Satellite communication system, authentication method and device

Abstract

The present application discloses a satellite communication system, an authentication method and an apparatus, and relates to the field of satellite communication. In the present application, a satellite base station authenticates a ground station or a ground access device according to a first authentication token and a second authentication token, and the ground station or the ground access device authenticates the satellite base station according to a first authentication response and a second authentication response, so that two-way authentication can be achieved between the satellite base station and the ground station or the ground access device, thereby establishing a secure feeder link, improving the security of the feeder link, and ensuring secure communication between the satellite base station and the ground station.

Description

Technical Field

[0001] The present application relates to the field of satellite communications, and in particular to satellite communication systems, authentication methods and devices. Background Art

[0002] The satellite communication system consists of three parts: satellite end (such as satellite base station), ground end (such as ground station), and user end (such as user terminal). The satellite end acts as a relay station in the air, that is, it amplifies the electromagnetic waves sent by the ground station and then sends them back to another ground station. The ground station is the interface between the satellite system and the ground public network. The user terminal can access the satellite system through the ground station to form a link.

[0003] With the development of satellite communication network technology, satellite communication network security certification has received increasing attention. How to improve the security of satellite communications is a technical problem that needs to be solved at present. Summary of the invention

[0004] In an exemplary embodiment of the present application, a satellite communication system, an authentication method and an apparatus are provided to implement two-way authentication between a satellite base station and a ground station or a ground access device.

[0005] In a first aspect, a satellite communication system is provided, the system comprising: a satellite base station, a ground station, an authentication function entity and a key management function entity; the key management function entity is used to receive a first random number from the satellite base station, generate a second random number according to a satellite base station authentication root key, obtain an authentication vector according to the satellite base station authentication root key, the first random number and the second random number, and send the authentication vector to the authentication function entity, the authentication vector comprising the second random number, a second authentication token, a second authentication response and a second satellite base station authentication key; the authentication function entity is used to send the second random number and the second authentication token from the key management function entity to the satellite base station; and upon receiving the first random number from the satellite base station, After receiving an authentication response, the satellite base station is authenticated according to the first authentication response and the second authentication response; the satellite base station is used to generate the first random number, which is sent to the key management function entity via the ground station and the authentication function entity in sequence; and, after receiving the second random number and the second authentication token from the authentication function entity, a first authentication token is generated according to the satellite base station authentication root key, the first random number and the second random number, and after the ground station is authenticated according to the first authentication token and the second authentication token, the first authentication response is generated according to the satellite base station authentication root key, the first random number and the second random number, and the first authentication response is sent to the authentication function entity.

[0006] Optionally, the satellite base station is also used to send a first registration request to the ground station, the first registration request including the identification information of the satellite base station and the first random number; the ground station is also used to send a second registration request to the authentication function entity, the second registration request including the identification information of the satellite base station, the first random number and the identification information of the ground station; the authentication function entity is also used to send an authentication vector request to the key management function entity, the authentication vector request including the identification information of the satellite base station and the first random number.

[0007] Optionally, the authentication function entity is further used to: if the satellite base station is authenticated according to the first authentication response and the second authentication response, derive a second communication master key according to the second satellite base station authentication key and the identification information of the ground station, and send an authentication success message to the ground station, wherein the authentication success message includes the second communication master key, and the second communication master key is used for communication between the ground station and the satellite base station; the satellite base station is also used to: generate a first satellite base station authentication key according to the satellite base station authentication root key, the first random number and the second random number; derive a first communication master key according to the first satellite base station authentication key and the identification information of the ground station, and the first communication master key is used for communication between the ground station and the satellite base station.

[0008] In a second aspect, an authentication method is provided, the method comprising: a satellite base station generates a first random number, includes the first random number in a first registration request and sends it to a key management function entity, so that the key management function entity generates a second random number according to a satellite base station authentication root key, obtains an authentication vector according to the satellite base station authentication root key, the first random number and the second random number, and sends the authentication vector to an authentication function entity, the authentication vector comprising the second random number, a second authentication token, a second authentication response and a second satellite base station authentication key; the satellite base station receives the second random number and the second authentication token from the authentication function entity, generates a first authentication token according to the satellite base station authentication root key, the first random number and the second random number, and authenticates the ground station according to the second authentication token and the first authentication token; after the satellite base station authenticates the ground station successfully according to the first authentication token and the second authentication token, the satellite base station generates a first authentication response according to the satellite base station authentication root key, the first random number and the second random number, and sends the first authentication response to the authentication function entity, so that the authentication function entity authenticates the satellite base station according to the first authentication response and the second authentication response.

[0009] According to a third aspect, an authentication method is provided, the method comprising: an authentication function entity sends an authentication vector request to a key management function entity according to a second registration request from a ground station, the second registration request and the authentication vector request include a first random number generated by a satellite base station, so that the key management function entity generates a second random number according to a satellite base station authentication root key, obtains an authentication vector according to the satellite base station authentication root key, the first random number and the second random number, and sends the authentication vector to the authentication function entity, the authentication vector includes the second random number, a second authentication token, a second authentication response and a second satellite base station authentication key; the authentication function entity sends the second random number and the second authentication token from the key management function entity to the satellite base station, so that the satellite base station generates a first authentication token according to the satellite base station authentication root key, the first random number and the second random number, authenticates the ground station according to the second authentication token and the first authentication token, and generates a first authentication response according to the satellite base station authentication root key, the first random number and the second random number after the authentication is passed, and sends the first authentication response to the authentication function entity; the authentication function entity authenticates the satellite base station according to the first authentication response from the satellite base station and the second authentication response from the key management function entity.

[0010] In a fourth aspect, an authentication method is provided, the method comprising: a key management function entity receives an authentication vector request from an authentication management function, the authentication vector request comprising a first random number generated by a satellite base station; the key management function entity generates a second random number based on a satellite base station authentication root key, and obtains an authentication vector based on the satellite base station authentication root key, the first random number and the second random number, the authentication vector comprising the second random number, a second authentication token, a second authentication response and a second satellite base station authentication key; the key management function entity sends the authentication vector to the authentication function entity, so that the authentication function entity sends the second random number and the second authentication token to the satellite base station, wherein the first random number and the second random number are used by the satellite base station to generate a first authentication token for authenticating a ground station, and a first authentication response for the authentication management function to authenticate the satellite base station.

[0011] In a fifth aspect, a satellite communication system is provided, the system comprising: a satellite base station, a ground station and an authentication management function entity; the authentication management function entity is used to receive a first random number from the satellite base station, generate a second random number according to a satellite base station authentication root key, obtain an authentication vector according to the satellite base station authentication root key, the first random number and the second random number, the authentication vector comprising the second random number, a second authentication token, a second authentication response and a second satellite base station authentication key, and send the second random number and the second authentication token to the satellite base station; and after receiving a first authentication response from the satellite base station, authenticate the satellite base station according to the first authentication response and the second authentication response; the satellite base station is used to generate the first random number, which is sent to the authentication management function entity via the ground station; and after receiving the second random number and the second authentication token from the authentication management function entity, generate a first authentication token according to the satellite base station authentication root key, the first random number and the second random number, and after the ground station is authenticated according to the first authentication token and the second authentication token, generate the first authentication response according to the satellite base station authentication root key, the first random number and the second random number and send the first authentication response to the authentication management function entity.

[0012] Optionally, the satellite base station is also used to send a first registration request to the ground station, the first registration request including identification information of the satellite base station and the first random number; the ground station is also used to send a second registration request to the authentication management function entity, the second registration request including identification information of the satellite base station, the first random number and identification information of the ground station.

[0013] Optionally, the authentication management function entity is further used to: if the satellite base station is authenticated according to the first authentication response and the second authentication response, derive a second communication master key according to the second satellite base station authentication key and the identification information of the ground station, and send an authentication success message to the ground station, wherein the authentication success message includes the second communication master key, and the second communication master key is used for communication between the ground station and the satellite base station; the satellite base station is also used to: generate a first satellite base station authentication key according to the satellite base station authentication root key, the first random number and the second random number; derive a first communication master key according to the first satellite base station authentication key and the identification information of the ground station, and the first communication master key is used for communication between the ground station and the satellite base station.

