Satellite communication-oriented quic communication method and device based on data classification, and medium

Abstract

The application discloses a satellite communication-based data classification-oriented QUIC communication method and device, and a medium, which comprises the following steps: a client sends a client greeting to a server; in response to the client greeting, the server determines an encryption algorithm, a key agreement algorithm and a signature algorithm used by transmission data corresponding to each security level label, and sends a server greeting to the client; thereby completing handshaking between the client and the server; the client and the server generate and agree on a key according to the security level label; the client encrypts transmission data according to the security level label, and uploads the encrypted transmission data to the server; the server decrypts the encrypted transmission data according to the security level label, thereby completing secure transmission of the data; the client signs the transmission data according to the security level label, and uploads the signed transmission data and the security level label to the server; and the server verifies the signature according to the security level label.

Description

Technical Field

[0001] The present invention relates to information security technology in the field of satellite communications, and in particular to a QUIC communication method, device, and medium based on data classification for satellite communications. Background Art

[0002] With the rapid development of low-orbit satellite internet and commercial satellite communications, satellite communication systems have become an essential component of modern information infrastructure. However, satellite communications are characterized by high latency, high packet loss rates, unstable links, and limited computing and bandwidth resources, posing significant challenges to the security and protection of communication data.

[0003] Traditional satellite communications typically use traditional cryptographic algorithms such as RSA, ECDH, ECDSA, and AES. These algorithms are mature, stable, and highly efficient, but face potential security risks posed by quantum computers. In the future, quantum computers will be able to crack traditional algorithms like RSA and ECC in a short period of time, posing a serious threat to the security of satellite communications.

[0004] To address the threat of quantum computing, quantum-resistant cryptographic algorithms such as MLKEM and MLDSA have been proposed. However, these algorithms are still in the early stages of development and, compared to traditional algorithms, are computationally intensive, require longer keys, and consume more bandwidth. Therefore, simply replacing traditional cryptography with quantum-resistant cryptography would significantly increase the burden on satellite communication systems and undermine their stable operation.

[0005] The security levels of data transmitted via satellite communications vary widely. Some data requires extremely high security, while others, such as general telemetry and status data, require less security. Forcing all data to use a unified quantum-resistant algorithm would waste valuable communication resources, degrade performance, and fail to fully leverage the strengths of different cryptographic algorithms.

[0006] In summary, the existing technology has the following problems:

[0007] (1) Traditional cryptographic algorithms face the threat of quantum computers and will be unable to protect the long-term security of sensitive satellite communication data in the future;

[0008] (2) At present, quantum-resistant cryptographic algorithms have high overhead, high computational complexity and communication bandwidth requirements, and cannot completely replace traditional algorithms in the short term;

[0009] (3) Different levels of data in satellite communications have very different security requirements. In a highly resource-constrained satellite communication environment, if quantum-resistant algorithms are uniformly applied to all data, communication performance and efficiency will be significantly reduced. Currently, there is a lack of reasonable and clear data classification and cryptographic algorithm hierarchical application solutions.

[0010] (4) The existing QUIC and TLS protocols lack support for the flexible use of traditional cryptography, hybrid cryptography and quantum-resistant cryptography based on data classification, making it difficult to smoothly introduce and upgrade quantum-resistant algorithms. Summary of the Invention

[0011] In view of this, the present invention provides a QUIC communication method, device, and medium based on data classification for satellite communication.

[0012] In a first aspect, an embodiment of the present invention provides a QUIC communication method based on data classification for satellite communication, which is applied to a client. The method includes:

[0013] The client sends a client hello to the server and receives a server hello from the server, thus completing the handshake between the client and the server. The server hello is generated by the server in response to the client hello to determine the encryption algorithm, key agreement algorithm, and signature algorithm corresponding to each security level tag.

[0014] The client generates and negotiates keys based on the key negotiation algorithm corresponding to the security level tag of the transmitted data.

[0015] The client encrypts the transmitted data according to the encryption algorithm corresponding to the security level label and uploads the encrypted transmitted data to the server; it receives a confirmation message from the server to confirm that the server has completed decryption of the encrypted transmitted data according to the security level label, thereby completing the secure transmission of the data;

[0016] The client signs the transmitted data according to the signature algorithm corresponding to the security level label, and uploads the signed transmitted data and its security level label to the server; it receives a confirmation message sent by the server to confirm that the server has completed the verification signature according to the security level label.

