Satellite terminal authentication method and device, computer equipment and storage medium

Abstract

The invention relates to the technical field of network and security, in particular to a satellite terminal authentication method and device, computer equipment and a storage medium. The method comprises the following steps: in response to a received first authentication request sent by an AMF network element, decrypting a subscription hidden identifier (SUCI) in a terminal authentication request to obtain a user permanent identifier (SUPI); sending the SUPI to a unified data management UDM network element, so that the UDM network element sends an authentication vector generation request to an AKMS network element after determining an authentication mode according to the SUPI; in response to a received authentication vector generation request sent by the UDM network element, generating an authentication vector according to a core algorithm group contained in a key agreement agreement (AKA) authentication protocol; and performing AKA authentication on the satellite terminal according to the authentication vector. According to the method and the device, the subsequent process of generating the key through the authentication vector and the storage of the key are both completed by the AKMS network element, so that the security of key transmission in the AKA authentication process is improved, and the repeated deployment of a cryptographic operation function is avoided.

Description

Technical Field

[0001] This application relates to the field of network and security technologies, and particularly to a satellite terminal authentication method, apparatus, computer device, and storage medium. Background Art

[0002] In the future 6G (6th generation wireless systems) network, the integration of space, air, and ground will be realized. There will be not only base stations but also lightweight core networks on satellites, and the AKA (Authentication and Key Agreement) authentication process will be completed on satellites. Compared with the controllable wired connection between the ground core network and the base station, satellites and the ground can only transmit messages wirelessly.

[0003] Due to the broadcast nature of the wireless link, an attacker can intercept the communication data between the satellite and the ground within a certain range. Once the data is intercepted, the attacker may obtain sensitive information, posing a serious threat to communication security. Summary of the Invention

[0004] Based on this, it is necessary to provide a satellite terminal authentication method, apparatus, computer device, and storage medium that can prevent the leakage of sensitive information and ensure communication security for the above technical problems.

[0005] In a first aspect, this application provides a satellite terminal authentication method applied to an AKMS network element. The method includes:

[0006] In response to receiving a first authentication request sent by an AMF network element, decrypt the subscription concealed identifier SUCI in the terminal authentication request to obtain the subscriber permanent identifier SUPI;

[0007] Send the SUPI to a unified data management UDM network element, so that the UDM network element sends an authentication vector generation request to the AKMS network element after determining the authentication method according to the SUPI;

[0008] In response to receiving the authentication vector generation request sent by the UDM network element, generate an authentication vector according to the core algorithm group included in the key negotiation protocol AKA authentication protocol;

[0009] Authenticate the satellite terminal according to the authentication vector.

[0010] In one embodiment, the authentication vector includes: a random number RAND, an authentication token AUTN, a key-anchored security function KAUSF, and an extended expected authentication response XRES*.

[0011] In one embodiment, the AKA authentication of the satellite terminal according to the authentication vector includes:

[0012] Performing extended authentication on the satellite terminal through RAND, AUTN, and XRES*;

[0013] In the case where the authentication result of the extended authentication is passed, performing AKA authentication on the satellite terminal according to KAUSF.

[0014] In one embodiment, the performing extended authentication on the satellite terminal through RAND, AUTN, and XRES* includes:

[0015] Feeding back an authentication vector generation response carrying the RAND and the AUTN to the UDM network element; so that the UDM network element sends the RAND and the AUTN to the AMF network element through the authentication server function AUSF network element;

[0016] Receiving a second authentication request carrying an extended authentication response RES* sent by the AUSF network element; the second authentication request is sent by the AMF network element to the AUSF network element after receiving a third authentication response sent by the satellite terminal; the third authentication response is sent by the satellite terminal after receiving a third authentication request carrying the RAND and the AUTN sent by the AMF network element; the third authentication request is sent by the AMF network element to the satellite terminal after receiving the RAND and the AUTN;

[0017] Performing extended authentication on the satellite terminal according to RES* and the XRES*.

[0018] In one embodiment, the performing extended authentication on the satellite terminal according to RES* and the XRES* includes:

[0019] If the RES* and the XRES* are the same, determining that the authentication result of the extended authentication is passed;

[0020] If the RES* and the XRES* are different, determining that the authentication result of the extended authentication is not passed.

[0021] In one embodiment, the performing AKA authentication on the satellite terminal according to KAUSF includes:

[0022] Generating a security anchor function KSEAF key and an access and mobility management function KAMF key according to the KAUSF to complete the AKA authentication for the satellite terminal.

[0023] In one embodiment, after performing AKA authentication on the satellite terminal, the method further includes:

[0024] In response to receiving a non-access stratum (NAS) layer key invocation request sent by the AMF network element, generate a NAS integrity protection key KNASint key and a NAS encryption key KNASenc key according to the KAMF key;

[0025] Feed back a NAS layer key invocation response carrying the KNASint key and the KNASenc key to the AMF network element; the NAS layer key invocation response is used to instruct the AMF network element to establish a NAS system management controller (SMC) according to the KNASint key and the KNASenc key.

[0026] In one embodiment, after performing AKA authentication on the satellite terminal, the method further includes:

[0027] In response to receiving a base station key invocation request sent by the AMF network element, generate a KgNB key according to the KAMF key;

[0028] Encrypt the KgNB key according to a preset key between the satellite base station and the core network to obtain a KgNB ciphertext;

[0029] Feed back a base station key invocation response carrying the KgNB ciphertext to the AMF network element; so that the AMF network element sends a KgNB key upload request carrying the KgNB ciphertext to the satellite base station; the KgNB key upload request is used to instruct the satellite base station to decrypt the KgNB ciphertext based on the preset key to obtain the KgNB key, and establish an AS SMC according to the KgNB key.

[0030] In a second aspect, the present application further provides a satellite terminal authentication device, configured in an AKMS network element, and the device includes:

[0031] A decryption module, configured to decrypt a subscription concealed identifier (SUCI) in the terminal authentication request in response to receiving a first authentication request sent by the AMF network element to obtain a subscriber permanent identifier (SUPI);

[0032] A sending module, configured to send the SUPI to a unified data management (UDM) network element, so that after the UDM network element determines an authentication method according to the SUPI, it sends an authentication vector generation request to the AKMS network element;

[0033] A generation module, configured to generate an authentication vector according to a core algorithm group included in an authentication and key agreement (AKA) authentication protocol in response to receiving the authentication vector generation request sent by the UDM network element;

[0034] An authentication module, configured to perform AKA authentication on the satellite terminal according to the authentication vector.

