Encryption method, system and related devices in a satellite communication system

Abstract

This application discloses an encryption method, system, and related apparatus in a satellite communication system. This application relates to the field of satellite communication. The transmitting device can divide the original data into i sub-integers and one zero packet, where i is an integer greater than or equal to zero. The data length of each sub-integer is a first specified length, and the length of the zero packet is less than the first specified length. The transmitting device can obtain encrypted integer packets based on the integer packets. The transmitting device can pad the zero packet to the first specified length, and then perform a bitwise XOR operation on the padded zero packet and the zero packet encryption vector to obtain encrypted zero packets. The transmitting device extracts the data corresponding to the zero packets in the encrypted zero packets to obtain the resulting zero packets. The transmitting device can obtain application layer messages based on the encrypted integer packets and the encrypted zero packets. The transmitting device improves the processing speed of obtaining zero packets and saves the transmission interface resources occupied by padding data.

Description

Technical Field

[0001] This application relates to the field of satellite communications, and in particular to an encryption method, system and related apparatus in a satellite communication system. Background Technology

[0002] The BeiDou short message service is one of the distinctive features of the BeiDou Navigation Satellite System compared to other global positioning and navigation systems such as the US Global Positioning System (GPS) and Russia's Global Navigation Satellite System (GLONASS). It is particularly suitable for positioning and communication in areas such as oceans, deserts, grasslands, and uninhabited areas where mobile communication is unavailable, lacks coverage, or has been damaged. The BeiDou short message service communication system has undergone technical upgrades, and some necessary resources have been made available for civilian use. Communication protocols need to be designed based on the characteristics of the BeiDou short message service communication system, taking into account the specific needs of civilian services and equipment.

[0003] To ensure data security, data needs to be encrypted before transmission between the terminal and BeiDou network equipment. Currently, encryption between the terminal and BeiDou network equipment may generate redundant data, wasting the air interface resources of the BeiDou communication system. Summary of the Invention

[0004] This application provides an encryption method, system, and related apparatus in a BeiDou communication system. This application relates to the field of satellite communication. The transmitting device divides the original data into i sub-integers and one zero packet, where i is an integer greater than or equal to zero. The data length of each sub-integer is a first specified length, and the length of the zero packet is less than the first specified length. The transmitting device obtains encrypted integer packets based on the integer packets. The transmitting device fills the zero packet to the first specified length, and then performs a bitwise XOR operation on the filled zero packet and the zero packet encryption vector to obtain an encrypted zero packet. The transmitting device extracts the data corresponding to the zero packet from the encrypted zero packet to obtain the result zero packet. The transmitting device can obtain application layer messages based on the encrypted integer packets and the encrypted zero packet. In this way, the transmitting device improves the processing speed of obtaining the zero packet and saves the transmission interface resources occupied by filling data, ensuring the security of data transmission.

[0005] Firstly, this application provides an encryption method in a BeiDou communication system, comprising: a terminal adding padding data to the end of a zero packet in the original data up to a first specified length to obtain a padded zero packet. The data length of the zero packet is a second specified length. The first specified length is greater than the second specified length. The terminal performs a bitwise XOR operation on the padded zero packet and the zero packet encryption vector to obtain an encrypted zero packet. The terminal extracts data of a second specified length from the header of the encrypted zero packet to obtain a result zero packet. The terminal sends an application layer message to the BeiDou network device. The application layer message includes the result zero packet.

[0006] The encryption method provided in this application for the BeiDou communication system can improve the processing speed of obtaining zero packets and save the transmission air interface resources occupied by filling data, thus saving the resources of the BeiDou communication system and ensuring data security.

[0007] In one possible implementation, the original data further includes i sub-integer packets, where i is a positive integer. The method also includes: the terminal obtaining an encrypted integer packet based on the i sub-integer packets. The data length of each sub-integer packet is a first specified length, and the application layer message also includes the encrypted integer packet.

[0008] In one possible implementation, the terminal obtains the encrypted whole block based on i sub-blocks. Specifically, the terminal obtains the encrypted vector of the a-th sub-block from the i sub-blocks and its initial vector, where a is less than or equal to i. The terminal uses an encryption algorithm to determine the encrypted sub-block of the a-th sub-block using the encryption vector and the encryption key. The encryption key is a data segment of a first specified length from the original key, and it differs from the initial vector of the a-th sub-block. The terminal concatenates the encrypted sub-blocks of the i sub-blocks together to obtain the encrypted whole block. The encryption algorithm can be SM4, SM3, etc., and this application does not limit this.

[0009] In one possible implementation, the method further includes: when a equals 1, the initial vector of the a-th sub-block is a data segment of a first specified length in the original key. When a is greater than 1, the initial vector of the a-th sub-block is the encrypted sub-block of the (a-1)-th sub-block, or the initial vector of the a-th sub-block is a data segment of a first specified length in the original key. The encryption key and the initial vector can be a data segment of a first specified length composed of any non-repeating bits in the original key, and the encryption key and the initial vector are different. Optionally, the encryption key and the initial vector can be different preset data segments of the first specified length.

[0010] In one possible implementation, the application layer message also includes message header information, which includes an encryption indicator field. This encryption indicator field indicates the encryption algorithm used by the terminal when generating the application layer message. The encryption algorithm can be SM4, SM3, etc., and this application does not limit this choice.

[0011] In one possible implementation, before the terminal adds padding data to the end of the zero-groups in the original data up to a first specified length, the method further includes: the terminal determining the number of sub-integer groups as i based on the data length of the original data and the first specified length. The terminal divides the i data segments of the first specified length starting from the beginning position in the original data into i sub-integer groups. The terminal determines the data segments in the original data after the i sub-integer groups as zero-groups.

[0012] In one possible implementation, before obtaining the encrypted zero block based on the padded zero block and the zero block encryption vector, the method further includes: the terminal obtaining the zero block encryption vector based on the zero block initialization vector and the encryption key using an encryption algorithm. Here, the zero block initialization vector is a data segment of a first specified length in the original key. Here, the encryption key is a data segment of a first specified length in the original key, and the encryption key is different from the zero block initialization vector.

[0013] In one possible implementation, before obtaining the encrypted zero block based on the padded zero block and the zero block encryption vector, the method further includes: the terminal obtaining the zero block encryption vector based on the zero block initialization vector and the encryption key using an encryption algorithm. Here, the zero block initialization vector is the encrypted sub-integer corresponding to the a-th sub-integer block. And the encryption key is a data segment of a first specified length in the original key.

[0014] In one possible implementation, before the terminal performs a bitwise XOR operation on the padding zero block and the zero block encryption vector to obtain the encrypted zero block, the method further includes: the terminal obtaining the original key from the cellular network. Optionally, the terminal and the BeiDou network device negotiate to obtain the original key through the BeiDou network. Optionally, the terminal and the BeiDou network device have the original key pre-set.

[0015] In one possible implementation, the first specified length is 128 bits.

[0016] In one possible implementation, the data length of the resulting zero group is the same as the data length of the zero group.

[0017] Secondly, this application provides another encryption method in a BeiDou communication system, comprising: a BeiDou network device receiving an application layer message sent by a terminal, the application layer message including a result zero packet. The data length of the result zero packet is a second specified length. The BeiDou network device adds padding data to the end of the result zero packet to obtain a result-padded zero packet. The data length of the result-padded zero packet is a first specified length. The BeiDou network device performs a bitwise XOR operation on the result-padded zero packet and the zero packet encryption vector to obtain a decrypted zero packet. The BeiDou network device extracts the second specified length of data from the header of the decrypted zero packet to obtain the zero packet in the original data.

[0018] In one possible implementation, the application layer message also includes encrypted integer packets. The method further includes: the BeiDou network device obtaining i sub-integer packets from the original data based on the encrypted integer packets. The data length of each sub-integer packet is a first specified length, where i is a positive integer. The BeiDou network device concatenates the i sub-integer packets and a zero packet to obtain the original data.

[0019] In one possible implementation, before the BeiDou network device obtains i sub-groups from the original data based on the encrypted whole groups, the method further includes: the BeiDou network device determining the number of encrypted sub-groups as i based on the data length of the encrypted data and a first specified length. Here, the encrypted data consists of concatenated encrypted whole groups and result zero groups. The BeiDou network device divides the i data segments of the first specified length, starting from the beginning position in the encrypted data, into encrypted whole groups. Each encrypted whole group includes i encrypted sub-groups. The BeiDou network device identifies the data segments following the i encrypted sub-groups in the encrypted data as result zero groups.

[0020] In one possible implementation, the BeiDou network device obtains i sub-integer blocks from the original data based on encrypted integer blocks. Specifically, this includes: the BeiDou network device, based on the a-th encrypted sub-integer block and the encryption key, determines the integer encryption vector of the a-th encrypted sub-integer block using an encryption algorithm, where a is less than or equal to i. The encryption key is a data segment of a first specified length in the original key. The BeiDou network device obtains sub-integer blocks of the a-th encrypted sub-integer block based on the integer encryption vector and the initial vector of the a-th encrypted sub-integer block. The initial vector of the a-th encrypted sub-integer block is different from the encryption key. The encryption algorithm can be SM4, SM3, etc., and this application does not limit this.

[0021] In one possible implementation, when a equals 1, the initial vector of the a-th sub-block is a data segment of a first specified length in the original key. When a is greater than 1, the initial vector of the a-th encrypted sub-block is the (a-1)-th encrypted sub-block, or a data segment of a first specified length in the original key. The encryption key and the initial vector can be a data segment of a first specified length composed of any non-repeating bits from the original key, and the encryption key and the initial vector are different. Optionally, the encryption key and the initial vector can be different preset data segments of the first specified length.

[0022] In one possible implementation, before the BeiDou network device performs a bitwise XOR operation on the result to fill in zero packets and the zero packet encryption vector to obtain the decrypted zero packets, the method further includes: the application layer message also includes message header information. The message header information includes an encryption indicator field. The BeiDou network device determines the encryption algorithm used by the terminal when generating the application layer message based on the encryption indicator field. The encryption algorithm can be the SM4 algorithm, the SM3 algorithm, etc., and this application does not limit this.

[0023] In one possible implementation, before the BeiDou network device performs a bitwise XOR operation on the result-filled zero-block and zero-block encryption vector to obtain the decrypted zero-block, the method further includes: the BeiDou network device obtaining the zero-block encryption vector based on the zero-block initialization vector and the encryption key using an encryption algorithm. Here, the zero-block initialization vector is a data segment of a first specified length in the original key. Here, the encryption key is a data segment of a first specified length in the original key, and the zero-block initialization vector and the encryption key are different.

[0024] In one possible implementation, before the BeiDou network device performs a bitwise XOR operation on the result-filled zero-block and zero-block encryption vector to obtain the decrypted zero-block, the method further includes: the BeiDou network device obtaining the zero-block encryption vector based on the zero-block initial vector and the encryption key using an encryption algorithm. Here, the zero-block initial vector is the a-th encrypted sub-block. And the encryption key is the first specified length data segment in the original key.

[0025] In one possible implementation, before the BeiDou network device performs a bitwise XOR operation on the result to fill in zero packets and the zero-packet encryption vector to obtain the decrypted zero packets, the method further includes: the BeiDou network device obtaining the original key from the cellular network. Optionally, the terminal and the BeiDou network device negotiate to obtain the original key through the BeiDou network. Optionally, the terminal and the BeiDou network device have the original key preset.

[0026] Thirdly, this application provides a BeiDou communication system, including: a terminal and BeiDou network equipment; wherein,

[0027] A terminal is used to add padding data to the end of zero groups in the original data up to a first specified length to obtain padding zero groups; wherein the data length of the zero groups is a second specified length; wherein the first specified length is greater than the second specified length;

[0028] The terminal is also used to perform a bitwise XOR operation on the padding zero block and the zero block encryption vector to obtain the encryption zero block;

[0029] The terminal is also used to extract data of a second specified length from the header of the encrypted null packet to obtain the result null packet;

[0030] The terminal is also used to send application layer messages to BeiDou network equipment; among which, the application layer messages include result zero packets;

[0031] Beidou network equipment is used to receive application layer messages;

[0032] The BeiDou network equipment is also used to add padding data to the end of the result zero group to obtain the result zero-padded group; wherein the data length of the result zero-padded group is a first specified length;

[0033] Beidou network equipment is also used to perform bitwise XOR operations on the results filled with zero packets and the zero packet encryption vector to obtain decrypted zero packets;

[0034] Beidou network equipment is also used to intercept the second specified length of data in the header of the decrypted zero packet to obtain the zero packet in the original data.

[0035] Fourthly, this application provides a communication device including one or more processors, one or more memories, and a transceiver. The transceiver, the one or more memories, and the one or more processors are coupled together. The one or more memories are used to store computer program code, which includes computer instructions. When the one or more processors execute the computer instructions, the communication device performs the method in any of the possible implementations of the first aspect described above.

[0036] The communication device can be a terminal or other product-type equipment.

[0037] Fifthly, this application provides a communication device including one or more processors, one or more memories, and a transceiver. The transceiver, the one or more memories, and the one or more processors are coupled together. The one or more memories are used to store computer program code, which includes computer instructions. When the one or more processors execute the computer instructions, the communication device performs the method in any of the possible implementations of the second aspect described above.

[0038] The communication device can be a BeiDou network device, or any network element or a combination of multiple network elements in a BeiDou network device.

[0039] In a sixth aspect, this application provides a computer storage medium including computer instructions that, when executed on a computer, cause the computer to perform the method in any possible implementation of the first aspect described above.

[0040] In a seventh aspect, this application provides a computer storage medium including computer instructions that, when executed on a computer, cause the computer to perform the method in any possible implementation of the second aspect described above.

[0041] Eighthly, this application provides a computer program product that, when run on a computer, causes the computer to perform the method in any possible implementation of the first aspect described above.

[0042] Ninthly, this application provides a computer program product that, when run on a computer, causes the computer to perform the method in any possible implementation of the second aspect described above.

[0043] In a tenth aspect, this application provides a chip or chip system for use in a terminal, including a processing circuit and an interface circuit. The interface circuit is used to receive code instructions and transmit them to the processing circuit, and the processing circuit is used to execute the code instructions to perform the method in any possible implementation of the first aspect described above. Attached Figure Description

[0044] Figure 1 This application provides a schematic diagram of the architecture of a BeiDou communication system.

[0045] Figure 2A A schematic diagram of the protocol encapsulation architecture for inbound data of a Beidou communication system provided in this application embodiment;

[0046] Figure 2B A schematic diagram of the protocol parsing architecture for inbound data of a Beidou communication system is provided for embodiments of this application;

[0047] Figure 3A A schematic diagram of the protocol encapsulation architecture for outbound data of a Beidou communication system provided in this application embodiment;

[0048] Figure 3B A schematic diagram of the protocol parsing architecture for outbound data of a Beidou communication system provided in this application embodiment;

[0049] Figure 4 This application provides a schematic diagram illustrating the division of raw data into whole packets and zero packets in a BeiDou communication system.

[0050] Figure 5This application provides a schematic diagram of a process for obtaining encrypted integer packets in a BeiDou communication system.

[0051] Figure 6 This application provides a schematic diagram of obtaining sub-zero packets in a BeiDou communication system.

[0052] Figure 7 A flowchart illustrating the encryption of zero packets in a BeiDou communication system is provided as an embodiment of this application.

[0053] Figure 8 This application provides a schematic diagram of bitwise XOR operation in a BeiDou communication system.

[0054] Figure 9 This application provides a schematic diagram of the encryption process of an encryption method in a BeiDou communication system.

[0055] Figure 10 This application provides a schematic diagram of the decryption process of an encryption method in a BeiDou communication system, as illustrated in an embodiment of the present application.

[0056] Figure 11 A schematic diagram of the encryption process for another encryption method in a BeiDou communication system provided in this application embodiment;

[0057] Figure 12 A schematic diagram of the hardware structure of a terminal 100 provided in an embodiment of this application;

[0058] Figure 13 A flowchart illustrating an encryption method in a BeiDou communication system provided in this application embodiment;

[0059] Figure 14 This is a schematic diagram of the structure of a communication device provided in an embodiment of this application;

[0060] Figure 15 This is a schematic diagram of another communication device provided in an embodiment of this application;

[0061] Figure 16 This is a schematic diagram of another communication device provided in an embodiment of this application;

[0062] Figure 17 This is a schematic diagram of another communication device provided in an embodiment of this application. Detailed Implementation

[0063] The technical solutions in the embodiments of this application will be clearly and thoroughly described below with reference to the accompanying drawings. In the description of the embodiments of this application, unless otherwise stated, " / " means "or," for example, A / B can mean A or B; the word "and / or" in the text is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone.

