Satellite communication system, authentication method and device

Abstract

The present application discloses a satellite communication system, an authentication method and an apparatus, and relates to the field of satellite communication. In the present application, a satellite base station authenticates a ground station according to authentication information of a satellite base station authentication function entity for authenticating a ground station, and the satellite base station authentication function entity authenticates the satellite base station according to an authentication request of a feeder link management function entity, so that two-way authentication is achieved between the satellite base station and the ground station, thereby establishing a secure feeder link, improving the security of the feeder link, and ensuring secure communication between the satellite base station and the ground station.

Description

Technical Field

[0001] The present application relates to the field of satellite communications, and in particular to satellite communication systems, authentication methods and devices. Background Art

[0002] The satellite communication system consists of three parts: satellite end (such as satellite base station), ground end (such as ground station), and user end (such as user terminal). The satellite end acts as a relay station in the air, that is, it amplifies the electromagnetic waves sent by the ground station and then sends them back to another ground station. The ground station is the interface between the satellite system and the ground public network. The user terminal can access the satellite system through the ground station to form a link.

[0003] With the development of satellite communication network technology, satellite communication network security certification has received increasing attention. How to improve the security of satellite communications is a technical problem that needs to be solved at present. Summary of the invention

[0004] In an exemplary embodiment of the present application, a satellite communication system, an authentication method and an apparatus are provided to implement two-way authentication between a satellite base station and a ground station.

[0005] In a first aspect, a satellite communication system is provided, the system comprising: a satellite base station, a ground station, a feeder link management function entity and a satellite base station authentication function entity; the satellite base station is used to send a registration request to the feeder link management function entity, the registration request comprising identification information of the satellite base station and identification information of the ground station; and, after successful authentication with the satellite base station authentication function entity, generate a first feeder link communication root key according to the identification information of the ground station and information shared with the satellite base station authentication function entity, and after receiving a message from the feeder link management function entity for instructing to perform an access layer security mode command process with the ground station, generate a first feeder link master key according to the first feeder link communication root key and the ground station identification information; the feeder link management function entity is used to receive the registration request from the satellite base station, and send a registration request to the feeder link management function entity. The satellite base station authentication function entity sends an authentication request, which includes the identification information of the satellite base station and the identification information of the ground station; and, after receiving the second feeder link communication root key from the satellite base station authentication function entity, generates a second feeder link master key according to the second feeder link communication root key and the identification information of the ground station, sends the second feeder link master key to the ground station, and sends a message to the satellite base station for indicating the access layer security mode command process with the ground station; the satellite base station authentication function entity is used to perform two-way authentication with the satellite base station after receiving the authentication request, and after the authentication is passed, generates the second feeder link communication root key according to the identification information of the ground station and the information shared with the satellite base station, and sends the second feeder link communication root key to the feeder link management function entity.

[0006] Optionally, the satellite base station is further used to: after establishing a wireless resource control (RRC) connection with the ground station, switch to a terminal of the ground station; after receiving a message from the feeder link management function entity instructing an access layer security mode command process with the ground station, switch to a base station of the ground station; the ground station is further used to: after establishing an RRC connection with the satellite base station, switch to a base station of the satellite base station; after receiving a second feeder link communication master key from the feeder link management function entity, switch to a terminal of the satellite base station.

[0007] Optionally, the ground station is also used to: after establishing an RRC connection with the satellite base station, send indication information and identification information of the ground station to the satellite base station, wherein the indication information is used to indicate that the RRC connection is a feeder link connection; the satellite base station is also used to: after receiving the indication information and the identification information of the ground station, switch to the terminal of the ground station.

[0008] In a second aspect, an authentication method is provided, the method comprising: a satellite base station sends a registration request to a feeder link management function entity via a ground station, so that the feeder link management function entity sends an authentication request to a satellite base station authentication function entity, the registration request and the authentication request include identification information of the satellite base station and identification information of the ground station; after the satellite base station and the satellite base station authentication function entity are successfully authenticated, a first feeder link communication root key is generated according to a root key shared by the satellite base station and the satellite base station authentication function entity and the identification information of the ground; after the satellite base station receives a message from the feeder link management function entity for indicating an access layer security mode command process with the ground station, the satellite base station generates a first feeder link communication master key used by the satellite base station when communicating with the ground station according to the first feeder link communication root key and the identification information of the ground station, and establishes an access layer security connection with the ground station.