[0035] In a third aspect, the present application further provides a computer device. The computer device includes a memory and a processor. The memory stores a computer program. When the processor executes the computer program, the following steps are implemented:

[0036] In response to receiving a first authentication request sent by an AMF network element, decrypt the subscription concealed identifier (SUCI) in the terminal authentication request to obtain a subscriber permanent identifier (SUPI);

[0037] Send the SUPI to a unified data management (UDM) network element, so that the UDM network element sends an authentication vector generation request to an AKMS network element after determining an authentication method according to the SUPI;

[0038] In response to receiving the authentication vector generation request sent by the UDM network element, generate an authentication vector according to a core algorithm group included in an authentication and key agreement (AKA) authentication protocol;

[0039] Perform AKA authentication on the satellite terminal according to the authentication vector.

[0040] In a fourth aspect, the present application further provides a computer-readable storage medium. The computer-readable storage medium stores a computer program. When the computer program is executed by a processor, the following steps are implemented:

[0041] In response to receiving a first authentication request sent by an AMF network element, decrypt the subscription concealed identifier (SUCI) in the terminal authentication request to obtain a subscriber permanent identifier (SUPI);

[0042] Send the SUPI to a unified data management (UDM) network element, so that the UDM network element sends an authentication vector generation request to an AKMS network element after determining an authentication method according to the SUPI;

[0043] In response to receiving the authentication vector generation request sent by the UDM network element, generate an authentication vector according to a core algorithm group included in an authentication and key agreement (AKA) authentication protocol;

[0044] Perform AKA authentication on the satellite terminal according to the authentication vector.

[0045] In a fifth aspect, the present application further provides a computer program product. The computer program product includes a computer program. When the computer program is executed by a processor, the following steps are implemented:

[0046] In response to receiving the first authentication request sent by the AMF network element, decrypt the subscription concealed identifier (SUCI) in the terminal authentication request to obtain the subscriber permanent identifier (SUPI).

[0047] Send the SUPI to the unified data management (UDM) network element, so that after the UDM network element determines the authentication method according to the SUPI, it sends an authentication vector generation request to the AKMS network element.

[0048] In response to receiving the authentication vector generation request sent by the UDM network element, generate an authentication vector according to the core algorithm group included in the authentication and key agreement (AKA) authentication protocol.

[0049] Authenticate the satellite terminal according to the authentication vector.

[0050] In the above satellite terminal authentication method, device, computer device, and storage medium, the AKMS network element decrypts the subscription concealed identifier (SUCI) in the terminal authentication request to obtain the subscriber permanent identifier (SUPI), and after receiving the authentication vector generation request sent by the UDM network element, generates an authentication vector according to the core algorithm group included in the authentication and key agreement (AKA) authentication protocol. Furthermore, the satellite terminal is authenticated according to the authentication vector. According to the above content, it can be seen that in the process of satellite terminal authentication in this application, the AKMS network element completes processes such as SUCI decryption and authentication vector generation, reducing the participation of other network elements in the core network in the authentication process, realizing centralized management of the authentication process, and ensuring that the subsequent process of generating the key through the authentication vector and the storage of the key are both completed by the AKMS network element, improving the security of key transmission in the AKA authentication process and avoiding duplicate deployment of password operation functions. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 It is an application environment diagram of a satellite terminal authentication method provided by an embodiment of this application.

[0052] Figure 2 It is a flowchart of the first satellite terminal authentication method provided by an embodiment of this application.

[0053] Figure 3 It is a flowchart of the second satellite terminal authentication method provided by an embodiment of this application.

[0054] Figure 4 It is a flowchart of the third satellite terminal authentication method provided by an embodiment of this application.

[0055] Figure 5 It is a signaling diagram of the first satellite terminal authentication method provided by an embodiment of this application.

[0056] Figure 6 Schematic diagram of the process of the fourth satellite terminal authentication method provided by the embodiment of the present application;

[0057] Figure 7 Signaling diagram of the second satellite terminal authentication method provided by the embodiment of the present application;

[0058] Figure 8 Signaling diagram of the third satellite terminal authentication method provided by the embodiment of the present application;

[0059] Figure 9 Structural block diagram of a satellite terminal authentication device provided by the embodiment of the present application;

[0060] Figure 10 Internal structure diagram of a computer device in an embodiment. Detailed implementation manners

[0061] In order to make the objectives, technical solutions and advantages of the present application clearer and more understandable, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0062] The satellite terminal authentication method provided by the embodiment of the present application can be applied to an application environment as shown in Figure 1 . Among them, the UDM network element 102 and the AMF network element 103 communicate with the AKMS network element 104 through a network. The AKMS network element decrypts the subscription concealed identifier SUCI in the terminal authentication request to obtain the subscriber permanent identifier SUPI, and after receiving the authentication vector generation request sent by the UDM network element, generates an authentication vector according to the core algorithm group included in the key agreement protocol AKA authentication protocol; furthermore, performs AKA authentication on the satellite terminal according to the authentication vector.

[0063] In one embodiment, as shown in Figure 2 , a satellite terminal authentication method is provided. Taking the method applied to the AKMS network element 104 in Figure 1 as an example, the method includes the following steps:

[0064] S201, in response to receiving a first authentication request sent by the AMF network element, decrypt the subscription concealed identifier SUCI in the terminal authentication request to obtain the subscriber permanent identifier SUPI.

[0065] Among them, SUCI (Subscription Concealed Identifier) is the core mechanism for user privacy protection, which is generated by encrypting the user's permanent identifier SUPI (Subscription Permanent Identifier).

[0066] In an embodiment of the present application, when it is necessary to decrypt the SUCI to obtain the SUPI, the following may be included: extracting key fields from the SUCI, where the key fields may include but are not limited to: the public key identifying the home network, the temporary public key generated by the satellite terminal, the encrypted SUPI ciphertext, and the message authentication code; retrieving the corresponding elliptic curve private key (HN Private Key) from the secure storage according to the public key identifying the home network; generating a shared key through the elliptic curve key exchange algorithm (ECDH) according to the elliptic curve private key and the temporary public key; furthermore, generating a symmetric key for decrypting the SUPI and a MAC key for verifying the MAC through a key derivation function (KDF); when it is determined that the data integrity of the SUCI is qualified according to the MAC key, decrypting the SUPI ciphertext through the symmetric key to obtain the SUPI.