[0064] Hereinafter, the terms "first" and "second" are used for descriptive purposes only and should not be construed as implying or suggesting relative importance or implicitly indicating the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature, and in the description of the embodiments of this application, unless otherwise stated, "multiple" means two or more.

[0065] The following describes a BeiDou communication system 10 provided in an embodiment of this application.

[0066] like Figure 1 As shown, the BeiDou communication system 10 may include, but is not limited to, terminal 100, BeiDou short message satellite 21, BeiDou network equipment 200, cellular network equipment 400, and terminal 300, etc.

[0067] In this system, terminal 100 in the BeiDou network can send short message information to terminal 300 in the cellular network. Specifically, terminal 100 can first send short message information to BeiDou short message satellite 21. BeiDou short message satellite 21 only acts as a relay, directly forwarding the short message information sent by terminal 100 to BeiDou network equipment 200 on the ground. BeiDou network equipment 200 can parse the short message information forwarded by the satellite according to the BeiDou communication protocol and forward the message content parsed from the short message information to cellular network equipment 400. Cellular network equipment 400 can then forward the message content to terminal 300 through the traditional cellular communication network.

[0068] Cellular network terminal 300 can also send short message information to BeiDou network terminal 100. Terminal 300 can send short messages to short message center 25 through traditional cellular communication networks. Short message center 25 can forward the short message from terminal 300 to BeiDou network device 200. BeiDou network device 200 can relay the short message from terminal 300 to terminal 100 via BeiDou short message satellite 21.

[0069] Optionally, the BeiDou communication system 10 may also include a national emergency rescue platform and a national emergency rescue center. The BeiDou network equipment 200 can transmit emergency rescue messages sent by the terminal 100 to the national emergency rescue center through the national rescue platform.

[0070] The aforementioned BeiDou network equipment 200 may include, but is not limited to, the BeiDou ground transceiver station 22, the BeiDou central station 23, and the BeiDou short message fusion communication platform 24. The BeiDou ground transceiver station 22 may include one or more devices with transmitting and receiving functions, or it may include one or more devices with both transmitting and receiving functions; this is not limited here. The BeiDou ground transceiver station 22 can be used by the BeiDou network equipment 200 for data processing at the physical layer protocol (PHY). The BeiDou central station 23 can be used by the BeiDou network equipment 200 for data processing at the satellite link control protocol (SLC) layer and the message data convergence protocol (MDCP) layer. The BeiDou short message fusion communication platform 24 can be used for data processing at the application layer protocol (APP).

[0071] The aforementioned cellular network equipment 400 may include, but is not limited to, a short message service center (SMSC) 25. The SMSC 25 can be used to forward data sent by the BeiDou network equipment 200 to user equipment within the cellular network, or it can be used to forward data from the cellular network to the BeiDou network equipment 200.

[0072] It should be noted that in the BeiDou communication system, the process of terminal 100 sending data to BeiDou network device 200 is called inbound transmission. The process of BeiDou network device 200 sending data to terminal 100 is called outbound transmission.

[0073] In one possible implementation, the transmitting device can obtain whole packets and zero packets based on the original data. The transmitting device can obtain encrypted whole packets based on the whole packets, the original key, and a cipher blockchaining (CBC) mode based on the SM4 national cryptographic algorithm. The transmitting device can obtain encrypted zero packets based on zero packets, an encryption key (CK), encrypted whole packets, and a cipher feedback (CFB) mode based on the SM4 national cryptographic algorithm. The original key is a key preset in both the transmitting and receiving devices. For example, the original key can be a key negotiated and obtained by the transmitting and receiving devices under a cellular network, or it can be a key set by the transmitting and receiving devices at the factory. The encryption key can be the key used to encrypt and decrypt data based on the original key. The transmitting device can concatenate the encrypted whole packets and encrypted zero packets to obtain encrypted data, and add a header information before the encrypted data to obtain an application layer message. The header information includes an encryption indicator field, which can be used to indicate that the encryption algorithm used by the transmitting device is the SM4 national cryptographic algorithm. The sending device can send application layer messages to the receiving device.

[0074] The transmitting device can divide the original data into whole packets and zero packets based on a first specified length. When the length of the original data is i times the first specified length, the transmitting device can divide the original data into i sub-whole packets, where i is a positive integer. When the length of the original data is less than the first specified length, the transmitting device can divide the original data into one zero packet. When the length of the original data is greater than i times the first specified length, the transmitting device can divide the original data into i sub-whole packets and one zero packet. The i sub-whole packets can be collectively referred to as whole packets, and the length of each sub-whole packet is the first specified length. The length of each zero packet is a second specified length, which is less than the first specified length. This description focuses on the scenario where the transmitting device divides the original data into i sub-whole packets and one zero packet.

[0075] After receiving an application-layer message from the sending device, the receiving device can determine that the encryption algorithm used by the sending device is the Chinese national cryptographic algorithm SM4 based on the encryption indication field. The receiving device can divide the encrypted data into encrypted whole blocks and encrypted null blocks. The receiving device can obtain whole blocks based on the encrypted whole blocks and the encryption key, and obtain null blocks based on the encrypted null blocks and the encryption key. The receiving device can then concatenate the whole blocks and null blocks to obtain the original data.

[0076] It should be noted that during the inbound process, the sending device is terminal 100, and the receiving device is Beidou network device 200. During the outbound process, the sending device is Beidou network device 200, and the receiving device is terminal 100.

[0077] In one possible implementation, the sending device can add a zero-packet indication field to the application layer message. This field indicates whether the application layer message includes encrypted zero packets. Optionally, the sending device can add a raw data length indication to the application layer message, indicating the length of the raw data. The receiving device can determine the encrypted whole packets and encrypted zero packets based on the length of the raw data and a first specified length. Optionally, the sending device can add the length of the raw data to the data sent to the receiving device at the MDCP or SLC layer, where the data sent to the receiving device includes the aforementioned encrypted data.

[0078] In this way, the sending and receiving devices can process raw data of different lengths to obtain encrypted data, thus ensuring data security.

[0079] The following describes a protocol architecture for inbound data of a Beidou communication system 10 provided in this application embodiment.

[0080] Figure 2A This paper illustrates a schematic diagram of the protocol encapsulation architecture for inbound data of a Beidou communication system 10 provided in an embodiment of this application.

[0081] like Figure 2A As shown, the BeiDou message transmission protocol layer on terminal 100 can be divided into application layer, message data aggregation layer, satellite link control layer and physical layer.

[0082] When terminal 100 sends data to BeiDou network device 200, the workflow of the BeiDou message transmission protocol on terminal 100 can be as follows:

[0083] Terminal 100 can encrypt the original data to obtain encrypted data. It then adds a header information before the encrypted data to obtain the application layer message.

[0084] The original data may include, but is not limited to, data input by the calling user (e.g., the user of terminal 100) (e.g., text data, image data, audio data, video data, etc.), the number of called users (e.g., the called users may include the user of terminal 300), the ID of the called user, the location information of terminal 100, and the authentication information of terminal 100 (e.g., authentication code).

[0085] Specifically, terminal 100 can divide the original data into whole blocks and zero blocks. Each whole block can include one or more sub-whole blocks of a first specified length, and the zero blocks have a data length shorter than the first specified length. Terminal 100 can obtain encrypted whole blocks based on the whole blocks and the original key, and encrypted zero blocks based on the zero blocks and the original key. Terminal 100 can concatenate the encrypted whole blocks and encrypted zero blocks together to obtain the encrypted data.

[0086] The message header information may include, but is not limited to, an encryption indicator field. The encryption indicator field is used to indicate the encryption algorithm used by terminal 100 to encrypt data (e.g., the Chinese national cryptographic algorithm SM4).

[0087] Optionally, when the length of the original data is a positive integer multiple of the first specified length, the terminal 100 can divide the original data into whole blocks and obtain encrypted whole blocks based on the whole blocks.

[0088] Optionally, when the length of the original data is less than the first specified length, the terminal 100 can divide the original data into zero blocks and obtain encrypted zero blocks based on the zero blocks.

[0089] Optionally, the message header information may include a zero-packet indication field, which can be used to indicate whether the encrypted data includes encrypted zero packets.

[0090] Optionally, the message header information may include an original data length indication field, which can be used to indicate the length of the original data. The BeiDou network device 200 can determine whether the encrypted data includes encrypted zero packets based on the original data length indication field.

[0091] Optionally, terminal 100 may compress the original data before encrypting it. Understandably, the header may also include a compression indication field. This field can be used to indicate the type of compression algorithm used by terminal 100 to compress the data.

[0092] Optionally, terminal 100 can compress the original data to obtain compressed data. Terminal 100 can add the aforementioned compression indicator field before the compressed data. Then, it can encrypt the compressed data with the compression indicator field added to obtain encrypted data.

[0093] At the MDCP layer, terminal 100 can obtain application layer messages sent by the APP layer through the inter-layer interface and treat the application layer messages as an MDCP SDU. At the MDCP layer, terminal 100 can add padding data to the end of the MDCPSDU up to a first specified length and add a redundancy length indicator field to the MDCP SDU. This redundancy length indicator field can be used to indicate the data length of the padding data. Terminal 100 can split the padding data and the MDCP SDU with the added redundancy length indicator field into one or more fixed-length MDCP segments (M_segment), and add a successor indicator field to the header of each MDCP segment to obtain an MDCP PDU. That is, an MDCP PDU includes an M_segment and a successor indicator field. The successor indicator field can be used to indicate the order of the current MDCPPDU among multiple MDCPPDUs in the same MDCPSDU, or that the current MDCPPDU is the only MDCPPDU.

[0094] At the SLC layer, terminal 100 can obtain the MDCPPDU issued by the MDCP layer through the inter-layer interface, which is then used as an SLCSDU. At the SLC layer, terminal 100 can segment the SLCSDU into one or more (e.g., four) fixed-length SLC segment data (S_segment), and add frame header information (also known as frame format indication information) to the header of each S_segment to obtain an SLC PDU. The frame header information may include, but is not limited to, a user ID field, a total frame count field, and a frame sequence number field. The user ID field can be used to indicate the terminal (e.g., terminal 100) that generated the SLC PDU. The total frame count field can be used to indicate the total number of SLCPDUs included in the SLC SDU to which this SLCPDU belongs. The frame sequence number field can be used to indicate the sequence number of this SLC PDU within its SLC SDU.

[0095] At the PHY layer, terminal 100 can obtain the SLC PDU issued by the SLC layer through the inter-layer interface. Terminal 100 can perform physical layer processing on it (e.g., encoding, pilot insertion, modulation, spread spectrum, etc.) to obtain the inbound data. Then, terminal 100 can send the inbound data to BeiDou short message satellite 21, which will relay it to BeiDou network equipment 200.

[0096] Figure 2B This paper illustrates a schematic diagram of the protocol parsing architecture for inbound data of a Beidou communication system 10 provided in an embodiment of this application.

[0097] like Figure 2BAs shown, the BeiDou message transmission protocol layer on the BeiDou network device 200 can be divided into the application layer, message data aggregation layer, satellite link control layer, and physical layer. The BeiDou network device 200 may include, but is not limited to, the BeiDou ground transceiver station 22, the BeiDou central station 23, and the BeiDou short message fusion communication platform 24. The BeiDou ground transceiver station 22 can be used to handle the protocol processing of the PHY layer. The BeiDou central station 23 can be used to handle the protocol processing of the SLC layer and MDCP layer. The BeiDou short message fusion communication platform 24 can be used to handle the protocol processing of the APP layer.

[0098] When terminal 100 sends data to BeiDou network device 200, the workflow of the BeiDou message transmission protocol on terminal 100 can be as follows:

[0099] At the PHY layer, the BeiDou network device 200 can acquire the inbound data sent by the terminal 100. After performing physical layer processing on the inbound data (e.g., despreading, demodulation, pilot removal, decoding, etc.), the BeiDou network device 200 presents the data to the SLC layer through the inter-layer interface as the SLC PDU of the SLC layer.

[0100] At the SLC layer, the BeiDou network device 200 can combine SLC PDUs belonging to the same terminal into a single SLC SDU based on the frame header information of the SLC PDU. The BeiDou network device 200 can then present the SLC SDU to the MDCP layer through the inter-layer interface, serving as the MDCP PDU for the MDCP layer.

[0101] At the MDCP layer, the BeiDou network device 200 can concatenate all MDCP PDUs belonging to the same MDCP SDU according to their reception time, and remove the padding data and redundancy length indicator field from the concatenated MDCPPDU to obtain the MDCPSDU. The BeiDou network device 200 can then present the MDCP SDU to the APP layer through the inter-layer interface, serving as the application layer message received by the APP layer.

[0102] At the APP layer, the Beidou network device 200 can decrypt the encrypted data in the application layer message to obtain the original data.

[0103] Specifically, after determining the encryption algorithm used by terminal 100 based on the encryption indication field of the application layer message, BeiDou network device 200 divides the encrypted data into encrypted whole packets and encrypted zero packets. BeiDou network device 200 can decrypt the encrypted whole packets to obtain whole packets, and decrypt the encrypted zero packets to obtain zero packets. BeiDou network device 200 can then concatenate the whole packets and zero packets to obtain the original data.

[0104] Optionally, if the encrypted data only includes encrypted zero packets, the Beidou network device 200 can decrypt the encrypted zero packets to obtain the original data.

[0105] Optionally, if the encrypted data only includes encrypted whole packets, the Beidou network device 200 can decrypt the encrypted whole packets to obtain the original data.

[0106] Optionally, the message header information may include a zero packet indication field, and the BeiDou network device 200 may determine whether the encrypted data includes encrypted zero packets based on the zero packet indication field.

[0107] Optionally, the message header information may include an original data length indication field, which can be used to indicate the length of the original data. The BeiDou network device 200 can determine whether the encrypted data includes encrypted zero packets based on the original data length indication field. For example, when the original data length indication field is a positive integer multiple of a first specified length, the BeiDou network device 200 can determine that the encrypted data only includes encrypted integer packets.

[0108] Optionally, the BeiDou network device 200 can decrypt the encrypted data to obtain compressed data. The BeiDou network device 200 can then decompress the compressed data to obtain the original data.

[0109] In the embodiments of this application, the above protocol processing procedure is only an example for illustration, and this application does not limit the specific operation of protocol processing.

[0110] The following describes a protocol architecture for outbound data of a Beidou communication system 10 provided in this application embodiment.

[0111] Figure 3A This paper illustrates a schematic diagram of the protocol encapsulation architecture for outbound data of a Beidou communication system 10 provided in an embodiment of this application.

[0112] like Figure 3A As shown, the BeiDou message transmission protocol layer on the BeiDou network equipment 200 can be divided into the application layer, message data aggregation layer, satellite link control layer, and physical layer.

[0113] When BeiDou network device 200 sends data to terminal 100, the workflow of the BeiDou message transmission protocol on BeiDou network device 200 can be as follows:

[0114] At the APP layer, the Beidou network device 200 can encrypt the original data to obtain encrypted data. It then adds a message header to the encrypted data to obtain the application layer message. The original data may include, but is not limited to, data sent by a third-party server (e.g., the SMS center 25) (e.g., data entered by the called user), text, semaphore signals, voice, images, animations, authentication information (e.g., authentication codes), etc.

[0115] Specifically, the BeiDou network device 200 can divide the raw data into whole packets and zero packets. Each whole packet can include one or more sub-whole packets of a first specified length, and the zero packets have a second specified length, which is shorter than the first specified length. The BeiDou network device 200 can obtain encrypted whole packets based on the whole packets and the original key, and encrypted zero packets based on the zero packets and the original key. The BeiDou network device 200 can then concatenate the encrypted whole packets and encrypted zero packets to obtain the encrypted data.

[0116] The message header information may include, but is not limited to, the encryption indicator field. The encryption indicator field is used to indicate the encryption algorithm used by the BeiDou network device to encrypt data.

[0117] Optionally, when the length of the original data is a positive integer multiple of the first specified length, the Beidou network device 200 can divide the original data into whole packets and obtain encrypted whole packets based on the whole packets.

[0118] Optionally, when the length of the original data is less than the first specified length, the Beidou network device 200 can divide the original data into zero packets and obtain encrypted zero packets based on the zero packets.

[0119] Optionally, the BeiDou network device 200 can compress the original data before encrypting it. Understandably, the message header may also include a compression indication field. This compression indication field can be used to indicate the type of compression algorithm used by the BeiDou network device 200 to compress the data.

[0120] Optionally, the message header information may include a zero-packet indication field, which can be used to indicate whether the encrypted data includes encrypted zero packets.

[0121] Optionally, the message header information may include an original data length indication field, which can be used to indicate the length of the original data. Terminal 100 can determine whether the encrypted data includes encrypted zero packets based on the original data length indication field.