[0009] In a third aspect, an authentication method is provided, the method comprising: a feeder link management function entity receives a registration request from a satellite base station via a ground station, and sends an authentication request to a satellite base station authentication function entity, so that the satellite base station authentication function entity performs two-way authentication with the satellite base station, and the registration request and the authentication request include identification information of the satellite base station and identification information of the ground station; after receiving a second feeder link communication root key from the satellite base station authentication function entity, the feeder link management function entity generates a second feeder link communication master key used when the ground station communicates with the satellite base station according to the second feeder link communication root key and the identification information of the ground station, sends the second feeder link master key to the ground station, and sends a message to the satellite base station for instructing an access layer security mode command process with the ground station, so that the satellite base station generates a first feeder link communication master key used when the satellite base station communicates with the ground station according to the first feeder link communication root key and the identification information of the ground station, and establishes an access layer security connection with the ground station.

[0010] In a fourth aspect, a communication device is provided, comprising a memory and a processor; the memory stores computer instructions; the processor is used to read the computer instructions and execute a method as described in any one of the second and third aspects.

[0011] According to a fifth aspect, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable the computer to execute the method as described in any one of the second and third aspects.

[0012] In a sixth aspect, a computer program product is provided, and when the computer program product is called by a computer, the computer executes the method as described in any one of the second aspect and the third aspect. In the above embodiments of the present application, the satellite base station authenticates the ground station according to the authentication information of the satellite base station authentication function entity for authenticating the ground station, and the satellite base station authentication function entity authenticates the satellite base station according to the authentication request of the feeder link management function entity, so that two-way authentication is achieved between the satellite base station and the ground station to establish a secure feeder link, improve the security of the feeder link, and ensure secure communication between the satellite base station and the ground station.

[0013] In the above-mentioned embodiments of the present application, the satellite base station authenticates the ground station according to the authentication information of the satellite base station authentication function entity for authenticating the ground station, and the satellite base station authentication function entity authenticates the satellite base station according to the authentication request of the feeder link management function entity, so that two-way authentication is achieved between the satellite base station and the ground station to establish a secure feeder link, improve the security of the feeder link, and ensure secure communication between the satellite base station and the ground station. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0015] Figure 1 The physical block diagram of the satellite communication system according to the embodiment of the present application is exemplarily shown;

[0016] Figure 2 A satellite communication system provided by an embodiment of the present application is exemplarily shown;

[0017] Figure 3 An example is shown based on Figure 2 Schematic diagram of the authentication process provided by the embodiment;

[0018] Figure 4 The structural diagram of the communication device provided in the embodiment of the present application is exemplified. DETAILED DESCRIPTION

[0019] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0020] The technical solutions in the embodiments of the present application will be described clearly and in detail below in conjunction with the accompanying drawings. In the description of the embodiments of the present application, unless otherwise specified, " / " means or, for example, A / B can mean A or B; "and / or" in the text is only a description of the association relationship of associated objects, indicating that there can be three relationships, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, "multiple" means two or more than two.

[0021] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as suggesting or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features, and in the description of the embodiments of the present application, unless otherwise specified, "plurality" means two or more.

[0022] The parameters involved in the embodiments of the present application may include:

[0023] (1) A first random number, generated by the satellite base station. For convenience, the first random number is also referred to as RAND1 in this document.

[0024] (2) a first authentication token, generated by the satellite base station. For convenience, the first authentication token is also referred to as message authentication code 1, MAC1 in this document;

[0025] (3) a first authentication response, generated by the satellite base station;

[0026] (4) a first satellite base station authentication key, which is generated by the satellite base station. For convenience, the first satellite base station authentication key is also referred to as Kauth1 in this document;

[0027] (5) a first feeder link communication root key, generated by the satellite base station;

[0028] (6) a first feeder link communication master key, generated by the satellite base station;

[0029] (7) a second random number, generated by the satellite base station authentication function entity. For convenience, the second random number is also referred to as RAND2 in this document.

[0030] (8) a second authentication token, generated by the satellite base station authentication function entity. For convenience, the second authentication token is also referred to as message authentication code 2, or MAC2, in this document.