[0014] In a sixth aspect, an authentication method is provided, the method comprising: a satellite base station generates a first random number, includes the first random number in a first registration request and sends it to an authentication management function entity, so that the authentication management function entity generates a second random number according to the satellite base station authentication root key, obtains an authentication vector according to the satellite base station authentication root key, the first random number and the second random number, and the authentication vector comprises the second random number, a second authentication token, a second authentication response and a second satellite base station authentication key; the satellite base station receives the second random number and the second authentication token from the authentication management function entity, generates a first authentication token according to the satellite base station authentication root key, the first random number and the second random number, and authenticates the ground station according to the first authentication token and the second authentication token; after the satellite base station authenticates the ground station successfully according to the first authentication token and the second authentication token, the satellite base station generates a first authentication response according to the satellite base station authentication root key, the first random number and the second random number, and sends the first authentication response to the authentication management function entity, so that the authentication management function entity authenticates the satellite base station according to the first authentication response and the second authentication response.

[0015] In a seventh aspect, an authentication method is provided, the method comprising: an authentication management function entity receives a second registration request from a ground station, the second authentication request comprising a first random number generated by a satellite base station; the authentication management function entity generates a second random number according to a satellite base station authentication root key, obtains an authentication vector according to the satellite base station authentication root key, the first random number and the second random number, the authentication vector comprising the second random number, a second authentication token, a second authentication response and a second satellite base station authentication key, and sends the second random number and the second authentication token to the satellite base station; the authentication management function entity receives the first authentication response from the satellite base station, and authenticates the satellite base station according to the first authentication response and the second authentication response; wherein the first authentication response is generated by the satellite base station according to the satellite base station authentication root key, the first random number and the second random number after the ground station is authenticated by the satellite base station according to the first authentication token and the second authentication token, and the first authentication token is generated by the satellite base station according to the satellite base station authentication root key, the first random number and the second random number.

[0016] In an eighth aspect, a satellite communication system is provided, the system comprising: a satellite base station, a ground access device and a key management function entity; the key management function entity is used to receive a first random number from the satellite base station, generate a second random number according to a satellite base station authentication root key, obtain an authentication vector according to the satellite base station authentication root key, the first random number and the second random number, and send the authentication vector to the ground access device, the authentication vector comprising the second random number, a second authentication token, a second authentication response and a second satellite base station authentication key; the ground access device is used to send the second random number and the second authentication token from the key management function entity to the satellite base station; and, upon receiving the authentication vector from the satellite base station After receiving the first authentication response, authenticating the satellite base station according to the first authentication response and the second authentication response; the satellite base station is used to generate the first random number, and the first random number is sent to the key management function entity via the ground access device; and after receiving the second random number and the second authentication token from the authentication management function entity, generating a first authentication token according to the satellite base station authentication root key, the first random number and the second random number, and after the ground access device station is passed according to the first authentication token and the second authentication token, generating the first authentication response according to the satellite base station authentication root key, the first random number and the second random number, and sending the first authentication response to the ground access device.

[0017] Optionally, the satellite base station is also used to send a registration request to the ground access device, the registration request including the identification information of the satellite base station, the first random number and the identification information of the ground access device; the ground access device is also used to send an authentication vector request to the key management function entity, the authentication vector request including the identification information of the satellite base station and the first random number.

[0018] Optionally, the ground access device is also used to: if the satellite base station is authenticated according to the first authentication response and the second authentication response, derive a second communication master key according to the second satellite base station authentication key and the identification information of the ground access device, and the second communication master key is used for communication between the ground access device and the satellite base station; the satellite base station is also used to: generate a first satellite base station authentication key according to the satellite base station authentication root key, the first random number and the second random number; derive a first communication master key according to the first satellite base station authentication key and the identification information of the ground access device, and the first communication master key is used for communication between the ground access device and the satellite base station.

[0019] In a ninth aspect, an authentication method is provided, the method comprising: a satellite base station generates a first random number, includes the first random number in a registration request and sends it to a key management function entity, so that the key management function entity generates a second random number according to the satellite base station authentication root key, obtains an authentication vector according to the satellite base station authentication root key, the first random number and the second random number, and sends the authentication vector to a ground access device, the authentication vector comprising the second random number, a second authentication token, a second authentication response and a second satellite base station authentication key; the satellite base station receives the second random number and the second authentication token from the ground access device, generates a first authentication token according to the satellite base station authentication root key, the first random number and the second random number, and authenticates the ground access device according to the second authentication token and the first authentication token; after the satellite base station authenticates the ground access device successfully according to the first authentication token and the second authentication token, it generates a first authentication response according to the satellite base station authentication root key, the first random number and the second random number, and sends the first authentication response to the ground access device, so that the ground access device authenticates the satellite base station according to the first authentication response and the second authentication response.

[0020] In a tenth aspect, an authentication method is provided, the method comprising: a ground access device sends an authentication vector request to a key management function entity according to a registration request from a satellite base station, the registration request and the vector authentication request include a first random number generated by the satellite base station, so that the key management function entity generates a second random number according to a satellite base station authentication root key, and obtains an authentication vector according to the satellite base station authentication root key, the first random number and the second random number, the authentication vector including the second random number, a second authentication token, a second authentication response and a second satellite base station authentication key; the ground access device sends the second random number and the second authentication token from the key management function entity, and sends the second random number and the second authentication token to the satellite base station; the ground access device authenticates the satellite base station according to the first authentication response from the satellite base station and the second authentication response from the key management function entity; wherein the first authentication response is generated by the satellite base station according to the satellite base station authentication root key, the first random number and the second random number after the satellite base station authenticates the ground access device according to the first authentication token and the second authentication token, and the first authentication token is generated by the satellite base station according to the satellite base station authentication root key, the first random number and the second random number.

[0021] In an eleventh aspect, an authentication method is provided, the method comprising: a key management function entity receives an authentication vector request from a ground access device, the authentication vector request comprising a first random number generated by a satellite base station; the key management function entity generates a second random number based on a satellite base station authentication root key, obtains an authentication vector based on the satellite base station authentication root key, the first random number and the second random number, and sends the authentication vector to the ground access device, the authentication vector comprising the second random number, a second authentication token, a second authentication response and a second satellite base station authentication key; the key management function entity sends the authentication vector to the ground access device, so that the ground access device sends the second random number and the second authentication token to the satellite base station, wherein the first random number and the second random number are used by the satellite base station to generate a first authentication token for authenticating the ground access device, and a first authentication response for the authentication management function to authenticate the satellite base station.

[0022] In the twelfth aspect, a communication device is provided, comprising a memory and a processor; the memory stores computer instructions; the processor is used to read the computer instructions and execute any method as described in aspects 2 to 4, aspects 6 to 7, and aspects 9 to 11.

[0023] In the thirteenth aspect, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable the computer to execute any method as described in aspects 2 to 4, aspects 6 to 7, and aspects 9 to 11.

[0024] In a fourteenth aspect, a computer program product is provided, which, when called by a computer, enables the computer to execute a method as described in any one of aspects 2 to 4, aspects 6 to 7, and aspects 9 to 11.

[0025] In the above-mentioned embodiments of the present application, the satellite base station authenticates the ground station or the ground access device according to the first authentication token and the second authentication token, and the ground station or the ground access device authenticates the satellite base station according to the first authentication response and the second authentication response, thereby achieving two-way authentication between the satellite base station and the ground station or the ground access device, thereby establishing a secure feeder link, improving the security of the feeder link, and ensuring secure communication between the satellite base station and the ground station. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0027] Figure 1 The physical block diagram of the satellite communication system according to the embodiment of the present application is exemplarily shown;

[0028] Figure 2 A satellite communication system provided by an embodiment of the present application is exemplarily shown;

[0029] Figure 3 An example is shown based on Figure 2 Schematic diagram of the authentication process provided by the embodiment;

[0030] Figure 4 Another satellite communication system provided by an embodiment of the present application is exemplarily shown;

[0031] Figure 5 An example is shown based on Figure 4 Schematic diagram of the authentication process provided by the embodiment;

[0032] Figure 6 Another satellite communication system provided by an embodiment of the present application is exemplarily shown;

[0033] Figure 7 An example is shown based on Figure 6 Schematic diagram of the authentication process provided by the embodiment;

[0034] Figure 8 The structural diagram of the communication device provided in the embodiment of the present application is exemplified. DETAILED DESCRIPTION

[0035] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0036] The technical solutions in the embodiments of the present application will be described clearly and in detail below in conjunction with the accompanying drawings. In the description of the embodiments of the present application, unless otherwise specified, " / " means or, for example, A / B can mean A or B; "and / or" in the text is only a description of the association relationship of associated objects, indicating that there can be three relationships, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, "multiple" means two or more than two.

[0037] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as suggesting or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features, and in the description of the embodiments of the present application, unless otherwise specified, "plurality" means two or more.

