Satellite communication system, authentication method and device

Abstract

The present application discloses a satellite communication system, an authentication method and an apparatus, and relates to the field of satellite communication. In the present application, an authentication center or a ground access device authenticates a satellite base station according to a first authentication token and a second authentication token, and a satellite base station authenticates a ground station or a ground access device according to a first authentication response and a second authentication response, so that two-way authentication can be achieved between the satellite base station and the ground station or the ground access device, thereby establishing a secure feeder link, improving the security of the feeder link, and ensuring secure communication between the satellite base station and the ground station.

Description

Technical Field

[0001] The present application relates to the field of satellite communications, and in particular to satellite communication systems, authentication methods and devices. Background Art

[0002] The satellite communication system consists of three parts: satellite end (such as satellite base station), ground end (such as ground station), and user end (such as user terminal). The satellite end acts as a relay station in the air, that is, it amplifies the electromagnetic waves sent by the ground station and then sends them back to another ground station. The ground station is the interface between the satellite system and the ground public network. The user terminal can access the satellite system through the ground station to form a link.

[0003] With the development of satellite communication network technology, satellite communication network security certification has received increasing attention. How to improve the security of satellite communications is a technical problem that needs to be solved at present. Summary of the invention

[0004] In an exemplary embodiment of the present application, a satellite communication system, an authentication method and an apparatus are provided to implement two-way authentication between a satellite base station and a ground station or a ground access device.

[0005] In a first aspect, a satellite communication system is provided, the system comprising: a satellite base station, a ground station and an authentication center; the satellite base station is used to receive a first random number from the ground station, generate a second random number according to a root key shared by the ground station and the satellite base station, generate an authentication vector according to the root key shared by the ground station and the satellite base station, the first random number and the second random number, the authentication vector comprising the second random number, a second authentication token, a second authentication response and a second feeder link communication master key, send the second random number and the second authentication token to the ground station; and receive a first authentication response from the ground station, authenticate the ground station according to the first authentication response and the second authentication response; the ground station is used to generate a first random number, send the first random number to the ground station, and authenticate the ground station according to the first authentication response and the second authentication response. sent to the satellite base station; and used to send the second random number, the second authentication token and the first random number from the satellite base station to the authentication center, and send the first authentication response from the authentication center to the satellite base station; the authentication center is used to receive the second random number, the first random number and the second authentication token from the ground station, generate the first authentication token according to the root key shared by the ground station and the satellite base station, the first random number and the second random number, and after the satellite base station is authenticated according to the first authentication token and the second authentication token, generate the first authentication response according to the root key shared by the ground station and the satellite base station, the first random number and the second random number, and send the first authentication response to the ground station.

[0006] Optionally, the ground station is also used to send a registration request to the satellite base station, the registration request including the ground station's identification information, the first random number and indication information for instructing the ground station to make a registration request to the satellite base station; the satellite base station is also used to send an authentication request to the ground station, the authentication request including the second random number and the second authentication token; the ground station is also used to send an authentication parameter request to the authentication center, the authentication parameter request including the first random number, the second random number, the second authentication token, the ground station's identification information and the satellite's identification information.

[0007] Optionally, the authentication center is further used to derive a first feeder link communication master key based on a root key shared by the ground station and the satellite base station, the first random number and the second random number, and send the first feeder link communication master key to the ground station if the satellite base station is authenticated according to the first authentication token and the second authentication token; the ground station is further used to derive a first satellite base station key used when the ground station communicates with the satellite base station according to the first feeder link communication master key, the identification information of the ground station and the identification information of the satellite base station; the satellite base station is further used to derive a second satellite base station key used when the satellite base station communicates with the ground station according to the second feeder link communication master key, the identification information of the ground station and the identification information of the satellite base station.

[0008] Optionally, the authentication center is further used to derive a first feeder link communication master key based on a root key shared by the ground station and the satellite base station, the first random number and the second random number, and send the first feeder link communication master key to the ground station if the satellite base station is authenticated according to the first authentication token and the second authentication token; the ground station is further used to use the first feeder link communication master key as a first satellite base station key used when the ground station and the satellite base station communicate; the satellite base station is further used to use the second feeder link communication master key as a second satellite base station key used when the satellite base station communicates with the ground station.

[0009] Optionally, the satellite base station is also used to: derive the root key shared by the ground station and the satellite base station based on the superior key used to derive the root key of the ground station and the identification information of the ground station; or, obtain the locally stored root key shared by the ground station and the satellite base station.

[0010] In a second aspect, an authentication method is provided, the method comprising: a satellite base station receives a registration request from a ground station, the registration request includes a first random number generated by the ground station, obtains a root key shared by the ground station and the satellite base station, generates a second random number according to the root key shared by the ground station and the satellite base station, generates an authentication vector according to the root key shared by the ground station and the satellite base station, the first random number and the second random number, the authentication vector includes the second random number, the second authentication token, a second authentication response and a second feeder link communication master key; the satellite base station sends the second random number and the second authentication token to the authentication center via the ground station, so that the authentication center generates a first authentication token according to the root key shared by the ground station and the satellite base station, the second random number and the first random number generated by the ground station, authenticates the satellite base station according to the first authentication token and the second authentication token, and generates the first authentication response according to the root key shared by the ground station and the satellite base station, the first random number and the second random number after the satellite base station is authenticated, and sends the first authentication response to the satellite base station; the satellite base station receives the first authentication response generated by the authentication center, and authenticates the ground station according to the first authentication response and the second authentication response.

[0011] In a third aspect, an authentication method is provided, the method comprising: a ground station generates a first random number, includes the first random number in a registration request and sends it to a satellite base station, so that the satellite base station generates an authentication vector according to a root key shared by the ground station and the satellite base station, the first random number and the second random number, the authentication vector comprising the second random number, the second authentication token, a second authentication response and a second feeder link communication master key; wherein the second random number is generated by the satellite base station according to the root key shared by the ground station and the satellite base station; the ground station sends the second random number and the second authentication token from the satellite base station to the authentication center, so that the authentication center generates a first authentication token according to the root key shared by the ground station and the satellite base station, the first random number and the second random number, authenticates the satellite base station according to the first authentication token and the second authentication token, and generates the first authentication response according to the root key shared by the ground station and the satellite base station, the first random number and the second random number after the satellite base station is authenticated, and sends the first authentication response to the satellite base station; the ground station sends the first authentication response from the authentication center to the satellite base station, so that the satellite base station authenticates the ground station according to the first authentication response and the second authentication response.

[0012] In a fourth aspect, an authentication method is provided, the method comprising: an authentication center receiving an authentication parameter request from a ground station, the authentication parameter request comprising a second random number generated by a satellite base station, a second authentication token and a first random number generated by the ground station; wherein the second random number is generated by the satellite base station according to a root key shared by the ground station and the satellite base station, the second authentication token is generated by the satellite base station according to the root key shared by the ground station and the satellite base station, the first random number generated by the ground station and the second random number generated by the satellite base station, and the first random number is generated by the ground station according to the root key shared by the ground station and the satellite base station; the authentication center generates a first authentication token according to the root key shared by the ground station and the satellite base station, the first random number and the second random number, authenticates the satellite base station according to the first authentication token and the second authentication token, and generates a first authentication response according to the root key shared by the ground station and the satellite base station, the first random number and the second random number after the satellite base station is authenticated, and sends the first authentication response to the ground station, the first authentication response is sent to the satellite base station via the ground station, so that the satellite base station authenticates the ground station according to the first authentication response and the second authentication response.