[0031] (9) A second authentication response, generated by the satellite base station authentication function entity;

[0032] (10) a second satellite base station authentication key, which is generated by the satellite base station authentication function entity. For convenience, the second satellite base station authentication key is also referred to as Kauth2 in this document;

[0033] (11) A second feeder link communication root key, generated by the satellite base station authentication function entity;

[0034] (12) a second feeder link communication master key, generated by the feeder link management function entity;

[0035] It should be noted that the above parameter naming method is only an example, and the embodiment of the present application does not limit the naming method of the above parameters.

[0036] Figure 1 The physical block diagram of the satellite communication system of the embodiment of the present application is shown as an example. Figure 1 As shown, the satellite communication system includes: a satellite terminal 101, a satellite base station (102a, 102b), a ground station 103 and a core network 104. Before the satellite terminal and the satellite base station (102a, 102b) communicate through a service link, it is necessary for the satellite base station (102a, 102b) and the ground station 103 to perform two-way authentication and establish a secure feeder link through the core network 104, wherein the satellite base station 102a and the satellite base station 102b exchange information through an inter-satellite link. In the above system architecture, the ground station may include a gateway station, a gateway station, etc.

[0037] Figure 1 Only two satellite base stations are used as an example for description, and the embodiment of the present application does not limit the number of satellite base stations and the above-mentioned other devices.

[0038] The satellite base station (102a, 102b) is a satellite with satellite communication base station capabilities. The ground station 103 is used to connect the satellite base station to the satellite communication core network 104 to realize the satellite feeder link and its security. Among them, the ground station can forward and receive information during the information exchange process of satellite communication; the core network 104 is mainly used for call connection, billing, mobility management, supplementary service implementation, intelligent triggering, etc.

[0039] Currently, there is no standard solution for establishing a secure association between a satellite base station and a ground station. To this end, the embodiments of the present application provide a satellite communication system, an authentication method and a device. Through the embodiments of the present application, a secure feeder link can be established between the satellite base station and the ground station, thereby improving the security of the feeder link and ensuring secure communication between the satellite base station and the ground station.

[0040] Figure 2A satellite communication system provided by an embodiment of the present application is exemplarily shown, which shows a feeder link security architecture of the satellite communication system. As shown in the figure, the satellite communication system includes: a satellite base station (201a, 201b), a ground station (202a, 202b), a feeder link management function entity 203 and a second network element 204. Among them, the feeder link management function entity 203 is used for mobility management, and the second network element 204 is used for data management. The feeder link management function entity 203 and the second network element 204 can be network elements in the core network.

[0041] It is understandable that the feeder link management function entity may also be called a feeder link management function or a feeder link management function network element or other names, and the satellite base station authentication function entity may also be called a satellite base station authentication function or a feeder link management function network element or other names. The embodiments of the present application do not limit this.

[0042] It should be noted that the embodiment of the present application does not limit the number of satellite base stations and ground stations in the above architecture.

[0043] Based on the above architecture, mutual authentication between the satellite base station and the ground station can be achieved.

[0044] The following first briefly describes the functions of each component in the above satellite system.

[0045] The satellite base station is used to send a registration request to a feeder link management function entity, wherein the registration request includes identification information of the satellite base station and identification information of the ground station; and receive authentication information for authenticating the ground station from the satellite base station authentication function entity, and authenticate the ground station according to the authentication information.

[0046] The feeder link management functional entity is used to receive a registration request from a satellite base station, send an authentication request to a satellite base station authentication functional entity, wherein the authentication request includes identification information of the satellite base station and identification information of the ground station; and receive a message of successful satellite base station authentication from the satellite base station authentication functional entity.

[0047] The satellite base station authentication function entity is used to receive the authentication request from the feeder link management function entity, send authentication information for authenticating the ground station to the satellite base station, authenticate the satellite base station, and send the information of successful satellite base station authentication to the feeder link management function entity.

[0048] Based on Figure 2 Satellite communication systems, Figure 3 The following is an exemplary diagram of the authentication process provided in an embodiment of the present application, through which two-way authentication between a satellite base station and a ground station can be achieved.