[0122] Optionally, the BeiDou network device 200 can compress the original data to obtain compressed data. The BeiDou network device 200 can then add the aforementioned compression indicator field before the compressed data. Finally, the compressed data with the compression indicator field added is encrypted to obtain encrypted data.

[0123] At the MDCP layer, the BeiDou network device 200 can obtain application layer packets sent from the APP layer through the inter-layer interface and treat each application layer packet as an MDCP SDU. The BeiDou network device 200 can split the MDCP SDU into one or more fixed-length MDCP segments (M_segment) and add a successor indication field to the header of each MDCP segment to obtain an MDCP PDU. That is, an MDCP PDU includes an M_segment and a successor indication field. The successor indication field can be used to indicate the order of the current MDCPPDU within the same MDCPSDU.

[0124] At the SLC layer, the BeiDou network device 200 can obtain the MDCPPDU issued by the MDCP layer through the inter-layer interface, and use it as the SLCSDU. The BeiDou network device 200 can segment the SLCSDU into one or more (e.g., four) fixed-length SLC segment data (S_segment), and add frame header information to the header of each S_segment to obtain the SLC PDU. The frame header information may include, but is not limited to, a user ID field, a total frame count field, and a frame sequence number field. The user ID field can be used to identify the receiving device (e.g., terminal 100), and the value of the user ID field is the ID number of the receiving device. For a detailed description of the total frame count field and the frame sequence number field, please refer to the embodiment described in 3A above, and it will not be repeated here.

[0125] At the PHY layer, the BeiDou network device 200 can obtain the SLC PDU issued by the SLC layer through the inter-layer interface, which serves as the user frame. The BeiDou network device 200 can concatenate multiple user frames or a single user's user frames (also known as data frames), adding a frame header (e.g., version number) and a checksum to obtain the physical frame. The BeiDou network device 200 can then perform physical layer processing on the physical frame (e.g., encoding, pilot insertion, modulation, spread spectrum, etc.) to obtain the encoded data for the message branch (S2C-d branch). The BeiDou network device 200 can combine the encoded data of the S2C-d branch with the pilot data (also known as subcode) of the pilot branch (S2C-p branch) to form pilot encoded data, i.e., outgoing data. This outgoing data is then sent to the BeiDou short message satellite 21, which relays it to one or more terminals. It is understood that the pilot data of the S2C-p branch is related to the satellite beam. When the satellite beam information is known, the pilot data of the S2C-p branch is also known and does not require decoding. However, the encoded data of the S2C-d branch requires decoding.

[0126] Figure 3B This paper illustrates a schematic diagram of the protocol parsing architecture for outbound data of a Beidou communication system 10 provided in an embodiment of this application.

[0127] like Figure 3B As shown, the BeiDou message transmission protocol layer on terminal 100 can be divided into application layer, message data aggregation layer, satellite link control layer and physical layer.

[0128] At the PHY layer, terminal 100 can capture the encoded data of the S2C-d tributary based on the subcode of the S2C-p tributary sent by BeiDou network device 200. After capturing the encoded data of the S2C-d tributary, terminal 100 can perform physical layer processing (e.g., despreading, demodulation, pilot removal, decoding, etc.) to obtain physical frames. Terminal 100 can then extract user frames belonging to terminal 100 from the physical frames. Terminal 100 can then present the user frames to the SLC layer through the inter-layer interface as SLC PDUs for the SLC layer.

[0129] At the SLC layer, when the user frame received by terminal 100 is a general data frame, terminal 100 can concatenate SLC PDUs belonging to the same SLC SDU into a single SLC SDU. Terminal 100 can then present the SLC SDU to the MDCP layer through the inter-layer interface, serving as the MDCP PDU for the MDCP layer. When the user frame received by terminal 100 is an ACK frame, terminal 100 can retransmit data, send the next SLC SDU, or stop sending data to the BeiDou network device 200.

[0130] At the MDCP layer, terminal 100 can concatenate one or more MDCP PDUs into an MDCP SDU. Terminal 100 can then present the MDCP SDU to the APP layer through the inter-layer interface, serving as an application layer message received by the APP layer.

[0131] At the APP layer, terminal 100 can decrypt the encrypted data of the application layer message to obtain the original data.

[0132] Specifically, after determining the encryption algorithm used by terminal 100 based on the encryption indication field of the application layer message, terminal 100 divides the encrypted data into encrypted whole packets and encrypted zero packets. Terminal 100 can decrypt the encrypted whole packets to obtain whole packets, and decrypt the encrypted zero packets to obtain zero packets. Terminal 100 can concatenate the whole packets and zero packets together to obtain the original data.

[0133] Optionally, terminal 100 can decrypt the encrypted data to obtain compressed data. Terminal 100 then decompresses the compressed data to obtain the original data.

[0134] Optionally, if the encrypted data only includes encrypted null packets, the terminal 100 can decrypt the encrypted null packets to obtain the original data.

[0135] Optionally, if the encrypted data only includes the encrypted whole block, the terminal 100 can decrypt the encrypted whole block to obtain the original data.

[0136] Optionally, the message header information may include a zero packet indication field, and the terminal 100 may determine whether the encrypted data includes encrypted zero packets based on the zero packet indication field.

[0137] Optionally, the message header information may include an original data length indication field, which can be used to indicate the length of the original data. Terminal 100 can determine whether the encrypted data includes encrypted zero blocks based on the original data length indication field. For example, when the original data length indication field is a positive integer multiple of a first specified length, terminal 100 can determine that the encrypted data only includes encrypted integer blocks.

[0138] In the embodiments of this application, the above protocol processing procedure is only an example for illustration, and this application does not limit the specific operation of protocol processing.

[0139] The following describes a schematic step in which a transmitting device obtains encrypted data, as provided in an embodiment of this application.

[0140] 1. The transmitting device obtains whole packets and zero packets based on the raw data.

[0141] like Figure 4As shown, the transmitting device can determine the number of sub-integer packets (i) based on the data length of the original data and a first specified length. Then, starting from the beginning of the original data, it extracts i data segments of the first specified length, dividing them into i sub-integer packets. These i sub-integer packets can be collectively referred to as integer packets. The transmitting device can define the data following the integer packets as zero packets. The data length of the zero packets is a second specified length, which is less than the first specified length.

[0142] 2. The sending device obtains the encrypted whole packet based on the whole packet.

[0143] The transmitting device can obtain the encrypted block based on the entire block, the encryption key, and the block initialization vector. The entire block, encryption key, and block initialization vector are the inputs to the CBC mode based on the SM4 algorithm, and the encrypted block is the output of the CBC mode based on the SM4 algorithm. The specific steps are as follows:

[0144] (1) The transmitting device can divide the original data into i sub-integer packets, the data length of which is a first specified length. (2) The transmitting device can perform an XOR operation on the sub-integer packets and the initial vector of the whole packet to obtain the encryption vector of the whole packet. (3) The transmitting device uses the encryption vector of the whole packet and the encryption key to obtain the encrypted sub-integer packets through an encryption algorithm. (4) The transmitting device concatenates the encrypted sub-integer packets together to obtain the encrypted whole packet.

[0145] The encryption algorithm used by the transmitting device is the SM4 national cryptographic algorithm. It should be noted that the transmitting device can also use other encryption algorithms to obtain encrypted sub-integer blocks, such as the SM3 national cryptographic algorithm, etc., but this application embodiment does not limit this.

[0146] The encryption key can be obtained based on the original key of the sending device, and the encryption key can be a data segment of a first specified length in the original key. The original key can be obtained through negotiation between the sending and receiving devices. The initialization vector of the first sub-block can be obtained based on the original key (i.e., the initialization vector of the first sub-block can be a data segment of a first specified length in the original key), and the initialization vector of the second and subsequent sub-blocks can be the encrypted sub-block corresponding to the preceding sub-block.

[0147] Optionally, the initial vector of the entire block can be obtained based on the original key, and the initial vector of the entire block can be a data segment of a first specified length in the original key. Optionally, the initial vector of the entire block can also be a preset data segment of a first specified length, which is not limited in this embodiment. It should be noted that the encryption key and the initial vector of the entire block can be a data segment of a first specified length composed of any non-repeating bits in the original key, and the encryption key and the initial vector of the entire block are different.

[0148] For example, the encryption key can be a first specified length of data segment of the original key starting from the start position. The block initialization vector can be a first specified length of data segment of the original key starting from the middle position, where the middle position is between the start and end positions. For example, the length of the original key can be 32 bytes, where the first 16 bytes of the original key starting from the start position can be used as the encryption key. The 16 bytes of the original key after the 16th byte starting from the start position can be used as the block initialization vector.

[0149] For example, such as Figure 5 As shown, the transmitting device can first divide the original data into i sub-groups, where i is a positive integer greater than 0. Each sub-group has a data length of a first specified length, which can be 16 bytes. It should be noted that in the description of this embodiment, 1 byte and 8 bits are the same length.

[0150] The transmitting device can perform an XOR operation on the first sub-block (i.e., sub-block 1) and the block initialization vector to obtain the first block encryption vector (i.e., block encryption vector 1). The transmitting device can then perform an encryption operation on the first block encryption vector and the encryption key using the SM4 algorithm to obtain the first encrypted sub-block (i.e., encrypted sub-block 1). The original key can be a key obtained by the transmitting and receiving devices within the cellular network. The original key can be 32 bytes long. The block initialization vector can be the 16 bytes of data at the end of the original key, and the encryption key can be the 16 bytes of data at the beginning of the original key.

[0151] Subsequently, the transmitting device can perform an XOR operation on the second sub-integrated block and (i.e., sub-integrated block 2) the first encrypted sub-integrated block (i.e., encrypted sub-integrated block 1) to obtain the encryption vector of the second integrated block (i.e., integrated block encryption vector 2). The transmitting device can then perform an encryption operation on the encryption vector of the second integrated block and the encryption key using the SM4 algorithm to obtain the second encrypted sub-integrated block (i.e., encrypted sub-integrated block 2). It should be noted that the initial vector of the integrated block corresponding to the second sub-integrated block and subsequent sub-integrated blocks is the encrypted sub-integrated block obtained based on the previous sub-integrated block. It can be understood that, in this way, the transmitting device can obtain the encrypted sub-integrated block obtained by encrypting each sub-integrated block. The transmitting device can concatenate all encrypted sub-integrated blocks (e.g., from encrypted sub-integrated block 1 to encrypted sub-integrated block i) together to obtain the encrypted integrated block.

[0152] For example, the programming language by which the sending device obtains the encrypted data packet is shown below:

[0153] P = byte[0..len_p]

[0154] len_x = 128 * floor(len_p / 128)

[0155] Pa = P[0..len_x]

[0156] if len_p % 128! = 0:

[0157] Pb = P[len_x..len_p]

[0158] Ea = SM4_CBC(K,Pa,IV)

[0159] SM4_CBC{

[0160] Pa = {D1,D2,D3,...,Dx}

[0161] D1'=D1⊕IV

[0162] E1 = SM4(K, D1')

[0163] D2'=D2⊕E1

[0164] E2 = SM4(K, D2')

[0165] D3'=D3⊕E2

[0166] E3 = SM4(K, D3') ...

[0168] Dx'=Dx⊕Ex-1

[0169] Ex = SM4(K, Dx')

[0170] Ea = E1||E2||E3||...||Ex

[0171] return Ea

[0172] }

[0173] Where P represents the original data, and the length of P is the same as the original data length, i.e., len_p. Pa represents integer blocks, and Pb represents zero blocks. The length of Pa is len_x, and the number of sub-integer blocks is floor(len_p / 128), where floor is the floor function and / is division. Therefore, the length of Pa is the product of the length of the sub-integer blocks and the number of sub-integer blocks. After the original data is divided into integer blocks, there is still residual data (a remainder after dividing len_p and 128), i.e., len_p % 128! = 0. Here, % is the remainder symbol, and ! = is the inequality symbol. Zero blocks are the portion of the original data excluding integer blocks. In the following embodiments, the original data includes zero blocks.

[0174] Where IV is the initial vector of the whole block, and K is the encryption key. D1 is the first sub-block, D1' is the encryption vector of the first whole block, and E1 is the first encrypted sub-block. D2 is the second sub-block, D2' is the encryption vector of the second whole block, E2 is the second encrypted sub-block, and so on. ⊕ represents the bitwise XOR operation. || is the concatenation symbol, used to concatenate data before and after the symbol. SM4 is the Chinese national cryptographic algorithm. Ea is the encrypted whole block.

[0175] For example, when the original data P has a length of 275 bytes, the complete block Pa consists of the first 272 bytes of the original data, and the zero block Pb consists of the last 3 bytes of the original data. The transmitting device can divide the complete block Pa into 17 sub-blocks (D1 to D17), where each sub-block has a data length of 16 bytes. The transmitting device can obtain encrypted sub-blocks (i.e., E1 to E17) based on the sub-blocks, the initialization vector (IV) of the complete block, and the encryption key K. The transmitting device can then concatenate the encrypted sub-blocks together to obtain the encrypted complete block. The IV and K are both 16 bytes long. The encrypted complete block is 272 bytes long.

[0176] It should be noted that there is no particular order in which the sending device receives the encrypted whole packet and the encrypted zero packet, and this application does not impose any restrictions on this.

[0177] In one possible implementation, the transmitting device can obtain the encrypted zero packet based on the zero packet, the encryption key, the zero packet initialization vector, and the CFB-8 mode of the SM4 algorithm. Here, the zero packet, the encryption key, and the zero packet initialization vector are the inputs to the CFB-8 mode of the SM4 algorithm, and the encrypted zero packet is the output of the CFB-8 mode of the SM4 algorithm.

[0178] 3. The sending device obtains encrypted zero packets based on the zero packets.

[0179] (1) The transmitting device divides the zero packet into one or more sub-zero packets.

[0180] Specifically, the transmitting device can divide the zero packet into one or more sub-zero packets based on a third specified length. The transmitting device then uses these sub-zero packets, the zero packet initialization vector, and the encryption key to obtain the encrypted sub-zero packet corresponding to each of the one or more sub-zero packets. The transmitting device can then concatenate these one or more encrypted sub-zero packets together to obtain the encrypted zero packet.

[0181] Specifically, if the data length of the last sub-zero group in one or more sub-zero groups is less than the third specified length, padding data can be added after the data of the last sub-zero group until the data length of the last sub-zero group reaches the third specified length. The padding data can be random numbers or specified values ​​(such as 0, 1, etc.).

[0182] For example, such as Figure 6 As shown, the transmitting device can sequentially extract j-1 sub-zero packets of a third specified length from the zero packet, starting from the beginning position. Here, j is an integer greater than or equal to 1. After the transmitting device extracts these j-1 sub-zero packets, if the length of the remaining data in the zero packet (also called the residual data) is less than the third specified length but greater than zero, the transmitting device can add padding data to the end of the residual data to obtain the last sub-zero packet (e.g., sub-zero packet j). Here, the third specified length can be 8 bits. When the length of the residual data is N bits, the length of the padding data is (8-N) bits, where N is an integer greater than 0 and less than 8.

[0183] (2) The transmitting device obtains encrypted sub-zero packets based on the sub-zero packets.

[0184] a. The transmitting device can obtain the process vector using the SM4 algorithm based on the zero-block initialization vector and the encryption key.

[0185] b. The transmitting device can intercept the data of the third indicated length in the process vector to obtain the zero-block encryption vector.

[0186] c. The transmitting device performs an XOR operation on the zero-block encryption vector and the sub-zero block to obtain the encrypted sub-zero block.

[0187] d. The transmitting device can concatenate the encrypted sub-zero packets together to obtain encrypted zero packets.

[0188] The encryption key can be obtained based on the original key of the sending device. The original key can be obtained through negotiation between the sending and receiving devices. Optionally, the encryption key can be a data segment of a first specified length from the original key; for example, the encryption key can be a data segment of a first specified length starting from the beginning of the original key.

[0189] The initial vector of the first sub-zero block can be obtained based on the original key (e.g., it can be a data segment of the first specified length in the original key), or the initial vector of the first sub-zero block can be the encrypted sub-integer corresponding to any sub-integer, for example, it can be the encrypted sub-integer of the last sub-integer mentioned above.

[0190] The initial zero-group vectors of the second and subsequent sub-zero-groups can be obtained based on the initial zero-group vector of the preceding sub-zero-group and the encrypted sub-zero-group. Alternatively, the initial zero-group vectors of the second and subsequent sub-zero-groups can be the initial zero-group vector of the first sub-zero-group. Optionally, the initial zero-group vector can also be a preset data segment of a first specified length, which is not limited in this embodiment.