[0013] In a fifth aspect, a satellite communication system is provided, the system comprising: a satellite base station and a ground access device; the satellite base station is used to receive a first random number from the ground access device, generate a second random number according to a root key shared by the ground access device and the satellite base station, generate an authentication vector according to the root key shared by the ground access device and the satellite base station, the first random number and the second random number, the authentication vector comprising the second random number, a second authentication token, a second authentication response and a second feeder link communication master key, send the second random number and the second authentication token to the ground access device; and receive a first authentication response from the ground access device, generate a second authentication vector according to the first authentication response and the second authentication response to authenticate the ground access device; the ground access device is used to generate a first random number and send the first random number to the satellite base station; and is used to receive the second random number and the second authentication token from the satellite base station, generate the first authentication token according to the root key shared by the ground access device and the satellite base station, the first random number and the second random number, and after authenticating the satellite base station according to the first authentication token and the second authentication token, generate the first authentication response according to the root key shared by the ground access device and the satellite base station, the first random number and the second random number, and send the first authentication response to the satellite base station.

[0014] Optionally, the ground access device is also used to send a registration request to the satellite base station, the registration request including identification information of the ground access device, the first random number and indication information used to instruct the ground access device to make a registration request to the satellite base station; the satellite base station is also used to send an authentication request to the ground access device, the authentication request including the second random number and the second authentication token.

[0015] Optionally, the ground access device is also used to: if the satellite base station is authenticated according to the first authentication token and the second authentication token, derive a first feeder link communication master key according to the root key shared by the ground access device and the satellite base station, the first random number and the second random number; derive a first satellite base station key used when the ground access device communicates with the satellite base station according to the first feeder link communication master key, the identification information of the ground station and the identification information of the satellite base station; the satellite base station is also used to derive a second satellite base station key used when the satellite base station communicates with the ground access device according to the second feeder link communication master key, the identification information of the ground access device and the identification information of the satellite base station.

[0016] Optionally, the ground access device is also used to derive a first feeder link communication master key based on a root key shared by the ground access device and the satellite base station, the first random number and the second random number if the satellite base station is authenticated according to the first authentication token and the second authentication token, and use the first feeder link communication master key as a first satellite base station key used when the ground access device communicates with the satellite base station; the satellite base station is also used to use the second feeder link communication master key as a second satellite base station key used when the satellite base station communicates with the ground access device.

[0017] Optionally, the satellite base station is also used to: derive the root key shared by the ground access device and the satellite base station based on the superior key used to derive the root key of the ground access device and the identification information of the ground access device; or, obtain the locally stored root key shared by the ground access device and the satellite base station.

[0018] In a sixth aspect, an authentication method is provided, the method comprising: a satellite base station receives a registration request from a ground access device, the registration request includes a first random number generated by the ground access device, obtains a root key shared by the ground access device and the satellite base station, generates a second random number based on the root key shared by the ground access device and the satellite base station, generates an authentication vector based on the root key shared by the ground access device and the satellite base station, the first random number and the second random number, the authentication vector includes the second random number, the second authentication token, a second authentication response and a second feeder link communication master key; the satellite base station sends the second random number and the second authentication token to the ground access device , so that the ground access device generates a first authentication token according to the root key shared by the ground access device and the satellite base station, the second random number and the first random number generated by the ground access device, and authenticates the satellite base station according to the first authentication token and the second authentication token, and after the satellite base station authentication is passed, generates the first authentication response according to the root key shared by the ground access device and the satellite base station, the first random number and the second random number, and sends the first authentication response to the satellite base station; the satellite base station receives the first authentication response generated by the ground access device, and authenticates the ground access device according to the first authentication response and the second authentication response.

[0019] In a seventh aspect, an authentication method is provided, the method comprising: a ground access device generates a first random number, includes the first random number in a registration request and sends it to the satellite base station, so that the satellite base station generates an authentication vector according to the root key shared by the ground access device and the satellite base station, the first random number and the second random number, and the authentication vector comprises the second random number, the second authentication token, a second authentication response and a second feeder link communication master key; wherein the second random number is generated by the satellite base station according to the root key shared by the ground access device and the satellite base station; the ground access device receives the second random number and the second authentication token from the satellite base station, generates a first authentication token according to the root key shared by the ground access device and the satellite base station, the first random number and the second random number, authenticates the satellite base station according to the first authentication token and the second authentication token, and generates the first authentication response according to the root key shared by the ground access device and the satellite base station, the first random number and the second random number after the satellite base station is authenticated, and sends the first authentication response to the satellite base station, so that the satellite base station authenticates the ground access device according to the first ground authentication response and the second authentication response.

[0020] In an eighth aspect, a satellite communication device is provided, comprising a memory and a processor; the memory stores computer instructions; the processor is used to read the computer instructions and execute a method as described in any one of aspects 2 to 4 and aspects 6 to 7.

[0021] In a ninth aspect, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to cause the computer to execute a method as described in any one of aspects 2 to 4 and aspects 6 to 7.

[0022] In a tenth aspect, a computer program product is provided, which, when called by a computer, enables the computer to execute a method as described in any one of aspects 2 to 4 and aspects 6 to 7.

[0023] In the above-mentioned embodiments of the present application, the authentication center or the ground access device authenticates the satellite base station according to the first authentication token and the second authentication token, and the satellite base station authenticates the ground station or the ground access device according to the first authentication response and the second authentication response, thereby realizing two-way authentication between the satellite base station and the ground station or the ground access device, thereby establishing a secure feeder link, improving the security of the feeder link, and ensuring secure communication between the satellite base station and the ground station. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0025] Figure 1 The physical block diagram of the satellite communication system according to the embodiment of the present application is exemplarily shown;

[0026] Figure 2 A satellite communication system provided by an embodiment of the present application is exemplarily shown;

[0027] Figure 3 An example is shown based on Figure 2 Schematic diagram of the authentication process provided by the embodiment;

[0028] Figure 4 Another satellite communication system provided by an embodiment of the present application is exemplarily shown;

[0029] Figure 5 An example is shown based on Figure 4 Schematic diagram of the authentication process provided by the embodiment;

[0030] Figure 6 The structural diagram of the communication device provided in the embodiment of the present application is exemplified. DETAILED DESCRIPTION

[0031] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0032] The technical solutions in the embodiments of the present application will be described clearly and in detail below in conjunction with the accompanying drawings. In the description of the embodiments of the present application, unless otherwise specified, " / " means or, for example, A / B can mean A or B; "and / or" in the text is only a description of the association relationship of associated objects, indicating that there can be three relationships, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, "multiple" means two or more than two.

[0033] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as suggesting or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features, and in the description of the embodiments of the present application, unless otherwise specified, "plurality" means two or more.

[0034] The parameters involved in the embodiments of the present application may include:

[0035] (1) A first random number, generated by the ground station. For convenience, the first random number is also referred to as RAND1 in this document.