[0017] In a second aspect, an embodiment of the present invention provides a QUIC communication method based on data classification for satellite communication, which is applied to a server. The method includes:

[0018] In response to the client hello sent by the client, the server determines the encryption algorithm, key agreement algorithm, and signature algorithm corresponding to each security level tag, and sends a server hello to the client, thereby completing the handshake between the client and the server;

[0019] The server performs key negotiation based on the key negotiation algorithm corresponding to the security level label.

[0020] The server receives the encrypted transmission data uploaded by the client according to the encryption algorithm corresponding to the security level label, decrypts the encrypted transmission data according to the security level label, and sends a confirmation message to the client, thereby completing the secure transmission of the data;

[0021] The server receives the transmission data uploaded by the client and its security level label, which is signed according to the signature algorithm corresponding to the security level label, verifies the signature of the transmission data according to the security level label, and sends a confirmation message to the client to confirm the authenticity and integrity of the transmission data.

[0022] In a third aspect, an embodiment of the present invention provides an electronic device, including:

[0023] at least one processor; and

[0024] a memory communicatively connected to the at least one processor; wherein,

[0025] The memory stores one or more computer programs that can be executed by the at least one processor, and the one or more computer programs are executed by the at least one processor to enable the at least one processor to execute the above-mentioned QUIC communication method based on data classification for satellite communication.

[0026] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, it implements the above-mentioned QUIC communication method based on data classification for satellite communication.

[0027] Compared with the prior art, the present invention has the following beneficial effects:

[0028] The present invention provides a QUIC communication method based on data classification for satellite communications. Satellite communication transmission data is classified according to security requirements, data sensitivity, and life cycle length, and different security level labels are assigned. Traditional cryptographic algorithms, hybrid cryptographic algorithms, and separate quantum-resistant cryptographic algorithms are used respectively, thereby effectively avoiding the problems of over-protection of low-sensitivity data and insufficient protection of high-sensitivity data. This not only meets the security requirements of satellite communications, but also efficiently utilizes communication resources. At the same time, the present invention flexibly selects traditional or quantum-resistant algorithms based on security level labels, avoiding the blind use of high-overhead quantum-resistant algorithms, and effectively reducing the computational burden and communication bandwidth consumption of satellite communication systems. Through the hierarchical application of traditional, hybrid, and quantum-resistant algorithms, a smooth migration of quantum-resistant cryptographic algorithms is gradually achieved, ensuring the long-term security of satellite communication systems in the quantum computing era. In addition, based on the existing QUIC and TLS protocols, the present invention achieves smooth compatibility and expansion of quantum-resistant algorithms through flexible negotiation of protocol extensions and algorithms, facilitates the rapid deployment of existing satellite communication equipment, and has protocol compatibility and easy scalability. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0030] Figure 1 A schematic diagram of a flow chart of data classification provided by an embodiment of the present invention;

[0031] Figure 2 A flowchart of a QUIC communication method based on data classification for satellite communications provided by an embodiment of the present invention;

[0032] Figure 3 A schematic diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0033] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0034] It should be noted that, unless there is any conflict, the features in the following embodiments and implementations may be combined with each other.

[0035] like Figure 1 As shown, the evaluation and classification process of satellite communication transmission data of the present invention includes:

[0036] Acquire the transmission data, perform a security assessment on the transmission data, divide the transmission data into a first security level, a second security level, and a third security level, package the transmission data of the first security level and add a first tag (i.e., Tag=1), package the transmission data of the second security level and add a second tag (i.e., Tag=2), and package the transmission data of the third security level and add a third tag (i.e., Tag=3).

[0037] Furthermore, this example categorizes transmitted data into security levels; specifically, three confidentiality levels are defined: Top Secret, Secret, and Confidential. Top Secret refers to information whose disclosure would cause particularly serious harm, such as satellite control keys; Confidential refers to information whose disclosure would cause serious harm, such as encryption algorithm parameters, military supporting technologies, and encrypted communication protocols; and Secret refers to information whose disclosure would cause some harm, such as project names, partner organizations, preliminary technical plans, and equipment models. In this example, public information is designated as the first security level, data classified as confidential and / or secret is designated as the second security level, and data classified as top secret is designated as the third security level.