[0067] It should be noted that the AMF network element receives the first authentication request carrying the SUCI and sends the first authentication request to the AUSF network element, and the AUSF network element forwards the first authentication request to the UDM network element, and the UDM network element then forwards the first authentication request to the AKMS network element.

[0068] S202, sending the SUPI to the unified data management UDM network element, so that the UDM network element sends an authentication vector generation request to the AKMS network element after determining the authentication method according to the SUPI.

[0069] In an embodiment of the present application, the AKMS network element sends the SUPI to the UDM network element; the UDM network element selects the supported authentication method in the subscribed user data based on the SUPI; furthermore, after determining the authentication method according to the SUPI, it sends an authentication vector generation request to the AKMS network element.

[0070] S203, in response to receiving the authentication vector generation request sent by the UDM network element, generating an authentication vector according to the core algorithm group included in the key negotiation protocol AKA authentication protocol.

[0071] It should be noted that the authentication vector includes: a random number RAND, an authentication token AUTN, a key-anchored security function KAUSF, and an extended expected authentication response XRES*.

[0072] Among them, the core algorithm group may include functions f1 - f5, which are mainly used for user authentication, key generation, and security protection in 3G / 4G / 5G communication systems.

[0073] Specifically, when an authentication vector needs to be generated, RAND (Random Challenge), AUTN (Authentication Token), XRES (Expected Response), CK (Cipher Key), and IK (Integrity Key) can be generated based on the f1 - f5 functions; XRES*, and KAUSF (Key for Authentication Server Function) are derived from XRES, CK, and IK. Furthermore, an authentication vector composed of RAND, AUTN, KAUSF, and XRES* is obtained.

[0074] Among them, the AKMS network element locally stores KAUSF and XRES*.

[0075] S204. Perform AKA authentication on the satellite terminal according to the authentication vector.

[0076] It should be noted that when AKA authentication needs to be performed on the satellite terminal, extended authentication of the satellite terminal can be carried out through RAND, AUTN, and XRES*, and furthermore, KSEAF (Security Anchor Function Key) and KAMF9 (Access and Mobility Management Function Key) are generated to perform AKA authentication on the satellite terminal.

[0077] In the above satellite terminal authentication method, the AKMS network element decrypts the subscription hidden identifier SUCI in the terminal authentication request to obtain the user permanent identifier SUPI, and after receiving the authentication vector generation request sent by the UDM network element, generates an authentication vector according to the core algorithm group included in the key negotiation protocol AKA authentication protocol; furthermore, performs AKA authentication on the satellite terminal according to the authentication vector. According to the above content, it can be seen that in the process of satellite terminal authentication in this application, the AKMS network element completes processes such as SUCI decryption and authentication vector generation, reducing the participation of other network elements in the core network in the authentication process, realizing centralized management of the authentication process, and moreover, ensuring that the subsequent process of generating the key through the authentication vector and the storage of the key are both completed by the AKMS network element, improving the security of key transmission in the AKA authentication process and avoiding duplicate deployment of password operation functions.

[0078] In one embodiment, as Figure 3 shown, when it is necessary to perform AKA authentication on the satellite terminal according to the authentication vector, the following may be included:

[0079] S301, perform extended authentication on the satellite terminal through RAND, AUTN, and XRES*.

[0080] It should be noted that when it is necessary to perform extended authentication on the satellite terminal through RAND, AUTN, and XRES*, the following may be included: feedback an authentication vector generation response carrying RAND and AUTN to the UDM network element; so that the UDM network element sends RAND and AUTN to the AMF network element through the authentication server function AUSF network element; receive a second authentication request carrying the extended authentication response RES* sent by the AUSF network element; the second authentication request is sent by the AMF network element to the AUSF network element after receiving the third authentication response sent by the satellite terminal; the third authentication response is sent by the satellite terminal after receiving the third authentication request carrying RAND and AUTN sent by the AMF network element; the third authentication request is sent by the AMF network element to the satellite terminal after receiving RAND and AUTN; perform extended authentication on the satellite terminal according to RES* and XRES*.

[0081] Furthermore, when performing extended authentication on the satellite terminal according to RES* and XRES*, the following may be included: if RES* and XRES* are the same, determine that the authentication result of the extended authentication is passed; if RES* and XRES* are different, determine that the authentication result of the extended authentication is not passed.

[0082] S302, in the case where the authentication result of the extended authentication is passed, perform AKA authentication on the satellite terminal according to KAUSF.

[0083] It should be noted that when AKA authentication is required for the satellite terminal according to the KAUSF, the following content may be included: generating a Key for Secure Anchor Function (KSEAF) key and a Key for Access and Mobility Management Function (KAMF) key according to the KAUSF to complete the AKA authentication for the satellite terminal.

[0084] The above satellite terminal authentication method generates a response by feeding back an authentication vector carrying RAND and AUTN to the UDM network element, so as to obtain RES* generated by the satellite terminal; furthermore, RES* and XRES* are compared. When the authentication result of the extended authentication is passed, a Key for Secure Anchor Function (KSEAF) key and a Key for Access and Mobility Management Function (KAMF) key are generated according to the KAUSF to complete the AKA authentication for the satellite terminal, thereby ensuring that the process of generating keys through the authentication vector and the storage of the keys are both completed by the AKMS network element, improving the security of key transmission in the AKA authentication process and avoiding the repeated deployment of password operation functions.

[0085] In one embodiment, as Figure 4 shown, when establishing NAS SMC after AKA authentication of the satellite terminal, the following content may also be included:

[0086] S401, in response to receiving a non-access stratum (NAS) layer key invocation request sent by the AMF network element, generating a NAS integrity protection key (KNASint key) and a NAS encryption key (KNASenc key) according to the KAMF key.

[0087] It should be noted that before the AMF network element sends a NAS layer key invocation request to the AKMS network element, the AMF network element may activate NAS integrity protection. Furthermore, after successfully activating NAS integrity protection, the AMF network element sends a NAS layer key invocation request to the AKMS network element.

[0088] Specifically, after receiving the NAS layer key invocation request, the AKMS network element derives the KNASint and KNASenc keys based on the KAMF key stored after AKA authentication.

[0089] S402, feeding back a NAS layer key invocation response carrying the KNASint key and the KNASenc key to the AMF network element; the NAS layer key invocation response is used to instruct the AMF network element to establish a NAS System Management Controller (SMC) according to the KNASint key and the KNASenc key.

