orbit satellites and ground control centers. The method realizes two-way authentication between low-orbit broadband satellites and ground control centers through a pre-shared key based on a symmetric cryptographic mechanism, and adopts a challenge-response method to ensure the security and efficiency of the authentication process. At the same time, the present invention also proposes a key switching scheme, which provides a strong guarantee for key switching through a strict switching timing process, ensuring the continuous and stable operation of the low-orbit satellite network. Compared with the prior art, the present method can realize an efficient identity authentication process while ensuring security, and has strong autonomy and flexibility to cope with potential risks such as single point failures. Summary of the invention

[0005] In view of the above problems, the purpose of the present invention is to propose a 5G-AKA improved protocol access authentication method that is resistant to link attacks, uses random number dynamic filling technology to ensure the length consistency of user identities during transmission, and resists link attacks based on identity length differences.

[0006] In order to achieve the above object, the technical solution adopted by the present invention is: an identity authentication networking method between a low-orbit satellite and a ground control center, comprising the following steps:

[0007] Step 1: Initialize the system before the satellite is launched, preset the key between the ground-based node and the low-orbit broadband satellite, and generate and distribute the relevant information required in the authentication process;

[0008] Step 2: Satellite-ground networking authentication: The low-orbit broadband satellite obtains the timestamp, calculates the temporary identity and sends it to the ground gateway station. The ground gateway station encrypts it twice and sends it to the satellite networking authentication system. The satellite networking authentication system verifies the legitimacy of the temporary identity. The ground gateway station encrypts the data and sends it to the low-orbit broadband satellite. The low-orbit broadband satellite verifies the freshness and legitimacy of the authentication data. The ground gateway station encrypts the data and sends it to the satellite networking authentication system. The satellite networking authentication simulation system compares RES and XRES to determine whether the authentication is passed;

[0009] Step 3: Set the flag Tag to indicate the key encryption status of the data packet.

[0010] As a preferred embodiment of the present invention, the relevant information in step 1 includes: the identity information ID of the low-orbit broadband satellite sat , encryption key DK enc , Authentication key DK auth , Pre-made work encryption key Work enc and the anonymous identity key K.

[0011] As a preferred embodiment of the present invention, the satellite-to-ground networking authentication in step 2 specifically includes the following steps:

[0012] Step 2.1: The low-orbit broadband satellite uses the onboard clock to obtain the current time, calculate the timestamp T, and calculate the temporary identity ID based on the obtained timestamp T and the preset identity protection key K corresponding to the ground satellite networking authentication system. temp =f(K,T∥ID sat ) is used for this network authentication and then sent to the ground gateway station;

[0013] Step 2.2: After receiving the authentication request from the low-orbit broadband satellite, the ground gateway station calls the cipher machine to re-encrypt the authentication data and then sends it to the satellite networking authentication system;

[0014] Step 2.3: After receiving the authentication request from the ground gateway station, the satellite networking authentication system decrypts the original data sent by the low-orbit satellite and authenticates the temporary identity ID. temp Perform legality verification, and proceed to step 2.4 after passing the verification;

[0015] Step 2.4: The satellite networking authentication system selects a set of DKs corresponding to the satellite ID obtained. enc And generate session key SEK, SEK = DK enc ⊕DK auth , generate challenge random number R, initialization vector IV, timestamp T Au And the network authentication system device number SID, apply to the key management system to obtain the work authentication key WKauth , construct plaintext data msg = IV∥T Au ∥R∥SID∥WK auth , calculate the ciphertext cipher = Enc SEK (IV, msg) and message check code MAC = H SEK (IV, msg), and combine the obtained authentication parameters into authentication data Au = IV | cipher | MAC, and calculate the expected authentication response XRES = f RES (DK enc ⊕DK auth ,R);

[0016] Step 2.5: After the calculation is completed, the satellite networking authentication system stores the session key SEK and the expected authentication response XRES locally and the working authentication key WK auth Encrypt and send to the cipher machine, and encrypt the authentication data Au and send it back to the ground gateway station;