[0191] For example, the initial vector of the second and subsequent sub-zero packets is obtained based on the initial vector of the previous sub-zero packet and the encrypted sub-zero packet. Specifically, the transmitting device can extract data of a fourth specified length from the initial vector of the previous sub-zero packet as a truncation vector. The transmitting device then concatenates the truncation vector with the encrypted sub-zero packet corresponding to the previous sub-zero packet to obtain the initial vector of the zero packet. Here, the fourth specified length is the difference between the first specified length and the third specified length.

[0192] It should be noted that when the length of the original data is less than the first specified length, the sending device can only obtain zero packets. In this case, the initial vector of the first sub-zero packet is either a data segment of the first specified length in the original key or a preset data segment of the first specified length.

[0193] Optionally, the zero-packet initialization vector can be determined by negotiation between the transmitting and receiving devices in the cellular network.

[0194] Figure 7 This illustration shows a flowchart of obtaining encrypted zero packets according to an embodiment of this application.

[0195] For example, such as Figure 7 As shown, the transmitting device can calculate process vector 1 using the SM4 algorithm based on the encryption key and zero-block initialization vector 1. The transmitting device can extract the first 8 bits of process vector 1 to obtain zero-block encryption vector 1. The transmitting device can perform an XOR operation on zero-block encryption vector 1 and sub-zero-block 1 to obtain encrypted sub-zero-block 1, which has a data length of 8 bits. Here, zero-block initialization vector 1 can be a specified encrypted sub-block, for example, any one of the aforementioned encrypted sub-blocks (e.g., ...). Figure 5 The encrypted sub-block i is shown.

[0196] Next, the transmitting device can extract the last 120 bits of data from the zero-block encryption vector 1 to obtain truncated vector 1. The transmitting device can then concatenate truncated vector 1 and encrypted sub-zero block 1 to obtain zero-block initialization vector 2. The transmitting device can then calculate process vector 2 using the SM4 algorithm with the encryption key and zero-block initialization vector 2. The transmitting device can then extract the first 8 bits of data from process vector 2 to obtain zero-block encryption vector 2. Finally, the transmitting device can perform an XOR operation on zero-block encryption vector 2 and sub-zero block 2 to obtain encrypted sub-zero block 2, which has a data length of 8 bits.

[0197] Next, the sending device can extract the last 120 bits of data from the null-block encryption vector 2 to obtain truncated vector 2. The sending device can then concatenate truncated vector 2 and encrypted sub-null-block 2 to obtain the initial null-block vector 3. The sending device can then calculate the process vector 3 using the SM4 algorithm with the encryption key and the initial null-block vector 3. The sending device can then extract the first 8 bits of data from the process vector 3 to obtain the null-block encryption vector 3. The sending device can then perform an XOR operation on the null-block encryption vector 3 and sub-null-block 3 to obtain encrypted sub-null-block 3, and so on.

[0198] Once the transmitting device obtains the encrypted sub-zero packets corresponding to all sub-zero packets, that is, once the transmitting device obtains encrypted sub-zero packets 1 to encrypted sub-zero packets j, the transmitting device can sequentially concatenate encrypted sub-zero packets 1 to encrypted sub-zero packets j to obtain encrypted zero packets.

[0199] The encryption key can be 16 bytes of data in the header of the original key. The original key can be a key obtained by the sending and receiving devices within the cellular network. The length of the original key can be 32 bytes.

[0200] For example, when the zero group is as described above Figure 5 When Pb is shown, the programming language for the sending device to obtain encrypted zero packets is as follows:

[0201] Eb = SM4_CFB(K, Pb, Ex)

[0202] SM4_CFB{

[0203] Pb = {D1,D2,D3,...,Dy}

[0204] IV = Ex

[0205] IV' = SM4(K,IV)

[0206] D1' = MSB8(IV')

[0207] E1=D1'⊕D1

[0208] IV = LSB 120 (IV)||E1

[0209] IV' = SM4(K,IV)

[0210] D2' = MSB8(IV')

[0211] E2=D2'⊕D2

[0212] IV = LSB 120 (IV)||E2

[0213] IV' = SM4(K,IV)

[0214] D3' = MSB8(IV')

[0215] E3=D3'⊕D3 ...

[0217] IV = LSB 120 (IV)||Ey-1

[0218] IV' = SM4(K,IV)

[0219] Dy' = MSB8(IV')

[0220] Ey=Dy'⊕Dy

[0221] Eb = E1||E2||E3...||Ey

[0222] return Eb

[0223] }

[0224] Where Pb is the zero block. D1, D2, D3, ..., Dy are sub-zero blocks of a second specified length. K is the encryption key. Ex is the above. Figure 5The last encrypted sub-block shown. The initialization vector IV (IV) corresponding to D1 is Ex. MSB8 is a function that extracts the first 8 bits of the input data. LSB 120 This is a function to extract the last 120 bits of the input data. SM4 is the Chinese national cryptographic algorithm SM4. E1 is the encrypted sub-zero block corresponding to D1, E2 is the encrypted sub-zero block corresponding to D2, E3 is the encrypted sub-zero block corresponding to D3, and so on. Here, ⊕ represents the bitwise XOR operation. || is the concatenation symbol, which can be used to concatenate data before and after the symbol. SM4 is the Chinese national cryptographic algorithm. Eb is the final encrypted zero block.

[0225] For example, when the length of the original data P is 275 bytes, the zero block Pb is the last 3 bytes of the original data. The transmitting device can divide the zero block Pb into 3 sub-zero blocks (D1 to D3), where each sub-zero block is 8 bits long. The transmitting device can obtain encrypted sub-zero blocks (E1 to E3) based on the sub-zero blocks, the zero block initialization vector IV, and the encryption key K. The transmitting device can concatenate the encrypted sub-zero blocks together to obtain the encrypted zero block. Here, the IV, K, and the initialization vector are 16 bytes long, and the zero block encryption vector is 8 bits long. The length of the encrypted block is 3 bytes.

[0226] In this way, the sending device can obtain encrypted zero packets and, based on the encrypted zero packets, obtain the application layer message to be sent to the receiving device.

[0227] Optionally, the sending device can obtain encrypted data based on encrypted null packets and / or encrypted integer packets. The sending device can send the encrypted data and an original data length indication field to the receiving device. The original data length indication can be used to indicate the length of the original data. The receiving device can determine the number of encrypted integer packets and encrypted null packets based on the original data length indication.

[0228] Optionally, the sending device may send the encrypted data and a zero-packet indication field to the receiving device. The zero-packet indication field can be used to indicate whether the encrypted data includes encrypted zero packets. The receiving device can determine whether the encrypted data includes encrypted zero packets based on the zero-packet indication field.

[0229] However, the transmitting device needs to first split the zero packet into sub-zero packets, then encrypt the sub-zero packets to obtain encrypted sub-zero packets, and finally concatenate the encrypted sub-zero packets together to obtain the encrypted zero packet. The process of obtaining the encrypted zero packet by the transmitting device is complex and involves many calculations. Furthermore, if the length of the last sub-zero packet is less than a second specified length, the transmitting device must add padding data to the sub-zero packet, which consumes air interface resources.

[0230] This application provides another encryption method in a BeiDou communication system. The transmitting device can divide the original data into i sub-integers and one zero-group. Here, i is an integer greater than or equal to zero. The data length of the sub-integers is a first specified length, and the data length of the zero-group is a second specified length, where the second specified length is less than the first specified length. The transmitting device can pad the zero-group to the first specified length, and then perform a bitwise XOR operation on the padded zero-group and the zero-group encryption vector to obtain an encrypted zero-group. The transmitting device extracts the corresponding bits from the encrypted zero-group to obtain a result zero-group. The length of the result zero-group is the same as the length of the original zero-group. The transmitting device can obtain the encrypted integer group based on the integer group. The transmitting device concatenates the encrypted integer group and the result zero-group together to obtain the encrypted data. The transmitting device then sends an application layer message to the receiving device. The application layer message includes message header information and encrypted data. The message header information includes an encryption indicator field, which indicates the encryption algorithm used by the transmitting device.

[0231] It should be noted that because each bit of the bitwise XOR operation is only related to the two inputs of the corresponding bit, and no two bits of the output will affect each other, the sending device can remove the data corresponding to the padding data in the encrypted zero block without affecting the receiving device's ability to obtain the zero block from the result zero block.

[0232] In this way, the transmitting device not only improves the processing speed of obtaining zero packets, but also saves the transmission air interface resources occupied by filling data.

[0233] 1. The transmitting device obtains whole packets and zero packets based on the raw data.

[0234] The transmitting device can sequentially extract i sub-integer packets of a first specified length, starting from the starting position, where i is an integer greater than or equal to zero. These i sub-integer packets can be collectively referred to as integer packets. The transmitting device can treat the remaining data with a length greater than zero after extraction as zero packets.

[0235] 2. The sending device obtains the encrypted whole packet based on the whole packet.

[0236] The transmitting device can obtain the encrypted block based on the block size, encryption key, and block size initialization vector. For a detailed description of how the transmitting device obtains the encrypted block size, please refer to the above. Figure 5 The embodiments shown are not described in detail here.

[0237] 3. The sending device obtains encrypted zero packets based on the zero packets.

[0238] (1) The transmitting device adds padding data to the zero packet to obtain the padding zero packet.

[0239] Since the length of the zero packet is less than the first specified length, the transmitting device can add padding data at a specified position (e.g., the tail) of the zero packet. The padding data can be a random number or a specified number (e.g., 0 or 1). The data length of the zero packet is the second specified length, and the data length of the padding data is the fifth specified length. The sum of the second specified length and the fifth specified length is the first specified length.

[0240] (2) The transmitting device can obtain the zero-block encryption vector using the SM4 algorithm based on the zero-block initial vector and the encryption key.

[0241] The initial zero-block vector can be obtained based on the original key or the encrypted sub-block. Specifically, the initial zero-block vector can be a data segment of a first specified length from the original key. That is, the initial zero-block vector can be a data segment of a first specified length composed of any non-repeating bits from the original key. For example, the initial zero-block vector can be obtained based on a data segment of a first specified length before the end position in the original key. This first specified length of data can be arranged in either forward or reverse order as the initial zero-block vector. For example, when the length of the original key is 256 bits, the initial zero-block vector is a data segment composed of the 256th bit, the 255th bit, the 254th bit, ..., the 129th bit of the original key. Alternatively, the initial zero-block vector can be a data segment composed of the 129th bit, the 130th bit, the 131st bit, ..., the 256th bit of the original key.

[0242] Alternatively, the zero-block initialization vector can be obtained based on encrypted sub-blocks. Specifically, the zero-block initialization vector can be a first specified length of data obtained based on encrypted sub-blocks. For example, the zero-block initialization vector can be an encrypted sub-block corresponding to any of the aforementioned sub-blocks (e.g., the last sub-block).

[0243] The encryption key can be data of a first specified length from the original key (for example, the encryption key can be data of a first specified length from the start position in the original key). It should be noted that the encryption key can be a data segment of a first specified length composed of any non-repeating bits from the original key. The encryption key is different from the integer block initialization vector, and this embodiment of the application does not limit it.

[0244] It should also be noted that the transmitting device can also use other encryption algorithms to obtain encrypted sub-integer blocks, such as the SM3 national cryptographic algorithm, etc., but this application embodiment does not limit this.

[0245] (3) The transmitting device can perform a bitwise XOR operation on the zero-block encryption vector and the padding zero-block to obtain the encrypted zero-block.

[0246] like Figure 8 As shown, the transmitting device can sequentially XOR the values ​​in input 1 (e.g., a zero-block encryption vector) and input 2 (e.g., a padding zero block) from the start position to the end position, and perform an XOR calculation on the two input data corresponding to each bit. When the values ​​of the corresponding bits are the same, the result is 0. When the values ​​of the corresponding bits are different, the result is 1. It should be noted that the inverse operation of XOR is also an XOR operation. That is, input 2 can be obtained by performing a bitwise XOR operation between the output and input 1, and input 1 can be obtained by performing a bitwise XOR operation between the output and input 2.

[0247] It should be noted that the order of steps (2) and (3) is not limited in the embodiments of this application.

[0248] (4) The sending device obtains the result zero packet based on the encrypted zero packet.

[0249] After receiving the encrypted null packet, the transmitting device can extract a second data segment of a specified length from a specified position (e.g., the header) in the encrypted null packet to obtain the result null packet.

[0250] For example, such as Figure 9 As shown, the length of the zero packet obtained by the transmitting device is M bits. Here, M is a positive integer greater than 0 and less than 128. The transmitting device can add padding data to the end of the zero packet to obtain a padded zero packet. The padding data can consist of random numbers, and its length is (128-M) bits. The length of the padded zero packet is 128 bits. For example, when the second specified length (i.e., M) is 112 bits, the fifth specified length (i.e., 128-M) is 16 bits.

[0251] The transmitting device can obtain a zero-block encryption vector based on the zero-block initialization vector and the encryption key using the SM4 algorithm. The zero-block initialization vector can be the last encrypted sub-block of the aforementioned sub-blocks. The encryption key can be the first 128 bits of the original key. The transmitting device uses the SM4 national cryptographic algorithm. It should be noted that the transmitting device can also use other encryption algorithms to obtain encrypted sub-blocks, such as the SM3 national cryptographic algorithm, etc., but this application embodiment does not limit this.

[0252] Subsequently, the transmitting device can perform a bitwise XOR operation on the zero-block encryption vector and the padding zero-block to obtain the encrypted zero-block. It should be noted that the order in which the transmitting device obtains the zero-block encryption vector and the padding zero-block is not limited in the embodiments of this application.

[0253] For example, when the zero group is as described above Figure 5 When Pb is shown, the programming language for the sending device to obtain encrypted zero packets is as follows:

[0254] Eb = SM4_2(K, Pb, IV)

[0255] SM4_2{

[0256] P1 = Rand 128-O ()

[0257] Pb'=Pb||P1

[0258] IV' = SM4(K,IV)

[0259] E1=IV'⊕Pb'

[0260] Eb = MSB O (E1)

[0261] return Eb

[0262] }

[0263] Where Eb is the final null block. K is the encryption key, IV is the null block initialization vector, P1 is the fifth specified length of padding data, Pb is the second specified length of null block, Pb' is the padding null block, IV' is the null block encryption vector, E1 is the encrypted null block, and O is the length of the null block. MSB O This is a function to extract the first 0 bits of the input data.

[0264] In this way, the sending device can obtain encrypted zero packets without performing packet operations, reducing the number of calculations required by the sending device. Moreover, since the sending device ultimately removes the padding data, it also saves the transmission interface resources consumed by the padding data.

[0265] 4. The sending device obtains the application layer message based on encrypted whole packets and encrypted zero packets.

[0266] The transmitting device can concatenate encrypted integer packets and encrypted null packets to obtain encrypted data. The transmitting device can add header information to the encrypted data to obtain an application layer message. This application layer message can include header information and encrypted data. The header information can include an encryption indicator field. This encryption indicator field can be used to indicate that the transmitting device used the SM4 algorithm to obtain the encrypted data.

[0267] Afterwards, the sending device can also send application layer messages to the receiving device.

[0268] 5. The receiving device receives the application layer message and obtains the raw data based on the application layer message.

[0269] After receiving the application layer message, the receiving device can determine the encryption algorithm used by the sending device based on the encryption indication field. Then, based on the encryption algorithm, encryption key, and encrypted data, it can obtain the original data.

[0270] (1) The receiving device acquires the encrypted whole packet and the result zero packet.

[0271] Specifically, the receiving device can determine that the transmitting device is using the SM4 encryption algorithm through the encryption indication field, and then decrypt the encrypted data based on the SM4 algorithm. Optionally, when the transmitting device uses another encryption algorithm, the receiving device can determine the encryption algorithm used by the transmitting device based on the encryption indication field, and then decrypt the encrypted data based on the determined encryption algorithm.

[0272] The sending device can obtain the encrypted whole packet and the result zero packet from the encrypted data.

[0273] The receiving device can sequentially extract i encrypted sub-blocks of a first specified length, starting from the initial position, where i is an integer greater than or equal to zero. These i encrypted sub-blocks can be collectively referred to as encrypted blocks. The receiving device can use the remaining data of a length greater than zero after extraction as encrypted zero blocks.

[0274] (2) The receiving device obtains the whole packet based on the encrypted whole packet.

[0275] The receiving device can obtain the encrypted vector of the entire block using the SM4 algorithm based on the encrypted sub-block and the decryption key. The receiving device then obtains sub-blocks based on the encrypted vector and the initial vector of the entire block. Finally, the receiving device concatenates the sub-blocks to obtain the entire block. The decryption key is the reverse of the encryption key. It should be noted that the algorithmic structure of the transmitting device using the SM4 algorithm to encrypt the entire block's encryption vector and encryption key to obtain the encrypted sub-blocks is the same as the algorithmic structure of the receiving device using the SM4 algorithm to decrypt the encrypted sub-blocks based on the encryption key to obtain the encrypted vector of the entire block.