[0090] It should be noted that when the AMF network element needs to establish NAS SMC based on the KNASint key and KNASenc key, the AMF network element can send the NAS SMC message to the gateway station, the gateway station sends it to the satellite base station, and the satellite base station sends the message to the satellite terminal. The NAS security mode command message includes: Selected NAS Algorithm (the selected NAS algorithm), ngKSI (Next Hop Key Set Identifier), Replayed UE SecurityCapabilities, and other optional information, and performs integrity protection on the NAS SMC message; moreover, the AMF network element activates NAS uplink decryption; after the satellite terminal UE verifies the NAS SMC message, including checking the UE security capabilities, the security module calculates the NAS layer key using the NAS algorithm and parameters such as KAMF included in the message, and uses KNASint to verify the integrity of the NAS message. If the integrity verification passes, the satellite terminal sends a NAS Security ModeComplete message to the AMF to confirm that the security protection mechanism verification has been activated. The satellite and the gateway station forward the NAS Security Mode Complete message to the AMF; finally, after receiving the NAS security mode complete message, the AMF network element decrypts and performs integrity verification on it. If the verification passes, the AMF network element confirms that the security context with the UE has been successfully established and starts encrypting subsequent NAS downlink messages.

[0091] Among them, the NAS layer key can be used for the encryption operation of NAS layer signaling.

[0092] In an embodiment of the present application, the process of establishing NAS SMC is as Figure 5 shown:

[0093] S501, the AMF network element activates NAS integrity protection;

[0094] S502, the AMF network element sends a NAS layer key invocation request to the AKMS network element;

[0095] S503, the AKMS network element generates the NAS integrity protection key KNASint key and the NAS encryption KNASenc key according to the KAMF key;

[0096] S504, the AKMS network element feeds back a NAS layer key invocation response carrying the KNASint key and the KNASenc key to the AMF network element;

[0097] S505. The AMF network element can send the NAS SMC message to the gateway station.

[0098] S506. The gateway station sends the NAS SMC message to the satellite base station.

[0099] S507. The satellite base station sends the NAS SMC message to the satellite terminal.

[0100] S508. After sending the NAS SMC message, the AMF network element activates NAS uplink decryption.

[0101] S509. The satellite terminal verifies the integrity of the NAS SMC message.

[0102] S510. If the verification passes, the satellite terminal sends a NAS security mode complete message to the AMF network element.

[0103] S511. The AMF network element decrypts and verifies the integrity of the NAS security mode complete message; if the verification passes, the AMF confirms that the security context with the UE has been successfully established and starts encrypting subsequent NAS downlink messages.

[0104] The above satellite terminal authentication method generates the NAS integrity protection key KNASint key and the NAS encryption KNASenc key through the KAMF key, ensuring that the AMF network element establishes the NAS system management controller SMC according to the KNASint key and the KNASenc key, and realizing the integrity protection of the NAS SMC message.

[0105] In one embodiment, as Figure 6 shown, after performing AKA authentication on the satellite terminal, when performing AS SMC establishment, the following may further be included:

[0106] S601. In response to receiving a base station key invocation request sent by the AMF network element, generate the KgNB key according to the KAMF key.

[0107] S602. Encrypt the KgNB key according to the preset key between the satellite base station and the core network to obtain the KgNB ciphertext.

[0108] S603. Feed back a base station key invocation response carrying the KgNB ciphertext to the AMF network element; so that the AMF network element sends a KgNB key upload request carrying the KgNB ciphertext to the satellite base station; the KgNB key upload request is used to instruct the satellite base station to decrypt the KgNB ciphertext based on the preset key to obtain the KgNB key, and perform AS SMC establishment according to the KgNB key.

[0109] In one embodiment of the present application, the process of AS SMC establishment is asFigure 7 As shown in:

[0110] S701, the AMF network element sends a base station key invocation request to the AKMS network element.

[0111] S702, the AKMS network element encrypts the KgNB key according to the pre - set key between the satellite base station and the core network to obtain the KgNB ciphertext.

[0112] S703, the AKMS network element sends a base station key invocation response carrying the KgNB ciphertext to the AMF network element.

[0113] S704, the AMF network element sends a KgNB key upload request carrying the KgNB ciphertext to the satellite base station.

[0114] S705, the satellite base station decrypts the KgNB ciphertext based on the pre - set key to obtain the KgNB key.

[0115] S706, the satellite base station sends a KgNB key upload response to the AMF network element.

[0116] S707, the satellite base station activates AS integrity protection.

[0117] S708, the satellite base station sends the AS SMC message to the satellite terminal. The AS SMC message contains the selected encryption algorithm and integrity protection algorithm, as well as relevant security parameters, and performs integrity protection on the AS SMC message.

[0118] S709, after the satellite base station sends the AS SMC, it activates RRC downlink encryption;

[0119] S710, the satellite terminal sends the AS SMC message to the security module. The security module derives keys such as KRRCint and KRRCenc, and performs integrity protection on the AS security mode complete message, calculates MAC - I;

[0120] S711, if the integrity verification based on MAC - I passes, the satellite terminal sends an AS security mode complete message to the satellite base station to confirm that the security protection mechanism verification has been activated.

[0121] S712, the satellite terminal enables RRC uplink encryption.

[0122] S713, the satellite base station enables RRC downlink decryption.

[0123] The above satellite terminal authentication method generates the KgNB key according to the KAMF key, and encrypts the KgNB key according to the preset key between the satellite base station and the core network to obtain the KgNB ciphertext, which ensures the security of the KgNB key and also guarantees the security of the KgNB key transmission.

[0124] In one embodiment, as Figure 8 shown, when AKA authentication of the satellite terminal is required, the following may be included:

[0125] S801, the satellite terminal sends an access request through an NAS message, carrying the terminal identifier (SUCI or 5GGUTI), and sends it to the satellite base station; the satellite base station forwards the NAS message to the gateway station, and the gateway station forwards the NAS message to the core network AMF network element.

[0126] S802, the AMF generates a first authentication request carrying the SUCI and sends it to the AUSF network element.

[0127] S803, the AUSF network element forwards the first authentication request to the UDM network element.

[0128] S804, the UDM network element forwards the first authentication request to the AKMS network element.

[0129] S805, the AKMS network element decrypts the SUCI to obtain the SUPI.

[0130] S806, the AKMS network element sends the SUPI to the UDM network element to query the user subscription information.

[0131] S807, the UDM network element selects the supported authentication method in the subscribed user data based on the SUPI.