[0036] (2) a first authentication token, generated by the authentication center. For convenience, the first authentication token is also referred to as message authentication code 1, MAC1 in this document;

[0037] (3) The first authentication response, generated by the authentication center;

[0038] (4) a first feeder link communication master key, generated by the authentication center. For convenience, the first feeder link communication master key is also referred to as Kmaster1 in this document;

[0039] (5) a first satellite base station key, generated by the ground station. For convenience, the first satellite base station key is also referred to as KgNB1 in this document;

[0040] (6) a second random number, generated by the satellite base station. For convenience, the second random number is also referred to as RAND2 in this document.

[0041] (7) a second authentication token, generated by the satellite base station. For convenience, the second authentication token is also referred to as message authentication code 2, or MAC2, in this document.

[0042] (8) a second authentication response, generated by the satellite base station;

[0043] (9) a second feeder link communication master key, generated by the satellite base station. For convenience, the second feeder link communication master key is also referred to as Kmaster2 in this document;

[0044] (10) A second satellite base station key is generated by the satellite base station. For convenience, the second satellite base station key is also referred to as KgNB2 in this document.

[0045] It should be noted that the above parameter naming method is only an example, and the embodiment of the present application does not limit the naming method of the above parameters.

[0046] Figure 1 The physical block diagram of the satellite communication system of the embodiment of the present application is shown as an example. Figure 1 As shown, the satellite communication system includes: a satellite terminal 101, a satellite base station (102a, 102b), a ground station 103 and a core network 104. Before the satellite terminal and the satellite base station (102a, 102b) communicate through a service link, it is necessary for the satellite base station (102a, 102b) and the ground station 103 to perform two-way authentication and establish a secure feeder link through the core network 104, wherein the satellite base station 102a and the satellite base station 102b exchange information through an inter-satellite link. In the above system architecture, the ground station may include a gateway station, a gateway station, etc.

[0047] Figure 1 Only two satellite base stations are used as an example for description, and the embodiment of the present application does not limit the number of satellite base stations and the above-mentioned other devices.

[0048] The satellite base station (102a, 102b) is a satellite with satellite communication base station capabilities. The ground station 103 is used to connect the satellite base station to the satellite communication core network 104 to realize the satellite feeder link and its security. Among them, the ground station can forward and receive information during the information exchange process of satellite communication; the core network 104 is mainly used for call connection, billing, mobility management, supplementary service implementation, intelligent triggering, etc.

[0049] Currently, there is no standard solution for establishing a secure association between a satellite base station and a ground station. To this end, the embodiments of the present application provide a satellite communication system, an authentication method and a device. Through the embodiments of the present application, a secure feeder link can be established between the satellite base station and the ground station, thereby improving the security of the feeder link and ensuring secure communication between the satellite base station and the ground station.

[0050] Figure 2 A satellite communication system provided by an embodiment of the present application is exemplarily shown, which shows the feeder link security architecture of the satellite communication system. As shown in the figure, the satellite communication system includes: a satellite base station (201a, 201b), a ground station (202a, 202b) and an authentication center 203. Among them, the authentication center 203 is responsible for key distribution to the satellite base station and the ground station, and can assist the ground station to complete a two-way authentication operation with the satellite base station. It can be understood that the authentication center can be an authentication server or an authentication function or an authentication function entity or an authentication function network element, etc. The embodiment of the present application does not limit the naming method of the authentication center.

[0051] It should be noted that the embodiment of the present application does not limit the number of satellite base stations and ground stations in the above architecture.

[0052] Based on the above architecture, mutual authentication between the satellite base station and the ground station can be achieved.

[0053] The following first briefly describes the functions of each component in the above satellite system.

[0054] A satellite base station, used for receiving a first random number RAND1 from a ground station, generating a second random number RAND2 according to a root key shared by the ground station and the satellite base station, generating an authentication vector according to the root key shared by the ground station and the satellite base station, the first random number RAND1 and the second random number RAND2, the authentication vector including the second random number RAND2, a second authentication token MAC2, a second authentication response and a second feeder link communication master key Kmaster2, sending the second random number RAND2 and the second authentication token MAC2 to the ground station; and, receiving a first authentication response from the ground station, authenticating the ground station according to the first authentication response and the second authentication response.

[0055] The ground station is used to generate a first random number RAND1 and send the first random number RAND1 to the satellite base station; and is used to send the second random number RAND2, the second authentication token MAC2 and the first random number RAND1 from the satellite base station to the authentication center, and send the first authentication response from the authentication center to the satellite base station.

[0056] The authentication center is used to receive the second random number RAND2, the first random number RAND1 and the second authentication token MAC2 from the ground station, generate the first authentication token MAC1 according to the root key shared by the ground station and the satellite base station, the first random number RAND1 and the second random number RAND2, and after authenticating the satellite base station according to the first authentication token MAC1 and the second authentication token MAC2, generate a first authentication response according to the root key shared by the ground station and the satellite base station, the first random number RAND1 and the second random number RAND2, and send the first authentication response to the ground station.

[0057] Based on Figure 2 Satellite communication systems, Figure 3 The following is an exemplary diagram of the authentication process provided in an embodiment of the present application, through which two-way authentication between a satellite base station and a ground station can be achieved.

[0058] After the ground station detects the satellite base station, a Radio Resource Control (RRC) connection is established between the ground station and the satellite base station. When the ground station and the satellite base station establish an RRC connection, the ground station can obtain the identification information of the satellite base station.

[0059] like Figure 3 As shown, the authentication process may include the following steps:

[0060] S301: The ground station sends a registration request to the satellite base station.

[0061] Exemplarily, in order to perform two-way authentication and establish a secure connection with the satellite base station, the ground station generates a first random number RAND1 for this authentication. The ground station sends a registration request to the satellite base station, and the registration request includes the first random number RAND1 generated by the ground station, the identification information of the ground station, and the indication information of the ground station registration request.

[0062] S302: After receiving the registration request, the satellite base station obtains the root key shared by the ground station and the satellite base station.

[0063] In this step, the satellite base station obtains the root key shared by the ground station and the satellite base station locally according to the identification information of the ground station. The root key of the satellite base station is shared by the satellite base station and the ground station, and different satellite base stations share their own with the ground station respectively. The root key used by a ground station to authenticate with a designated satellite base station is specifically used for the satellite base station, and different satellite base station root keys are configured on the ground station for different satellite base stations.

[0064] Optionally, the satellite base station obtains the root key shared by the ground station and the satellite base station in the following two ways:

[0065] Method 1: The satellite base station derives the root key shared by the ground station and the satellite base station according to the superior key used to derive the root key of the ground station and the identification information of the ground station. Exemplarily, the satellite base station stores the superior key that can derive the root key shared by the ground station and the satellite base station, and the satellite base station performs key calculation according to the superior key and the identification information of the ground station to derive the root key shared by the ground station and the satellite base station.

[0066] Method 2: The satellite base station directly obtains the locally stored root key shared by the ground station and the satellite base station.

[0067] S303: After obtaining the root key shared by the ground station and the satellite base station, the satellite base station generates an authentication vector.