[0276] (3) The receiving device obtains the zero packet based on the encrypted zero packet.

[0277] The receiving device can obtain the zero packet based on the result zero packet and the encryption key.

[0278] a. The receiving device obtains the zero-block encryption vector based on the zero-block initialization vector and the encryption key using the SM4 algorithm.

[0279] The zero-block initialization vector can be data of a first specified length from the original key, or it can be data of a first specified length obtained based on the encrypted sub-block. The encryption key can be data of a first specified length from the original key. It should be noted that the receiving device obtains the original key, the zero-block initialization vector, and the encryption key in the same way as the sending device.

[0280] b. The receiving device can add padding data to the end of the result zero packet to obtain the result filled zero packet.

[0281] Among them, the length of the result zero group is the fourth indicator length, the length of the data filling data is the fifth indicator length, and the length of the result filling zero group is the first indicator length.

[0282] c. The receiving device can perform a bitwise XOR operation on the result filled with zero blocks and the zero block encryption vector to obtain the decrypted zero blocks.

[0283] Since the inverse operation of bitwise XOR is also bitwise XOR, the receiving device can fill in the zero block and zero block encryption vector based on the result to obtain the decrypted zero block containing the zero block data.

[0284] d. The receiving device can intercept the data of a second specified length at a specified position of the decrypted zero packet to obtain the zero packet.

[0285] The specified location can be obtained through negotiation between the sending and receiving devices in a cellular network, or it can be added as a specified location identifier in the message header information to indicate the specified location.

[0286] Figure 10 This paper illustrates a schematic diagram of the decryption process of an encryption method in a BeiDou communication system provided in an embodiment of this application.

[0287] For example, such as Figure 10 As shown, the length of the result zero packet obtained by the receiving device is M bits, where M is a positive integer greater than or equal to 1. The receiving device can add padding data after the result zero packet to obtain a result-padded zero packet. The padding data can consist of random numbers, and the data length of the padding data is (128-M) bits. The length of the result-padded zero packet is 128 bits.

[0288] The receiving device can use the SM4 algorithm to obtain a zero-block encryption vector from the zero-block initialization vector and the encryption key. The zero-block initialization vector can be the last encrypted sub-block mentioned above. The encryption key can be the first 128 bits of the original key mentioned above.

[0289] Subsequently, the receiving device can perform a bitwise XOR operation on the zero-block encryption vector and the result-filled zero-block to obtain the decrypted zero-block. It should be noted that the order in which the receiving device obtains the zero-block encryption vector and the result-filled zero-block is not limited in this embodiment. Afterwards, the receiving device can extract the Mbit data from the header of the decrypted zero-block to obtain the zero-block.

[0290] Optionally, when the original data length of the sending device is less than the first specified length, the receiving device can only receive zero packets.

[0291] (4) The receiving device obtains the zero packet based on the encrypted zero packet.

[0292] The receiving device can concatenate whole packets and fragmented packets to obtain the raw data. Furthermore, the receiving device can perform corresponding processing on the raw data (e.g., forwarding the raw data to user equipment within the cellular network).

[0293] Thus, since the inverse operation of XOR is also XOR, the receiving device can decrypt the zero packet based on the result zero packet to obtain the zero packet.

[0294] In one possible implementation, the transmitting device can extract a second, specified-length data segment from a specified position in the zero-block encryption vector to obtain a zero-block result vector. The transmitting device can then perform a bitwise XOR operation on the zero-block result vector and the zero-block to obtain the resulting zero-block. This allows the transmitting device to save air interface resources while simplifying the operation.

[0295] Specifically, the sending device can divide the original data into i sub-integers and one zero block, where i is an integer greater than or equal to zero. The data length of each sub-integer is a first specified length, and the data length of the zero block is a second specified length, which is less than the first specified length. The sending device can obtain the encrypted integer block based on the integer blocks. The sending device can extract a data segment of the second specified length from a specified position in the zero block's encryption vector to obtain a zero block result vector. The sending device performs a bitwise XOR operation on the zero block result vector and the zero block to obtain a result zero block. The length of the result zero block is the same as the length of the original zero block. The sending device concatenates the encrypted integer block and the result zero block to obtain the encrypted data. The sending device then sends the application layer message to the receiving device. The application layer message includes a header and the encrypted data. The header includes an encryption indicator field, which indicates the encryption algorithm used by the sending device.

[0296] The receiving device can extract a data segment of a second specified length from a specified position in the receiving device's zero-block encryption vector to obtain a zero-block result vector. The receiving device can perform a bitwise XOR operation on the zero-block result vector and the result zero-block to obtain a zero-block. The second specified length is the data length of the zero-block. The specified position can be a preset specified position (e.g., negotiated via a cellular network).

[0297] Optionally, the sending device may add a specified position indication field to the application layer message, which can be used to indicate a specified position in the zero-block encryption vector.

[0298] In one possible implementation, the transmitting device can append padding data to the end of the null packet to obtain a padded null packet. Then, a bitwise XOR operation is performed on the padded null packet and the null packet encryption vector to obtain an encrypted null packet. The transmitting device can then send the application layer message including the encrypted null packet to the receiving device. This reduces the computational steps required to obtain the sub-null packets.

[0299] Figure 11 This paper illustrates a schematic diagram of the encryption process of an encryption method in a BeiDou communication system provided in an embodiment of this application.

[0300] For example, such as Figure 11As shown, the length of the sub-integer block obtained by the transmitting device is 128 bits, and the length of the zero block is M bits. Here, M is a positive integer greater than or equal to 1. The transmitting device can add padding data after the zero block to obtain a padded zero block. The padding data can be composed of random numbers, and its length is (128-M) bits, while the length of the padded zero block is 128 bits. The transmitting device can use the zero block initialization vector and the encryption key to obtain a zero block encryption vector using the SM4 algorithm. The zero block initialization vector can be a data segment of a first specified length from the original key, or it can be a data segment of a first specified length obtained based on the encrypted sub-integer block. The encryption key can be a data segment of a first specified length from the original key. The transmitting device can perform a bitwise XOR operation on the zero block encryption vector and the padded zero block to obtain an encrypted zero block. It should be noted that the order in which the transmitting device obtains the zero block encryption vector and the padded zero block is not limited in this embodiment. It should also be noted that the transmitting device can use other encryption algorithms to obtain encrypted sub-integer blocks, such as the SM3 national cryptographic algorithm, etc., and this embodiment does not limit this.

[0301] For example, when the zero group is as described above Figure 5 When Pb is shown, the programming language for the sending device to obtain encrypted zero packets is as follows:

[0302] Eb = SM4_CFB(K, Pb, IV)

[0303] SM4_CFB{

[0304] P1 = Rand 128-O ()Pb'=Pb||P1

[0305] IV' = SM4(K,IV)

[0306] Eb=IV'⊕Pb'

[0307] return Eb

[0308] }

[0309] Where Eb is the final encrypted null block. K is the encryption key, IV is the null block initialization vector, P1 is the fifth specified length of padding data, Pb is the second specified length of null block, Pb' is the padding null block, IV' is the null block encryption vector, and O is the length of the null block.

[0310] In one possible implementation, the sending device can add a zero-packet indication field to the application layer message. This field indicates whether the application layer message includes encrypted zero packets. Optionally, the sending device can add a raw data length indication to the application layer message, indicating the length of the raw data. The receiving device can determine the encrypted whole packets and encrypted zero packets based on the length of the raw data and a first specified length. Optionally, the sending device can append the length of the raw data to the outbound data at the MDCP layer or SLC layer before sending it to the receiving device.

[0311] The terminal 100 provided in the embodiments of this application is described below.

[0312] Terminal 100 may be a mobile phone, tablet computer, desktop computer, laptop computer, handheld computer, notebook computer, ultra-mobile personal computer (UMPC), netbook, as well as cellular phone, personal digital assistant (PDA), augmented reality (AR) device, virtual reality (VR) device, artificial intelligence (AI) device, wearable device, in-vehicle device, smart home device and / or smart city device. The specific type of electronic device is not particularly limited in the embodiments of this application.

[0313] Figure 12 This illustration shows a schematic diagram of the hardware structure of a terminal 100 provided in an embodiment of this application.

[0314] The following description uses terminal 100 as an example to illustrate the embodiment. It should be understood that... Figure 9 The terminal 100 shown is merely an example, and the terminal 100 may have more than... Figure 9 The more or fewer components shown can be combined into two or more components, or they can have different component configurations. Figure 9 The various components shown can be implemented in hardware, software, or a combination of hardware and software, including one or more signal processing and / or application-specific integrated circuits.

[0315] Terminal 100 may include: processor 110, external memory interface 120, internal memory 121, universal serial bus (USB) interface 130, charging management module 140, power management module 141, battery 142, antenna 1, antenna 2, mobile communication module 150, wireless communication module 160, audio module 170, speaker 170A, receiver 170B, microphone 170C, headphone jack 170D, sensor module 180, buttons 190, motor 191, indicator 192, camera 193, display screen 194, and subscriber identification module (SIM) card interface 195, etc. The sensor module 180 may include a pressure sensor 180A, a gyroscope sensor 180B, a barometric pressure sensor 180C, a magnetic sensor 180D, an accelerometer sensor 180E, a distance sensor 180F, a proximity sensor 180G, a fingerprint sensor 180H, a temperature sensor 180J, a touch sensor 180K, an ambient light sensor 180L, a bone conduction sensor 180M, etc.

[0316] It is understood that the structure illustrated in the embodiments of the present invention does not constitute a specific limitation on the terminal 100. In other embodiments of this application, the terminal 100 may include more or fewer components than illustrated, or combine some components, or split some components, or have different component arrangements. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0317] Processor 110 may include one or more processing units, such as: application processor (AP), modem processor, graphics processing unit (GPU), image signal processor (ISP), controller, memory, video codec, digital signal processor (DSP), baseband processor, and / or neural network processing unit (NPU), etc. Different processing units may be independent devices or integrated into one or more processors.

[0318] The controller can serve as the central nervous system and command center of the terminal 100. The controller can generate operation control signals based on the instruction opcode and timing signals to control the fetching and execution of instructions.

[0319] The processor 110 may also include a memory for storing instructions and data. In some embodiments, the memory in the processor 110 is a cache memory. This memory can store instructions or data that the processor 110 has just used or that are used repeatedly. If the processor 110 needs to use the instruction or data again, it can retrieve it directly from the memory. This avoids repeated accesses, reduces the waiting time of the processor 110, and thus improves the efficiency of the system.

[0320] In some embodiments, the processor 110 may include one or more interfaces. Interfaces may include an inter-integrated circuit (I2C) interface, an inter-integrated circuit sound (I2S) interface, a pulse code modulation (PCM) interface, a universal asynchronous receiver / transmitter (UART) interface, a mobile industry processor interface (MIPI), a general-purpose input / output (GPIO) interface, a subscriber identity module (SIM) interface, and / or a universal serial bus (USB) interface, etc.

[0321] The I2C interface is a bidirectional synchronous serial bus, including a serial data line (SDA) and a serial clock line (SCL). In some embodiments, the processor 110 may include multiple I2C buses. The processor 110 can couple to the touch sensor 180K, charger, flash, camera 193, etc., through different I2C bus interfaces. For example, the processor 110 can couple to the touch sensor 180K through the I2C interface, enabling the processor 110 and the touch sensor 180K to communicate through the I2C bus interface, thereby realizing the touch function of the terminal 100.

[0322] The I2S interface can be used for audio communication. In some embodiments, the processor 110 may include multiple I2S buses. The processor 110 can be coupled to the audio module 170 via the I2S bus to enable communication between the processor 110 and the audio module 170. In some embodiments, the audio module 170 can transmit audio signals to the wireless communication module 160 via the I2S interface to enable the function of answering phone calls through a Bluetooth headset.

[0323] The PCM interface can also be used for audio communication, sampling, quantizing, and encoding analog signals. In some embodiments, the audio module 170 and the wireless communication module 160 can be coupled via the PCM bus interface. In some embodiments, the audio module 170 can also transmit audio signals to the wireless communication module 160 via the PCM interface, enabling the function of answering phone calls through a Bluetooth headset. Both the I2S interface and the PCM interface can be used for audio communication.

[0324] The UART interface is a universal serial data bus used for asynchronous communication. This bus can be a bidirectional communication bus. It converts the data to be transmitted between serial and parallel communication. In some embodiments, the UART interface is typically used to connect the processor 110 and the wireless communication module 160. For example, the processor 110 communicates with the Bluetooth module in the wireless communication module 160 via the UART interface to implement Bluetooth functionality. In some embodiments, the audio module 170 can transmit audio signals to the wireless communication module 160 via the UART interface to enable music playback through Bluetooth headphones.

[0325] The MIPI interface can be used to connect the processor 110 to peripheral devices such as the display screen 194 and the camera 193. The MIPI interface includes a camera serial interface (CSI) and a display serial interface (DSI). In some embodiments, the processor 110 and the camera 193 communicate via the CSI interface to enable the shooting function of the terminal 100. The processor 110 and the display screen 194 communicate via the DSI interface to enable the display function of the terminal 100.

[0326] The GPIO interface can be configured via software. It can be configured as a control signal or a data signal. In some embodiments, the GPIO interface can be used to connect the processor 110 to a camera 193, a display screen 194, a wireless communication module 160, an audio module 170, a sensor module 180, etc. The GPIO interface can also be configured as an I2C interface, an I2S interface, a UART interface, a MIPI interface, etc.

[0327] USB port 130 is a USB standard compliant interface, specifically a Mini USB port, Micro USB port, USB Type-C port, etc. USB port 130 can be used to connect a charger to charge terminal 100, and can also be used for data transfer between terminal 100 and peripheral devices. It can also be used to connect headphones for audio playback. This interface can also be used to connect other electronic devices, such as AR devices.

[0328] It is understood that the interface connection relationships between the modules illustrated in the embodiments of the present invention are merely illustrative and do not constitute a structural limitation on the terminal 100. In other embodiments of this application, the terminal 100 may also adopt different interface connection methods or a combination of multiple interface connection methods as described in the above embodiments.

[0329] The charging management module 140 receives charging input from a charger. The charger can be a wireless charger or a wired charger. In some wired charging embodiments, the charging management module 140 receives charging input from the wired charger via the USB interface 130. In some wireless charging embodiments, the charging management module 140 receives wireless charging input via the wireless charging coil of the terminal 100. While charging the battery 142, the charging management module 140 can also supply power to the electronic device via the power management module 141.

[0330] The power management module 141 connects the battery 142, the charging management module 140, and the processor 110. The power management module 141 receives input from the battery 142 and / or the charging management module 140, providing power to the processor 110, internal memory 121, external memory, display screen 194, camera 193, and wireless communication module 160, etc. The power management module 141 can also monitor parameters such as battery capacity, battery cycle count, and battery health status (leakage current, impedance). In some other embodiments, the power management module 141 may also be located within the processor 110. In other embodiments, the power management module 141 and the charging management module 140 may be located in the same device.

[0331] The wireless communication function of terminal 100 can be implemented through antenna 1, antenna 2, mobile communication module 150, wireless communication module 160, modem processor and baseband processor, etc.

[0332] Antennas 1 and 2 are used to transmit and receive electromagnetic wave signals. Each antenna in terminal 100 can be used to cover one or more communication frequency bands. Different antennas can also be multiplexed to improve antenna utilization. For example, antenna 1 can be multiplexed as a diversity antenna for a wireless local area network. In some other embodiments, the antennas can be used in conjunction with tuning switches.

[0333] The mobile communication module 150 can provide solutions for wireless communication applications including 2G / 3G / 4G / 5G on the terminal 100. The mobile communication module 150 may include at least one filter, switch, power amplifier, low-noise amplifier (LNA), etc. The mobile communication module 150 can receive electromagnetic waves via the antenna 1, and perform filtering, amplification, and other processing on the received electromagnetic waves before transmitting them to the modem processor for demodulation. The mobile communication module 150 can also amplify the signal modulated by the modem processor and convert it into electromagnetic waves for radiation via the antenna 1. In some embodiments, at least some functional modules of the mobile communication module 150 may be housed in the processor 110. In some embodiments, at least some functional modules of the mobile communication module 150 and at least some modules of the processor 110 may be housed in the same device.