[0017] Step 2.6: The ground gateway receives the response from the satellite networking authentication system, decrypts the data using the local symmetric key, calls the cipher machine to encrypt using the current working encryption key, and then sends it to the low-orbit broadband satellite;

[0018] Step 2.7: After receiving the response from the ground gateway, the low-orbit broadband satellite decrypts according to the indicated decryption algorithm. After obtaining the authentication data Au and the challenge random number R, the low-orbit broadband satellite needs to verify the freshness and legitimacy of the authentication data. After the verification is passed, it proceeds to step 2.8;

[0019] Step 2.8: After authentication, the low-orbit broadband satellite uses the onboard clock to generate a timestamp T RES , calculate RES, and set the timestamp T RES and RES are returned to the ground gateway station;

[0020] Step 2.9: After receiving the message from the low-orbit broadband satellite, the ground gateway station calls the cipher machine for decryption, encrypts the data using the local encryption key, and sends it to the satellite networking authentication system;

[0021] Step 2.10: The satellite networking authentication simulation system receives the RES from the requesting party's low-orbit broadband satellite within the specified time, verifies the timestamp, and compares whether RES and XRES are equal. If they are equal, the authentication is passed; otherwise, the authentication is terminated and the connection is released.

[0022] As a preferred embodiment of the present invention, the legitimacy verification in step 2.3 is as follows:

[0023] The satellite networking authentication system uses the preset identity protection key K to authenticate the temporary identity IDtemp Decrypt and verify whether the obtained timestamp T meets the freshness requirement, and the decrypted ID sat Whether it is a legal satellite, only if all the conditions are met can the subsequent process continue.

[0024] As a preferred embodiment of the present invention, the verification method of freshness and legality in step 2.7 is:

[0025] Based on the preset authentication key DK enc and DK auth , the low-orbit broadband satellite generates the key SEK, the low-orbit broadband satellite decrypts the plaintext, extracts the timestamp and random number R, uses the onboard clock to calculate the current time, and generates the timestamp T A ′ u , calculate T A ′ u and T Au If the time difference △T does not exceed the set threshold T0, the message is considered fresh;

[0026] The low-orbit broadband satellite extracts and calculates the MAC in Au, uses the agreed algorithm to calculate the message check code MAC, and compares whether the two are equal. If they are equal, it is determined that the message is legal and continues to execute the subsequent authentication process.

[0027] As a preferred embodiment of the present invention, the key encryption state of the data packet in step 3 specifically includes:

[0028] “00” indicates normal encryption status;

[0029] "01" indicates that there is a need to switch the key. The data packet has been encrypted with the new key and needs to be decrypted with the new key.

[0030] "10" means the key has been switched and the data is encrypted with the new key;

[0031] "Key injection" means injecting a new working key into the low-orbit broadband satellite and the cipher machine. During this period, the key encryption status of the data packet on the satellite-to-ground link is "00";

[0032] The "key transition period" is the time period for key transition, which is divided into transition period I and transition period II. In transition period I, the key encryption state of the data packet is "01", and in transition period II, the key encryption state of the data packet is "10". The dividing point between transition periods I and II is the key switching moment.

[0033] As a preferred embodiment of the present invention, during the key injection period, the satellite networking authentication system pushes the key switching time and the new working key to the ground cryptographic machine and the low-orbit broadband satellite, and the ground cryptographic machine and the low-orbit broadband satellite maintain the new and old versions of the key to prepare for the key switching;

[0034] After the new key is pushed, it enters transition period I. The ground gateway station sets the tag of the data packet sent to the satellite to "01", indicating that the working key is about to switch. During this period, there are two types of encrypted data packets transmitted on the satellite-to-ground link. One part of the data packets is encrypted with the old key, and the other part is encrypted with the new key.