[0038] Furthermore, in this example, data transmitted at the first security level has low data sensitivity and a short lifespan (<5 years). Even if it is cracked by quantum computers, the security risk is manageable, so only traditional cryptographic algorithms (such as AES and ECDH) are used. Data transmitted at the second security level has high data sensitivity and a medium-to-long lifespan (5-15 years). Compatibility with traditional cryptography is required, while a gradual transition to quantum-resistant algorithms is required. Hybrid cryptographic algorithms (such as ECDH + MLKEM key exchange, ECDSA + MLDSA signatures) can be used. Data transmitted at the third security level has extremely high data sensitivity and an extremely long lifespan (>15 years), requiring the use of quantum-resistant algorithms. Therefore, a dedicated quantum-resistant algorithm (such as MLKEM, MLDSA, or AES-256) is required.

[0039] It should be noted that the most important value of hybrid encryption is to provide a security mechanism for migrating to quantum-resistant algorithms before the quantum era arrives. Currently, traditional algorithms (such as ECDH, RSA, etc.) are widely used and very mature, with complete infrastructure, hardware acceleration, and standard systems. However, quantum-resistant cryptography (such as MLKEM, MLDSA) is relatively new, and its standards and hardware support are not yet widely mature. Hybrid encryption allows the system to transition between traditional algorithms and quantum-resistant algorithms, and to gradually and smoothly transition to quantum-resistant cryptography without completely abandoning traditional infrastructure. Even if quantum-resistant cryptography unexpectedly encounters security issues in the future, traditional cryptographic algorithms can be temporarily used to provide temporary protection for data, giving the data transmission system enough time to respond and replace the new algorithm. The specific implementation is:

[0040] Hybrid key exchange: ECDH and MLKEM algorithms are used to generate traditional and quantum shared keys respectively, and the final shared key is generated by combining them through HKDF; the expression is as follows:

[0041] K_final = HKDF(K_ECDH || K_MLKEM, salt, info)

[0042] Hybrid signature algorithm: The message is signed with both ECDSA and MLDSA, and the recipient needs to verify both. The expression is as follows:

[0043] Signature(M) = (ECDSA_Sign(M), MLDSA_Sign(M))

[0044] Hybrid encryption algorithm: Currently, there is no standardized symmetric quantum-resistant algorithm approved by NIST, and AES-256 is considered equally secure against quantum attacks. Therefore, this example uses AES-128 for tag=1 and AES-256 for tags=2 and 3. Keys generated using key encapsulation algorithms at different security levels are combined to achieve a hierarchical encryption algorithm.

[0045] like Figure 2 As shown, an embodiment of the present invention provides a QUIC communication method based on data classification for satellite communication, the method comprising the following steps:

[0046] In step S1, the client sends a client hello to the server. In response to the client hello, the server determines the encryption algorithm and key agreement algorithm used for the transmitted data corresponding to each security level tag, and then sends a server hello to the client. This completes the handshake between the client and the server.

[0047] Specifically, step S1 includes the following sub-steps:

[0048] In step S101, the client sends a client hello (i.e., ClientHello message) to the server, along with a list of encryption algorithms supported by the client and a security level label; wherein the list of encryption algorithms supported by the client includes traditional cryptographic algorithms such as ECDH and quantum-resistant cryptographic algorithms such as MLKEM.

[0049] In step S102 , the server configures a corresponding encryption algorithm in response to the encryption algorithm list supported by the client and the security level label sent by the client.

[0050] Specifically, in this example, when the security level tag corresponding to the transmitted data is the first tag, that is, Tag=1, a traditional cryptographic algorithm is used, such as ECDH; when the security level tag corresponding to the transmitted data is the second tag, that is, Tag=2, a mixture of traditional cryptographic algorithms and quantum-resistant algorithms is used, such as a combination of ECDH and MLKEM; when the security level tag corresponding to the transmitted data is the third tag, that is, Tag=3, only a quantum-resistant algorithm is used, such as MLKEM.