[0068] Exemplarily, the satellite base station generates a second random number RAND2 for this authentication based on the acquired root key shared by the ground station and the satellite base station. Then, an authentication vector is generated based on the root key shared by the ground station and the satellite base station, the first random number RAND1, and the second random number RAND2. The authentication vector may include the second random number RAND2, the second authentication token MAC2, the second authentication response, and the second feeder link communication master key Kmaster2.

[0069] The second authentication token MAC2 is a message authentication code (MAC) used to protect the first random number RAND1 and the second random number RAND2 from being tampered with during transmission. Exemplarily, the second authentication token MAC2 can be obtained by performing message authentication code calculation on the first random number RAND1 and the second random number RAND2 according to the satellite base station authentication root key. For example, the satellite base station uses the root key shared by the ground station and the satellite base station to obtain other calculation parameters participating in MAC2, wherein the other calculation parameters participating in MAC2 are strings, and the hash message authentication code algorithm is used to perform an OR operation on the first random number RAND1, the second random number RAND2 and other parameters participating in MAC2 calculation, thereby obtaining the second authentication token MAC2. For example, a calculation method of the second authentication token MAC2 can be expressed as: using the HMAC algorithm to calculate the input string S, where S = RAND1||RAND2||other parameters participating in MAC calculation, wherein "||" is an OR logical operator, and two operands are required when || is operated, for example, the first operand first random number RAND1 and the second operand second random number RAND2.

[0070] Exemplarily, the second authentication response can be obtained by performing message authentication code calculation on the first random number RAND1 and the second random number RAND2 according to the root key shared by the ground station and the satellite base station. For example, the satellite base station uses the root key shared by the ground station and the satellite base station to obtain other calculation parameters participating in the second authentication response and the operation identifier of the second authentication response, wherein the other parameters participating in the calculation of the second authentication response are character strings, and the hash message authentication code algorithm is used to perform an OR operation on the operation identifier of the second authentication response, the first random number RAND1, the second random number RAND2, and the other parameters participating in the calculation of the second authentication response to obtain the second authentication response. For example, a calculation method for the second authentication response can be expressed as: using the HMAC algorithm to calculate the input string S, wherein S = the operation identifier of the second authentication response||RAND1||RAND2||other parameters participating in the calculation of the second authentication response.

[0071] Exemplarily, the second feeder link communication master key Kmaster2 can be obtained by performing message authentication code calculation on the first random number RAND1 and the second random number RAND2 according to the satellite base station authentication root key. For example, the satellite base station uses the root key shared by the ground station and the satellite base station to obtain other calculation parameters participating in the second feeder link communication master key Kmaster2 and the operation identifier of the second feeder link communication master key Kmaster2, wherein the other calculation parameters participating in the second feeder link communication master key Kmaster2 are strings, and the hash message authentication code algorithm is used to perform an OR operation on the operation identifier of the second feeder link communication master key, the first random number RAND1, the second random number RAND2, and the other calculation parameters participating in the second feeder link communication master key Kmaster2 to obtain the second feeder link communication master key Kmaster2. For example, a calculation method of the second feeder link communication master key Kmaster2 can be expressed as: using the HMAC algorithm to calculate the input string S, wherein S = the second feeder link communication master key Kmaster operation identifier||RAND1||RAND2||other parameters participating in the Kmaster calculation.

[0072] S304: After generating the authentication vector, the satellite base station sends an authentication request to the ground station.

[0073] The authentication request sent by the satellite base station to the ground station includes the second random number RAND2 in the authentication vector and the second authentication token MAC2.

[0074] S305: After receiving the authentication request, the ground station sends an authentication parameter request to the authentication center.

[0075] The authentication parameter request sent by the ground station to the authentication center includes the first random number RAND1, the second random number RAND2, the second authentication token MAC2, the identification information of the ground station and the identification information of the satellite base station.

[0076] S306: After receiving the authentication parameter request, the authentication center authenticates the satellite base station.

[0077] In this step, the satellite base station first generates a first authentication token MAC1 based on the root key shared by the ground station and the satellite base station, the first random number RAND1, the second random number RAND2 and other parameters participating in the MAC1 calculation, and then authenticates the satellite base station based on the first authentication token MAC1 and the second authentication token MAC2. If the first authentication token MAC1 and the second authentication token MAC2 are the same, it indicates that the received second random number RAND2 has not been modified, that is, the satellite base station is successfully authenticated. Among them, the generation method of the first authentication token MAC1 is the same as the generation method of the second authentication token MAC2.

[0078] S307: The authentication center calculates the first authentication response and the first feeder link communication master key Kmaster1.

[0079] Exemplarily, the authentication center generates a first authentication response based on the root key shared by the ground station and the satellite base station, the first random number RAND1, the second random number RAND2, and other calculation parameters participating in the second authentication response, wherein the method for generating the first authentication response is the same as the method for generating the second authentication response. For example, the authentication center may generate a first authentication response after successfully authenticating the satellite base station. For example, the satellite base station uses the root key shared by the ground station and the satellite base station to obtain other calculation parameters participating in the first authentication response and the operation identifier of the first authentication response, and uses the same hash message authentication code algorithm as the generation algorithm of the second authentication response to perform an OR operation on the operation identifier of the first authentication response, the first random number RAND1, the second random number RAND2, and other parameters participating in the calculation of the first authentication response to obtain the first authentication response. If the authentication center successfully authenticates the satellite base station, the first authentication response is carried in the authentication parameter response sent to the ground station.

[0080] Exemplarily, the authentication center generates a first authentication response according to the root key shared by the ground station and the satellite base station, the first random number RAND1, the second random number RAND2, and the calculation parameters of the first feeder link communication master key Kmaster1, wherein the generation method of the first feeder link communication master key Kmaster1 is the same as the generation method of the first feeder link communication master key Kmaster1. For example, the authentication center can generate the first feeder link communication master key Kmaster1 after successfully authenticating the satellite base station. For example, the satellite base station uses the root key shared by the ground station and the satellite base station to obtain other calculation parameters of the first feeder link communication master key Kmaster1 and the operation identifier of the first feeder link communication master key Kmaster1, and adopts the same hash message authentication code algorithm as the generation algorithm of the second feeder link communication master key Kmaster1 to perform an OR operation on the operation identifier of the first feeder link communication master key Kmaster1, the first random number RAND1, the second random number RAND2, and other parameters participating in the calculation of the first feeder link communication master key Kmaster1, so as to obtain the first feeder link communication master key Kmaster1.

[0081] S308: After the authentication center successfully authenticates the satellite base station, it sends an authentication parameter response to the ground station. The authentication parameter response includes a first authentication response and a first feeder link communication master key Kmaster1.

[0082] S309: After receiving the authentication parameter response from the authentication center, the ground station sends an authentication response to the satellite base station, where the authentication response includes a first authentication response.

[0083] S310: After receiving the authentication response, the satellite base station authenticates the ground station.

[0084] In this step, after the satellite base station obtains the first authentication response from the received authentication response, it authenticates the ground station according to the first authentication response and the second authentication response generated by the satellite base station. Exemplarily, if the first authentication response and the second authentication response are the same, the satellite base station is authenticated successfully.

[0085] If the satellite base station successfully authenticates the ground station, the process may also include the following steps:

[0086] S311a and S311b: The ground station derives the first satellite base station key KgNB1, and the satellite base station derives the second satellite base station key KgNB2.