[0035] The working key is switched at the key switching moment, and then the transition period II begins. The flag bit of all data packets sent to the satellite is set to "10", and the data is encrypted with the new key. When the low-orbit broadband satellite detects that the flag bit is "10", the new key will be used for decryption.

[0036] When all working encryption keys have been switched, the ground gateway station will set the Tag flag of all data packets sent to the satellite to "00", and the key switching process is completed.

[0037] Compared with the prior art, the technical solution disclosed in the present invention has the following technical effects:

[0038] 1. Efficient resource utilization: In response to the challenge of limited onboard equipment resources of low-orbit broadband satellites, this solution designs an optimized satellite-ground networking authentication process, which significantly reduces the computing overhead, ensures that an efficient and fast authentication process can be achieved under limited resource conditions, and improves the utilization of equipment resources;

[0039] 2. Higher security strength: It effectively addresses the security risks brought about by the high degree of openness of satellite-to-ground communication links, ensures the confidentiality, integrity and authenticity of data transmission, and greatly improves the security of the entire low-orbit broadband satellite network;

[0040] 3. Flexible key management mechanism: In response to the frequent update requirements of the satellite-to-ground link working key, a key switching scheme is proposed. This scheme uses the ingenious combination of flag bits and control key transition period to achieve smooth key switching, which not only ensures the continuity of system operation, but also avoids potential security vulnerabilities caused by key updates. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 The present invention is a flow chart of the identity authentication networking method between a low-orbit satellite and a ground control center.

[0042] Figure 2 This is a flow chart of the satellite-to-ground networking authentication phase of the identity authentication networking method of the present invention. DETAILED DESCRIPTION

[0043] The embodiments of the present invention are described in detail below, and examples of the embodiments are given in the accompanying drawings, wherein the same or similar symbols throughout represent the same or similar components or components with the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and cannot be interpreted as limiting the present invention.

[0044] The invention discloses an identity authentication networking method between a low-orbit satellite and a ground control center. The overall process is divided into a system initialization phase, a satellite-ground networking authentication phase and a key switching phase.

[0045] System initialization phase

[0046] System initialization is performed before the satellite is launched. It is mainly responsible for presetting the key between the ground-based node and the low-orbit broadband satellite, as well as generating and distributing the relevant information required in the authentication process, including the identity information ID of the low-orbit broadband satellite. sat , encryption key DK enc , Authentication key DK auth , Pre-made work encryption key Work enc , anonymous identity key K, etc.;

[0047] Satellite-ground network certification stage

[0048] During the satellite-to-ground network authentication phase, the low-orbit broadband satellite uses the onboard clock to obtain the current time, calculates the timestamp T, and calculates the temporary identity ID based on the obtained T and the preset identity protection key K corresponding to the ground satellite network authentication system. temp =f(K,T∥ID sat ) is used for this network authentication and then sent to the ground gateway station;

[0049] After receiving the authentication request from the low-orbit broadband satellite, the ground gateway station calls the cipher machine to re-encrypt the authentication data and then sends it to the satellite networking authentication system;

[0050] After receiving the authentication request from the ground gateway, the satellite networking authentication system decrypts the original data sent by the low-orbit satellite and authenticates the temporary identity ID. temp Conduct legality verification;

[0051] The satellite networking authentication system uses the preset identity protection key K to authenticate the temporary identity ID temp Decrypt and verify whether the obtained timestamp T meets the freshness requirement, and the decrypted ID sat Is it a legal satellite? If all the legal conditions are met, the subsequent process will continue;

[0052] The satellite networking authentication system uses the satellite ID to select a corresponding set of DK enc and generate session keys Generate challenge random number R, initialization vector IV, timestamp T Au , Network authentication system device number SID, apply to the key management system to obtain the work authentication key WK auth , construct plaintext data msg = IV∥T Au ∥R∥SID∥WK auth , calculate the ciphertext cipher = Enc SEK (IV, msg) and message check code MAC = H SEK (IV, msg). The authentication parameters are combined into the authentication data Au = IV | cipher | MAC, and the expected authentication response is calculated.