[0038] The parameters involved in the embodiments of the present application may include:

[0039] (1) A first random number, generated by the satellite base station. For convenience, the first random number is also referred to as RAND1 in this document.

[0040] (2) a first authentication token, generated by the satellite base station. For convenience, the first authentication token is also referred to as message authentication code 1, MAC1 in this document;

[0041] (3) a first authentication response, generated by the satellite base station;

[0042] (4) a first satellite base station authentication key, which is generated by the satellite base station. For convenience, the first satellite base station authentication key is also referred to as Kauth1 in this document;

[0043] (5) a first communication master key, generated by the satellite base station. For convenience, the first communication master key is also referred to as KS-gNB1 in this document;

[0044] (6) a second random number, generated by the key management function entity. For convenience, the second random number is also referred to as RAND2 in this document.

[0045] (7) a second authentication token, generated by the key management function entity. For convenience, the second authentication token is also referred to as message authentication code 2, or MAC2, in this document;

[0046] (8) a second authentication response, generated by the key management function entity;

[0047] (9) a second satellite base station authentication key, generated by the key management function entity. For convenience, the second satellite base station authentication key is also referred to as Kauth2 in this document;

[0048] (10) The second communication master key is generated by the authentication management function entity. For convenience, the second communication master key is also referred to as KS-gNB2 in this document.

[0049] It should be noted that the above parameter naming method is only an example, and the embodiment of the present application does not limit the naming method of the above parameters.

[0050] Figure 1 The physical block diagram of the satellite communication system of the embodiment of the present application is shown as an example. Figure 1 As shown, the satellite communication system includes: a satellite terminal 101, a satellite base station (102a, 102b), a ground station 103 and a core network 104. Before the satellite terminal 101 communicates with the satellite base station (102a, 102b) through a service link, it is necessary for the satellite base station (102a, 102b) and the ground station 103 to perform two-way authentication and establish a secure feeder link through the core network 104, wherein the satellite base station 102a and the satellite base station 102b exchange information through an inter-satellite link. In the above system architecture, the ground station may include a gateway station, a gateway station, etc.

[0051] Figure 1 Only two satellite base stations are used as an example for description, and the embodiment of the present application does not limit the number of satellite base stations and the above-mentioned other devices.

[0052] Satellite base stations (102a, 102b) are satellites with satellite communication base station capabilities. Ground stations 103 are used to connect satellite base stations to the core network 104 of satellite communication to realize satellite feeder links and their security. Among them, the ground station can forward and receive information during the information exchange process of satellite communication; the core network 104 is mainly used for call connection, billing, mobility management, supplementary service implementation, intelligent triggering, etc.

[0053] Currently, there is no standard solution for establishing a secure association between a satellite base station and a ground station. To this end, the embodiments of the present application provide a satellite communication system, an authentication method and a device. Through the embodiments of the present application, a secure feeder link can be established between the satellite base station and the ground station, thereby improving the security of the feeder link and ensuring secure communication between the satellite base station and the ground station.

[0054] Figure 2A satellite communication system provided by an embodiment of the present application is exemplarily shown, which shows a feeder link security architecture of the satellite communication system. As shown in the figure, the satellite communication system includes: a satellite base station (201a, 201b), a ground station (202a, 202b), an authentication function entity 203 and a key management function entity 204. Among them, the authentication function entity 203 and the key management function entity 204 can be located in the core network.

[0055] It is understandable that the authentication function entity may also be called authentication function or authentication function network element or other names, and the key management function entity may also be called key management function or key management function network element or other names. The embodiments of the present application do not limit this.

[0056] It should be noted that the embodiment of the present application does not limit the number of satellite base stations and ground stations in the above architecture.

[0057] Based on the above architecture, mutual authentication between the satellite base station and the ground station can be achieved.

[0058] The following first briefly describes the functions of each component in the above satellite system.

[0059] The key management function entity is used to receive a first random number RAND1 from a satellite base station, generate a second random number RAND2 according to a satellite base station authentication root key, obtain an authentication vector according to the satellite base station authentication root key, the first random number RAND1 and the second random number RAND2, and send the authentication vector to the authentication function entity. The authentication vector includes the second random number RAND2, a second authentication token MAC2, a second authentication response and a second satellite base station authentication key Kauth2.

[0060] The authentication function entity is used to send the second random number RAND2 and the second authentication token MAC2 from the key management function entity to the satellite base station; and after receiving the first authentication response from the satellite base station, authenticate the satellite base station according to the first authentication response and the second authentication response.

[0061] A satellite base station is used to generate a first random number RAND1, which is sent to a key management function entity via a ground station and an authentication function entity in sequence; and, after receiving a second random number RAND2 and a second authentication token MAC2 from the authentication function entity, a first authentication token MAC1 is generated according to a satellite base station authentication root key, the first random number RAND1 and the second random number RAND2, and after authenticating the ground station according to the first authentication token MAC1 and the second authentication token MAC2, a first authentication response is generated according to the satellite base station authentication root key, the first random number RAND1 and the second random number RAND2, and the first authentication response is sent to the authentication function entity.

[0062] Based on Figure 2 Satellite communication systems, Figure 3 The following is an exemplary diagram of the authentication process provided in an embodiment of the present application, through which two-way authentication between a satellite base station and a ground station can be achieved.

[0063] In S301, before the ground station and the satellite base station perform two-way authentication and establish a secure connection, the satellite base station, the ground station, the authentication function entity and the key management function entity respectively configure information related to satellite base station authentication. For example, the satellite base station is configured with a satellite base station authentication root key and information about a legitimate ground station, such as identification information of a legitimate ground station; the ground station is configured with information about a legitimate satellite base station, such as identification information of a legitimate satellite base station; the authentication function entity is configured with information about a legitimate ground station and satellite base station; and the key management function entity is configured with information about a legitimate satellite base station and a satellite base station authentication root key.

[0064] In S302, after the ground station detects the satellite base station, a Radio Resource Control (RRC) connection is established between the ground station and the satellite base station. When the ground station and the satellite base station establish an RRC connection, the ground station can obtain identification information of the satellite base station.

[0065] like Figure 3 As shown, the authentication process may include the following steps:

[0066] S303: The satellite base station sends a first registration request to the ground station.

[0067] Exemplarily, in order to perform two-way authentication and establish a secure connection with the ground station, the satellite base station generates a first random number RAND1 for this authentication. The satellite base station sends a first registration request to the ground station, and the first registration request includes the first random number RAND1 generated by the satellite base station and identification information of the satellite base station.

[0068] S304: After receiving the first registration request, the ground station sends a second registration request to the authentication function entity.

[0069] Exemplarily, the second registration request sent by the ground station to the authentication function entity includes the identification information of the satellite base station, the first random number RAND1 generated by the satellite base station, and the identification information of the ground station.

[0070] S305: After receiving the second registration request, the authentication function entity sends an authentication vector request to the key management function entity.

[0071] Exemplarily, the authentication vector request sent by the authentication function entity to the key management function entity includes identification information of the satellite base station and the first random number RAND1.

[0072] S306: After receiving the authentication vector request, the key management function entity obtains the authentication vector.

[0073] Exemplarily, the key management function entity obtains the identification information of the satellite base station from the received authentication vector request, obtains the corresponding satellite base station authentication root key according to the identification information of the satellite base station, and generates the second random number RAND2 for this authentication according to the satellite base station authentication root key. Then, the authentication vector is obtained according to the satellite base station authentication root key, the first random number RAND1 and the second random number RAND2. The authentication vector may include the second random number RAND2, the second authentication token MAC2, the second authentication response and the second satellite base station authentication key Kauth2.

[0074] The second authentication token MAC2 is a message authentication code (MAC) used to protect the first random number RAND1 and the second random number RAND2 from being tampered with during transmission. Exemplarily, the second authentication token MAC2 can be obtained by performing message authentication code calculation on the first random number RAND1 and the second random number RAND2 according to the satellite base station authentication root key. For example, the key management function entity uses a hash message authentication code algorithm to perform an OR operation on the first random number RAND1 and the second random number RAND2 according to the satellite base station authentication root key, thereby obtaining the second authentication token MAC2. For example, a calculation method of the second authentication token MAC2 can be expressed as: using the HMAC algorithm to calculate the input string S, where S = RAND1||RAND2, where "||" is an OR logical operator, and two operands are required when || is operated, for example, the first operand first random number RAND1 and the second operand second random number RAND2.