[0087] In this step, the ground station can derive the first satellite base station key KgNB1 used when the ground station communicates with the satellite base station based on the first feeder link communication master key Kmaster1 calculated by the authentication center, the identification information of the ground station, and the identification information of the satellite base station. The satellite base station can derive the second satellite base station key KgNB2 used when the satellite base station communicates with the ground station based on the second feeder link communication master key Kmaster2 in the authentication vector, the identification information of the ground station, and the identification information of the satellite base station.

[0088] Optionally, the ground station may use the first feeder link communication master key Kmaster1 calculated by the authentication center as the first satellite base station key KgNB1 used when the ground station communicates with the satellite base station. The satellite base station may use the second feeder link communication master key Kmaster2 as the second satellite base station key KgNB2 used when the satellite base station communicates with the ground station.

[0089] After that, the access stratum (AS) and security mode command (SMC) processes can be executed between the satellite base station and the ground station to establish a security context for secure communication between the satellite base station and the ground station.

[0090] Exemplarily, the satellite base station and the ground station may perform the AS process to derive the keys KRRCint and KRRCenc for access control security in accordance with the provisions of the 3rd Generation Partnership Project (3GPP); and perform the SMC process to derive the keys KUPint and KUPenc for access data security. When there is a security context for secure communication between the satellite base station and the ground station, the operation performed by the feeder link security is as follows: the ground station detects the signal of the satellite base station, and the ground station has a security context for secure communication with the satellite base station, then the ground station sends an RRC reconnection request (Resume Request) to the satellite base station, which includes resume information, such as an inactivated radio network temporary identifier I-RNTI, and then the satellite base station and the ground station start to perform the RRC Resume process and derive a new AS security context.

[0091] In the above-mentioned embodiments of the present application, the satellite communication system of the embodiments includes a satellite base station, a ground station and an authentication center, wherein the authentication center authenticates the ground station according to a first authentication token MAC1 generated by the authentication center and a second authentication token MAC2 generated by the satellite base station, and the satellite base station authenticates the ground station according to a first authentication response generated by the authentication center and a second authentication response generated by the satellite base station, thereby enabling two-way authentication to be achieved between the satellite base station and the ground station, thereby establishing a secure feeder link, improving the security of the feeder link, and ensuring secure communication between the satellite base station and the ground station.

[0092] Figure 4 Another satellite communication system provided by an embodiment of the present application is exemplarily shown, which shows a feeder link safety architecture of the satellite communication system. As shown in the figure, the satellite communication system includes: a satellite base station (401a, 401b) and ground access equipment (402a, 402b).

[0093] It is understandable that the ground access equipment may also be called a ground access device or other names, and the embodiments of the present application are not limited to this.

[0094] It should be noted that the embodiment of the present application does not limit the number of satellite base stations and ground access devices in the above architecture.

[0095] Based on the above architecture, mutual authentication between satellite base stations and ground access equipment can be achieved.

[0096] The following first briefly describes the functions of each component in the above satellite system.

[0097] A satellite base station is used to receive a first random number RAND1 from a ground access device, generate a second random number RAND2 based on a root key shared by the ground access device and the satellite base station, generate an authentication vector based on the root key shared by the ground access device and the satellite base station, the first random number RAND1 and the second random number RAND2, the authentication vector including the second random number RAND2, a second authentication token MAC2, a second authentication response and a second feeder link communication master key Kmaster2, send the second random number RAND2 and the second authentication token MAC2 to the ground access device; and receive a first authentication response from the ground access device, and authenticate the ground access device based on the first authentication response and the second authentication response.

[0098] A ground access device is used to generate a first random number RAND1 and send the first random number RAND1 to a satellite base station; and is used to receive a second random number RAND2 and a second authentication token MAC2 from the satellite base station, generate a first authentication token MAC1 according to a root key shared by the ground access device and the satellite base station, the first random number RAND1 and the second random number RAND2, and after authenticating the satellite base station according to the first authentication token MAC1 and the second authentication token MAC2, generate a first authentication response according to the root key shared by the ground access device and the satellite base station, the first random number RAND1 and the second random number RAND2, and send the first authentication response to the satellite base station.

[0099] Based on Figure 4 Satellite communication systems, Figure 5 The following is an exemplary diagram of the authentication process provided in an embodiment of the present application, through which two-way authentication between a satellite base station and a ground access device can be achieved.

[0100] After the ground access device detects the satellite base station, a Radio Resource Control (RRC) connection is established between the ground access device and the satellite base station. When the ground access device and the satellite base station establish an RRC connection, the ground access device can obtain identification information of the satellite base station.

[0101] like Figure 5 As shown, the authentication process may include the following steps:

[0102] S501: The ground access device sends a registration request to the satellite base station.

[0103] Exemplarily, in order to perform two-way authentication and establish a secure connection with the satellite base station, the ground access device generates a first random number RAND1 for this authentication. The ground access device sends a registration request to the satellite base station, and the registration request includes the first random number RAND1 generated by the ground access device, the identification information of the ground access device, and the indication information of the ground access device registration request.

[0104] S502: After receiving the registration request, the satellite base station obtains the root key shared by the ground access device and the satellite base station.

[0105] In this step, the satellite base station obtains the root key shared by the ground access device and the satellite base station locally according to the identification information of the ground access device. Among them, the root key shared by the ground access device and the satellite base station is the root key of the ground access device. The root key used by a ground access device to authenticate with a specified satellite base station is specifically used for the satellite base station. Different root keys configured on the ground access device can distinguish different satellite base stations. There are two ways for the satellite base station to obtain the root key shared by the ground access device and the satellite base station:

[0106] Optionally, the satellite base station derives the root key shared by the ground access device and the satellite base station based on the superior key used to derive the root key of the ground access device and the identification information of the ground access device. Exemplarily, the satellite base station stores the superior key that can derive the root key shared by the ground access device and the satellite base station, and the satellite base station performs key calculation based on the superior key and the identification information of the ground access device to derive the root key shared by the ground access device and the satellite base station.

[0107] Optionally, the satellite base station directly obtains the locally stored root key shared by the ground access device and the satellite base station.

[0108] S503: After acquiring the root key shared by the ground access device and the satellite base station, the satellite base station generates an authentication vector.

[0109] Exemplarily, the satellite base station generates a second random number RAND2 for this authentication based on the acquired root key shared by the ground access device and the satellite base station. Then, an authentication vector is generated based on the root key shared by the ground access device and the satellite base station, the first random number RAND1, and the second random number RAND2. The authentication vector may include the second random number RAND2, the second authentication token MAC2, the second authentication response, and the second feeder link communication master key Kmaster2.

[0110] The second authentication token MAC2 is a message authentication code (MAC) used to protect the first random number RAND1 and the second random number RAND2 from being tampered with during transmission. Exemplarily, the second authentication token MAC2 can be obtained by performing message authentication code calculation on the first random number RAND1 and the second random number RAND2 according to the satellite base station authentication root key. For example, the satellite base station uses the root key shared by the ground access device and the satellite base station to obtain other calculation parameters participating in MAC2, wherein the other calculation parameters participating in MAC2 are strings, and the hash message authentication code algorithm is used to perform an OR operation on the first random number RAND1, the second random number RAND2 and other parameters participating in MAC2 calculation, thereby obtaining the second authentication token MAC2. For example, a calculation method of the second authentication token MAC2 can be expressed as: using the HMAC algorithm to calculate the input string S, where S = RAND1||RAND2|| other parameters participating in MAC calculation, wherein "||" is an OR logical operator, and two operands are required when || is operated, for example, the first operand first random number RAND1 and the second operand second random number RAND2.