[0053] After the calculation is completed, the satellite network authentication system stores the session key and XRES locally, WK auth Encrypt and send to the cipher machine, and encrypt Au and send it back to the ground gateway station;

[0054] The ground gateway receives the response from the satellite networking authentication system, decrypts the data using the local symmetric key, calls the cipher machine to encrypt the data using the current working encryption key and sends it to the low-orbit broadband satellite.

[0055] After receiving the response from the ground gateway, the low-orbit broadband satellite needs to verify the freshness and legitimacy of the authentication data after decrypting it according to the indicated decryption algorithm and obtaining Au and the challenge random number R;

[0056] Based on the preset authentication key DK enc and DK auth , the low-orbit broadband satellite generates the key SEK, the low-orbit broadband satellite decrypts the plaintext, extracts the timestamp and random number R, uses the onboard clock to calculate the current time, and generates the timestamp T A ′ u , calculate T A ′ u and T Au If the time difference △T does not exceed the set threshold T0, the message is determined to be fresh and the subsequent steps are continued;

[0057] The low-orbit broadband satellite extracts and calculates the MAC in Au, uses the agreed algorithm to calculate the message check code MAC, and compares whether the two are equal. If they are equal, continue to execute the subsequent authentication process;

[0058] After the authentication is passed, the low-orbit broadband satellite uses the onboard clock to generate the timestamp T RES , calculate RES, and return the timestamp and RES to the ground gateway station;

[0059] After receiving the message from the low-orbit broadband satellite, the ground gateway station calls the cipher machine for decryption, encrypts the data using the local encryption key, and sends it to the satellite networking authentication system;

[0060] The satellite networking authentication simulation system receives the RES from the requesting party's low-orbit broadband satellite within the specified time, verifies the timestamp, and compares whether RES and XRES are equal. If they are equal, the authentication is passed; otherwise, the authentication is terminated and the connection is released;

[0061] Key switching phase

[0062] In the key switching phase, the flag Tag is first set to indicate the key encryption status of the data packet. Among them, "00" indicates the normal encryption status; "01" indicates that there is a need for key switching, that is, the key is about to be switched, the data packet has been encrypted with the new key, and it needs to be decrypted with the new key; "10" indicates that the key has been switched, and the data is encrypted with the new key;

[0063] "Key injection" means injecting a new working key into the low-orbit broadband satellite and the cipher machine. During this period, the key encryption status of the data packet on the satellite-to-ground link is "00";

[0064] The "key transition period" is the time period for key transition, which is divided into transition period I and transition period II. In transition period I, the key encryption state of the data packet is "01", and in transition period II, the key encryption state of the data packet is "10". The dividing point between transition periods I and II is the key switching moment.

[0065] During the key injection period, the satellite networking authentication system pushes the key switching time and the new working key to the ground cryptographic machine and the low-orbit broadband satellite. The ground cryptographic machine and the low-orbit broadband satellite maintain the old and new versions of the key to prepare for the key switching.

[0066] After the new key is pushed, it enters transition period I. The ground gateway station sets the tag of the data packet sent to the satellite to "01", indicating that the working key is about to switch. During this period, there are two types of encrypted data packets transmitted on the satellite-to-ground link. Some data packets are encrypted using the old key, and the other data packets are encrypted using the new key.

[0067] The working key is switched at the key switching moment, and then the transition period II begins. The flag bit of all data packets sent to the satellite is set to "10", and the data is encrypted with the new key. When the low-orbit broadband satellite detects that the flag bit is "10", the new key will be used for decryption.

[0068] When all working encryption keys have been switched, the ground gateway station will set the Tag flag of all data packets sent to the satellite to "00", and the key switching process is completed.

[0069] A person of ordinary skill in the art can understand that all or part of the steps carried out in the method of the above-mentioned embodiment can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium. When the program is executed, it includes one of the steps of the method embodiment or a combination thereof.