[0051] In step S103, the server sends a server greeting (ie, a ServerHello message) to the client so that the client can understand the encryption algorithm determined to be used in this communication.

[0052] In step S2, the client and the server generate and negotiate keys based on the security level label.

[0053] Specifically, step S2 includes the following sub-steps:

[0054] In step S201, the client generates a corresponding key according to the key agreement algorithm corresponding to each security level label.

[0055] Specifically, when the security level tag corresponding to the transmitted data is the first tag, that is, Tag=1, the client generates a first traditional public-private key pair based on the traditional cryptographic algorithm; when the security level tag corresponding to the transmitted data is the second tag, that is, Tag=2, the client generates the first traditional public-private key pair based on the traditional cryptographic algorithm, generates the first quantum-resistant public-private key pair based on the quantum-resistant algorithm, and combines the first traditional public-private key pair and the first quantum-resistant public-private key pair through a key derivation function; when the security level tag corresponding to the transmitted data is the third tag, that is, Tag=3, the client generates the first quantum-resistant public-private key pair only based on the quantum-resistant algorithm.

[0056] Exemplarily, when the security level tag corresponding to the transmitted data is the first tag, that is, Tag=1, the client generates a first ECDH public-private key pair; when the security level tag corresponding to the transmitted data is the second tag, that is, Tag=2, the client generates the first ECDH public-private key pair and the first MLKEM public-private key pair, and combines them through a key derivation function (such as HKDF); when the security level tag corresponding to the transmitted data is the third tag, that is, Tag=3, the client only generates the first MLKEM public-private key pair.

[0057] In step S202 , the client sends the first public key of the key agreement algorithm corresponding to each security level tag to the server via a client key exchange message (ie, ClientKeyExchange message).

[0058] Specifically, when the security level tag corresponding to the transmitted data is the first tag, that is, Tag=1, the client sends the first traditional public key to the server; when the security level tag corresponding to the transmitted data is the second tag, that is, Tag=2, the client sends a combination of the first traditional public key and the first quantum-resistant public key to the server; when the security level tag corresponding to the transmitted data is the third tag, that is, Tag=3, the client sends the first quantum-resistant public key to the server.

[0059] Exemplarily, when the security level tag corresponding to the transmitted data is the first tag, that is, Tag=1, the client sends the first ECDH public key to the server; when the security level tag corresponding to the transmitted data is the second tag, that is, Tag=2, the client sends a combination of the first ECDH public key and the first MLKEM public key to the server; when the security level tag corresponding to the transmitted data is the third tag, that is, Tag=3, the client sends the first MLKEM public key to the server.

[0060] In step S203, in response to the client key exchange message, the server generates a corresponding key based on the key negotiation algorithm corresponding to each security level label, and combines the public key of the encryption algorithm corresponding to each security level label sent by the client to generate a shared key of the encryption algorithm corresponding to each security level label; and obtains the server key negotiation data.

[0061] Specifically, when the security level tag corresponding to the transmitted data is the first tag, that is, Tag=1, the server generates a second traditional public-private key pair, uses the first traditional public key and the second traditional private key to generate a traditional shared key, and uses the second traditional public key as the server key negotiation data; when the security level tag corresponding to the transmitted data is the second tag, that is, Tag=2, the server generates a second traditional public-private key pair, uses the first traditional public key and the second traditional private key to generate a traditional shared key, uses the first quantum-resistant public key to generate a quantum-resistant shared key and a quantum-resistant ciphertext, combines the traditional shared key and the quantum-resistant shared key as the final combined shared key, and uses the second traditional public key and the quantum-resistant ciphertext as the server key negotiation data; when the security level tag corresponding to the transmitted data is the third tag, that is, Tag=3, the server uses the first quantum-resistant public key to generate a quantum-resistant shared key and a quantum-resistant ciphertext, and uses the quantum-resistant ciphertext as the server key negotiation data.