[0111] Exemplarily, the second authentication response can be obtained by performing message authentication code calculation on the first random number RAND1 and the second random number RAND2 according to the root key shared by the ground access device and the satellite base station. For example, the satellite base station uses the root key shared by the ground access device and the satellite base station to obtain other calculation parameters participating in the second authentication response and the operation identifier of the second authentication response, wherein the other parameters participating in the calculation of the second authentication response are strings, and the hash message authentication code algorithm is used to perform an OR operation on the operation identifier of the second authentication response, the first random number RAND1, the second random number RAND2, and other parameters participating in the calculation of the second authentication response to obtain the second authentication response. For example, a calculation method for the second authentication response can be expressed as: using the HMAC algorithm to calculate the input string S, where S = the operation identifier of the second authentication response||RAND1||RAND2||other parameters participating in the calculation of the second authentication response.

[0112] Exemplarily, the second feeder link communication master key Kmaster2 can be obtained by performing message authentication code calculation on the first random number RAND1 and the second random number RAND2 according to the satellite base station authentication root key. For example, the satellite base station uses the root key shared by the ground access device and the satellite base station to obtain other calculation parameters participating in the second feeder link communication master key Kmaster2 and the operation identifier of the second feeder link communication master key Kmaster2, wherein the other calculation parameters participating in the second feeder link communication master key Kmaster2 are strings, and the hash message authentication code algorithm is used to perform an OR operation on the operation identifier of the second feeder link communication master key, the first random number RAND1, the second random number RAND2, and the other calculation parameters participating in the second feeder link communication master key Kmaster2 to obtain the second feeder link communication master key Kmaster2. For example, a calculation method of the second feeder link communication master key Kmaster2 can be expressed as: using the HMAC algorithm to calculate the input string S, wherein S = the second feeder link communication master key Kmaster operation identifier||RAND1||RAND2||other parameters participating in the Kmaster calculation.

[0113] S504: After generating the authentication vector, the satellite base station sends an authentication request to the ground access device.

[0114] The authentication request sent by the satellite base station to the ground access device includes the second random number RAND2 in the authentication vector and the second authentication token MAC2.

[0115] S505: After receiving the authentication request, the ground access device authenticates the satellite base station.

[0116] In this step, the satellite base station first generates a first authentication token MAC1 based on the root key shared by the ground access device and the satellite base station, the first random number RAND1, the second random number RAND2 and other parameters participating in the MAC1 calculation, and then authenticates the satellite base station based on the first authentication token MAC1 and the second authentication token MAC2. If the first authentication token MAC1 and the second authentication token MAC2 are the same, it indicates that the received second random number RAND2 has not been modified, that is, the satellite base station is successfully authenticated. Among them, the generation method of the first authentication token MAC1 is the same as the generation method of the second authentication token MAC2.

[0117] S506: The ground access device calculates a first authentication response and a first feeder link communication master key Kmaster1.

[0118] Exemplarily, the ground access device generates a first authentication response based on a root key shared by the ground access device and the satellite base station, a first random number RAND1, a second random number RAND2, and other calculation parameters participating in the second authentication response, wherein the method for generating the first authentication response is the same as the method for generating the second authentication response. For example, the ground access device may generate a first authentication response after successfully authenticating the satellite base station. For example, the satellite base station uses the root key shared by the ground access device and the satellite base station to obtain other calculation parameters participating in the first authentication response and the operation identifier of the first authentication response, and uses the same hash message authentication code algorithm as the generation algorithm of the second authentication response to perform an OR operation on the operation identifier of the first authentication response, the first random number RAND1, the second random number RAND2, and other parameters participating in the calculation of the first authentication response to obtain the first authentication response. If the ground access device successfully authenticates the satellite base station, the first authentication response is carried in the authentication parameters sent to the satellite base station.

[0119] Exemplarily, the ground access device generates a first authentication response according to the root key shared by the ground access device and the satellite base station, the first random number RAND1, the second random number RAND2, and the calculation parameters of the first feeder link communication master key Kmaster1, wherein the generation method of the first feeder link communication master key Kmaster1 is the same as the generation method of the first feeder link communication master key Kmaster1. For example, the ground access device can generate the first feeder link communication master key Kmaster1 after successfully authenticating the satellite base station. For example, the satellite base station uses the root key shared by the ground access device and the satellite base station to obtain other calculation parameters of the first feeder link communication master key Kmaster1 and the operation identifier of the first feeder link communication master key Kmaster1, and adopts the same hash message authentication code algorithm as the generation algorithm of the second feeder link communication master key Kmaster1 to perform an OR operation on the operation identifier of the first feeder link communication master key Kmaster1, the first random number RAND1, the second random number RAND2, and other parameters participating in the calculation of the first feeder link communication master key Kmaster1, so as to obtain the first feeder link communication master key Kmaster1.

[0120] S507: After the ground access device successfully authenticates the satellite base station, it sends an authentication response to the satellite base station, where the authentication response includes a first authentication response.

[0121] S508: After receiving the authentication response, the satellite base station authenticates the ground access device.

[0122] In this step, after the satellite base station obtains the first authentication response from the received authentication response, it authenticates the ground access device according to the first authentication response and the second authentication response generated by the satellite base station. Exemplarily, if the first authentication response and the second authentication response are the same, the satellite base station is authenticated successfully.

[0123] If the satellite base station successfully authenticates the ground access device, the process may also include the following steps:

[0124] S509a and S509b: The ground access device exports the first satellite base station key KgNB1, and the satellite base station exports the second satellite base station key KgNB2.

[0125] In this step, the ground access device can derive the first satellite base station key KgNB1 used when the ground access device communicates with the satellite base station based on the first feeder link communication master key Kmaster1, the identification information of the ground access device, and the identification information of the satellite base station. The satellite base station can derive the second satellite base station key KgNB2 used when the satellite base station communicates with the ground access device based on the second feeder link communication master key Kmaster2 in the authentication vector, the identification information of the ground access device, and the identification information of the satellite base station. Optionally, the ground access device can use the first feeder link communication master key Kmaster1 as the first satellite base station key KgNB1 used when the ground access device communicates with the satellite base station. The satellite base station can use the second feeder link communication master key Kmaster2 as the second satellite base station key KgNB2 used when the satellite base station communicates with the ground access device.

[0126] After that, the access stratum (AS) and security mode command (SMC) processes can be executed between the satellite base station and the ground access device to establish a security context for secure communication between the satellite base station and the ground access device.