[0075] Exemplarily, the second authentication response can be obtained by performing message authentication code calculation on the first random number RAND1 and the second random number RAND2 according to the satellite base station authentication root key. For example, the key management function entity uses the satellite base station authentication root key to obtain the operation identifier of the second authentication response, and adopts the hash message authentication code algorithm to perform an OR operation on the operation identifier of the second authentication response, the first random number RAND1 and the second random number RAND2 to obtain the second authentication response. For example, a calculation method of the second authentication response can be expressed as: using the HMAC algorithm to calculate the input string S, where S = the operation identifier of the second authentication response||RAND1||RAND2.

[0076] Exemplarily, the second satellite base station authentication key Kauth2 can be obtained by performing message authentication code calculation on the first random number RAND1 and the second random number RAND2 according to the satellite base station authentication root key. For example, the key management function entity uses the satellite base station authentication root key to obtain the operation identifier of the satellite base station authentication key, and adopts the hash message authentication code algorithm to perform an OR operation on the operation identifier of the satellite base station authentication key, the first random number RAND1 and the second random number RAND2 to obtain the satellite base station authentication key. For example, a calculation method of the second satellite base station authentication key Kauth2 can be expressed as: using the HMAC algorithm to calculate the input string S, where S = Kauth operation identifier || RAND1 || RAND2.

[0077] S307: The key management function entity sends the authentication vector to the authentication function entity.

[0078] S308: After receiving the authentication vector, the authentication function entity sends an authentication request to the satellite base station through the ground station.

[0079] The authentication request sent by the authentication function entity to the satellite base station includes the second random number RAND2 in the authentication vector and the second authentication token MAC2.

[0080] S309: After receiving the authentication request, the satellite base station authenticates the ground station and sends an authentication response to the ground station to the authentication function entity according to the authentication result.

[0081] In this step, the satellite base station first generates a first authentication token MAC1 according to the satellite base station authentication root key, the first random number RAND1 and the second random number RAND2, and then authenticates the ground station according to the first authentication token MAC1 and the second authentication token MAC2. If the first authentication token MAC1 and the second authentication token MAC2 are the same, it indicates that the received second random number RAND2 has not been modified, that is, the ground station is authenticated successfully. The generation method of the first authentication token MAC1 is the same as the generation method of the second authentication token MAC2.

[0082] Further, the satellite base station generates a first authentication response according to the satellite base station authentication root key, the first random number RAND1 and the second random number RAND2. Exemplarily, the satellite base station may generate the first authentication response after successfully authenticating the ground station.

[0083] Exemplarily, the satellite base station may use the satellite base station authentication root key to obtain the operation identifier of the first authentication response, adopt the same hash message authentication code algorithm as the generation algorithm of the second authentication response, and perform an OR operation based on the operation identifier of the first authentication response, the first random number RAND1, and the second random number RAND2 to obtain the first authentication response.

[0084] If the satellite base station successfully authenticates the ground station, the authentication response sent to the authentication function entity carries the first authentication response.

[0085] S310: After receiving the authentication response, the authentication function entity authenticates the satellite base station.

[0086] In this step, after the authentication function entity obtains the first authentication response from the received authentication response, it authenticates the satellite base station according to the first authentication response and the second authentication response received from the key management function entity. Exemplarily, if the first authentication response and the second authentication response are the same, the satellite base station is authenticated successfully.

[0087] If the authentication function entity successfully authenticates the satellite base station, the process may further include the following steps:

[0088] S311: The authentication function entity derives the second communication master key KS-gNB2 between the satellite base station and the ground station.

[0089] In this step, the authentication function entity may derive the second communication master key KS-gNB2 according to the second satellite base station authentication key Kauth2 and the identification information of the ground station. The second communication master key KS-gNB2 is used for communication between the ground station and the satellite base station.

[0090] S312: The authentication function entity sends an authentication response to the ground station.

[0091] Taking the successful authentication of a satellite base station by an authentication function entity as an example, the authentication success message includes the second communication master key KS-gNB2 derived by the authentication function entity.

[0092] S313: After receiving the authentication response indicating successful authentication, the ground station sends a registration response to the satellite base station, where the registration response is used to indicate successful registration.

[0093] S314: After receiving the registration response (indicating successful registration), the satellite base station exports the first communication master key KS-gNB1 between the satellite base station and the ground station.

[0094] In this step, the satellite base station can generate a first satellite base station authentication key Kauth1 according to the satellite base station authentication root key, the first random number RAND1 and the second random number RAND2, and derive a first communication master key KS-gNB1 according to the first satellite base station authentication key Kauth1 and the identification information of the ground station. The first communication master key KS-gNB1 is used for communication between the ground station and the satellite base station. The generation method of the first satellite base station authentication key Kauth1 is the same as the generation method of the second satellite base station authentication key Kauth2, and the derivation method of the first satellite base station authentication key Kauth1 is the same as the derivation method of the second satellite base station authentication key Kauth2.

[0095] After that, the Access Stratum (AS) and Security Mode Command (SMC) processes can be executed between the satellite base station and the ground station.

[0096] Exemplarily, the satellite base station and the ground station may perform the AS process to derive the keys KRRCint and KRRCenc for access control security and perform the SMC process to derive the keys KUPint and KUPenc for access data security in accordance with the provisions of the 3rd Generation Partnership Project (3GPP).

[0097] In the above-mentioned embodiments of the present application, the satellite communication system of the embodiment includes a satellite base station, a ground station, an authentication function entity and a key management function entity, wherein the satellite base station authenticates the ground station according to a first authentication token MAC1 generated by the satellite base station and a second authentication token MAC2 generated by the key management function entity, and the ground station authenticates the satellite base station according to a first authentication response generated by the satellite base station and a second authentication response generated by the key management function entity, which can enable two-way authentication between the satellite base station and the ground station, thereby establishing a secure feeder link, improving the security of the feeder link, and ensuring secure communication between the satellite base station and the ground station.

[0098] Figure 4 Another satellite communication system provided by an embodiment of the present application is exemplarily shown, which shows a feeder link security architecture of the satellite communication system. As shown in the figure, the satellite communication system includes: a satellite base station (401a, 401b), a ground station (402a, 402b), and an authentication management function entity 403. Among them, the authentication management function entity 403 can be located in the core network.

[0099] It is understandable that the authentication management function entity may also be called an authentication management function or an authentication management function network element or other names, and the embodiments of the present application do not limit this.

[0100] It should be noted that the embodiment of the present application does not limit the number of satellite base stations and ground stations in the above architecture.

[0101] Based on the above architecture, mutual authentication between the satellite base station and the ground station can be achieved.

[0102] The following first briefly describes the functions of each component in the above satellite system.

[0103] The authentication management function entity is used to receive a first random number RAND1 from a satellite base station, generate a second random number RAND2 according to a satellite base station authentication root key, and obtain an authentication vector according to the satellite base station authentication root key, the first random number RAND1, and the second random number RAND2. The authentication vector includes a second random number RAND2, a second authentication token MAC2, a second authentication response, and a second satellite base station authentication key Kauth2. The authentication management function entity is used to send the second random number RAND2 and the second authentication token MAC2 in the authentication vector to the satellite base station; and after receiving a first authentication response from the satellite base station, authenticate the satellite base station according to the first authentication response and the second authentication response.

[0104] A satellite base station is used to generate a first random number RAND1, which is sent to an authentication management function entity via a ground station; and, after receiving a second random number RAND2 and a second authentication token MAC2 from the authentication management function entity, a first authentication token MAC1 is generated according to a satellite base station authentication root key, the first random number RAND1 and the second random number RAND2, and after authenticating the ground station according to the first authentication token MAC1 and the second authentication token MAC2, a first authentication response is generated according to the satellite base station authentication root key, the first random number RAND1 and the second random number RAND2, and the first authentication response is sent to the authentication management function entity.

[0105] Based on Figure 4 Satellite communication systems, Figure 5 The following is an exemplary diagram of the authentication process provided in an embodiment of the present application, through which two-way authentication between a satellite base station and a ground station can be achieved.

[0106] In S501, before the ground station and the satellite base station perform two-way authentication and establish a secure connection, the satellite base station, the ground station, and the authentication management function entity respectively configure information related to satellite base station authentication. For example, the satellite base station is configured with a satellite base station authentication root key and information about a legitimate ground station, such as identification information of a legitimate ground station; the ground station is configured with information about a legitimate satellite base station, such as identification information of a legitimate satellite base station; and the authentication management function entity is configured with information about a legitimate ground station, satellite base station, and a satellite base station authentication root key.

[0107] In S502, after the ground station detects the satellite base station, an RRC connection is established between the ground station and the satellite base station. When the ground station and the satellite base station establish an RRC connection, the ground station can obtain identification information of the satellite base station.