[0334] The modem processor may include a modulator and a demodulator. The modulator modulates the low-frequency baseband signal to be transmitted into a mid-to-high frequency signal. The demodulator demodulates the received electromagnetic wave signal into a low-frequency baseband signal. The demodulator then transmits the demodulated low-frequency baseband signal to the baseband processor for processing. After processing by the baseband processor, the low-frequency baseband signal is transmitted to the application processor. The application processor outputs sound signals through an audio device (not limited to speaker 170A, receiver 170B, etc.) or displays images or videos through the display screen 194. In some embodiments, the modem processor may be a separate device. In other embodiments, the modem processor may be independent of the processor 110 and may be housed in the same device as the mobile communication module 150 or other functional modules.

[0335] The wireless communication module 160 can provide solutions for wireless communication applications on the terminal 100, including wireless local area networks (WLAN) (such as wireless fidelity (Wi-Fi) networks), Bluetooth (BT), global navigation satellite system (GNSS), satellite communication modules, frequency modulation (FM), near field communication (NFC), and infrared (IR) technologies. The wireless communication module 160 can be one or more devices integrating at least one communication processing module. The wireless communication module 160 receives electromagnetic waves via antenna 2, performs frequency modulation and filtering of the electromagnetic wave signals, and sends the processed signal to processor 110. The wireless communication module 160 can also receive signals to be transmitted from processor 110, perform frequency modulation and amplification, and convert them into electromagnetic waves for radiation via antenna 2.

[0336] Among them, the satellite communication module can be used to communicate with satellite network equipment. For example, in the BeiDou communication system, the satellite communication module can communicate with BeiDou network equipment 200, and the satellite communication module can support short message transmission between BeiDou network equipment 200.

[0337] In some embodiments, antenna 1 of terminal 100 is coupled to mobile communication module 150, and antenna 2 is coupled to wireless communication module 160, enabling terminal 100 to communicate with networks and other devices via wireless communication technology. The wireless communication technology may include Global System for Mobile Communications (GSM), General Packet Radio Service (GPRS), Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), Time Division Code Division Multiple Access (TD-SCDMA), Long Term Evolution (LTE), BT, GNSS, WLAN, NFC, FM, and / or IR technologies, etc. The GNSS may include the Global Positioning System (GPS), the Global Navigation Satellite System (GLONASS), the BeiDou Navigation Satellite System (BDS), the Quasi-Zenith Satellite System (QZSS), and / or satellite-based augmentation systems (SBAS).

[0338] Terminal 100 implements display functions through a GPU, display screen 194, and application processor. The GPU is a microprocessor for image processing, connected to the display screen 194 and the application processor. The GPU is used to perform mathematical and geometric calculations and for graphics rendering. Processor 110 may include one or more GPUs, which execute program instructions to generate or modify display information.

[0339] Display screen 194 is used to display images, videos, etc. Display screen 194 includes a display panel. The display panel may be a liquid crystal display (LCD), an organic light-emitting diode (OLED), an active-matrix organic light-emitting diode (AMOLED), a flexible light-emitting diode (FLED), a miniature LED, a microLED, a quantum dot light-emitting diode (QLED), etc. In some embodiments, terminal 100 may include one or N displays 194, where N is a positive integer greater than 1.

[0340] Terminal 100 can perform shooting functions through ISP, camera 193, video codec, GPU, display 194 and application processor.

[0341] The ISP (Image Signal Processor) is used to process data fed back from the camera 193. For example, when taking a picture, the shutter is opened, and light is transmitted through the lens to the camera's photosensitive element. The light signal is converted into an electrical signal, and the camera's photosensitive element transmits the electrical signal to the ISP for processing, transforming it into an image visible to the naked eye. The ISP can also perform algorithmic optimization of image noise, brightness, and skin tone. The ISP can also optimize parameters such as exposure and color temperature of the shooting scene. In some embodiments, the ISP can be set in the camera 193.

[0342] Camera 193 is used to capture still images or videos. An object is projected onto a photosensitive element by generating an optical image through the lens. The photosensitive element can be a charge-coupled device (CCD) or a complementary metal-oxide-semiconductor (CMOS) phototransistor. The photosensitive element converts the light signal into an electrical signal, which is then passed to an ISP for conversion into a digital image signal. The ISP outputs the digital image signal to a DSP for processing. The DSP converts the digital image signal into image signals in standard RGB, YUV, or other formats. In some embodiments, terminal 100 may include one or N cameras 193, where N is a positive integer greater than 1.

[0343] A digital signal processor (DSP) is used to process digital signals. Besides digital image signals, it can also process other digital signals. For example, when terminal 100 selects a frequency point, the DSP can perform Fourier transforms on the frequency energy.

[0344] Video codecs are used to compress or decompress digital video. Terminal 100 may support one or more video codecs. Thus, terminal 100 can play or record videos in various encoding formats, such as Moving Picture Experts Group (MPEG) 1, MPEG 2, MPEG 3, MPEG 4, etc.

[0345] NPU stands for Neural Network (NN) Computing Processor. By borrowing the structure of biological neural networks, such as the transmission patterns between neurons in the human brain, it can rapidly process input information and continuously learn on its own. NPUs can enable intelligent cognitive applications in terminals, such as image recognition, facial recognition, speech recognition, and text understanding.

[0346] The external storage interface 120 can be used to connect an external storage card, such as a Micro SD card, to expand the storage capacity of the terminal 100. The external storage card communicates with the processor 110 through the external storage interface 120 to perform data storage functions. For example, music, video, and other files can be saved on the external storage card.

[0347] Internal memory 121 can be used to store computer executable program code, which includes instructions. Processor 110 executes various functional applications and data processing of terminal 100 by running the instructions stored in internal memory 121. Internal memory 121 may include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback, image playback, etc.), etc. The data storage area may store data created during the use of terminal 100 (such as audio data, phonebook, etc.). Furthermore, internal memory 121 may include high-speed random access memory and may also include non-volatile memory, such as at least one disk storage device, flash memory device, universal flash storage (UFS), etc.

[0348] Terminal 100 can implement audio functions, such as music playback and recording, through audio module 170, speaker 170A, receiver 170B, microphone 170C, headphone jack 170D, and application processor.

[0349] The audio module 170 is used to convert digital audio information into analog audio signals for output, and also to convert analog audio input into digital audio signals. The audio module 170 can also be used for encoding and decoding audio signals. In some embodiments, the audio module 170 may be located in the processor 110, or some functional modules of the audio module 170 may be located in the processor 110.

[0350] The speaker 170A, also known as a "loudspeaker," is used to convert audio electrical signals into sound signals. The terminal 100 can listen to music or make hands-free calls through the speaker 170A.

[0351] The receiver 170B, also known as the "earpiece," is used to convert audio electrical signals into sound signals. When the terminal 100 receives a phone call or voice message, the receiver 170B can be brought close to the listener's ear to hear the voice.

[0352] Microphone 170C, also known as a "microphone" or "voice transducer," is used to convert sound signals into electrical signals. When making a phone call or sending a voice message, the user can speak by bringing their mouth close to microphone 170C, inputting the sound signal into microphone 170C. Terminal 100 may have at least one microphone 170C. In some embodiments, terminal 100 may have two microphones 170C, which, in addition to collecting sound signals, can also perform noise reduction. In other embodiments, terminal 100 may have three, four, or more microphones 170C, which can collect sound signals, reduce noise, identify the sound source, and perform directional recording, etc.

[0353] The 170D headphone jack is used to connect wired headphones. The 170D headphone jack can be a USB 130 interface or a 3.5mm Open Mobile Terminal Platform (OMTP) standard interface, a CTIA (Cellular Telecommunications Industry Association of the USA) standard interface.

[0354] Pressure sensor 180A is used to sense pressure signals and convert them into electrical signals. In some embodiments, pressure sensor 180A can be disposed on display screen 194. There are many types of pressure sensors 180A, such as resistive pressure sensors, inductive pressure sensors, and capacitive pressure sensors. A capacitive pressure sensor may include at least two parallel plates with conductive material. When force is applied to pressure sensor 180A, the capacitance between the electrodes changes. Terminal 100 determines the pressure intensity based on the change in capacitance. When a touch operation is applied to display screen 194, terminal 100 detects the intensity of the touch operation based on pressure sensor 180A. Terminal 100 can also calculate the touch position based on the detection signal from pressure sensor 180A. In some embodiments, touch operations applied to the same touch position but with different touch operation intensities can correspond to different operation commands. For example: when a touch operation with an intensity less than a first pressure threshold is applied to the SMS application icon, a command to view an SMS is executed. When a touch operation with an intensity greater than or equal to the first pressure threshold is applied to the SMS application icon, a command to create a new SMS is executed.

[0355] The gyroscope sensor 180B can be used to determine the motion attitude of the terminal 100. In some embodiments, the gyroscope sensor 180B can determine the angular velocity of the terminal 100 around three axes (i.e., the x, y, and z axes). The gyroscope sensor 180B can be used for image stabilization. For example, when the shutter is pressed, the gyroscope sensor 180B detects the angle of the terminal 100's shake, calculates the distance that the lens module needs to compensate based on the angle, and allows the lens to counteract the shake of the terminal 100 through reverse movement, thus achieving image stabilization. The gyroscope sensor 180B can also be used in navigation and motion-sensing game scenarios.

[0356] The barometric pressure sensor 180C is used to measure air pressure. In some embodiments, the terminal 100 calculates altitude using the air pressure value measured by the barometric pressure sensor 180C to assist in positioning and navigation.

[0357] The magnetic sensor 180D includes a Hall sensor. The terminal 100 can use the magnetic sensor 180D to detect the opening and closing of the flip cover. In some embodiments, when the terminal 100 is a flip phone, the terminal 100 can detect the opening and closing of the flip cover using the magnetic sensor 180D. Then, based on the detected opening and closing state of the cover or the flip cover, features such as automatic flip unlocking can be set.

[0358] The 180E accelerometer can detect the magnitude of acceleration of terminal 100 in various directions (typically three axes). When terminal 100 is stationary, it can detect the magnitude and direction of gravity. It can also be used to identify the posture of electronic devices, and is applied to applications such as screen orientation switching and pedometers.

[0359] A distance sensor 180F is used to measure distance. The terminal 100 can measure distance via infrared or laser. In some embodiments, during a shooting scene, the terminal 100 can utilize the distance sensor 180F to measure distance for rapid focusing.

[0360] The proximity sensor 180G may include, for example, a light-emitting diode (LED) and a light detector, such as a photodiode. The LED may be an infrared LED. The terminal 100 emits infrared light outward through the LED. The terminal 100 uses the photodiode to detect infrared reflected light from nearby objects. When sufficient reflected light is detected, it can be determined that there is an object near the terminal 100. When insufficient reflected light is detected, the terminal 100 can determine that there is no object near the terminal 100. The terminal 100 may use the proximity sensor 180G to detect when a user holds the terminal 100 close to their ear for a call, so as to automatically turn off the screen to save power. The proximity sensor 180G can also be used in holster mode and pocket mode for automatic unlocking and screen locking.

[0361] The ambient light sensor 180L is used to sense the ambient light intensity. The terminal 100 can adaptively adjust the brightness of the display screen 194 based on the sensed ambient light intensity. The ambient light sensor 180L can also be used to automatically adjust the white balance when taking pictures. The ambient light sensor 180L can also work with the proximity sensor 180G to detect whether the terminal 100 is in a pocket to prevent accidental touches.

[0362] The fingerprint sensor 180H is used to collect fingerprints. The terminal 100 can use the characteristics of the collected fingerprints to unlock the device, access application locks, take photos with fingerprints, and answer calls with fingerprints.

[0363] Temperature sensor 180J is used to detect temperature. In some embodiments, terminal 100 uses the temperature detected by temperature sensor 180J to execute a temperature processing strategy. For example, when the temperature reported by temperature sensor 180J exceeds a threshold, terminal 100 reduces the performance of the processor located near temperature sensor 180J to reduce power consumption and implement thermal protection. In other embodiments, when the temperature is below another threshold, terminal 100 heats battery 142 to prevent abnormal shutdown of terminal 100 due to low temperature. In still other embodiments, when the temperature is below yet another threshold, terminal 100 boosts the output voltage of battery 142 to prevent abnormal shutdown due to low temperature.

[0364] Touch sensor 180K, also known as a "touch panel," can be located on display screen 194. The touch sensor 180K and display screen 194 together form a touchscreen, also known as a "touchscreen." Touch sensor 180K detects touch operations applied to or near it. The touch sensor can transmit the detected touch operation to the application processor to determine the type of touch event. Visual output related to the touch operation can be provided through display screen 194. In other embodiments, touch sensor 180K may also be located on the surface of terminal 100, in a different position than display screen 194.

[0365] The bone conduction sensor 180M can acquire vibration signals. In some embodiments, the bone conduction sensor 180M can acquire vibration signals from the vibrating bone segments of the human vocal cords. The bone conduction sensor 180M can also contact the human pulse to receive blood pressure signals. In some embodiments, the bone conduction sensor 180M can also be incorporated into headphones to form bone conduction headphones. The audio module 170 can parse the voice signals from the vibrating bone segments of the vocal cords acquired by the bone conduction sensor 180M to realize voice functionality. The application processor can parse heart rate information from the blood pressure signals acquired by the bone conduction sensor 180M to realize heart rate detection functionality.

[0366] Buttons 190 include a power button, volume buttons, etc. Buttons 190 can be mechanical buttons or touch-sensitive buttons. Terminal 100 can receive button input and generate key signal inputs related to user settings and function control of terminal 100.

[0367] Motor 191 can generate vibration alerts. Motor 191 can be used for incoming call vibration alerts or for touch vibration feedback. For example, different vibration feedback effects can correspond to touch operations performed on different applications (such as taking photos, playing audio, etc.). Motor 191 can also correspond to different vibration feedback effects for touch operations performed on different areas of the display screen 194. Different application scenarios (such as time reminders, receiving messages, alarm clocks, games, etc.) can also correspond to different vibration feedback effects. The touch vibration feedback effect can also be customized.

[0368] Indicator 192 can be an indicator light, used to indicate charging status, power changes, or to indicate messages, missed calls, notifications, etc.

[0369] The SIM card interface 195 is used to connect a SIM card. The SIM card can be inserted into or removed from the SIM card interface 195 to make contact with and separate from the terminal 100. The terminal 100 can support one or N SIM card interfaces, where N is a positive integer greater than 1. The SIM card interface 195 can support Nano SIM cards, Micro SIM cards, SIM cards, etc. Multiple cards can be inserted into the same SIM card interface 195 simultaneously. The multiple cards can be of the same or different types. The SIM card interface 195 is also compatible with different types of SIM cards. The SIM card interface 195 is also compatible with external memory cards. The terminal 100 interacts with the network through the SIM card to realize functions such as calls and data communication. In some embodiments, the terminal 100 uses an eSIM, i.e., an embedded SIM card. The eSIM card can be embedded in the terminal 100 and cannot be separated from the terminal 100.

[0370] The following describes an encryption method in a BeiDou communication system provided in the embodiments of this application.

[0371] Figure 13 A flowchart illustrating an encryption method in a BeiDou communication system provided in an embodiment of this application is shown.

[0372] like Figure 13 As shown, the encryption method in this BeiDou communication system includes the following steps:

[0373] S1301, Terminal 100 adds padding data to the end of the zero group in the original data up to a first specified length to obtain a padding zero group; wherein, the data length of the zero group is a second specified length, and the first specified length is greater than the second specified length.

[0374] S1302, Terminal 100 performs a bitwise XOR operation on the padding zero block and the zero block encryption vector to obtain the encrypted zero block.

[0375] S1303, Terminal 100 intercepts the data of the second specified length in the header of the encrypted zero packet and obtains the result zero packet.

[0376] S1304, Terminal 100 sends an application layer message including result zero packets to Beidou network device 200.

[0377] S1305 and Beidou network equipment 200 add padding data to the end of the result zero group to obtain the result padding zero group; wherein, the data length of the result padding zero group is the first specified length.

[0378] S1306 and Beidou Network Equipment 200 perform a bitwise XOR operation on the result-filled zero-block and zero-block encryption vector to obtain the decrypted zero-block.

[0379] S1307, Beidou Network Equipment 200 intercepts the second specified length of data in the header of the decrypted zero packet to obtain the zero packet in the original data.

[0380] For a detailed description of the results involving terminal 100 and the resulting zero-grouping, please refer to the above. Figure 9 The embodiments shown are not described in detail here.

[0381] For a detailed description of the BeiDou network equipment 200 and the zero-packet data, please refer to the aforementioned [reference needed]. Figure 10 The embodiments described herein will not be repeated here.

[0382] The following describes some possible implementation methods for execution by terminal 100.

[0383] In one possible implementation, the original data further includes i sub-integer packets, where i is a positive integer. The method also includes: the terminal obtaining an encrypted integer packet based on the i sub-integer packets. The data length of each sub-integer packet is a first specified length, and the application layer message also includes the encrypted integer packet.