[0049] S301: After the ground station as a terminal detects the signal of the satellite base station, in order to obtain a security context for secure communication between the satellite base station and the ground station, a Radio Resource Control (RRC) connection is established between the ground station and the satellite base station.

[0050] S302: After the ground station and the satellite base station establish an RRC connection, the ground station sends indication information to the satellite base station, where the indication information is used to indicate that the RRC connection is a feeder link connection. Optionally, the indication information may carry identification information of the ground station.

[0051] S303a and S303b: After the ground station and the satellite base station establish an RRC connection, the satellite base station obtains the identification information of the ground station. The satellite base station and the ground station perform role switching according to the identification information of the ground station. Exemplarily, after the satellite base station obtains the identification information of the ground station, the identification information of the ground station indicates the satellite base station as a terminal, the satellite base station switches to the terminal of the ground station, and the ground station switches to the base station of the satellite base station.

[0052] like Figure 3 As shown, the authentication process may include the following steps:

[0053] S304: The satellite base station sends a registration request to the feeder link management function entity through the ground station.

[0054] Exemplarily, in order to perform two-way authentication and establish a secure connection with the ground station, the satellite base station generates a first random number RAND1 for this authentication. The satellite base station sends a registration request to the feeder link management function entity through the ground station, and the registration request includes the identification information of the satellite base station, the first random number RAND1 generated by the satellite base station, and the identification information of the ground station.

[0055] S305: After receiving the registration request, the feeder link management function entity sends an authentication request to the satellite base station authentication function entity.

[0056] Exemplarily, the authentication request sent by the feeder link management function entity to the satellite base station authentication function entity includes identification information of the satellite base station, a first random number RAND1 generated by the satellite base station, and identification information of the ground station.

[0057] S306: After receiving the authentication request, the satellite base station authentication function entity generates an authentication vector.

[0058] Exemplarily, the satellite base station authentication function entity obtains the identification information of the satellite base station from the received authentication request, obtains the corresponding satellite base station authentication root key according to the identification information of the satellite base station, and generates a second random number RAND2 for this authentication according to the satellite base station authentication root key. Then, an authentication vector is generated according to the satellite base station authentication root key, the first random number RAND1 and the second random number RAND2. The authentication vector may include the second random number RAND2, the second authentication token MAC2, the second authentication response and the second satellite base station authentication key Kauth2.

[0059] The second authentication token MAC2 is a message authentication code (MAC) used to protect the first random number RAND1 and the second random number RAND2 from being tampered with during transmission. Exemplarily, the second authentication token MAC2 can be obtained by performing message authentication code calculation on the first random number RAND1 and the second random number RAND2 according to the satellite base station authentication root key. For example, the satellite base station authentication function entity adopts a hash message authentication code algorithm to perform an OR operation on the first random number RAND1 and the second random number RAND2 according to the satellite base station authentication root key, thereby obtaining the second authentication token MAC2. For example, a calculation method of the second authentication token MAC2 can be expressed as: using the HMAC algorithm to calculate the input string S, where S = RAND1||RAND2, where "||" is an OR logical operator, and two operands are required when || is operated, for example, the first operand first random number RAND1 and the second operand second random number RAND2.

[0060] Exemplarily, the second authentication response can be obtained by performing message authentication code calculation on the first random number RAND1 and the second random number RAND2 according to the satellite base station authentication root key. For example, the satellite base station authentication function entity obtains the operation identifier of the second authentication response using the satellite base station authentication root key, and uses the hash message authentication code algorithm to perform an OR operation on the operation identifier of the second authentication response, the first random number RAND1, and the second random number RAND2 to obtain the second authentication response. For example, a calculation method for the second authentication response can be expressed as: using the HMAC algorithm to calculate the input string S, where S = the operation identifier of the second authentication response||RAND1||RAND2.

[0061] Exemplarily, the second satellite base station authentication key Kauth2 can be obtained by performing message authentication code calculation on the first random number RAND1 and the second random number RAND2 according to the satellite base station authentication root key. For example, the satellite base station authentication function entity uses the satellite base station authentication root key to obtain the operation identifier of the satellite base station authentication key, and adopts the hash message authentication code algorithm to perform an OR operation on the operation identifier of the satellite base station authentication key, the first random number RAND1 and the second random number RAND2 to obtain the satellite base station authentication key. For example, a calculation method of the second satellite base station authentication key Kauth2 can be expressed as: using the HMAC algorithm to calculate the input string S, where S = Kauth operation identifier || RAND1 || RAND2.