[0108] like Figure 5 As shown, the authentication process may include the following steps:

[0109] S503: The satellite base station sends a first registration request to the ground station.

[0110] Exemplarily, in order to perform two-way authentication and establish a secure connection with the ground station, the satellite base station generates a first random number RAND1 for this authentication. The satellite base station sends a first registration request to the ground station, and the first registration request includes the first random number RAND1 generated by the satellite base station and identification information of the satellite base station.

[0111] S504: After receiving the first registration request, the ground station sends a second registration request to the authentication management function entity.

[0112] Exemplarily, the second registration request sent by the ground station to the authentication management function entity includes the identification information of the satellite base station, the first random number RAND1 generated by the satellite base station, and the identification information of the ground station.

[0113] S505: After receiving the second registration request, the authentication management function entity obtains an authentication vector.

[0114] Exemplarily, the authentication management function entity obtains the identification information of the satellite base station from the received authentication vector request, obtains the corresponding satellite base station authentication root key according to the identification information of the satellite base station, and generates the second random number RAND2 for this authentication according to the satellite base station authentication root key. Then, the authentication vector is obtained according to the satellite base station authentication root key, the first random number RAND1 and the second random number RAND2. The authentication vector may include the second random number RAND2, the second authentication token MAC2, the second authentication response and the second satellite base station authentication key Kauth2.

[0115] The second authentication token MAC2 is a message authentication code MAC, which is used to protect the first random number RAND1 and the second random number RAND2 from being tampered with during transmission. Exemplarily, the second authentication token MAC2 can be obtained by performing message authentication code calculation on the first random number RAND1 and the second random number RAND2 according to the satellite base station authentication root key. For example, the authentication management function entity adopts a hash message authentication code algorithm, and performs an OR operation on the first random number RAND1 and the second random number RAND2 according to the satellite base station authentication root key, thereby obtaining the second authentication token MAC2. For example, a calculation method of the second authentication token MAC2 can be expressed as: using the HMAC algorithm to calculate the input string S, where S = RAND1||RAND2, || is the logical operation symbol of OR, and two operands are required when || is operated, for example, the first operand first random number RAND1 and the second operand second random number RAND2.

[0116] Exemplarily, the second authentication response can be obtained by performing message authentication code calculation on the first random number RAND1 and the second random number RAND2 according to the satellite base station authentication root key. For example, the authentication management function entity obtains the operation identifier of the second authentication response using the satellite base station authentication root key, and uses the hash message authentication code algorithm to perform an OR operation on the operation identifier of the second authentication response, the first random number RAND1, and the second random number RAND2 to obtain the second authentication response. For example, a calculation method for the second authentication response can be expressed as: using the HMAC algorithm to calculate the input string S, where S = the operation identifier of the second authentication response||RAND1||RAND2.

[0117] Exemplarily, the second satellite base station authentication key Kauth2 can be obtained by performing message authentication code calculation on the first random number RAND1 and the second random number RAND2 according to the satellite base station authentication root key. For example, the authentication management function entity uses the satellite base station authentication root key to obtain the operation identifier of the satellite base station authentication key, and adopts the hash message authentication code algorithm to perform an OR operation on the operation identifier of the satellite base station authentication key, the first random number RAND1 and the second random number RAND2 to obtain the satellite base station authentication key. For example, a calculation method of the second satellite base station authentication key Kauth2 can be expressed as: using the HMAC algorithm to calculate the input string S, where S = Kauth operation identifier || RAND1 || RAND2.

[0118] S506: The authentication management function entity sends an authentication request to the satellite base station through the ground station.

[0119] The authentication request sent by the authentication management function entity to the satellite base station includes the second random number RAND2 and the second authentication token MAC2 in the authentication vector.

[0120] S507: After receiving the authentication request, the satellite base station authenticates the ground station and sends an authentication response to the ground station to the authentication management function entity according to the authentication result.

[0121] In this step, the satellite base station first generates a first authentication token MAC1 according to the satellite base station authentication root key, the first random number RAND1 and the second random number RAND2, and then authenticates the ground station according to the first authentication token MAC1 and the second authentication token MAC2. If the first authentication token MAC1 and the second authentication token MAC2 are the same, it indicates that the received second random number RAND2 has not been modified, that is, the ground station is authenticated successfully. The generation method of the first authentication token MAC1 is the same as the generation method of the second authentication token MAC2.

[0122] Further, the satellite base station generates a first authentication response according to the satellite base station authentication root key, the first random number RAND1 and the second random number RAND2. Exemplarily, the satellite base station may generate the first authentication response after successfully authenticating the ground station.

[0123] Exemplarily, the satellite base station may use the satellite base station authentication root key to obtain the operation identifier of the first authentication response, adopt the same hash message authentication code algorithm as the generation algorithm of the second authentication response, and perform an OR operation based on the operation identifier of the first authentication response, the first random number RAND1, and the second random number RAND2 to obtain the first authentication response.

[0124] If the satellite base station successfully authenticates the ground station, the authentication response sent to the authentication management function entity carries the first authentication response.

[0125] S508: After receiving the authentication response, the authentication management function entity authenticates the satellite base station.

[0126] In this step, after the authentication management function entity obtains the first authentication response from the received authentication response, it authenticates the satellite base station according to the first authentication response and the second authentication response. Exemplarily, if the first authentication response and the second authentication response are the same, the satellite base station is authenticated successfully.

[0127] If the authentication management function entity successfully authenticates the satellite base station, the process may further include the following steps:

[0128] S509: The authentication management function entity exports the second communication master key KS-gNB2 between the satellite base station and the ground station.

[0129] In this step, the authentication management function entity may derive the second communication master key KS-gNB2 according to the second satellite base station authentication key Kauth2 and the identification information of the ground station. The second communication master key KS-gNB2 is used for communication between the ground station and the satellite base station.

[0130] S510: The authentication management function entity sends an authentication response to the ground station.

[0131] Taking the successful authentication of the satellite base station by the authentication management function entity as an example, the authentication success message includes the second communication master key KS-gNB2 derived by the authentication management function entity.

[0132] S511: After receiving the authentication response indicating successful authentication, the ground station sends a registration response to the satellite base station, where the registration response is used to indicate successful registration.

[0133] S512: After receiving the registration response (indicating successful registration), the satellite base station exports the first communication master key KS-gNB1 between the satellite base station and the ground station.

[0134] In this step, the satellite base station can generate a first satellite base station authentication key Kauth1 according to the satellite base station authentication root key, the first random number RAND1 and the second random number RAND2, and derive a first communication master key KS-gNB1 according to the first satellite base station authentication key Kauth1 and the identification information of the ground station. The first communication master key KS-gNB1 is used for communication between the ground station and the satellite base station. The generation method of the first satellite base station authentication key Kauth1 is the same as the generation method of the second satellite base station authentication key Kauth2, and the derivation method of the first satellite base station authentication key Kauth1 is the same as the derivation method of the second satellite base station authentication key Kauth2.

[0135] Afterwards, AS and SMC processes can be performed between the satellite base station and the ground station.

[0136] Exemplarily, the satellite base station and the ground station may perform the AS process to derive the keys KRRCint and KRRCenc for access control security and perform the SMC process to derive the keys KUPint and KUPenc for access data security in accordance with the provisions in 3GPP.

[0137] In the above-mentioned embodiment of the present application, the satellite communication system includes a satellite base station, a ground station, and an authentication management functional entity, wherein the satellite base station authenticates the ground station according to a first authentication token MAC1 generated by the satellite base station and a second authentication token MAC2 generated by the authentication management functional entity, and the ground station authenticates the satellite base station according to a first authentication response generated by the satellite base station and a second authentication response generated by the authentication management functional entity, thereby realizing two-way authentication between the satellite base station and the ground station, thereby establishing a secure feeder link, improving the security of the feeder link, and ensuring secure communication between the satellite base station and the ground station.

[0138] Figure 6 Another satellite communication system provided by an embodiment of the present application is exemplarily shown, which shows a feeder link security architecture of the satellite communication system. As shown in the figure, the satellite communication system includes: a satellite base station (601a, 601b), a ground access device (602a, 602b) and a key management function entity 603. Among them, the key management function entity 603 can be located in the core network.

[0139] It is understandable that the ground access equipment may also be called a ground access device or other names, and the key management function entity may also be called a key management function or a key management function network element or other names, and the embodiments of the present application do not limit this.

[0140] It should be noted that the embodiment of the present application does not limit the number of satellite base stations and ground access devices in the above architecture.