[0062] Exemplarily, when the security level tag corresponding to the transmitted data is the first tag, that is, Tag=1, the server generates a second ECDH public-private key pair, uses the first ECDH public key and the second ECDH private key to generate an ECDH shared key, and uses the second ECDH public key as the server key negotiation data; when the security level tag corresponding to the transmitted data is the second tag, that is, Tag=2, the server generates a second ECDH public-private key pair, uses the first ECDH public key and the second ECDH private key to generate an ECDH shared key, uses the first MLKEM public key to generate an MLKEM shared key and an MLKEM ciphertext, combines the ECDH shared key and the MLKEM shared key as the final combined shared key, and uses the second ECDH public key and the MLKEM ciphertext as the server key negotiation data; when the security level tag corresponding to the transmitted data is the third tag, that is, Tag=3, the server uses the first MLKEM public key to generate an MLKEM shared key and an MLKEM ciphertext, and uses the MLKEM ciphertext as the server key negotiation data.

[0063] In step S204 , the server sends server key negotiation data corresponding to each security level tag to the client via a server key exchange message (ie, ServerKeyExchange message).

[0064] Specifically, when the security level tag corresponding to the transmitted data is the first tag, that is, Tag=1, the server sends the second traditional public key to the client; when the security level tag corresponding to the transmitted data is the second tag, that is, Tag=2, the server sends the second traditional public key and quantum-resistant ciphertext to the client; when the security level tag corresponding to the transmitted data is the third tag, that is, Tag=3, the server sends quantum-resistant ciphertext to the client.

[0065] Exemplarily, when the security level tag corresponding to the transmitted data is the first tag, that is, Tag=1, the server sends the second ECDH public key to the client; when the security level tag corresponding to the transmitted data is the second tag, that is, Tag=2, the server sends the second ECDH public key and MLKEM ciphertext to the client; when the security level tag corresponding to the transmitted data is the third tag, that is, Tag=3, the server sends MLKEM ciphertext to the client.

[0066] In step S205 , in response to the server key exchange message (ie, ServerKeyExchange message), the client generates a shared key of the key agreement algorithm corresponding to each security level tag in combination with the server key agreement data sent by the server.

[0067] Specifically, when the security level tag corresponding to the transmitted data is the first tag, that is, Tag=1, the client uses the first traditional private key and the second traditional public key to generate a traditional shared key; when the security level tag corresponding to the transmitted data is the second tag, that is, Tag=2, the client uses the first traditional private key and the second traditional public key to generate a traditional shared key, uses the first quantum-resistant private key and the quantum-resistant ciphertext to generate a quantum-resistant shared key, and combines the traditional shared key and the quantum-resistant shared key to obtain the final shared key; when the security level tag corresponding to the transmitted data is the third tag, that is, Tag=3, the client uses the first quantum-resistant private key and the quantum-resistant ciphertext to generate a quantum-resistant shared key.

[0068] Exemplarily, when the security level tag corresponding to the transmitted data is the first tag, that is, Tag=1, the client uses the first ECDH private key and the second ECDH public key to generate an ECDH shared key; when the security level tag corresponding to the transmitted data is the second tag, that is, Tag=2, the client uses the first ECDH private key and the second ECDH public key to generate an ECDH shared key, uses the first MLKEM private key and the MLKEM ciphertext to generate an MLKEM shared key, and combines the ECDH shared key and the MLKEM shared key as the final combined shared key; when the security level tag corresponding to the transmitted data is the third tag, that is, Tag=3, the client uses the first MLKEM private key and the MLKEM ciphertext to generate an MLKEM shared key.

[0069] In step S206, the server sends a completion message (i.e., a Finished message) to the client, and the client sends a completion message (i.e., a Finished message) to the server. The server and the client confirm to each other through the Finished message that the key negotiation has been successfully completed.

[0070] In step S3, the client encrypts the transmission data according to the security level label and uploads the encrypted transmission data to the server; the server decrypts the encrypted transmission data according to the security level label, thereby completing the secure transmission of the data.

[0071] Specifically, step S3 includes the following sub-steps:

[0072] In step S301 , the client confirms the encryption method of the transmission data of each security level according to the security level label, and encrypts the transmission data of each security level.