[0062] S307: The satellite base station authenticates the ground station according to the authentication vector, and the satellite base station authentication function entity authenticates the ground station according to the authentication vector.

[0063] In this step, the satellite base station first generates a first authentication token MAC1 according to the satellite base station authentication root key, the first random number RAND1 and the second random number RAND2, and then authenticates the ground station according to the first authentication token MAC1 and the second authentication token MAC2. If the first authentication token MAC1 and the second authentication token MAC2 are the same, it indicates that the received second random number RAND2 has not been modified, that is, the ground station is authenticated successfully. The generation method of the first authentication token MAC1 is the same as the generation method of the second authentication token MAC2.

[0064] Further, the satellite base station generates a first authentication response according to the satellite base station authentication root key, the first random number RAND1 and the second random number RAND2. Exemplarily, the satellite base station may generate the first authentication response after successfully authenticating the ground station.

[0065] Exemplarily, the satellite base station may use the satellite base station authentication root key to obtain the operation identifier of the first authentication response, adopt the same hash message authentication code algorithm as the generation algorithm of the second authentication response, and perform an OR operation based on the operation identifier of the first authentication response, the first random number RAND1, and the second random number RAND2 to obtain the first authentication response.

[0066] If the satellite base station successfully authenticates the ground station, the authentication success message sent to the satellite base station authentication function entity carries the first authentication response.

[0067] After the satellite base station authentication function entity obtains the first authentication response from the received authentication success message, it authenticates the satellite base station according to the first authentication response and the second authentication response in the authentication vector. Exemplarily, if the first authentication response and the second authentication response are the same, the satellite base station is authenticated successfully.

[0068] If the authentication function entity successfully authenticates the satellite base station, the process may further include the following steps:

[0069] S308a and S308b: The satellite base station generates a first feeder link communication root key, and the satellite base station authentication function entity generates a second feeder link communication root key.

[0070] In this step, the satellite base station may generate a first feeder link communication root key according to a root key shared by the satellite base station and the satellite base station authentication function entity and identification information of the ground station. The satellite base station authentication function entity may generate a second feeder link communication root key according to a root key shared by the satellite base station and the satellite base station authentication function entity and identification information of the ground station.

[0071] S309: After generating the second feeder link communication root key, the satellite base station authentication function entity sends the second feeder link communication root key to the feeder link management function entity.

[0072] S310: After receiving the second feeder link communication root key, the feeder link management function entity stores the second feeder link communication root key and generates a second feeder link communication master key.

[0073] In this step, the feeder link management function entity generates a second feeder link communication master key used when the ground station communicates with the satellite base station according to the second feeder link communication root key and the identification information of the ground station.

[0074] Exemplarily, after receiving the second feeder link communication master key from the satellite base station authentication function entity, the feeder link management function entity stores the second feeder link communication master key, and generates a second feeder link communication master key used for communication between the ground station and the satellite base station based on the second feeder link communication root key and the identification information of the ground station.

[0075] S311: After generating the second feeder link communication master key, the feeder link management function entity sends the second feeder link communication master key to the ground station.

[0076] S312: The feeder link management function entity instructs the satellite base station to execute the access stratum (AS) and SMC process.

[0077] Exemplarily, after the satellite base station authentication function entity authenticates the satellite base station, the feeder link management function entity sends to the satellite base station indication information for executing the AS and SMC processes between the satellite base station and the ground station.

[0078] Furthermore, the feeder link management functional entity instructs the AS and SMC process on the algorithm used for secure communication between the satellite base station and the ground station.

[0079] Exemplarily, the feeder link management function entity instructs the AS and SMC process to use an algorithm for secure communication between the satellite base station and the ground station, and generates a series of keys for matching the satellite base station and the ground station for secure communication.

[0080] S313: The satellite base station may generate a first feeder link communication master key used when the satellite base station communicates with the ground station according to the first feeder link root key and the identification information of the ground station.