[0070] In various embodiments of the present invention, it should be understood that the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0071] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for identity authentication networking between a low-orbit satellite and a ground control center, characterized in that: The following steps are involved: Step 1: Initialize the system before the satellite is launched, preset the key between the ground-based node and the low-orbit broadband satellite, and generate and distribute the relevant information required in the authentication process; Step 2: Satellite-ground networking authentication: The low-orbit broadband satellite obtains the timestamp, calculates the temporary identity and sends it to the ground gateway station. The ground gateway station encrypts it twice and sends it to the satellite networking authentication system. The satellite networking authentication system verifies the legitimacy of the temporary identity. The ground gateway station encrypts the data and sends it to the low-orbit broadband satellite. The low-orbit broadband satellite verifies the freshness and legitimacy of the authentication data. The ground gateway station encrypts the data and sends it to the satellite networking authentication system. The satellite networking authentication simulation system compares the authentication response data RES and XRES to determine whether the authentication is passed; Step 3: Set the flag Tag to indicate the key encryption status of the data packet.

2. The identity authentication networking method between a low-orbit satellite and a ground control center according to claim 1, characterized in that: The relevant information in step 1 includes: the identity information ID of the low-orbit broadband satellite sat , encryption key DK enc , Authentication key DK auth , Pre-made work encryption key Work enc and the anonymous identity key K.

3. The identity authentication networking method between a low-orbit satellite and a ground control center according to claim 1, characterized in that: The step 2 of satellite-to-ground networking authentication specifically includes the following steps: Step 2.1: The low-orbit broadband satellite uses the onboard clock to obtain the current time, calculate the timestamp T, and calculate the temporary identity ID based on the obtained timestamp T and the preset identity protection key K corresponding to the ground satellite networking authentication system. temp =f(K,T∥ID sat ) is used for this network authentication and then sent to the ground gateway station; Step 2.2: After receiving the authentication request from the low-orbit broadband satellite, the ground gateway station calls the cipher machine to re-encrypt the authentication data and then sends it to the satellite networking authentication system; Step 2.3: After receiving the authentication request from the ground gateway station, the satellite networking authentication system decrypts the original data sent by the low-orbit satellite and authenticates the temporary identity ID. temp Perform legality verification, and proceed to step 2.4 after passing the verification; Step 2.4: The satellite networking authentication system uses the obtained satellite ID to select the corresponding encryption key DK enc , and using the encryption key DK enc and authentication key DK auth , generate session key SEK = DK enc ⊕DK auth , generate challenge random number R, initialization vector IV, timestamp T Au And the network authentication system device number SID, apply to the key management system to obtain the work authentication key WK auth , construct plaintext data msg = IV∥T Au ∥R∥SID∥WK auth , use the session key SEK to encrypt the initialization vector IV and the plaintext msg, and calculate the ciphertext cipher = Enc SEK (IV, msg), use the hash function to calculate the message check code MAC corresponding to the initialization vector IV and the plaintext msg = H SEK (IV, msg), and combine the obtained authentication parameters into authentication data Au = IV | cipher | MAC, and calculate the expected authentication response data XRES = f RES (DK enc ⊕DK auth ,R); Step 2.5: After the calculation is completed, the satellite networking authentication system stores the session key SEK and the expected authentication response XRES locally and the working authentication key WK auth Encrypt and send to the cipher machine, and encrypt the authentication data Au and send it back to the ground gateway station; Step 2.6: The ground gateway receives the response from the satellite networking authentication system, decrypts the data using the local symmetric key, calls the cipher machine to encrypt using the current working encryption key, and then sends it to the low-orbit broadband satellite; Step 2.7: After receiving the response from the ground gateway, the low-orbit broadband satellite decrypts according to the indicated decryption algorithm. After obtaining the authentication data Au and the challenge random number R, the low-orbit broadband satellite needs to verify the freshness and legitimacy of the authentication data. After the verification is passed, it proceeds to step 2.8; Step 2.8: After authentication, the low-orbit broadband satellite uses the onboard clock to generate a timestamp T RES , calculate the authentication corresponding data RES, and timestamp T RES And the authentication corresponding data RES is returned to the ground gateway station; Step 2.9: After receiving the message from the low-orbit broadband satellite, the ground gateway station calls the cipher machine for decryption, encrypts the data using the local encryption key, and sends it to the satellite networking authentication system; Step 2.10: The satellite networking authentication simulation system receives the authentication response data RES from the requesting party's low-orbit broadband satellite within the specified time and verifies the timestamp T RES Afterwards, compare whether the values ​​of the authentication corresponding data RES and XRES are equal. If they are equal, the authentication is successful; otherwise, the authentication is terminated and the connection is released.