[0132] S808, the UDM network element sends an authentication vector generation request to the AKMS network element.

[0133] S809, the AKMS network element executes functions f1-f5 to generate RAND, AUTN, XRES, CK, and IK, and then derives XRES*, and KAUSF from XRES, CK, and IK to generate an authentication vector (RAND, AUTN, KAUSF, XRES*).

[0134] S810, the AKMS network element returns an authentication vector generation response carrying RAND and AUTN to the UDM network element; the AKMS network element saves XRES* and KAUSF by itself.

[0135] S811, the UDM network element returns a first authentication response to the AUSF network element, carrying RAND, AUTN, and including the SUPI at the same time.

[0136] S812. The AUSF forwards the first authentication response to the AMF, including RAND and AUTN.

[0137] S813. The AMF sends a third authentication request carrying RAND and AUTN to the satellite terminal.

[0138] S814. The satellite terminal calculates and compares whether XMAC is consistent with MAC, and verifies the freshness of AUTN. If it passes, RES* is calculated.

[0139] It should be noted that XMAC is calculated by the satellite terminal through the f1-f5 function, MAC exists in AUTN; RES* is calculated by the satellite terminal using the civilianized f1-f5 function.

[0140] Furthermore, when verifying the freshness of AUTN, it can be determined whether the timeliness of the SQN serial number of AUTN is qualified.

[0141] S815. The satellite terminal sends a third authentication response carrying RES* to the AMF network element.

[0142] S816. The AMF network element sends the third authentication response to the AUSF network element.

[0143] S817. The AUSF network element forwards the second authentication request carrying the extended authentication response RES* to the AKMS network element.

[0144] S818. The AKMS performs extended authentication on the satellite terminal based on RES* and XRES*.

[0145] S819. In the case where the authentication result of the extended authentication is passed, the AKMS network element generates a security anchor function KSEAF key and an access and mobility management function KAMF key according to KAUSF.

[0146] S820. The AKMS network element returns the terminal authentication result to the AUSF network element.

[0147] S821. The AUSF network element forwards the terminal authentication result to the AMF network element, and the AMF network element completes the subsequent security process.

[0148] In the above satellite terminal authentication method, the AKMS network element decrypts the subscription hidden identifier SUCI in the terminal authentication request to obtain the user permanent identifier SUPI. After receiving the authentication vector generation request sent by the UDM network element, the AKMS network element generates an authentication vector according to the core algorithm group included in the authentication and key agreement (AKA) authentication protocol. Furthermore, based on the authentication vector, the satellite terminal is authenticated using AKA. According to the above content, it can be seen that during the satellite terminal authentication process of this application, the AKMS network element completes processes such as SUCI decryption and authentication vector generation, reducing the participation of other network elements in the core network in the authentication process, achieving centralized management of the authentication process. Moreover, it is ensured that the subsequent process of generating the key based on the authentication vector and the storage of the key are both completed by the AKMS network element, improving the security of key transmission during the AKA authentication process and avoiding the repeated deployment of password operation functions.

[0149] It should be understood that although the steps in the flowcharts involved in the above embodiments are shown in sequence according to the arrows, these steps do not necessarily have to be executed in the order indicated by the arrows. Unless there is a clear indication in this article, the execution of these steps has no strict order limit, and these steps can be executed in other orders. Moreover, at least some of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages. These steps or stages do not necessarily have to be executed at the same time, but can be executed at different times. The execution order of these steps or stages does not necessarily have to be sequential, but can be executed alternately or in turn with at least some of the steps or stages in other steps or other steps.

[0150] Based on the same inventive concept, an embodiment of this application also provides a satellite terminal authentication device for implementing the above-mentioned satellite terminal authentication method. The solution provided by this device to solve the problem is similar to the solution described in the above method. Therefore, the specific limitations in one or more embodiments of the satellite terminal authentication device provided below can refer to the limitations on the satellite terminal authentication method in the above text and will not be repeated here.

[0151] In one embodiment, as Figure 9 shown, a satellite terminal authentication device is provided, including: a decryption module 10, a sending module 20, a generation module 30, and an authentication module 40, where:

[0152] The decryption module 10 is configured to decrypt the subscription hidden identifier SUCI in the terminal authentication request to obtain the user permanent identifier SUPI in response to receiving a first authentication request sent by the AMF network element.

[0153] A sending module 20, configured to send the SUPI to a unified data management UDM network element, so that after the UDM network element determines an authentication method according to the SUPI, it sends an authentication vector generation request to an AKMS network element.

[0154] A generating module 30, configured to respond to receiving the authentication vector generation request sent by the UDM network element, and generate an authentication vector according to a core algorithm group included in an authentication and key agreement AKA authentication protocol.

[0155] An authentication module 40, configured to perform AKA authentication on a satellite terminal according to the authentication vector.

[0156] The authentication vector includes: a random number RAND, an authentication token AUTN, a key-anchored security function KAUSF, and an extended expected authentication response XRES*.

[0157] Perform extended authentication on the satellite terminal through the RAND, AUTN, and XRES*;

[0158] In the case where the authentication result of the extended authentication is passed, perform AKA authentication on the satellite terminal according to the KAUSF.

[0159] Feed back an authentication vector generation response carrying the RAND and AUTN to the UDM network element; so that the UDM network element sends the RAND and AUTN to an authentication server function AUSF network element through the AMF network element;

[0160] Receive a second authentication request carrying an extended authentication response RES* sent by the AUSF network element; the second authentication request is sent by the AMF network element to the AUSF network element after receiving a third authentication response sent by the satellite terminal; the third authentication response is sent by the satellite terminal after receiving a third authentication request carrying the RAND and AUTN sent by the AMF network element; the third authentication request is sent by the AMF network element to the satellite terminal after receiving the RAND and AUTN;

[0161] Perform extended authentication on the satellite terminal according to the RES* and XRES*.

[0162] If the RES* and XRES* are the same, determine that the authentication result of the extended authentication is passed;

[0163] If the RES* and XRES* are different, determine that the authentication result of the extended authentication is not passed.

[0164] Generate a security anchor function KSEAF key and an access and mobility management function KAMF key according to the KAUSF to complete the AKA authentication for the satellite terminal.

[0165] In response to receiving a non-access stratum (NAS) key invocation request sent by an AMF network element, generate an NAS integrity protection key KNASint key and an NAS encryption key KNASenc key based on the KAMF key;

[0166] Feed back an NAS key invocation response carrying the KNASint key and the KNASenc key to the AMF network element; the NAS key invocation response is used to instruct the AMF network element to establish an NAS system management controller (SMC) based on the KNASint key and the KNASenc key.