[0127] Exemplarily, the satellite base station and the ground access device may perform the AS process to derive the keys KRRCint and KRRCenc for access control security in accordance with the provisions of the 3rd Generation Partnership Project (3GPP); and perform the SMC process to derive the keys KUPint and KUPenc for access data security. When there is a security context for secure communication between the satellite base station and the ground access device, the feeder link security operation is as follows: the ground access device detects the signal of the satellite base station, and the ground access device has a security context for secure communication with the satellite base station, then the ground access device sends an RRC reconnection request (Resume Request) to the satellite base station, which includes resume information, such as an inactivated radio network temporary identifier I-RNTI, and then the satellite base station and the ground access device start to perform the RRC Resume process and derive a new AS security context.

[0128] In the above-mentioned embodiments of the present application, the satellite communication system of the embodiment includes a satellite base station and a ground access device, wherein the ground access device authenticates the ground access device according to a first authentication token MAC1 generated by the ground access device and a second authentication token MAC2 generated by the satellite base station, and the satellite base station authenticates the ground access device according to a first authentication response generated by the ground access device and a second authentication response generated by the satellite base station, so that two-way authentication can be achieved between the satellite base station and the ground access device, thereby establishing a secure feeder link, improving the security of the feeder link, and ensuring secure communication between the satellite base station and the ground access device.

[0129] Figure 6 The structural diagram of the communication device provided in the embodiment of the present application is exemplified.

[0130] As shown in the figure, the device may include: a processor 601 , a memory 602 , and a bus interface 603 .

[0131] The bus architecture may include any number of interconnected buses and bridges, specifically linking together various circuits of one or more processors represented by processor 601 and memory represented by memory 602. The bus architecture may also link together various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface. The processor 601 is responsible for managing the bus architecture and general processing, and the memory 602 may store data used by the processor 601 when performing operations.

[0132] The process disclosed in the embodiment of the present application can be applied to the processor 601, or implemented by the processor 601. In the implementation process, each step of the signal processing process can be completed by the hardware integrated logic circuit or software instructions in the processor 601. The processor 601 can be a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, and can implement or execute the methods, steps and logic block diagrams disclosed in the embodiment of the present application. The general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the embodiment of the present application can be directly embodied as a hardware processor to be executed, or the hardware and software modules in the processor are combined and executed. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 602, and the processor 601 reads the information in the memory 602 and completes the steps of the information processing process in combination with its hardware.

[0133] Specifically, the processor 601 is used to read the computer instructions in the memory 602 and execute the authentication method in the embodiment of the present application.

[0134] It should be noted here that the above-mentioned communication device provided in the embodiment of the present application can implement all the method steps implemented in the above-mentioned method embodiment, and can achieve the same technical effect. The parts and beneficial effects that are the same as the method embodiment in this embodiment will not be described in detail here.

[0135] It should be noted that the processor involved in the above-mentioned embodiments of the present application can be a central processing unit (CPU), a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It can implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the content of this application. The processor can also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and the like. Among them, the memory can be integrated in the processor or can be set separately from the processor.

[0136] Based on the same technical concept, the embodiment of the present application also provides a computer-readable storage medium. The computer-readable storage medium stores computer-executable instructions, which are used to enable a computer to execute Figure 3 and Figure 5 The process being executed.

[0137] Based on the same technical concept, the embodiment of the present application also provides a computer program product, which, when called by a computer, enables the computer to execute Figure 3 and Figure 5 The process being executed.

[0138] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0139] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0140] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0141] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0142] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A satellite communication system, characterized in that: include: Satellite base stations, ground stations and authentication centers; The satellite base station is configured to receive a first random number from the ground station, generate a second random number according to a root key shared by the ground station and the satellite base station, generate an authentication vector according to the root key shared by the ground station and the satellite base station, the first random number and the second random number, the authentication vector including the second random number, a second authentication token, a second authentication response and a second feeder link communication master key, and send the second random number and the second authentication token to the ground station; and, receiving a first authentication response from the ground station, and authenticating the ground station according to the first authentication response and the second authentication response; The ground station is used to generate a first random number and send the first random number to the satellite base station; and, used to send the second random number, the second authentication token and the first random number from the satellite base station to the authentication center, and send the first authentication response from the authentication center to the satellite base station; The authentication center is used to receive the second random number, the first random number and the second authentication token from the ground station, generate a first authentication token according to the root key shared by the ground station and the satellite base station, the first random number and the second random number, and after authenticating the satellite base station according to the first authentication token and the second authentication token, generate the first authentication response according to the root key shared by the ground station and the satellite base station, the first random number and the second random number, and send the first authentication response to the ground station.

2. The system according to claim 1, characterized in that: The ground station is further used to send a registration request to the satellite base station, where the registration request includes identification information of the ground station, the first random number, and indication information for instructing the ground station to send a registration request to the satellite base station; The satellite base station is further used to send an authentication request to the ground station, wherein the authentication request includes the second random number and the second authentication token; The ground station is also used to send an authentication parameter request to the authentication center, and the authentication parameter request includes the first random number, the second random number, the second authentication token, the identification information of the ground station and the identification information of the satellite.

3. The system according to claim 1, characterized in that: The authentication center is further configured to derive a first feeder link communication master key according to a root key shared by the ground station and the satellite base station, the first random number, and the second random number if the satellite base station is authenticated according to the first authentication token and the second authentication token, and send the first feeder link communication master key to the ground station; The ground station is further used to derive a first satellite base station key used when the ground station communicates with the satellite base station according to the first feeder link communication master key, the identification information of the ground station and the identification information of the satellite base station; The satellite base station is further used to derive a second satellite base station key used when the satellite base station communicates with the ground station based on the second feeder link communication master key, the identification information of the ground station and the identification information of the satellite base station.

4. The system according to claim 1, characterized in that: The authentication center is further configured to derive a first feeder link communication master key according to a root key shared by the ground station and the satellite base station, the first random number, and the second random number if the satellite base station is authenticated according to the first authentication token and the second authentication token, and send the first feeder link communication master key to the ground station; The ground station is further configured to use the first feeder link communication master key as a first satellite base station key used when the ground station communicates with the satellite base station; The satellite base station is further configured to use the second feeder link communication master key as a second satellite base station key used when the satellite base station communicates with the ground station.

5. The system according to any one of claims 1 to 4, characterized in that: The satellite base station is also used for: Deriving a root key shared by the ground station and the satellite base station according to the superior key used to derive the root key of the ground station and the identification information of the ground station; Alternatively, a locally stored root key shared by the ground station and the satellite base station is obtained.

6. An authentication method, characterized in that: include: The satellite base station receives a registration request from a ground station, wherein the registration request includes a first random number generated by the ground station, obtains a root key shared by the ground station and the satellite base station, generates a second random number according to the root key shared by the ground station and the satellite base station, and generates an authentication vector according to the root key shared by the ground station and the satellite base station, the first random number, and the second random number, wherein the authentication vector includes the second random number, a second authentication token, a second authentication response, and a second feeder link communication master key; The satellite base station sends the second random number and the second authentication token to an authentication center via the ground station, so that the authentication center generates a first authentication token according to a root key shared by the ground station and the satellite base station, the second random number, and the first random number generated by the ground station, and authenticates the satellite base station according to the first authentication token and the second authentication token, and generates a first authentication response according to the root key shared by the ground station and the satellite base station, the first random number, and the second random number after the satellite base station passes the authentication, and sends the first authentication response to the satellite base station; The satellite base station receives a first authentication response generated by the authentication center, and authenticates the ground station according to the first authentication response and the second authentication response.