[0081] Exemplarily, after the satellite base station successfully authenticates the ground station, it generates a first feeder link communication root key based on the identification information of the ground station. After receiving a message from the feeder link management function entity instructing an access layer security mode command process with the ground station, it generates a first feeder link communication master key used for communication between the satellite base station and the ground station based on the first feeder link communication root key.

[0082] S314a and S314b: After the satellite base station receives a message from the feeder link management function entity instructing to perform an access layer security mode command process with the ground station, the satellite base station and the ground station switch roles.

[0083] Exemplarily, after receiving a message from the feeder link management function entity instructing to perform an access layer security mode command process with the ground station, the satellite base station switches to the base station of the ground station, and the ground station switches to the terminal of the satellite base station.

[0084] Thereafter, AS and SMC processes may be performed between the satellite base station and the ground station, wherein a series of keys for matching the satellite base station and the ground station for secure communication are generated during the process of establishing an AS secure connection.

[0085] Exemplarily, the satellite base station and the ground station may perform the AS process to derive the keys KRRCint and KRRCenc for access control security and perform the SMC process to derive the keys KUPint and KUPenc for access data security in accordance with the provisions of the 3rd Generation Partnership Project (3GPP).

[0086] When there is a security context for secure communication between the satellite base station and the ground station, the operations performed by the feeder link security include: the ground station detects the signal of the satellite base station, and the ground station has a security context for secure communication with the satellite base station, then the ground station sends an RRC reconnection request (Resume Request) to the satellite base station, which contains Resume information, such as an inactivated radio network temporary identifier I-RNTI, and then the satellite base station and the ground station start to execute the RRC Resume process and derive a new AS security context.

[0087] In the above-mentioned embodiments of the present application, the satellite base station authenticates the ground station according to the authentication information of the satellite base station authentication function entity for authenticating the ground station, and the satellite base station authentication function entity authenticates the satellite base station according to the authentication request of the feeder link management function entity, so that two-way authentication is achieved between the satellite base station and the ground station to establish a secure feeder link, improve the security of the feeder link, and ensure secure communication between the satellite base station and the ground station.

[0088] Based on the same technical concept, an embodiment of the present application also provides a communication device. Figure 4 The structural diagram of the communication device provided in the embodiment of the present application is exemplified.

[0089] As shown in the figure, the device may include: a processor 401 , a memory 402 , and a bus interface 403 .

[0090] The bus architecture may include any number of interconnected buses and bridges, specifically linking together various circuits of one or more processors represented by processor 401 and memory represented by memory 402. The bus architecture may also link together various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface. Processor 401 is responsible for managing the bus architecture and general processing, and memory 402 may store data used by processor 401 when performing operations.

[0091] The process disclosed in the embodiment of the present application can be applied to the processor 401, or implemented by the processor 401. In the implementation process, each step of the signal processing process can be completed by the hardware integrated logic circuit or software instructions in the processor 401. The processor 401 can be a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, and can implement or execute the methods, steps and logic block diagrams disclosed in the embodiment of the present application. The general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the embodiment of the present application can be directly embodied as a hardware processor to be executed, or the hardware and software modules in the processor are combined and executed. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 402, and the processor 401 reads the information in the memory 402 and completes the steps of the information processing process in combination with its hardware.

[0092] Specifically, the processor 401 is used to read the computer instructions in the memory 402 and execute the authentication method in the embodiment of the present application.

[0093] It should be noted here that the above-mentioned communication device provided in the embodiment of the present application can implement all the method steps performed by the satellite base station or ground station or the first network element or the second network element in the above-mentioned method embodiment, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be described in detail here.

[0094] It should be noted that the processor involved in the above-mentioned embodiments of the present application can be a central processing unit (CPU), a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It can implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the content of this application. The processor can also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and the like. Among them, the memory can be integrated in the processor or can be set separately from the processor.

[0095] Based on the same technical concept, the embodiment of the present application also provides a computer-readable storage medium. The computer-readable storage medium stores computer-executable instructions, which are used to enable a computer to execute Figure 3 The process being executed.

[0096] Based on the same technical concept, the embodiment of the present application also provides a computer program product, which, when called by a computer, enables the computer to execute Figure 3 The process being executed.