[0073] Specifically, in this example, when the security level tag corresponding to the transmitted data is the first tag, that is, Tag=1, AES-128 is used to encrypt the data, and the encryption key is derived from the shared key negotiated by ECDH; when the security level tag corresponding to the transmitted data is the second tag, that is, Tag=2, AES-256 is used to encrypt the data, and the key is derived from the shared key negotiated by the aforementioned ECDH and MLKEM; when the security level tag corresponding to the transmitted data is the third tag, that is, Tag=3, AES-256 is used to encrypt the data, and the encryption key is derived from the shared key negotiated by MLKEM.

[0074] In step S302, the client sends the encrypted transmission data and its corresponding security level label to the server via a QUIC STREAM data frame.

[0075] In step S303, the server selects a corresponding decryption method according to the security level label, and decrypts the encrypted transmission data of each security level to obtain its plain text.

[0076] In step S304 , after successful decryption, the server sends a confirmation message (ie, an ACK message) to the client to confirm that the decryption and reception of the transmitted data are successful.

[0077] In step S4, the client signs the transmission data according to the security level label, and uploads the signed transmission data and its security level label to the server; the server verifies the signature according to the security level label.

[0078] Specifically, step S4 includes the following sub-steps:

[0079] Step S401: The client signs the transmitted data according to the security level label;

[0080] Specifically, when the security level tag corresponding to the transmitted data is the first tag, that is, Tag=1, the client signs the transmitted data based on the traditional cryptographic algorithm; when the security level tag corresponding to the transmitted data is the second tag, that is, Tag=2, the client double-signs the transmitted data based on the traditional cryptographic algorithm and the quantum-resistant algorithm; when the security level tag corresponding to the transmitted data is the third tag, that is, Tag=3, the client only double-signs the transmitted data based on the quantum-resistant algorithm.

[0081] Exemplarily, when the security level tag corresponding to the transmitted data is the first tag, that is, Tag=1, the client signs the transmitted data based on the ECDSA algorithm; when the security level tag corresponding to the transmitted data is the second tag, that is, Tag=2, the client double-signs the transmitted data based on the ECDSA and MLDSA algorithms; when the security level tag corresponding to the transmitted data is the third tag, that is, Tag=3, the client uses a separate MLDSA algorithm to sign the transmitted data.

[0082] In step S402, the client sends the signed transmission data and its security level label to the server via a QUIC STREAM data frame.

[0083] In step S403, the server receives the signed transmission data and its security level label sent by the client, and performs signature verification on the transmission data according to the security level label.

[0084] Specifically, when the security level tag corresponding to the transmitted data is the first tag, that is, Tag=1, the server only verifies the traditional cryptographic signature; when the security level tag corresponding to the transmitted data is the second tag, that is, Tag=2, the server verifies the traditional cryptographic signature and the quantum-resistant signature; when the security level tag corresponding to the transmitted data is the third tag, that is, Tag=3, the server only verifies the quantum-resistant signature.

[0085] For example, when the security level tag corresponding to the transmitted data is the first tag, that is, Tag=1, the server only verifies the ECDSA signature; when the security level tag corresponding to the transmitted data is the second tag, that is, Tag=2, the server verifies the ECDSA and MLDSA dual signatures; when the security level tag corresponding to the transmitted data is the third tag, that is, Tag=3, the server only verifies the quantum-resistant signature algorithm MLDSA signature.

[0086] In step S404, after completing the signature verification, the server sends a confirmation message (ie, an ACK message) to the client to feedback to the client that the signature verification is successful, thereby confirming the authenticity and integrity of the transmitted data.

[0087] Accordingly, the present application also provides an electronic device, comprising: one or more processors; a memory for storing one or more programs; when the one or more programs are executed by the one or more processors, the one or more processors implement the above-mentioned QUIC communication method based on data classification for satellite communication. Figure 3 As shown, a hardware structure diagram of a QUIC communication method based on data classification for satellite communication provided by an embodiment of the present invention is provided for any device with data processing capabilities, except Figure 3In addition to the processor, memory, and network interface shown, any device with data processing capabilities in which the apparatus in the embodiment is located may also include other hardware, generally based on the actual functions of the device with data processing capabilities, which will not be described in detail.