[0141] Based on the above architecture, mutual authentication between satellite base stations and ground access equipment can be achieved.

[0142] The functions of each component in the above satellite system are first briefly described below.

[0143] The key management function entity is used to receive a first random number RAND1 from a satellite base station, generate a second random number RAND2 according to a satellite base station authentication root key, obtain an authentication vector according to the satellite base station authentication root key, the first random number RAND1 and the second random number RAND2, and send the authentication vector to a ground access device. The authentication vector includes a second random number RAND2, a second authentication token MAC2, a second authentication response and a second satellite base station authentication key Kauth2.

[0144] The ground access device is used to send a second random number RAND2 and a second authentication token MAC2 from a key management function entity to a satellite base station; and after receiving a first authentication response from the satellite base station, authenticate the satellite base station according to the first authentication response and the second authentication response.

[0145] A satellite base station is used to generate a first random number RAND1, which is sent to a key management function entity via a ground access device; and, after receiving a second random number RAND2 and a second authentication token MAC2 from the ground access device, a first authentication token MAC1 is generated according to the satellite base station authentication root key, the first random number RAND1 and the second random number RAND2, and after authenticating the ground access device according to the first authentication token MAC1 and the second authentication token MAC2, a first authentication response is generated according to the satellite base station authentication root key, the first random number RAND1 and the second random number RAND2, and the first authentication response is sent to the ground access device.

[0146] Based on Figure 6 Satellite communication systems, Figure 7 The following is an exemplary diagram of the authentication process provided in an embodiment of the present application, through which two-way authentication between a satellite base station and a ground access device can be achieved.

[0147] In S701, before the ground access device and the satellite base station perform two-way authentication and establish a secure connection, the satellite base station, the ground access device and the key management function entity respectively configure information related to satellite base station authentication. For example, the satellite base station is configured with a satellite base station authentication root key and information about a legitimate ground access device, such as identification information of a legitimate ground access device; the ground access device is configured with information about a legitimate ground access device and information about a satellite base station, such as identification information of a legitimate satellite base station; and the key management function entity is configured with information about a legitimate satellite base station and a satellite base station authentication root key.

[0148] In S702, after the ground access device detects the satellite base station, an RRC connection is established between the ground access device and the satellite base station. When the ground access device and the satellite base station establish an RRC connection, the ground access device can obtain identification information of the satellite base station.

[0149] like Figure 7 As shown, the authentication process may include the following steps:

[0150] S703: The satellite base station sends a registration request to the ground access device.

[0151] Exemplarily, in order to perform two-way authentication and establish a secure connection with the ground access device, the satellite base station generates a first random number RAND1 for this authentication. The satellite base station sends a registration request to the ground access device, and the registration request includes the first random number RAND1 generated by the satellite base station and the identification information of the satellite base station.

[0152] S704: After receiving the registration request, the ground access device sends an authentication vector request to the key management function entity.

[0153] Exemplarily, the authentication vector request sent by the ground access device to the key management function entity includes identification information of the satellite base station and the first random number RAND1.

[0154] S705: After receiving the authentication vector request, the key management function entity obtains the authentication vector.

[0155] Exemplarily, the key management function entity obtains the identification information of the satellite base station from the received authentication vector request, obtains the corresponding satellite base station authentication root key according to the identification information of the satellite base station, and generates the second random number RAND2 for this authentication according to the satellite base station authentication root key. Then, the authentication vector is obtained according to the satellite base station authentication root key, the first random number RAND1 and the second random number RAND2. The authentication vector may include the second random number RAND2, the second authentication token MAC2, the second authentication response and the second satellite base station authentication key Kauth2.

[0156] The second authentication token MAC2 is a message authentication code MAC, which is used to protect the first random number RAND1 and the second random number RAND2 from being tampered with during transmission. Exemplarily, the second authentication token MAC2 can be obtained by performing message authentication code calculation on the first random number RAND1 and the second random number RAND2 according to the satellite base station authentication root key. For example, the key management function entity adopts a hash message authentication code algorithm to perform an OR operation on the first random number RAND1 and the second random number RAND2 according to the satellite base station authentication root key, thereby obtaining the second authentication token MAC2. For example, a calculation method of the second authentication token MAC2 can be expressed as: using the HMAC algorithm to calculate the input string S, where S = RAND1||RAND2, || is the logical operation symbol of OR, and || requires two operands when performing the operation, for example, the first operand first random number RAND1 and the second operand second random number RAND2.

[0157] Exemplarily, the second authentication response can be obtained by performing message authentication code calculation on the first random number RAND1 and the second random number RAND2 according to the satellite base station authentication root key. For example, the key management function entity obtains the operation identifier of the second authentication response using the satellite base station authentication root key, and uses the hash message authentication code algorithm to perform an OR operation on the operation identifier of the second authentication response, the first random number RAND1, and the second random number RAND2 to obtain the second authentication response. For example, a calculation method for the second authentication response can be expressed as: using the HMAC algorithm to calculate the input string S, where S = the operation identifier of the second authentication response||RAND1||RAND2.

[0158] Exemplarily, the second satellite base station authentication key Kauth2 can be obtained by performing message authentication code calculation on the first random number RAND1 and the second random number RAND2 according to the satellite base station authentication root key. For example, the key management function entity uses the satellite base station authentication root key to obtain the operation identifier of the satellite base station authentication key, and adopts the hash message authentication code algorithm to perform an OR operation on the operation identifier of the satellite base station authentication key, the first random number RAND1 and the second random number RAND2 to obtain the satellite base station authentication key. For example, a calculation method of the second satellite base station authentication key Kauth2 can be expressed as: using the HMAC algorithm to calculate the input string S, where S = Kauth operation identifier || RAND1 || RAND2.

[0159] S706: The key management function entity sends the authentication vector to the ground access device.

[0160] S707: After receiving the authentication vector, the ground access device sends an authentication request to the satellite base station.

[0161] The authentication request sent by the ground access device to the satellite base station includes the second random number RAND2 in the authentication vector and the second authentication token MAC2.

[0162] S708: After receiving the authentication request, the satellite base station authenticates the ground access device and sends an authentication response to the ground access device according to the authentication result.

[0163] In this step, the satellite base station first generates a first authentication token MAC1 according to the satellite base station authentication root key, the first random number RAND1 and the second random number RAND2, and then authenticates the ground access device according to the first authentication token MAC1 and the second authentication token MAC2. If the first authentication token MAC1 and the second authentication token MAC2 are the same, it indicates that the received second random number RAND2 has not been modified, that is, the ground access device is authenticated successfully. The generation method of the first authentication token MAC1 is the same as the generation method of the second authentication token MAC2.

[0164] Further, the satellite base station generates a first authentication response according to the satellite base station authentication root key, the first random number RAND1 and the second random number RAND2. Exemplarily, the satellite base station may generate a first authentication response after successfully authenticating the ground access device.

[0165] Exemplarily, the satellite base station may use the satellite base station authentication root key to obtain the operation identifier of the first authentication response, adopt the same hash message authentication code algorithm as the generation algorithm of the second authentication response, and perform an OR operation based on the operation identifier of the first authentication response, the first random number RAND1, and the second random number RAND2 to obtain the first authentication response.

[0166] If the satellite base station successfully authenticates the ground access device, the authentication response sent to the ground access device carries the first authentication response.

[0167] S709: After receiving the authentication response, the ground access device authenticates the satellite base station.

[0168] In this step, after the ground access device obtains the first authentication response from the received authentication response, it authenticates the satellite base station according to the first authentication response and the second authentication response received from the key management function entity. Exemplarily, if the first authentication response and the second authentication response are the same, the satellite base station is authenticated successfully.

[0169] If the ground access device successfully authenticates the satellite base station, the process may also include the following steps:

[0170] S710: The authentication function entity derives the second communication master key KS-gNB2 between the satellite base station and the ground access equipment.

[0171] In this step, the authentication function entity may derive the second communication master key KS-gNB2 according to the second satellite base station authentication key Kauth2 and the identification information of the ground access device. The second communication master key KS-gNB2 is used for communication between the ground access device and the satellite base station.

[0172] S711: After receiving the authentication response indicating successful authentication, the ground access device sends a registration response to the satellite base station, where the registration response is used to indicate successful registration.

[0173] S712: After receiving the registration response (indicating successful registration), the satellite base station exports the first communication master key KS-gNB1 between the satellite base station and the ground access device.