[0097] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0098] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0099] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0100] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0101] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A satellite communication system, characterized in that: include: Satellite base station, ground station, feeder link management functional entity and satellite base station authentication functional entity; The satellite base station is used to send a registration request to the feeder link management function entity, where the registration request includes identification information of the satellite base station and identification information of the ground station; and, after successful authentication with the satellite base station authentication function entity, generating a first feeder link communication root key according to the identification information of the ground station and the information shared with the satellite base station authentication function entity, and after receiving a message from the feeder link management function entity for instructing to perform an access layer security mode command process with the ground station, generating a first feeder link communication master key according to the first feeder link communication root key and the ground station identification information; The feeder link management function entity is used to receive the registration request from the satellite base station, and send an authentication request to the satellite base station authentication function entity, wherein the authentication request includes identification information of the satellite base station and identification information of the ground station; and, after receiving the second feeder link communication root key from the satellite base station authentication function entity, generating a second feeder link communication master key according to the second feeder link communication root key and the identification information of the ground station, sending the second feeder link communication master key to the ground station, and sending a message to the satellite base station for instructing to perform an access layer security mode command process with the ground station; The satellite base station authentication function entity is used to perform two-way authentication with the satellite base station after receiving the authentication request, and after the authentication is passed, generate the second feeder link communication root key according to the identification information of the ground station and the information shared with the satellite base station, and send the second feeder link communication root key to the feeder link management function entity.

2. The system according to claim 1, characterized in that: The satellite base station is also used for: After establishing a radio resource control RRC connection with the ground station, switching to a terminal of the ground station; After receiving a message from the feeder link management function entity for instructing to perform an access layer security mode command process with the ground station, switching to a base station of the ground station; The ground station is also used for: After establishing an RRC connection with the satellite base station, switching to a base station of the satellite base station; After receiving the second feeder link communication master key from the feeder link management function entity, it switches to the terminal of the satellite base station.

3. The system according to claim 2, characterized in that The ground station is also used to: After establishing an RRC connection with the satellite base station, sending indication information and identification information of the ground station to the satellite base station, wherein the indication information is used to indicate that the RRC connection is a feeder link connection; The satellite base station is also used for: After receiving the indication information and the identification information of the ground station, switch to the terminal of the ground station.

4. An authentication method, characterized in that: include: The satellite base station sends a registration request to a feeder link management function entity via a ground station, so that the feeder link management function entity sends an authentication request to a satellite base station authentication function entity, wherein the registration request and the authentication request include identification information of the satellite base station and identification information of the ground station; After the satellite base station and the satellite base station authentication function entity are successfully authenticated, a first feeder link communication root key is generated according to the root key shared by the satellite base station and the satellite base station authentication function entity and the ground identification information; After the satellite base station receives a message from the feeder link management function entity instructing an access layer security mode command process with the ground station, it generates a first feeder link communication master key used by the satellite base station to communicate with the ground station based on the first feeder link communication root key and the identification information of the ground station, and establishes an access layer security connection with the ground station.

5. An authentication method, characterized in that: include: The feeder link management function entity receives a registration request from a satellite base station via a ground station, and sends an authentication request to a satellite base station authentication function entity, so that the satellite base station authentication function entity performs two-way authentication with the satellite base station, wherein the registration request and the authentication request include identification information of the satellite base station and identification information of the ground station; After receiving the second feeder link communication root key from the satellite base station authentication function entity, the feeder link management function entity generates a second feeder link communication master key used when the ground station communicates with the satellite base station according to the second feeder link communication root key and the identification information of the ground station, sends the second feeder link communication master key to the ground station, and sends a message to the satellite base station for instructing the access layer security mode command process with the ground station, so that the satellite base station generates the first feeder link communication master key used when the satellite base station communicates with the ground station according to the first feeder link communication root key and the identification information of the ground station, and establishes an access layer security connection with the ground station.

6. A satellite communication device, characterized in that: The method comprises a memory and a processor; the memory stores computer instructions; and the processor is used to read the computer instructions and execute the method as claimed in any one of claims 4 and 5.

7. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions for causing the computer to execute the method according to any one of claims 4 and 5.

8. A computer program product, characterized in that When the computer program product is called by a computer, the computer is caused to execute the method according to any one of claims 4 and 5 .

Images