[0384] For details, please refer to the above. Figure 5 The embodiment described above.

[0385] In one possible implementation, the terminal obtains the encrypted whole block based on i sub-blocks. Specifically, the terminal obtains the encrypted vector of the a-th sub-block from the i sub-blocks and its initial vector, where a is less than or equal to i. The terminal uses an encryption algorithm to determine the encrypted sub-block of the a-th sub-block using the encryption vector and the encryption key. The encryption key is a data segment of a first specified length from the original key, and it differs from the initial vector of the a-th sub-block. The terminal concatenates the encrypted sub-blocks of the i sub-blocks together to obtain the encrypted whole block. The encryption algorithm can be SM4, SM3, etc., and this application does not limit this.

[0386] For details, please refer to the above. Figure 5 The embodiment described above.

[0387] In one possible implementation, the method further includes: when a equals 1, the initial vector of the a-th sub-block is a data segment of a first specified length in the original key. When a is greater than 1, the initial vector of the a-th sub-block is the encrypted sub-block of the (a-1)-th sub-block, or the initial vector of the a-th sub-block is a data segment of a first specified length in the original key. The encryption key and the initial vector can be a data segment of a first specified length composed of any non-repeating bits in the original key, and the encryption key and the initial vector are different. Optionally, the encryption key and the initial vector can be different preset data segments of the first specified length.

[0388] For details, please refer to the above. Figure 5 The embodiment described above.

[0389] In one possible implementation, the application layer message also includes message header information, which includes an encryption indicator field. This encryption indicator field indicates the encryption algorithm used by the terminal when generating the application layer message. The encryption algorithm can be SM4, SM3, etc., and this application does not limit this choice.

[0390] In one possible implementation, before the terminal adds padding data to the end of the zero-groups in the original data up to a first specified length, the method further includes: the terminal determining the number of sub-integer groups as i based on the data length of the original data and the first specified length. The terminal divides the i data segments of the first specified length starting from the beginning position in the original data into i sub-integer groups. The terminal determines the data segments in the original data after the i sub-integer groups as zero-groups.

[0391] For details, please refer to the above. Figure 4 The embodiment described above.

[0392] In one possible implementation, before obtaining the encrypted zero block based on the padded zero block and the zero block encryption vector, the method further includes: the terminal obtaining the zero block encryption vector based on the zero block initialization vector and the encryption key using an encryption algorithm. Here, the zero block initialization vector is a data segment of a first specified length in the original key. Here, the encryption key is a data segment of a first specified length in the original key, and the encryption key is different from the zero block initialization vector.

[0393] For details, please refer to the above. Figure 9 The embodiment described above.

[0394] In one possible implementation, before obtaining the encrypted zero block based on the padded zero block and the zero block encryption vector, the method further includes: the terminal obtaining the zero block encryption vector based on the zero block initialization vector and the encryption key using an encryption algorithm. Here, the zero block initialization vector is the encrypted sub-integer corresponding to the a-th sub-integer block. And the encryption key is a data segment of a first specified length in the original key.

[0395] For details, please refer to the above. Figure 9 The embodiment described above.

[0396] In one possible implementation, before the terminal performs a bitwise XOR operation on the padding zero block and the zero block encryption vector to obtain the encrypted zero block, the method further includes: the terminal obtaining the original key from the cellular network. Optionally, the terminal and the BeiDou network device negotiate to obtain the original key through the BeiDou network. Optionally, the terminal and the BeiDou network device have the original key pre-set.

[0397] In one possible implementation, the first specified length is 128 bits.

[0398] For details, please refer to the above. Figure 5 The embodiment described above.

[0399] In one possible implementation, the data length of the resulting zero group is the same as the data length of the zero group.

[0400] For details, please refer to the above. Figure 9 The embodiment described above.

[0401] The following describes some possible implementation methods for the BeiDou network equipment 200.

[0402] In one possible implementation, the application layer message also includes encrypted integer packets. The method further includes: the BeiDou network device obtaining i sub-integer packets from the original data based on the encrypted integer packets. The data length of each sub-integer packet is a first specified length, where i is a positive integer. The BeiDou network device concatenates the i sub-integer packets and a zero packet to obtain the original data.

[0403] For details, please refer to the above. Figure 5 The embodiment described above.

[0404] In one possible implementation, before the BeiDou network device obtains i sub-groups from the original data based on the encrypted whole groups, the method further includes: the BeiDou network device determining the number of encrypted sub-groups as i based on the data length of the encrypted data and a first specified length. Here, the encrypted data consists of concatenated encrypted whole groups and result zero groups. The BeiDou network device divides the i data segments of the first specified length, starting from the beginning position in the encrypted data, into encrypted whole groups. Each encrypted whole group includes i encrypted sub-groups. The BeiDou network device identifies the data segments following the i encrypted sub-groups in the encrypted data as result zero groups.

[0405] For details, please refer to the above. Figure 5 The embodiment described above.

[0406] In one possible implementation, the BeiDou network device obtains i sub-integer blocks from the original data based on encrypted integer blocks. Specifically, this includes: the BeiDou network device, based on the a-th encrypted sub-integer block and the encryption key, determines the integer encryption vector of the a-th encrypted sub-integer block using an encryption algorithm, where a is less than or equal to i. The encryption key is a data segment of a first specified length in the original key. The BeiDou network device obtains sub-integer blocks of the a-th encrypted sub-integer block based on the integer encryption vector and the initial vector of the a-th encrypted sub-integer block. The initial vector of the a-th encrypted sub-integer block is different from the encryption key. The encryption algorithm can be SM4, SM3, etc., and this application does not limit this.

[0407] For details, please refer to the above. Figure 5 The embodiment described above.

[0408] In one possible implementation, when a equals 1, the initial vector of the a-th sub-block is a data segment of a first specified length in the original key. When a is greater than 1, the initial vector of the a-th encrypted sub-block is the (a-1)-th encrypted sub-block, or a data segment of a first specified length in the original key. The encryption key and the initial vector can be a data segment of a first specified length composed of any non-repeating bits from the original key, and the encryption key and the initial vector are different. Optionally, the encryption key and the initial vector can be different preset data segments of the first specified length.

[0409] For details, please refer to the above. Figure 5 The embodiment described above.

[0410] In one possible implementation, before the BeiDou network device performs a bitwise XOR operation on the result to fill in zero packets and the zero packet encryption vector to obtain the decrypted zero packets, the method further includes: the application layer message also includes message header information. The message header information includes an encryption indicator field. The BeiDou network device determines the encryption algorithm used by the terminal when generating the application layer message based on the encryption indicator field. The encryption algorithm can be the SM4 algorithm, the SM3 algorithm, etc., and this application does not limit this.

[0411] In one possible implementation, before the BeiDou network device performs a bitwise XOR operation on the result-filled zero-block and zero-block encryption vector to obtain the decrypted zero-block, the method further includes: the BeiDou network device obtaining the zero-block encryption vector based on the zero-block initialization vector and the encryption key using an encryption algorithm. Here, the zero-block initialization vector is a data segment of a first specified length in the original key. Here, the encryption key is a data segment of a first specified length in the original key, and the zero-block initialization vector and the encryption key are different.

[0412] For details, please refer to the above. Figure 10 The embodiment described above.

[0413] In one possible implementation, before the BeiDou network device performs a bitwise XOR operation on the result-filled zero-block and zero-block encryption vector to obtain the decrypted zero-block, the method further includes: the BeiDou network device obtaining the zero-block encryption vector based on the zero-block initial vector and the encryption key using an encryption algorithm. Here, the zero-block initial vector is the a-th encrypted sub-block. And the encryption key is the first specified length data segment in the original key.

[0414] For details, please refer to the above. Figure 10 The embodiment described above.

[0415] In one possible implementation, before the BeiDou network device performs a bitwise XOR operation on the result to fill in zero packets and the zero-packet encryption vector to obtain the decrypted zero packets, the method further includes: the BeiDou network device obtaining the original key from the cellular network. Optionally, the terminal and the BeiDou network device negotiate to obtain the original key through the BeiDou network. Optionally, the terminal and the BeiDou network device have the original key preset.

[0416] The foregoing details the method provided in this application. In order to facilitate better implementation of the above-described solutions in the embodiments of this application, the embodiments of this application also provide corresponding devices or equipment.

[0417] This application embodiment can divide the terminal 100 into functional modules according to the above method example. For example, each function can be divided into its own functional module, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module. It should be noted that the module division in this application embodiment is illustrative and only represents one logical functional division. In actual implementation, there may be other division methods.

[0418] The following will combine Figures 14 to 17 The communication device of the embodiments of this application is described in detail.

[0419] In the case of using integrated units, see Figure 14 , Figure 14 This is a schematic diagram of the structure of the communication device 1400 provided in an embodiment of this application. The communication device 1400 can be the terminal 100 in the above embodiments. Optionally, the communication device 1400 can be a chip / chip system, such as a Beidou communication chip. Figure 14 As shown, the communication device 1400 may include a transceiver unit 1410 and a processing unit 1420.

[0420] In one design, the processing unit 1420 can be used to add padding data to the end of the zero group in the original data up to a first specified length to obtain a padding zero group; wherein the data length of the zero group is a second specified length; wherein the first specified length is greater than the second specified length.

[0421] The processing unit 1420 is also configured to perform a bitwise XOR operation on the padding zero block and the zero block encryption vector to obtain the encryption zero block.

[0422] The processing unit 1420 is also used to extract data of a second specified length from the header of the encrypted null block to obtain the result null block.

[0423] The transceiver unit 1410 can be used to send application layer messages, including result zero packets, to the Beidou network device 200.

[0424] Optionally, the transceiver unit 1410 can also be used to perform the above-mentioned tasks. Figure 13 The method embodiment shown illustrates the functional steps related to sending and receiving performed by terminal 100.

[0425] Optionally, the processing unit 1420 can also be used to perform the above-mentioned tasks. Figure 13 The method embodiment shown illustrates the functional steps performed by terminal 100 related to protocol parsing, encapsulation, and computation determination.

[0426] It should be understood that the communication device 1400 in this design can perform the method steps executed by the terminal 100 in the aforementioned embodiment, and for the sake of brevity, it will not be described again here.

[0427] In the case of using integrated units, see Figure 15 , Figure 15 This is a schematic diagram of the communication device 1500 provided in this embodiment. The communication device 1500 can be the BeiDou network device 200 in the above embodiments. Optionally, the communication device 1500 can be a specific network element in the BeiDou network device 200, such as one or a combination of multiple network elements from the BeiDou ground transceiver station 22, the BeiDou central station 23, and the BeiDou short message fusion communication platform 24. Figure 15 As shown, the communication device 1500 may include a transceiver unit 1510 and a processing unit 1520.

[0428] In one design, the transceiver unit 1510 can be used to receive application layer messages sent by the terminal 100. The application layer messages include result zero packets, and the data length of the result zero packets is a second specified length.

[0429] The processing unit 1520 can be used to add padding data to the end of the result zero group to obtain the result zero-padded group; wherein the data length of the result zero-padded group is a first specified length.

[0430] The processing unit 1520 is also used to perform a bitwise XOR operation on the result-filled zero block and the zero block encryption vector to obtain the decrypted zero block.

[0431] The processing unit 1520 is also used to extract a second specified length of data from the header of the decrypted null packet to obtain the null packet in the original data.

[0432] Optionally, the transceiver unit 1510 can also be used to perform the above-mentioned tasks. Figure 10 The method embodiment shown illustrates the functional steps related to sending and receiving performed by the BeiDou network device 200.

[0433] Optionally, the processing unit 1520 can also be used to perform the above. Figure 10 The method embodiment shown illustrates the functional steps of protocol parsing, encapsulation, and computation determination performed by the BeiDou network device 200.

[0434] It should be understood that the communication device 1500 in this design can perform the method steps executed by the Beidou network device 200 in the aforementioned embodiment, and for the sake of brevity, it will not be described again here.

[0435] The terminal 100 and Beidou network device 200 of this application embodiment have been described above. It should be understood that any device possessing the above-described... Figure 14Any product of the aforementioned terminal 100 functions, as long as it possesses the above-mentioned features. Figure 15 Any form of product that incorporates the functions of the Beidou network device 200 falls within the protection scope of the embodiments of this application.

[0436] As a possible product form, the terminal 100 described in this application embodiment can be implemented using a general bus architecture.

[0437] See Figure 16 , Figure 16 This is a schematic diagram of the structure of the communication device 1600 provided in an embodiment of this application. The communication device 1600 may be a terminal 100, or a device therein. Figure 16 As shown, the communication device 1600 includes a processor 1601 and a transceiver 1602 internally connected and communicating with the processor. The processor 1601 can be a general-purpose processor or a dedicated processor, such as a baseband processor or a central processing unit (CPU) for satellite communication. The baseband processor can process satellite communication protocols and data, while the CPU can control the communication device (e.g., baseband chip, terminal, terminal chip), execute computer programs, and process data from these programs. The transceiver 1602, also known as a transceiver unit, transceiver, or transceiver circuit, is used to implement transceiver functions. The transceiver 1602 may include a receiver and a transmitter. The receiver, also known as a receiver circuit, is used to implement a receiving function; the transmitter, also known as a transmitter or transmitting circuit, is used to implement a transmitting function. Optionally, the communication device 1600 may also include an antenna 1603 and / or a radio frequency unit (not shown in the figure). The antenna 1603 and / or radio frequency unit may be located inside the communication device 1600 or separate from the communication device 1600, that is, the antenna 1603 and / or radio frequency unit may be deployed remotely or in a distributed manner.

[0438] Optionally, the communication device 1600 may include one or more memories 1604, which may store instructions, which may be computer programs, that can be executed on the communication device 1600 to cause the communication device 1600 to perform the methods described in the above method embodiments. Optionally, the memory 1604 may also store data. The communication device 1600 and the memory 1604 may be provided separately or integrated together.

[0439] The processor 1601, transceiver 1602, and memory 1604 can be connected via a communication bus.

[0440] In one design, the communication device 1600 can be used to perform the functions of the terminal 100 in the aforementioned embodiments; the processor 1601 can be used to perform the aforementioned... Figure 14The terminal 100 in the illustrated embodiment performs the functional steps related to protocol parsing and encapsulation, as well as calculation and / or other processes used in the technology described herein; the transceiver 1602 can be used to perform the above. Figure 14 The terminal 100 in the illustrated embodiment performs functional steps related to sending and receiving and / or other processes used in the techniques described herein.

[0441] In any of the above designs, the processor 1601 may include a transceiver for implementing receive and transmit functions. For example, the transceiver may be a transceiver circuit, an interface, or an interface circuit. The transceiver circuit, interface, or interface circuit for implementing receive and transmit functions may be separate or integrated. The aforementioned transceiver circuit, interface, or interface circuit may be used for reading and writing code / data, or it may be used for transmitting or relaying signals.

[0442] In any of the above designs, the processor 1601 may store instructions, which may be computer programs. These computer programs, running on the processor 1601, cause the communication device 1600 to execute the method steps executed by the terminal 100 in the above method embodiments. The computer program may be embedded in the processor 1601; in this case, the processor 1601 may be implemented in hardware.

[0443] In one implementation, the communication device 1600 may include circuitry capable of performing the functions of transmitting, receiving, or communicating as described in the foregoing method embodiments. The processor and transceiver described in this application can be implemented on integrated circuits (ICs), analog ICs, radio frequency integrated circuits (RFICs), mixed-signal ICs, application-specific integrated circuits (ASICs), printed circuit boards (PCBs), electronic devices, etc. The processor and transceiver can also be manufactured using various IC process technologies, such as complementary metal oxide semiconductors (CMOS), n-metal-oxide-semiconductor (NMOS), positive-channel metal oxide semiconductors (PMOS), bipolar junction transistors (BJTs), bipolar CMOS (BiCMOS), silicon germanium (SiGe), gallium arsenide (GaAs), etc.

[0444] The scope of the communication device described in this application is not limited thereto, and the structure of the communication device may vary. Figure 16 The communication device 1600 may be a standalone device or part of a larger device. For example, the communication device 1600 may be:

[0445] (1) Independent integrated circuit IC, or chip, or chip system or subsystem;

[0446] (2) A collection of one or more ICs, optionally including storage components for storing data and computer programs;

[0447] (3) ASIC, such as modem;

[0448] (4) Modules that can be embedded in other devices;

[0449] (5) Receivers, terminals, smart terminals, cellular phones, wireless devices, handheld devices, mobile units, vehicle-mounted devices, network devices, cloud devices, artificial intelligence devices, etc.

[0450] (6) Others, etc.