[0088] Accordingly, the present application also provides a computer-readable storage medium having computer instructions stored thereon, which, when executed by a processor, implement a QUIC communication method based on data classification for satellite communications as described above. The computer-readable storage medium may be an internal storage unit of any device with data processing capabilities as described in any of the aforementioned embodiments, such as a hard disk or memory. The computer-readable storage medium may also be an external storage device, such as a plug-in hard disk, a smart media card (SMC), an SD card, a flash card, etc. equipped on the device. Furthermore, the computer-readable storage medium may also include both an internal storage unit and an external storage device of any device with data processing capabilities. The computer-readable storage medium is used to store the computer program and other programs and data required by any device with data processing capabilities, and may also be used to temporarily store data that has been output or is to be output.

[0089] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the contents disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The description and examples are to be considered as exemplary only.

[0090] It will be understood that the present application is not limited to the exact construction that has been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof.

Claims

1. A QUIC communication method based on data classification for satellite communication, characterized in that: Applied to a client, the method includes: The client sends a client hello to the server and receives a server hello from the server, thus completing the handshake between the client and the server. The server hello is generated by the server in response to the client hello to determine the encryption algorithm, key agreement algorithm, and signature algorithm corresponding to each security level tag. The client generates and negotiates keys based on the key negotiation algorithm corresponding to the security level tag of the transmitted data. The client encrypts the transmitted data according to the encryption algorithm corresponding to the security level label and uploads the encrypted transmitted data to the server; it receives a confirmation message from the server to confirm that the server has completed decryption of the encrypted transmitted data according to the security level label, thereby completing the secure transmission of the data; The client signs the transmitted data according to the signature algorithm corresponding to the security level label, and uploads the signed transmitted data and its security level label to the server; it receives a confirmation message sent by the server to confirm that the server has completed the verification signature according to the security level label.

2. A QUIC communication method based on data classification for satellite communication according to claim 1, characterized in that: The process of determining the encryption algorithm, key agreement algorithm, and signature algorithm corresponding to each security level label includes: Get the transmission data; Performing a security assessment on the transmitted data, dividing the transmitted data into a first security level, a second security level, and a third security level, and marking the transmitted data corresponding to each security level with a security level label, including: adding a first label to the transmitted data of the first security level after packaging, adding a second label to the transmitted data of the second security level after packaging, and adding a third label to the transmitted data of the third security level after packaging; If the security level label corresponding to the transmitted data is the first label, the traditional cryptographic algorithm is used; if the security level label corresponding to the transmitted data is the second label, a mixture of the traditional cryptographic algorithm and the quantum-resistant algorithm is used; if the security level label corresponding to the transmitted data is the third label, only the quantum-resistant algorithm is used.

3. The QUIC communication method based on data classification for satellite communication according to claim 1, characterized in that: Based on the security level label, the client's key generation and key negotiation process includes: The client generates a corresponding first public-private key pair according to the key agreement algorithm corresponding to each security level label, and sends the first public key to the server; wherein the first public key is used by the server to generate a shared key; The client receives server-side key negotiation data corresponding to each security level label sent by the server; the server-side key negotiation data is generated by the server according to the key negotiation algorithm corresponding to each security level label; The client uses the first private key to negotiate key data with the server to generate a shared key for the key negotiation algorithm corresponding to each security level label; The client sends a completion message to the server to confirm that the key negotiation is complete.

4. A QUIC communication method based on data classification for satellite communication according to claim 3, characterized in that: The client generates a corresponding first public-private key pair according to the key agreement algorithm corresponding to each security level label, and sends the first public key to the server in the following process: When the security level label corresponding to the transmitted data is the first label, the client generates a first traditional public-private key pair based on a traditional cryptographic algorithm and sends the first traditional public key to the server; When the security level label corresponding to the transmitted data is the second label, the client generates a first traditional public-private key pair based on a traditional cryptographic algorithm, generates a first quantum-resistant public-private key pair based on a quantum-resistant algorithm, combines the first traditional public-private key pair and the first quantum-resistant public-private key pair through a key derivation function, and sends the combination of the first traditional public key and the first quantum-resistant public key to the server. When the security level label corresponding to the transmitted data is the third label, the client only generates a first quantum-resistant public-private key pair based on the quantum-resistant algorithm and sends the first quantum-resistant public key to the server.