[0174] In this step, the satellite base station can generate a first satellite base station authentication key Kauth1 according to the satellite base station authentication root key, the first random number RAND1 and the second random number RAND2, and derive a first communication master key KS-gNB1 according to the first satellite base station authentication key Kauth1 and the identification information of the ground access device. The first communication master key KS-gNB1 is used for communication between the ground access device and the satellite base station. The generation method of the first satellite base station authentication key Kauth1 is the same as the generation method of the second satellite base station authentication key Kauth2, and the derivation method of the first satellite base station authentication key Kauth1 is the same as the derivation method of the second satellite base station authentication key Kauth2.

[0175] After that, AS and SMC processes can be performed between the satellite base station and the ground access equipment.

[0176] Exemplarily, the satellite base station and the ground access equipment may perform the AS process to derive the keys KRRCint and KRRCenc for access control security and perform the SMC process to derive the keys KUPint and KUPenc for access data security in accordance with the provisions in 3GPP.

[0177] In the above-mentioned embodiment of the present application, the satellite communication system includes a satellite base station, a ground access device and a key management function entity, wherein the satellite base station authenticates the ground access device through a first authentication token MAC1 generated by the satellite base station and a second authentication token MAC2 generated by the key management function entity, and the ground access device authenticates the satellite base station according to a first authentication response generated by the satellite base station and a second authentication response generated by the key management function entity, thereby enabling two-way authentication to be achieved between the satellite base station and the ground access device, thereby establishing a secure feeder link, improving the security of the feeder link, and ensuring secure communication between the satellite base station and the ground access device.

[0178] Based on the same technical concept, an embodiment of the present application also provides a communication device. Figure 8 The structural diagram of the communication device provided in the embodiment of the present application is exemplified.

[0179] As shown in the figure, the device may include: a processor 801 , a memory 802 , and a bus interface 803 .

[0180] The bus architecture may include any number of interconnected buses and bridges, specifically linking together various circuits of one or more processors represented by processor 801 and memory represented by memory 802. The bus architecture may also link together various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface. The processor 801 is responsible for managing the bus architecture and general processing, and the memory 802 may store data used by the processor 801 when performing operations.

[0181] The process disclosed in the embodiment of the present application can be applied to the processor 801, or implemented by the processor 801. In the implementation process, each step of the signal processing process can be completed by the hardware integrated logic circuit or software instructions in the processor 801. The processor 801 can be a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, and can implement or execute the methods, steps and logic block diagrams disclosed in the embodiment of the present application. The general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the embodiment of the present application can be directly embodied as a hardware processor to be executed, or the hardware and software modules in the processor are combined and executed. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 802, and the processor 801 reads the information in the memory 802 and completes the steps of the information processing process in combination with its hardware.

[0182] Specifically, the processor 801 is used to read the computer instructions in the memory 802 and execute the authentication method in the embodiment of the present application.

[0183] It should be noted here that the above-mentioned communication device provided in the embodiment of the present application can implement all the method steps performed by the satellite base station or ground station or ground access equipment or authentication function entity or key management function entity or authentication management function entity in the above-mentioned method embodiment, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be described in detail here.

[0184] It should be noted that the processor involved in the above-mentioned embodiments of the present application can be a central processing unit (CPU), a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It can implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the content of this application. The processor can also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and the like. Among them, the memory can be integrated in the processor or can be set separately from the processor.

[0185] Based on the same technical concept, the embodiment of the present application also provides a computer-readable storage medium. The computer-readable storage medium stores computer-executable instructions, which are used to enable a computer to execute Figure 3 , Figure 5 or Figure 7 The process being executed.

[0186] Based on the same technical concept, the embodiment of the present application also provides a computer program product, which, when called by a computer, enables the computer to execute Figure 3 , Figure 5 or Figure 7 The process being executed.

[0187] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0188] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0189] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0190] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0191] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A satellite communication system, characterized in that: include: Satellite base station, ground station, authentication function entity and key management function entity; The key management function entity is configured to receive a first random number from the satellite base station, generate a second random number according to a satellite base station authentication root key, obtain an authentication vector according to the satellite base station authentication root key, the first random number and the second random number, and send the authentication vector to the authentication function entity, where the authentication vector includes the second random number, a second authentication token, a second authentication response and a second satellite base station authentication key; The authentication function entity is used to send the second random number and the second authentication token from the key management function entity to the satellite base station; and, after receiving a first authentication response from the satellite base station, authenticating the satellite base station according to the first authentication response and the second authentication response; The satellite base station is used to generate the first random number, which is sent to the key management function entity via the ground station and the authentication function entity in sequence; and, after receiving the second random number and the second authentication token from the authentication function entity, generate the first authentication token according to the satellite base station authentication root key, the first random number and the second random number, and after authenticating the ground station according to the first authentication token and the second authentication token, generate the first authentication response according to the satellite base station authentication root key, the first random number and the second random number, and send the first authentication response to the authentication function entity.

2. The system according to claim 1, characterized in that The satellite base station is further used to send a first registration request to the ground station, where the first registration request includes identification information of the satellite base station and the first random number; The ground station is further used to send a second registration request to the authentication function entity, where the second registration request includes the identification information of the satellite base station, the first random number and the identification information of the ground station; The authentication function entity is further used to send an authentication vector request to the key management function entity, where the authentication vector request includes the identification information of the satellite base station and the first random number.

3. The system according to claim 1, characterized in that: The authentication function entity is further used to: If the satellite base station is authenticated according to the first authentication response and the second authentication response, deriving a second communication master key according to the second satellite base station authentication key and identification information of the ground station, and sending an authentication success message to the ground station, wherein the authentication success message includes the second communication master key, and the second communication master key is used for the ground station to communicate with the satellite base station; The satellite base station is also used for: Generate a first satellite base station authentication key according to the satellite base station authentication root key, the first random number and the second random number; A first communication master key is derived according to the first satellite base station authentication key and the identification information of the ground station, and the first communication master key is used for communication between the ground station and the satellite base station.

4. An authentication method, characterized in that: include: The satellite base station generates a first random number, includes the first random number in a first registration request and sends it to a key management function entity, so that the key management function entity generates a second random number according to a satellite base station authentication root key, obtains an authentication vector according to the satellite base station authentication root key, the first random number and the second random number, and sends the authentication vector to an authentication function entity, where the authentication vector includes the second random number, a second authentication token, a second authentication response and a second satellite base station authentication key; The satellite base station receives the second random number and the second authentication token from the authentication function entity, generates a first authentication token according to the satellite base station authentication root key, the first random number and the second random number, and authenticates the ground station according to the second authentication token and the first authentication token; After the satellite base station authenticates the ground station according to the first authentication token and the second authentication token, it generates a first authentication response according to the satellite base station authentication root key, the first random number and the second random number, and sends the first authentication response to the authentication function entity, so that the authentication function entity authenticates the satellite base station according to the first authentication response and the second authentication response.

5. An authentication method, characterized in that: include: The authentication function entity sends an authentication vector request to the key management function entity according to a second registration request from the ground station, wherein the second registration request and the authentication vector request include a first random number generated by the satellite base station, so that the key management function entity generates a second random number according to a satellite base station authentication root key, obtains an authentication vector according to the satellite base station authentication root key, the first random number and the second random number, and sends the authentication vector to the authentication function entity, wherein the authentication vector includes the second random number, a second authentication token, a second authentication response and a second satellite base station authentication key; The authentication function entity sends the second random number and the second authentication token from the key management function entity to the satellite base station, so that the satellite base station generates a first authentication token according to the satellite base station authentication root key, the first random number and the second random number, authenticates the ground station according to the second authentication token and the first authentication token, and generates a first authentication response according to the satellite base station authentication root key, the first random number and the second random number after the authentication is passed, and sends the response to the authentication function entity; The authentication function entity authenticates the satellite base station according to the first authentication response from the satellite base station and the second authentication response from the key management function entity.

6. An authentication method, characterized in that: include: The key management function entity receives an authentication vector request from the authentication function entity, wherein the authentication vector request includes a first random number generated by the satellite base station; The key management function entity generates a second random number according to the satellite base station authentication root key, and obtains an authentication vector according to the satellite base station authentication root key, the first random number and the second random number, wherein the authentication vector includes the second random number, a second authentication token, a second authentication response and a second satellite base station authentication key; The key management function entity sends the authentication vector to the authentication function entity, so that the authentication function entity sends the second random number and the second authentication token to the satellite base station, wherein the first random number and the second random number are used by the satellite base station to generate a first authentication token for authenticating the ground station, and a first authentication response for the authentication function entity to authenticate the satellite base station.