[0451] As a possible product form, any network element in the BeiDou network device 200 described in this application embodiment (e.g., BeiDou ground transceiver station 22, BeiDou central station 23, BeiDou short message fusion communication platform 24) can be implemented by a general bus architecture.

[0452] See Figure 17 , Figure 17 This is a schematic diagram of the structure of the communication device 1700 provided in an embodiment of this application. The communication device 1700 may be a BeiDou network device 200, or a device therein. Figure 17As shown, the communication device 1700 includes a processor 1701 and a transceiver 1702 internally connected and communicating with the processor. The processor 1701 can be a general-purpose processor or a dedicated processor, such as a baseband processor or a central processing unit (CPU) for satellite communication. The baseband processor can process satellite communication protocols and data, while the CPU can control the communication device (e.g., a baseband chip), execute computer programs, and process data from those programs. The transceiver 1702, also known as a transceiver unit, transceiver, or transceiver circuit, is used to implement transceiver functions. The transceiver 1702 may include a receiver and a transmitter. The receiver, also known as a receiver circuit, is used to implement a receiving function; the transmitter, also known as a transmitter or transmitting circuit, is used to implement a transmitting function. Optionally, the communication device 1700 may also include an antenna 1703 and / or a radio frequency unit (not shown in the figure). The antenna 1703 and / or radio frequency unit may be located inside the communication device 1700 or separate from the communication device 1700, that is, the antenna 1703 and / or radio frequency unit may be deployed remotely or in a distributed manner.

[0453] Optionally, the communication device 1700 may include one or more memories 1704, which may store instructions, which may be computer programs, that can be executed on the communication device 1700 to cause the communication device 1700 to perform the methods described in the above method embodiments. Optionally, the memory 1704 may also store data. The communication device 1700 and the memory 1704 may be provided separately or integrated together.

[0454] The processor 1701, transceiver 1702, and memory 1704 can be connected via a communication bus.

[0455] In one design, the communication device 1700 can be used to perform the functions of the BeiDou network device 200 in the aforementioned embodiments: the processor 1701 can be used to perform the above-mentioned functions. Figure 15 The BeiDou network device 200 in the illustrated embodiment performs the relevant protocol parsing, encapsulation, and computational determination functional steps and / or other processes used in the technology described herein; the transceiver 1702 can be used to perform the above. Figure 15 The BeiDou network device 200 in the illustrated embodiment performs functional steps related to sending and receiving and / or other processes used in the technology described herein.

[0456] In any of the above designs, the processor 1701 may include a transceiver for implementing receive and transmit functions. For example, the transceiver may be a transceiver circuit, an interface, or an interface circuit. The transceiver circuit, interface, or interface circuit for implementing receive and transmit functions may be separate or integrated. The aforementioned transceiver circuit, interface, or interface circuit may be used for reading and writing code / data, or it may be used for transmitting or relaying signals.

[0457] In any of the above designs, the processor 1701 may store instructions, which may be computer programs. These computer programs, running on the processor 1701, cause the communication device 1700 to execute the method steps performed by the terminal 100 in the above method embodiments. The computer program may be embedded in the processor 1701; in this case, the processor 1701 may be implemented in hardware.

[0458] This application also provides a computer-readable storage medium storing computer program code. When the processor executes the computer program code, the electronic device performs the method in any of the foregoing embodiments.

[0459] This application also provides a computer program product that, when run on a computer, causes the computer to perform the methods in any of the foregoing embodiments.

[0460] This application also provides a communication device, which can exist in the form of a chip. The device includes a processor and an interface circuit. The processor is used to communicate with other devices through a receiving circuit, so that the device can execute the method in any of the foregoing embodiments.

[0461] This application also provides a BeiDou communication system, including a terminal 100 and a BeiDou network device 200, which can execute the methods in any of the foregoing embodiments.

[0462] This application fully describes the short message communication function in the BeiDou communication system. It is understood that other satellite systems may also support short message communication functions. Therefore, it is not limited to the BeiDou communication system. If other satellite systems also support short message communication functions, the method described in this application is also applicable to the communication of other satellite systems.

[0463] The steps of the methods or algorithms described in this application can be implemented in hardware or by a processor executing software instructions. The software instructions can consist of corresponding software modules, which can be stored in random access memory (RAM), flash memory, erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), registers, hard disks, portable hard disks, CD-ROMs, or any other form of storage medium known in the art. An exemplary storage medium is coupled to a processor, enabling the processor to read information from and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and storage medium can reside in an ASIC. Alternatively, the ASIC can reside in a core network interface device. Of course, the processor and storage medium can also exist as discrete components in the core network interface device.

[0464] Those skilled in the art will recognize that, in one or more of the examples above, the functions described in this application can be implemented using hardware, software, firmware, or any combination thereof. When implemented in software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or code on a computer-readable medium. Computer-readable media include computer-readable storage media and communication media, wherein communication media include any medium that facilitates the transmission of a computer program from one place to another. Storage media can be any available medium accessible to a general-purpose or special-purpose computer.

[0465] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit it. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A method for encryption in a satellite communication system, applied to a terminal, characterized in that, The method comprises the following steps: The terminal adds padding data to the tail of the zero packet in the original data to a first specified length to obtain a padding zero packet; wherein the data length of the zero packet is a second specified length; wherein the first specified length is greater than the second specified length; The terminal performs an exclusive or operation on the padding zero packet and a zero packet encryption vector to obtain an encrypted zero packet; The terminal intercepts data of a second specified length from the head of the encrypted zero packet to obtain a result zero packet; The terminal sends an application layer message to a satellite network device; wherein the application layer message comprises the result zero packet.

2. The method of claim 1, wherein, The original data further comprises i sub-integral packets, i being a positive integer; the method further comprises: The terminal obtains an encrypted integral packet based on the i sub-integral packets; wherein the data length of the sub-integral packet is a first specified length, and the application layer message further comprises the encrypted integral packet.

3. The method of claim 2, wherein, The terminal obtains an encrypted integral packet based on the i sub-integral packets, specifically comprising: The terminal obtains an integral packet encryption vector of an a-th sub-integral packet based on the a-th sub-integral packet and an integral packet initial vector of the a-th sub-integral packet, a being less than or equal to i; The terminal determines an encrypted sub-integral packet of the a-th sub-integral packet by an encryption algorithm on the integral packet encryption vector of the a-th sub-integral packet and an encryption key; wherein the encryption key is a data segment of a first specified length in an original key, and the encryption key is different from the integral packet initial vector of the a-th sub-integral packet; The terminal splices the encrypted sub-integral packets of the i sub-integral packets to obtain the encrypted integral packet.

4. The method of claim 3, wherein, The method further comprises: when a is equal to 1, the integral packet initial vector of the a-th sub-integral packet is a data segment of a first specified length in an original key; when a is greater than 1, the integral packet initial vector of the a-th sub-integral packet is an encrypted sub-integral packet of an a-1-th sub-integral packet, or the integral packet initial vector of the a-th sub-integral packet is a data segment of a first specified length in an original key.

5. The method of claim 1, wherein, The application layer message further comprises message header information, and the message header information comprises an encryption indication field, which is used to indicate an encryption algorithm used by the terminal when generating the application layer message.

6. The method of claim 2, wherein, Before the terminal adds padding data to the tail of the zero packet in the original data to the first specified length, the method further comprises: The terminal determines the number of sub-integral packets to be i based on the data length of the original data and the first specified length; The terminal divides i data segments of a first specified length starting from a starting position in the original data into i sub-integral packets; The terminal determines a data segment after the i sub-integral packets in the original data as the zero packet.

7. The method of claim 1, wherein, Before the encrypted zero packet is obtained, the method further comprises: The terminal obtains a zero-group encryption vector through an encryption algorithm based on a zero-group initial vector and an encryption key; wherein the zero-group initial vector is a data segment of a first specified length in an original key; wherein the encryption key is a data segment of a first specified length in the original key, and the encryption key is different from the zero-group initial vector.

8. The method of claim 3, wherein, Before the encrypted zero group is obtained, the method further comprises: The terminal obtains a zero-group encryption vector through an encryption algorithm based on a zero-group initial vector and an encryption key; wherein the zero-group initial vector is a data segment of a first specified length in an original key; wherein the encryption key is a data segment of a first specified length in the original key, and the encryption key is different from the zero-group initial vector.

9. The method according to any one of claims 1-8, characterized in that, Before the terminal performs an exclusive or operation on the padded zero group and the zero-group encryption vector to obtain an encrypted zero group, the method further comprises: The terminal obtains an original key from a cellular network.

10. The method according to any one of claims 1-8, characterized in that, The first specified length is 128 bits.

11. The method according to any one of claims 1-8, characterized in that, The data length of the result zero group is the same as the data length of the zero group.

12. A method for encryption in a satellite communication system, applied to a satellite network device, characterized in that, Comprise: The satellite network device receives an application layer message sent by a terminal, and the application layer message comprises a result zero group; wherein the data length of the result zero group is a second specified length; The satellite network device adds padding data to the tail of the result zero group to obtain a result padded zero group; wherein the data length of the result padded zero group is a first specified length; The satellite network device performs an exclusive or operation on the result padded zero group and a zero-group encryption vector to obtain a decrypted zero group; The satellite network device intercepts the second specified length of data in the head of the decrypted zero group to obtain a zero group in the original data.

13. The method of claim 12, wherein, The application layer message further comprises an encrypted integral group; the method further comprises: The satellite network device obtains i sub-integral groups in the original data based on the encrypted integral group; wherein the data length of the sub-integral group is a first specified length; wherein i is a positive integer; The satellite network device splices the i sub-integral groups and the zero group to obtain the original data.

14. The method of claim 13, wherein, Before the satellite network device obtains i sub-integral groups in the original data based on the encrypted integral group, the method further comprises: The satellite network device determines that the number of encrypted sub-integral groups is i based on the data length of the encrypted data and the first specified length; wherein the encrypted data is the encrypted integral group and the result zero group spliced together; The satellite network device divides the i first specified length data segments starting from the starting position in the encrypted data into encrypted integral groups; wherein the encrypted integral group comprises i encrypted sub-integral groups; The satellite network device determines the data segment after the i encrypted sub-integral groups in the encrypted data as the result zero group.

15. The method of claim 14, wherein, The satellite network device obtains i sub-integral groups in the original data based on the encrypted integral group, specifically comprising: The satellite network device determines, by using an encryption algorithm, an integral packet encryption vector of the a-th encrypted sub-integral packet based on the a-th encrypted sub-integral packet and an encryption key, where a is less than or equal to i; the encryption key is a data segment of a first specified length in the original key; The satellite network device obtains the a-th sub-integral packet based on the integral packet encryption vector of the a-th encrypted sub-integral packet and an integral packet initial vector of the a-th encrypted sub-integral packet, the integral packet initial vector of the a-th encrypted sub-integral packet being different from the encryption key.

16. The method of claim 15, wherein, The method further comprises: when a is equal to 1, the integral packet initial vector of the a-th encrypted sub-integral packet is a data segment of a first specified length in the original key; when a is greater than 1, the integral packet initial vector of the a-th encrypted sub-integral packet is the (a-1)-th encrypted sub-integral packet or a data segment of a first specified length in the original key.

17. The method of claim 12, wherein, Before the satellite network device performs a bitwise XOR operation on the result and a zero packet and a zero packet encryption vector to obtain a decrypted zero packet, the method further comprises: The application layer message further comprises message header information; the message header information comprises an encryption indication field; the satellite network device determines an encryption algorithm used by the terminal when generating the application layer message based on the encryption indication field.

18. The method according to any one of claims 12-17, characterized by, Before the satellite network device performs a bitwise XOR operation on the result and a zero packet and a zero packet encryption vector to obtain a decrypted zero packet, the method further comprises: The satellite network device obtains the zero packet encryption vector based on a zero packet initial vector and an encryption key by using an encryption algorithm; the zero packet initial vector is a data segment of a first specified length in the original key; the encryption key is a data segment of a first specified length in the original key, and the zero packet initial vector is different from the encryption key.

19. The method according to any one of claims 14-17, characterized by, Before the satellite network device performs a bitwise XOR operation on the result and a zero packet and a zero packet encryption vector to obtain a decrypted zero packet, the method further comprises: The satellite network device obtains the zero packet encryption vector based on a zero packet initial vector and an encryption key by using an encryption algorithm; the zero packet initial vector is a data segment of a first specified length in the original key; the encryption key is a data segment of a first specified length in the original key, and the zero packet initial vector is different from the encryption key.

20. The method of any one of claims 12-17, wherein, Before the satellite network device performs a bitwise XOR operation on the result and a zero packet and a zero packet encryption vector to obtain a decrypted zero packet, the method further comprises: The satellite network device obtains the original key from a cellular network.

21. A satellite communication system, characterized by The method comprises: A terminal and a satellite network device; wherein The terminal adds padding data to a first specified length at the tail of a zero packet in original data to obtain a padded zero packet; the data length of the zero packet is a second specified length; the first specified length is greater than the second specified length; The terminal further performs a bitwise XOR operation on the padded zero packet and a zero packet encryption vector to obtain an encrypted zero packet; The application layer message further comprises message header information; the message header information comprises an encryption indication field; the satellite network device determines an encryption algorithm used by the terminal when generating the application layer message based on the encryption indication field. Before the satellite network device performs a bitwise XOR operation on the result and a zero packet and a zero packet encryption vector to obtain a decrypted zero packet, the method further comprises: The satellite network device obtains the zero packet encryption vector based on a zero packet initial vector and an encryption key by using an encryption algorithm; the zero packet initial vector is a data segment of a first specified length in the original key; the encryption key is a data segment of a first specified length in the original key, and the zero packet initial vector is different from the encryption key. Before the satellite network device performs a bitwise XOR operation on the result and a zero packet and a zero packet encryption vector to obtain a decrypted zero packet, the method further comprises: The satellite network device obtains the zero packet encryption vector based on a zero packet initial vector and an encryption key by using an encryption algorithm; the zero packet initial vector is a data segment of a first specified length in the original key; the encryption key is a data segment of a first specified length in the original key, and the zero packet initial vector is different from the encryption key. Before the satellite network device performs a bitwise XOR operation on the result and a zero packet and a zero packet encryption vector to obtain a decrypted zero packet, the method further comprises: The satellite network device obtains the original key from a cellular network. The method comprises: A terminal and a satellite network device; wherein The terminal adds padding data to a first specified length at the tail of a zero packet in original data to obtain a padded zero packet; the data length of the zero packet is a second specified length; the first specified length is greater than the second specified length; The terminal further performs a bitwise XOR operation on the padded zero packet and a zero packet encryption vector to obtain an encrypted zero packet; The terminal is further configured to intercept data of a second specified length of a header of the encrypted zero-packet to obtain a result zero-packet. The terminal is further configured to send an application layer message to a satellite network device, wherein the application layer message comprises the result zero-packet. The satellite network device is configured to receive the application layer message. The satellite network device is further configured to add padding data to a tail of the result zero-packet to obtain a result padding zero-packet, wherein a data length of the result padding zero-packet is the first specified length. The satellite network device is further configured to perform a bitwise XOR operation on the result padding zero-packet and a zero-packet encryption vector to obtain a decrypted zero-packet. The satellite network device is further configured to intercept the data of the second specified length of the header of the decrypted zero-packet to obtain a zero-packet in original data.

22. A communications device, characterized by The communication apparatus comprises one or more processors, one or more memories, and a transceiver; wherein the transceiver, the one or more memories, and the one or more processors are coupled, the one or more memories are configured to store computer program codes, the computer program codes comprise computer instructions, and when the one or more processors execute the computer instructions, the communication apparatus performs the method according to any one of claims 1-11.

23. The communication apparatus according to claim 22, wherein, The communication apparatus is a terminal.

24. A communications device, characterized by The communication apparatus comprises one or more processors, one or more memories, and a transceiver; wherein the transceiver, the one or more memories, and the one or more processors are coupled, the one or more memories are configured to store computer program codes, the computer program codes comprise computer instructions, and when the one or more processors execute the computer instructions, the communication apparatus performs the method according to any one of claims 12-20.

25. The communication apparatus according to claim 24, wherein, The communication apparatus is a satellite network device.

26. A computer readable storage medium, the computer readable storage medium storing instructions, when the instructions are run on a computer, causing the computer to perform the method according to any one of claims 1-11.

27. A computer readable storage medium, the computer readable storage medium storing instructions, when the instructions are run on a computer, causing the computer to perform the method according to any one of claims 12-20.

28. A chip or chip system for use in a terminal, characterized by The apparatus comprises processing circuitry and interface circuitry, the interface circuitry is configured to receive code instructions and transmit to the processing circuitry, and the processing circuitry is configured to run the code instructions to perform the method according to any one of claims 1-11.

Images