5. The QUIC communication method based on data classification for satellite communication according to claim 3, characterized in that: The process of the client using the first private key to negotiate data with the server to generate a shared key for the key negotiation algorithm corresponding to each security level tag includes: When the security level tag corresponding to the transmitted data is a first tag, the client generates a traditional shared key using the first traditional private key and the second traditional public key; wherein the second traditional public key is generated by the server according to the key agreement algorithm corresponding to the first tag; When the security level label is the second label, the client uses the first traditional private key and the second traditional public key to generate a traditional shared key, uses the first quantum-resistant private key and the quantum-resistant ciphertext to generate a quantum-resistant shared key, and combines the traditional shared key and the quantum-resistant shared key to obtain a combined shared key; wherein the second traditional public key and the quantum-resistant ciphertext are generated by the server according to the key agreement algorithm corresponding to the second label; When the security level label is the third label, the client uses the first quantum-resistant private key and the quantum-resistant ciphertext to generate a quantum-resistant shared key; wherein, the quantum-resistant ciphertext is generated by the server according to the key agreement algorithm corresponding to the third label.

6. A QUIC communication method based on data classification for satellite communication, characterized in that: Applied to the server, the method includes: In response to the client hello sent by the client, the server determines the encryption algorithm, key agreement algorithm, and signature algorithm corresponding to each security level tag, and sends a server hello to the client, thereby completing the handshake between the client and the server; The server performs key negotiation based on the key negotiation algorithm corresponding to the security level label. The server receives the encrypted transmission data uploaded by the client according to the encryption algorithm corresponding to the security level label, decrypts the encrypted transmission data according to the security level label, and sends a confirmation message to the client, thereby completing the secure transmission of the data; The server receives the transmission data uploaded by the client and its security level label, which is signed according to the signature algorithm corresponding to the security level label, verifies the signature of the transmission data according to the security level label, and sends a confirmation message to the client to confirm the authenticity and integrity of the transmission data.

7. A QUIC communication method based on data classification for satellite communication according to claim 6, characterized in that: Based on the security level label, the server's key generation and key negotiation process includes: In response to the client key exchange message, the server generates a shared key for the key agreement algorithm corresponding to each security level label by combining the first public key, and obtains server key agreement data; wherein the first public key is generated by the client according to the key agreement algorithm corresponding to each security level label; Send the server-side key negotiation data of the key negotiation algorithm corresponding to each security level tag to the client; The server sends a completion message to the client to confirm that the key negotiation is complete.

8. A QUIC communication method based on data classification for satellite communication according to claim 7, characterized in that: The process by which the server generates a shared key for the key agreement algorithm corresponding to each security level tag includes: When the security level label corresponding to the transmitted data is the first label, the server generates a second traditional public-private key pair based on a traditional cryptographic algorithm, generates a traditional shared key based on the first traditional public key and the second traditional private key, and uses the second traditional public key as the server key negotiation data; wherein the first traditional public key is generated by the client according to the key negotiation algorithm corresponding to the first label; When the security level label corresponding to the transmitted data is the second label, the server generates a second traditional public-private key pair based on a traditional cryptographic algorithm, generates a traditional shared key based on the first traditional public key and the second traditional private key, generates a quantum-resistant shared key and a quantum-resistant ciphertext based on the first quantum-resistant public key, combines the traditional shared key and the quantum-resistant shared key as a combined shared key, and uses the second traditional public key and the quantum-resistant ciphertext as server-side key negotiation data; wherein the first traditional public key and the first quantum-resistant public key are generated by the client according to the key negotiation algorithm corresponding to the second label; When the security level label corresponding to the transmitted data is the third label, the server generates a quantum-resistant shared key and quantum-resistant ciphertext based on the first quantum-resistant public key, and uses the quantum-resistant ciphertext as the server key negotiation data; wherein, the first quantum-resistant public key is generated by the client according to the key negotiation algorithm corresponding to the third label.

9. An electronic device, characterized in that: include: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores one or more computer programs that can be executed by the at least one processor, and the one or more computer programs are executed by the at least one processor to enable the at least one processor to execute the QUIC communication method based on data classification for satellite communication as described in any one of claims 1-8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, it implements the QUIC communication method based on data classification for satellite communication as described in any one of claims 1 to 8.

Images