[0167] In response to receiving a base station key invocation request sent by the AMF network element, generate a KgNB key based on the KAMF key;

[0168] Encrypt the KgNB key according to a preset key between the satellite base station and the core network to obtain a KgNB ciphertext;

[0169] Feed back a base station key invocation response carrying the KgNB ciphertext to the AMF network element; so that the AMF network element sends a KgNB key upload request carrying the KgNB ciphertext to the satellite base station; the KgNB key upload request is used to instruct the satellite base station to decrypt the KgNB ciphertext based on the preset key to obtain the KgNB key, and establish an AS SMC according to the KgNB key.

[0170] For the above satellite terminal authentication device, the AKMS network element decrypts the subscription concealed identifier (SUCI) in the terminal authentication request to obtain the subscriber permanent identifier (SUPI), and after receiving the authentication vector generation request sent by the UDM network element, generates an authentication vector according to the core algorithm group included in the authentication and key agreement (AKA) authentication protocol; furthermore, performs AKA authentication on the satellite terminal according to the authentication vector. According to the above content, it can be seen that in the process of satellite terminal authentication in this application, the AKMS network element completes processes such as SUCI decryption and authentication vector generation, reducing the participation degree of other network elements in the core network in the authentication process, realizing centralized management of the authentication process, and moreover, ensuring that the subsequent process of generating keys through the authentication vector and the storage of keys are all completed by the AKMS network element, improving the security of key transmission in the AKA authentication process and avoiding the repeated deployment of password operation functions.

[0171] Each module in the above satellite terminal authentication device can be implemented in whole or in part by software, hardware, and their combination. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or stored in the memory of the computer device in the form of software, so as to facilitate the processor to call and execute the operations corresponding to the above-mentioned respective modules.

[0172] In one embodiment, a computer device is provided. The computer device may be a terminal, and its internal structural diagram may be as shown in Figure 10 The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit, and an input device. Among them, the processor, the memory, and the input / output interface are connected through a system bus, and the communication interface, the display unit, and the input device are connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and external devices. The communication interface of the computer device is used to communicate with external terminals in a wired or wireless manner. The wireless manner can be achieved through WIFI, a mobile cellular network, NFC (Near Field Communication), or other technologies. When the computer program is executed by the processor, it implements a satellite terminal authentication method. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen. The input device of the computer device can be a touch layer covered on the display screen, or a button, a trackball, or a touchpad provided on the housing of the computer device, or an external keyboard, a touchpad, or a mouse, etc.

[0173] Those skilled in the art can understand that Figure 10 the structure shown in is only a block diagram of some structures related to the solution of this application, and does not constitute a limitation on the computer device to which the solution of this application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine some components, or have different component arrangements.

[0174] A computer device is provided, including a memory and a processor. A computer program is stored in the memory. When the processor executes the computer program, the following steps are implemented:

[0175] In response to receiving a first authentication request sent by an Access and Mobility Management Function (AMF) network element, decrypt the Subscription Concealed Identifier (SUCI) in the terminal authentication request to obtain the Subscriber Permanent Identifier (SUPI);

[0176] Send the SUPI to the Unified Data Management (UDM) network element, so that after the UDM network element determines the authentication method according to the SUPI, it sends an authentication vector generation request to the AKMS network element;

[0177] In response to receiving an authentication vector generation request sent by the UDM network element, an authentication vector is generated according to the core algorithm group included in the Authentication and Key Agreement (AKA) authentication protocol.

[0178] Based on the authentication vector, perform AKA authentication on the satellite terminal.

[0179] When the processor executes the computer program, the following steps are also implemented:

[0180] The authentication vector includes: a random number RAND, an authentication token AUTN, a key-anchored security function KAUSF, and an extended expected authentication response XRES*.

[0181] When the processor executes the computer program, the following steps are also implemented:

[0182] Perform extended authentication on the satellite terminal through RAND, AUTN, and XRES*.

[0183] In the case where the authentication result of the extended authentication is passed, perform AKA authentication on the satellite terminal according to KAUSF.

[0184] When the processor executes the computer program, the following steps are also implemented:

[0185] Send an authentication vector generation response carrying RAND and AUTN to the UDM network element; so that the UDM network element sends RAND and AUTN to the AMF network element through the Authentication Server Function (AUSF) network element.

[0186] Receive a second authentication request carrying an extended authentication response RES* sent by the AUSF network element; the second authentication request is sent by the AMF network element to the AUSF network element after receiving a third authentication response sent by the satellite terminal; the third authentication response is sent by the satellite terminal after receiving a third authentication request carrying RAND and AUTN sent by the AMF network element; the third authentication request is sent by the AMF network element to the satellite terminal after receiving RAND and AUTN.

[0187] Perform extended authentication on the satellite terminal according to RES* and XRES*.

[0188] When the processor executes the computer program, the following steps are also implemented:

[0189] If RES* and XRES* are the same, determine that the authentication result of the extended authentication is passed;

[0190] If RES* and XRES* are not the same, determine that the authentication result of the extended authentication is not passed.

[0191] When the processor executes the computer program, the following steps are also implemented:

[0192] Generate the security anchor function KSEAF key and the access and mobility management function KAMF key according to KAUSF to complete the AKA authentication for the satellite terminal.

[0193] When the processor executes the computer program, the following steps are also implemented:

[0194] In response to receiving a non-access stratum NAS layer key invocation request sent by the AMF network element, generate the NAS integrity protection key KNASint key and the NAS encryption KNASenc key according to the KAMF key;

[0195] Feed back a NAS layer key invocation response carrying the KNASint key and the KNASenc key to the AMF network element; the NAS layer key invocation response is used to instruct the AMF network element to establish a NAS system management controller SMC according to the KNASint key and the KNASenc key.

[0196] When the processor executes the computer program, the following steps are also implemented:

[0197] In response to receiving a base station key invocation request sent by the AMF network element, generate the KgNB key according to the KAMF key;

[0198] Encrypt the KgNB key according to the preset key between the satellite base station and the core network to obtain the KgNB ciphertext;

[0199] Feed back a base station key invocation response carrying the KgNB ciphertext to the AMF network element; so that the AMF network element sends a KgNB key upload request carrying the KgNB ciphertext to the satellite base station; the KgNB key upload request is used to instruct the satellite base station to decrypt the KgNB ciphertext based on the preset key to obtain the KgNB key, and establish an AS SMC according to the KgNB key.