7. An authentication method, characterized in that: include: The ground station generates a first random number, includes the first random number in a registration request and sends it to the satellite base station, so that the satellite base station generates an authentication vector according to a root key shared by the ground station and the satellite base station, the first random number and a second random number, and the authentication vector includes the second random number, a second authentication token, a second authentication response and a second feeder link communication master key; wherein the second random number is generated by the satellite base station according to the root key shared by the ground station and the satellite base station; The ground station sends the second random number and the second authentication token from the satellite base station to an authentication center, so that the authentication center generates a first authentication token according to the root key shared by the ground station and the satellite base station, the first random number and the second random number, authenticates the satellite base station according to the first authentication token and the second authentication token, generates a first authentication response according to the root key shared by the ground station and the satellite base station, the first random number and the second random number after the satellite base station is authenticated, and sends the first authentication response to the satellite base station; The ground station sends a first authentication response from the authentication center to the satellite base station, so that the satellite base station authenticates the ground station according to the first authentication response and the second authentication response.

8. An authentication method, characterized in that: include: An authentication center receives an authentication parameter request from a ground station, wherein the authentication parameter request includes a second random number generated by a satellite base station, a second authentication token, and a first random number generated by the ground station; wherein the second random number is generated by the satellite base station according to a root key shared by the ground station and the satellite base station, the second authentication token is generated by the satellite base station according to a root key shared by the ground station and the satellite base station, the first random number generated by the ground station, and the second random number generated by the satellite base station, and the first random number is generated by the ground station according to the root key shared by the ground station and the satellite base station; The authentication center generates a first authentication token based on the root key shared by the ground station and the satellite base station, the first random number and the second random number, authenticates the satellite base station based on the first authentication token and the second authentication token, and after the satellite base station is authenticated, generates a first authentication response based on the root key shared by the ground station and the satellite base station, the first random number and the second random number, and sends the first authentication response to the ground station. The first authentication response is sent to the satellite base station via the ground station, so that the satellite base station authenticates the ground station based on the first authentication response and the second authentication response.

9. A satellite communication system, characterized in that: include: Satellite base stations and ground access equipment; The satellite base station is used to receive a first random number from the ground access device, generate a second random number according to a root key shared by the ground access device and the satellite base station, generate an authentication vector according to the root key shared by the ground access device and the satellite base station, the first random number and the second random number, the authentication vector including the second random number, a second authentication token, a second authentication response and a second feeder link communication master key, and send the second random number and the second authentication token to the ground access device; and receiving a first authentication response from the ground access device, and authenticating the ground access device according to the first authentication response and the second authentication response; The ground access device is used to generate a first random number and send the first random number to the satellite base station; And, it is used to receive the second random number and the second authentication token from the satellite base station, generate a first authentication token according to the root key shared by the ground access device and the satellite base station, the first random number and the second random number, and after authenticating the satellite base station according to the first authentication token and the second authentication token, generate the first authentication response according to the root key shared by the ground access device and the satellite base station, the first random number and the second random number, and send the first authentication response to the satellite base station.

10. The system according to claim 9, characterized in that: The ground access device is further used to send a registration request to the satellite base station, where the registration request includes identification information of the ground access device, the first random number, and indication information for instructing the ground access device to send a registration request to the satellite base station; The satellite base station is further used to send an authentication request to the ground access device, wherein the authentication request includes the second random number and the second authentication token.

11. The system according to claim 9, characterized in that: The ground access equipment is also used for: If the satellite base station is authenticated according to the first authentication token and the second authentication token, deriving a first feeder link communication master key according to a root key shared by the ground access device and the satellite base station, the first random number, and the second random number; deriving a first satellite base station key used when the ground access device communicates with the satellite base station according to the first feeder link communication master key, the identification information of the ground access device and the identification information of the satellite base station; The satellite base station is also used to derive a second satellite base station key used when the satellite base station communicates with the ground access device based on the second feeder link communication master key, the identification information of the ground access device and the identification information of the satellite base station.

12. The system of claim 9, wherein: The ground access device is further configured to derive a first feeder link communication master key according to a root key shared by the ground access device and the satellite base station, the first random number, and the second random number if the satellite base station is authenticated according to the first authentication token and the second authentication token, and use the first feeder link communication master key as a first satellite base station key used when the ground access device communicates with the satellite base station; The satellite base station is further configured to use the second feeder link communication master key as a second satellite base station key used when the satellite base station communicates with the ground access device.

13. The system of claim 9, wherein: The satellite base station is also used for: Deriving a root key shared by the ground access device and the satellite base station according to the upper-level key used to derive the root key of the ground access device and the identification information of the ground access device; Alternatively, a locally stored root key shared by the ground access device and the satellite base station is obtained.

14. An authentication method, characterized in that: include: The satellite base station receives a registration request from a ground access device, wherein the registration request includes a first random number generated by the ground access device, obtains a root key shared by the ground access device and the satellite base station, generates a second random number based on the root key shared by the ground access device and the satellite base station, and generates an authentication vector based on the root key shared by the ground access device and the satellite base station, the first random number, and the second random number, wherein the authentication vector includes the second random number, a second authentication token, a second authentication response, and a second feeder link communication master key; The satellite base station sends the second random number and the second authentication token to the ground access device, so that the ground access device generates a first authentication token according to the root key shared by the ground access device and the satellite base station, the second random number and the first random number generated by the ground access device, and authenticates the satellite base station according to the first authentication token and the second authentication token, and generates a first authentication response according to the root key shared by the ground access device and the satellite base station, the first random number and the second random number after the satellite base station is authenticated, and sends the first authentication response to the satellite base station; The satellite base station receives a first authentication response generated by the ground access device, and authenticates the ground access device according to the first authentication response and the second authentication response.

15. An authentication method, characterized in that: include: The ground access device generates a first random number, includes the first random number in a registration request and sends it to the satellite base station, so that the satellite base station generates an authentication vector according to the root key shared by the ground access device and the satellite base station, the first random number and the second random number, and the authentication vector includes the second random number, a second authentication token, a second authentication response and a second feeder link communication master key; wherein the second random number is generated by the satellite base station according to the root key shared by the ground access device and the satellite base station; The ground access device receives the second random number and the second authentication token from the satellite base station, generates a first authentication token based on the root key shared by the ground access device and the satellite base station, the first random number and the second random number, authenticates the satellite base station based on the first authentication token and the second authentication token, and after the satellite base station is authenticated, generates a first authentication response based on the root key shared by the ground access device and the satellite base station, the first random number and the second random number, and sends the first authentication response to the satellite base station, so that the satellite base station authenticates the ground access device based on the first authentication response and the second authentication response.

16. A satellite communication device, characterized in that: It comprises a memory and a processor; the memory stores computer instructions; the processor is used to read the computer instructions and execute the method as described in any one of claims 6-8 and 14-15.

17. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions for causing the computer to execute the method according to any one of claims 6 to 8 and 14 to 15.

18. A computer program product, characterized in that When the computer program product is called by a computer, the computer is caused to execute the method according to any one of claims 6 to 8 and 14 to 15.

Images