7. A satellite communication system, characterized in that: include: Satellite base stations, ground stations and authentication management functional entities; The authentication management function entity is configured to receive a first random number from the satellite base station, generate a second random number according to a satellite base station authentication root key, obtain an authentication vector according to the satellite base station authentication root key, the first random number, and the second random number, wherein the authentication vector includes the second random number, a second authentication token, a second authentication response, and a second satellite base station authentication key, and send the second random number and the second authentication token to the satellite base station; and, after receiving a first authentication response from the satellite base station, authenticating the satellite base station according to the first authentication response and the second authentication response; The satellite base station is used to generate the first random number, which is sent to the authentication management function entity via the ground station; and, after receiving the second random number and the second authentication token from the authentication management function entity, generate the first authentication token according to the satellite base station authentication root key, the first random number and the second random number, and after authenticating the ground station according to the first authentication token and the second authentication token, generate the first authentication response according to the satellite base station authentication root key, the first random number and the second random number and send the first authentication response to the authentication management function entity.

8. The system according to claim 7, characterized in that The satellite base station is further used to send a first registration request to the ground station, where the first registration request includes identification information of the satellite base station and the first random number; The ground station is further used to send a second registration request to the authentication management function entity, where the second registration request includes the identification information of the satellite base station, the first random number and the identification information of the ground station.

9. The system according to claim 7, characterized in that: The authentication management function entity is further used to: If the satellite base station is authenticated according to the first authentication response and the second authentication response, deriving a second communication master key according to the second satellite base station authentication key and identification information of the ground station, and sending an authentication success message to the ground station, wherein the authentication success message includes the second communication master key, and the second communication master key is used for the ground station to communicate with the satellite base station; The satellite base station is also used for: Generate a first satellite base station authentication key according to the satellite base station authentication root key, the first random number and the second random number; A first communication master key is derived according to the first satellite base station authentication key and the identification information of the ground station, and the first communication master key is used for communication between the ground station and the satellite base station.

10. An authentication method, characterized in that: include: The satellite base station generates a first random number, includes the first random number in a first registration request and sends it to an authentication management function entity, so that the authentication management function entity generates a second random number according to a satellite base station authentication root key, obtains an authentication vector according to the satellite base station authentication root key, the first random number and the second random number, and the authentication vector includes the second random number, a second authentication token, a second authentication response and a second satellite base station authentication key; The satellite base station receives the second random number and the second authentication token from the authentication management function entity, generates a first authentication token according to the satellite base station authentication root key, the first random number and the second random number, and authenticates the ground station according to the first authentication token and the second authentication token; After the satellite base station authenticates the ground station according to the first authentication token and the second authentication token, it generates a first authentication response according to the satellite base station authentication root key, the first random number and the second random number, and sends the first authentication response to the authentication management function entity, so that the authentication management function entity authenticates the satellite base station according to the first authentication response and the second authentication response.

11. An authentication method, characterized in that: include: The authentication management function entity receives a second registration request from the ground station, where the second registration request includes a first random number generated by the satellite base station; The authentication management function entity generates a second random number according to the satellite base station authentication root key, obtains an authentication vector according to the satellite base station authentication root key, the first random number and the second random number, the authentication vector including the second random number, a second authentication token, a second authentication response and a second satellite base station authentication key, and sends the second random number and the second authentication token to the satellite base station; The authentication management function entity receives a first authentication response from the satellite base station, and authenticates the satellite base station according to the first authentication response and the second authentication response; wherein the first authentication response is generated by the satellite base station according to the satellite base station authentication root key, the first random number and the second random number after the satellite base station authenticates the ground station according to the first authentication token and the second authentication token, and the first authentication token is generated by the satellite base station according to the satellite base station authentication root key, the first random number and the second random number.

12. A satellite communication system, characterized in that: include: Satellite base stations, ground access equipment and key management functional entities; The key management function entity is configured to receive a first random number from the satellite base station, generate a second random number according to a satellite base station authentication root key, obtain an authentication vector according to the satellite base station authentication root key, the first random number and the second random number, and send the authentication vector to the ground access device, where the authentication vector includes the second random number, a second authentication token, a second authentication response and a second satellite base station authentication key; The ground access device is used to send the second random number and the second authentication token from the key management function entity to the satellite base station; and, after receiving a first authentication response from the satellite base station, authenticating the satellite base station according to the first authentication response and the second authentication response; The satellite base station is used to generate the first random number, which is sent to the key management function entity via the ground access device; and, after receiving the second random number and the second authentication token from the key management function entity, generate a first authentication token according to the satellite base station authentication root key, the first random number and the second random number, and after passing the first authentication token and the second authentication token to the ground access device, generate the first authentication response according to the satellite base station authentication root key, the first random number and the second random number, and send the first authentication response to the ground access device.

13. The system of claim 12, wherein: The satellite base station is further used to send a registration request to the ground access device, wherein the registration request includes identification information of the satellite base station, the first random number and identification information of the ground access device; The ground access device is further used to send an authentication vector request to the key management function entity, where the authentication vector request includes identification information of the satellite base station and the first random number.

14. The system of claim 12, wherein: The ground access equipment is also used for: If the satellite base station is authenticated according to the first authentication response and the second authentication response, deriving a second communication master key according to the second satellite base station authentication key and identification information of a ground access device, the second communication master key being used for communication between the ground access device and the satellite base station; The satellite base station is also used for: Generate a first satellite base station authentication key according to the satellite base station authentication root key, the first random number and the second random number; A first communication master key is derived according to the first satellite base station authentication key and the identification information of the ground access device, and the first communication master key is used for communication between the ground access device and the satellite base station.

15. An authentication method, characterized in that: include: The satellite base station generates a first random number, includes the first random number in a registration request and sends it to a key management function entity, so that the key management function entity generates a second random number according to a satellite base station authentication root key, obtains an authentication vector according to the satellite base station authentication root key, the first random number and the second random number, and sends the authentication vector to a ground access device, where the authentication vector includes the second random number, a second authentication token, a second authentication response and a second satellite base station authentication key; The satellite base station receives the second random number and the second authentication token from the ground access device, generates a first authentication token according to the satellite base station authentication root key, the first random number and the second random number, and authenticates the ground access device according to the second authentication token and the first authentication token; After the satellite base station successfully authenticates the ground access device according to the first authentication token and the second authentication token, it generates a first authentication response according to the satellite base station authentication root key, the first random number and the second random number, and sends the first authentication response to the ground access device, so that the ground access device authenticates the satellite base station according to the first authentication response and the second authentication response.

16. An authentication method, characterized in that: include: The ground access device sends an authentication vector request to the key management function entity according to a registration request from the satellite base station, wherein the registration request and the authentication vector request include a first random number generated by the satellite base station, so that the key management function entity generates a second random number according to a satellite base station authentication root key, obtains an authentication vector according to the satellite base station authentication root key, the first random number and the second random number, and the authentication vector includes the second random number, a second authentication token, a second authentication response and a second satellite base station authentication key; The ground access device receives the second random number and the second authentication token from the key management function entity, and sends the second random number and the second authentication token to the satellite base station; The ground access device authenticates the satellite base station based on a first authentication response from the satellite base station and the second authentication response from the key management function entity; wherein the first authentication response is generated by the satellite base station according to the satellite base station authentication root key, the first random number and the second random number after the satellite base station authenticates the ground access device according to the first authentication token and the second authentication token, and the first authentication token is generated by the satellite base station according to the satellite base station authentication root key, the first random number and the second random number.

17. An authentication method, characterized in that: include: The key management function entity receives an authentication vector request from a ground access device, wherein the authentication vector request includes a first random number generated by a satellite base station; The key management function entity generates a second random number according to the satellite base station authentication root key, obtains an authentication vector according to the satellite base station authentication root key, the first random number and the second random number, and sends the authentication vector to a ground access device, where the authentication vector includes the second random number, a second authentication token, a second authentication response and a second satellite base station authentication key; The key management function entity sends the authentication vector to the ground access device, so that the ground access device sends the second random number and the second authentication token to the satellite base station, wherein the first random number and the second random number are used by the satellite base station to generate a first authentication token for authenticating the ground access device, and a first authentication response for the key management function entity to authenticate the satellite base station.

18. A communication device, characterized in that: It comprises a memory and a processor; the memory stores computer instructions; the processor is used to read the computer instructions and execute the method as described in any one of claims 4-6, 10-11 and 15-17.

19. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions for causing the computer to execute the method of any one of claims 4-6, 10-11, and 15-17.

20. A computer program product, characterized in that When the computer program product is called by a computer, the computer is caused to execute the method according to any one of claims 4 to 6, 10 to 11 and 15 to 17.

Images