[0200] A computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented:

[0201] In response to receiving a first authentication request sent by the access and mobility management function AMF network element, decrypt the subscription concealed identifier SUCI in the terminal authentication request to obtain the subscriber permanent identifier SUPI;

[0202] Send the SUPI to the unified data management UDM network element, so that after the UDM network element determines the authentication method according to the SUPI, it sends an authentication vector generation request to the AKMS network element;

[0203] In response to receiving the authentication vector generation request sent by the UDM network element, generate an authentication vector according to the core algorithm group included in the key agreement protocol AKA authentication protocol;

[0204] Perform AKA authentication on the satellite terminal according to the authentication vector.

[0205] When the computer program is executed by a processor, the following steps are also implemented:

[0206] The authentication vector includes: random number RAND, authentication token AUTN, key-anchored security function KAUSF, and extended expected authentication response XRES*.

[0207] When the computer program is executed by a processor, the following steps are also implemented:

[0208] Perform extended authentication on the satellite terminal through RAND, AUTN, and XRES*;

[0209] When the authentication result of the extended authentication is passed, perform AKA authentication on the satellite terminal according to KAUSF.

[0210] When the computer program is executed by a processor, the following steps are also implemented:

[0211] Feed back an authentication vector generation response carrying RAND and AUTN to the UDM network element; so that the UDM network element sends RAND and AUTN to the AMF network element through the authentication server function AUSF network element;

[0212] Receive a second authentication request carrying the extended authentication response RES* sent by the AUSF network element; the second authentication request is sent by the AMF network element to the AUSF network element after receiving the third authentication response sent by the satellite terminal; the third authentication response is sent by the satellite terminal after receiving the third authentication request carrying RAND and AUTN sent by the AMF network element; the third authentication request is sent by the AMF network element to the satellite terminal after receiving RAND and AUTN;

[0213] Perform extended authentication on the satellite terminal according to RES* and XRES*.

[0214] When the computer program is executed by a processor, the following steps are also implemented:

[0215] If RES* and XRES* are the same, determine that the authentication result of the extended authentication is passed;

[0216] If RES* and XRES* are not the same, determine that the authentication result of the extended authentication is not passed.

[0217] When the computer program is executed by a processor, the following steps are also implemented:

[0218] Generate a security anchor function KSEAF key and an access and mobility management function KAMF key according to KAUSF to complete the AKA authentication for the satellite terminal.

[0219] When the computer program is executed by a processor, the following steps are also implemented:

[0220] In response to receiving a non-access stratum NAS key invocation request sent by the AMF network element, generate a NAS integrity protection key KNASint key and a NAS encryption KNASenc key according to the KAMF key;

[0221] Feed back a NAS key invocation response carrying the KNASint key and the KNASenc key to the AMF network element; the NAS key invocation response is used to instruct the AMF network element to establish a NAS system management controller SMC according to the KNASint key and the KNASenc key.

[0222] When the computer program is executed by a processor, the following steps are also implemented:

[0223] In response to receiving a base station key invocation request sent by the AMF network element, generate a KgNB key according to the KAMF key;

[0224] Encrypt the KgNB key according to a preset key between the satellite base station and the core network to obtain a KgNB ciphertext;

[0225] Feed back a base station key invocation response carrying the KgNB ciphertext to the AMF network element; so that the AMF network element sends a KgNB key upload request carrying the KgNB ciphertext to the satellite base station; the KgNB key upload request is used to instruct the satellite base station to decrypt the KgNB ciphertext based on the preset key to obtain the KgNB key, and establish an AS SMC according to the KgNB key.

[0226] A computer program product is provided, including a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0227] In response to receiving a first authentication request sent by an access and mobility management function AMF network element, decrypt the subscription concealed identifier SUCI in the terminal authentication request to obtain a subscriber permanent identifier SUPI;

[0228] Send the SUPI to a unified data management UDM network element, so that after the UDM network element determines the authentication method according to the SUPI, it sends an authentication vector generation request to the AKMS network element;

[0229] In response to receiving the authentication vector generation request sent by the UDM network element, generate an authentication vector according to the core algorithm group included in the key agreement protocol AKA authentication protocol;

[0230] Perform AKA authentication on the satellite terminal based on the authentication vector.

[0231] When the computer program is executed by the processor, the following steps are also performed:

[0232] The authentication vector includes: random number RAND, authentication token AUTN, key anchor security function KAUSF and extended expected authentication response XRES*.

[0233] When the computer program is executed by the processor, the following steps are also performed:

[0234] Extended authentication of satellite terminals through RAND, AUTN and XRES*;

[0235] If the extended authentication result is passed, AKA authentication is performed on the satellite terminal according to KAUSF.

[0236] When the computer program is executed by the processor, the following steps are also performed:

[0237] Feedback the authentication vector generation response carrying RAND and AUTN to the UDM network element; so that the UDM network element sends RAND and AUTN to the AMF network element through the authentication server function AUSF network element;

[0238] Receive the second authentication request carrying the extended authentication response RES* sent by the AUSF network element; the second authentication request is sent by the AMF network element to the AUSF network element after receiving the third authentication response sent by the satellite terminal; the third authentication response is sent by the satellite terminal after receiving the third authentication request carrying RAND and AUTN sent by the AMF network element; the third authentication request is sent by the AMF network element to the satellite terminal after receiving RAND and AUTN;

[0239] Perform extended authentication on the satellite terminal based on RES* and XRES*.

[0240] When the computer program is executed by the processor, the following steps are also performed:

[0241] If RES* and XRES* are the same, the authentication result of the extended authentication is determined to be passed;

[0242] If RES* and XRES* are different, the authentication result of the extended authentication is determined to be failed.

[0243] When the computer program is executed by the processor, the following steps are also performed:

[0244] The security anchor function KSEAF key and the access and mobility management function KAMF key are generated based on KAUSF to complete the AKA authentication for the satellite terminal.

[0245] When the computer program is executed by a processor, the following steps are also implemented:

[0246] In response to receiving a non-access stratum (NAS) key invocation request sent by an AMF network element, generate a NAS integrity protection key KNASint and a NAS encryption key KNASenc based on the KAMF key;

[0247] Feed back a NAS key invocation response carrying the KNASint key and the KNASenc key to the AMF network element; the NAS key invocation response is used to instruct the AMF network element to establish a NAS system management controller (SMC) based on the KNASint key and the KNASenc key.