4. The identity authentication networking method between a low-orbit satellite and a ground control center according to claim 3, characterized in that: The legitimacy verification in step 2.3 is: The satellite networking authentication system uses the preset identity protection key K to authenticate the temporary identity ID temp Decrypt and verify whether the obtained timestamp T meets the freshness requirement, and the decrypted satellite identity information ID sat Whether it is a legal satellite, only if all the conditions are met can the subsequent process continue.

5. The identity authentication networking method between a low-orbit satellite and a ground control center according to claim 3, characterized in that: The verification method for validity and legality in step 2.7 is: Based on the preset encryption key DK enc and authentication key DK auth , the low-orbit broadband satellite generates a session key SEK, the low-orbit broadband satellite decrypts the plaintext msg, and extracts the timestamp T Au , random number R, use the onboard clock to calculate the current time and generate a timestamp T A ′ u , calculate T A ′ u and T Au If the time difference △T does not exceed the set threshold T0, the message is considered valid; The low-orbit broadband satellite extracts the authentication data Au, calculates the message check code MAC in the authentication data Au, uses the agreed algorithm to calculate the message check code MAC, and compares whether the two are equal. If they are equal, it is determined that the message is legal and continues to execute the subsequent authentication process.

6. The identity authentication networking method between a low-orbit satellite and a ground control center according to claim 1, characterized in that: The key encryption state of the data packet in step 3 specifically includes: "00" indicates normal encryption status; "01" indicates that there is a need to switch the key. The data packet has been encrypted with the new key and needs to be decrypted with the new key. "10" means the key has been switched and the data is encrypted with the new key; "Key injection" means injecting the new working key into the low-orbit broadband satellite and the cipher machine. During this period, the key encryption status of the data packet on the satellite-to-ground link is "00"; "Key transition period" is the time period of key transition, which is divided into transition period I and transition period II. In transition period I, the key encryption state of the data packet is "01", and in transition period II, the key encryption state of the data packet is "10". The dividing point between transition period I and II is the key switching moment.

7. The identity authentication networking method between a low-orbit satellite and a ground control center according to claim 6, characterized in that: During the key injection period, the satellite networking authentication system pushes the key switching time and the new working key to the ground cryptographic machine and the low-orbit broadband satellite. The ground cryptographic machine and the low-orbit broadband satellite maintain the old and new versions of the key to prepare for the key switching. After the new key is pushed, it enters transition period I. The ground gateway station sets the tag of the data packet sent to the satellite to "01", indicating that the working key is about to switch. During this period, there are two types of encrypted data packets transmitted on the satellite-to-ground link. One part of the data packets is encrypted with the old key, and the other part is encrypted with the new key. The working key is switched at the key switching moment, and then the transition period II begins. The flag bit of all data packets sent to the satellite is set to "10", and the data is encrypted with the new key. When the low-orbit broadband satellite detects that the flag bit is "10", the new key is enabled for decryption. When all working encryption keys have been switched, the ground gateway station will set the Tag flag of all data packets sent to the satellite to "00", and the key switching process is completed.

Images