[0248] When the computer program is executed by a processor, the following steps are also implemented:

[0249] In response to receiving a base station key invocation request sent by an AMF network element, generate a KgNB key based on the KAMF key;

[0250] Encrypt the KgNB key according to a preset key between the satellite base station and the core network to obtain a KgNB ciphertext;

[0251] Feed back a base station key invocation response carrying the KgNB ciphertext to the AMF network element; so that the AMF network element sends a KgNB key upload request carrying the KgNB ciphertext to the satellite base station; the KgNB key upload request is used to instruct the satellite base station to decrypt the KgNB ciphertext based on the preset key to obtain the KgNB key, and establish an access stratum (AS) SMC based on the KgNB key.

[0252] It should be noted that the user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use, and processing of relevant data need to comply with the relevant laws, regulations, and standards of relevant countries and regions.

[0253] Those of ordinary skill in the art can understand that all or part of the processes in the methods of the above embodiments can be completed by instructing relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above methods. Among them, any reference to a memory, database, or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memories. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc. The databases involved in the embodiments provided in the present application can include at least one of relational databases and non-relational databases. Non-relational databases can include distributed databases based on blockchain, etc., without limitation. The processors involved in the embodiments provided in the present application can be general-purpose processors, central processors, graphics processors, digital signal processors, programmable logic devices, data processing logics based on quantum computing, etc., without limitation.

[0254] The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity of description, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, it should be considered to be within the scope described in this specification.

[0255] The above embodiments only represent several implementation manners of the present application. The description is relatively specific and detailed, but it should not be construed as a limitation on the patent scope of the present application. It should be noted that for those of ordinary skill in the art, without departing from the concept of the present application, several modifications and improvements can still be made, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the appended claims.

Claims

1. A satellite terminal authentication method, characterized in that, Applied to the Authentication Key Management System (AKMS) network element, the method includes: In response to receiving a first authentication request sent by the Access and Mobility Management Function (AMF) network element, decrypt the Subscription Concealed Identifier (SUCI) in the terminal authentication request to obtain the Subscriber Permanent Identifier (SUPI); Send the SUPI to the Unified Data Management (UDM) network element, so that after the UDM network element determines the authentication method according to the SUPI, it sends an authentication vector generation request to the AKMS network element; In response to receiving the authentication vector generation request sent by the UDM network element, generate an authentication vector according to the core algorithm group included in the Authentication and Key Agreement (AKA) authentication protocol; Perform AKA authentication on the satellite terminal according to the authentication vector.

2. The method according to claim 1, characterized in that, The authentication vector includes: Random Number (RAND), Authentication Token (AUTN), Key Anchoring Security Function (KAUSF), and Extended Expected Authentication Response (XRES*).

3. The method according to claim 2, wherein The performing AKA authentication on the satellite terminal according to the authentication vector includes: Performing extended authentication on the satellite terminal through RAND, AUTN, and XRES*; In the case where the authentication result of the extended authentication is passed, perform AKA authentication on the satellite terminal according to KAUSF.

4. The method according to claim 3, characterized in that, The performing extended authentication on the satellite terminal through RAND, AUTN, and XRES* includes: Feed back an authentication vector generation response carrying the RAND and the AUTN to the UDM network element; so that the UDM network element sends the RAND and the AUTN to the AMF network element through the Authentication Server Function (AUSF) network element; Receive a second authentication request carrying the Extended Authentication Response (RES*) sent by the AUSF network element; the second authentication request is sent by the AMF network element to the AUSF network element after receiving a third authentication response sent by the satellite terminal; the third authentication response is sent by the satellite terminal after receiving a third authentication request carrying the RAND and the AUTN sent by the AMF network element; the third authentication request is sent by the AMF network element to the satellite terminal after receiving the RAND and the AUTN; Perform extended authentication on the satellite terminal according to RES* and the XRES*.

5. The method according to claim 4, characterized in that The performing extended authentication on the satellite terminal according to RES* and the XRES* includes: If the RES* and the XRES* are the same, determine that the authentication result of the extended authentication is passed; If the RES* and the XRES* are different, determine that the authentication result of the extended authentication is not passed.

6. The method according to claim 3, characterized in that, The performing AKA authentication on the satellite terminal according to KAUSF includes: Generate a Key Security Anchor Function (KSEAF) key and a Key for Access and Mobility Management Function (KAMF) key according to the KAUSF to complete the AKA authentication for the satellite terminal.

7. The method according to claim 1, wherein [[ID= In response to receiving a non-access stratum (NAS) key invocation request sent by an AMF network element, generate an NAS integrity protection key KNASint and an NAS encryption key KNASenc based on the KAMF key; Feed back an NAS key invocation response carrying the KNASint key and the KNASenc key to the AMF network element; the NAS key invocation response is used to instruct the AMF network element to establish an NAS system management controller (SMC) according to the KNASint key and the KNASenc key.

8. The method according to claim 1, wherein After performing AKA authentication on the satellite terminal, the method further includes: In response to receiving a base station key invocation request sent by an AMF network element, generate a KgNB key based on the KAMF key; Encrypt the KgNB key according to a preset key between the satellite base station and the core network to obtain a KgNB ciphertext; Feed back a base station key invocation response carrying the KgNB ciphertext to the AMF network element; so that the AMF network element sends a KgNB key upload request carrying the KgNB ciphertext to the satellite base station; the KgNB key upload request is used to instruct the satellite base station to decrypt the KgNB ciphertext based on the preset key to obtain the KgNB key, and establish an AS SMC according to the KgNB key.

9. A satellite terminal authentication device, characterized in that, Configured in an AKMS network element, the apparatus includes: A decryption module, configured to decrypt a subscription concealed identifier (SUCI) in the terminal authentication request in response to receiving a first authentication request sent by an AMF network element to obtain a subscriber permanent identifier (SUPI); A sending module, configured to send the SUPI to a unified data management (UDM) network element, so that after the UDM network element determines an authentication method according to the SUPI, it sends an authentication vector generation request to the AKMS network element; A generation module, configured to generate an authentication vector according to a core algorithm group included in an authentication and key agreement (AKA) authentication protocol in response to receiving the authentication vector generation request sent by the UDM network element; An authentication module, configured to perform AKA authentication on the satellite terminal according to the authentication vector.

10. A computer device, comprising a memory and a processor, the memory storing a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 8.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 8.

12. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 8.

Images