Beidou short message security communication method and system based on domestic cryptography

Abstract

This invention relates to a secure BeiDou short message communication method based on domestic cryptography. For communication between BeiDou service terminals and service servers via BeiDou satellite access to the BeiDou access gateway, a BeiDou secure key management center is introduced to distribute keys. A certificate-free authentication mechanism incorporating domestic cryptographic algorithms is designed to enable authentication and key negotiation between each BeiDou service terminal and the BeiDou access gateway. If both authentication and negotiation are successful, the BeiDou service terminal can then communicate with the service server via the BeiDou access gateway using BeiDou short messages. This design avoids certificate management and key escrow issues, saving resources. Furthermore, the use of a domestic cryptographic key negotiation mechanism for session key negotiation simplifies the interaction process, eliminates the need for protection keys, and ensures the security of BeiDou short messages during satellite transmission. Simultaneously, it achieves two-way authentication between the terminal and the gateway, protecting the service system from interference or unauthorized access.

Description

Technical Field

[0001] This invention relates to a secure short message communication method and system for BeiDou based on domestically developed cryptography, belonging to the field of satellite message communication technology. Background Technology

[0002] The short message communication service provided by the BeiDou Navigation Satellite System enables information transmission via BeiDou satellites in areas without signal coverage and in emergency situations, effectively overcoming the limitations of extreme geographical environments. BeiDou's unique short message function has been widely applied in various industries, including immediate rescue, disaster reporting, and mobile monitoring. In maritime applications, personnel can access real-time updates on weather, hydrology, anchorage, and navigation data, allowing for better route planning and intelligent vessel monitoring. In forestry, it provides real-time, accurate, and reliable data for forest rangers' daily patrols and forestry management, strengthening forest resource patrol and management capabilities. For forest fire fighting, short messages not only facilitate real-time uploading of fire hazard points but also provide emergency communication services during fires, aiding in emergency command and dispatch for forest fire prevention.

[0003] With the development of the BeiDou system, many performance aspects have been improved. Compared to the BeiDou-2 system, the BeiDou-3 system has increased its signal service capacity tenfold, reaching over 10 million times per hour; the length of a single short message has increased from 120 Chinese characters to 1000 Chinese characters; and the user transmission power has been reduced to 1 / 10. However, the following security issues exist in the BeiDou short message communication transmission process:

[0004] (1) The short message information is sent in plaintext via Beidou satellite, which poses a risk of data leakage.

[0005] (2) The lack of authentication for business terminals poses a risk of unauthorized access to the business system.

[0006] (3) Due to the limitations of the length and frequency of BeiDou short message communication, existing secure transmission protocols such as SSL and IPSec are difficult to apply to BeiDou short message communication.

[0007] Existing technologies have improved the security of terminal access and data transmission to some extent through authentication and encryption mechanisms included in security protocols, but they still have the following shortcomings:

[0008] (1) The cryptographic algorithms used, such as SM9, are complex to implement and require end users to equip themselves with powerful secure computing cryptographic devices, which increases hardware costs.

[0009] (2) Designing a PKI-based identity authentication mechanism requires providing digital certificates, which increases the cost of system certificate management.

[0010] (3) During key negotiation, the two parties need to use a pre-shared protection key to encrypt random numbers and generate a session key by XORing the random numbers. Once the protection key is leaked, the session key will be leaked. Summary of the Invention

[0011] The technical problem to be solved by this invention is to provide a Beidou short message secure communication method based on domestic cryptography. It designs a certificateless authentication mechanism combined with national cryptographic algorithms to realize identity authentication and key negotiation, thereby ensuring the security of data communication while improving the efficiency of data communication.

[0012] To solve the above-mentioned technical problems, the present invention adopts the following technical solution: The present invention designs a Beidou short message secure communication method based on domestic cryptography. Based on the access of each Beidou service terminal to the Beidou satellite, and the Beidou security key management center and each service server accessing the Beidou satellite through the Beidou access gateway, the following steps are taken to realize the communication between each Beidou service terminal and each service server regarding Beidou short messages.

[0013] Step A. Based on the BeiDou Security Key Management Center and combined with national cryptographic algorithms, generate complete private keys and partial public keys corresponding to the BeiDou access gateway and each BeiDou service terminal respectively;

[0014] Step B. For each BeiDou service terminal, based on the national cryptographic algorithm and the certificateless authentication mechanism, realize identity authentication and key negotiation between the BeiDou service terminal and the BeiDou access gateway. If both authentication and negotiation are successful, the BeiDou service terminal communicates with the service server via the BeiDou access gateway. If at least one of the authentication and negotiation fails, the BeiDou service terminal does not communicate with the service server.

[0015] As a preferred technical solution of the present invention: In step A, the BeiDou access gateway and each BeiDou service terminal are respectively taken as communication objects, and the following steps A1 to A3 are executed to obtain the complete private key and partial public key corresponding to each communication object, that is, the complete private key and partial public key corresponding to the BeiDou access gateway and each BeiDou service terminal respectively.

[0016] Step A1. The communication object generates a random number d1 and bases it on the finite field F. q Elliptic curve E(F) q The base point G on the elliptic curve E(F) q The doubling operation of ) is P1 = [d1]G, the public parameter P1 corresponding to the communication object is calculated, and then combined with the unique device identifier ID of the communication object, it is sent to the Beidou Security Key Management Center, and then proceeds to step A2;

[0017] Step A2. The Beidou Security Key Management Center generates a random number k, calculates the partial public key P corresponding to the communication object according to P = [k]G + P1 = (x,y), and based on h1 = A(x||ID||y), calculates the partial public key P according to d2 = k + S. m h1, calculate and obtain the partial private key d2 corresponding to the communication object, then send the partial public key P and the partial private key d2 to the communication object, and then proceed to step A3; where S m This indicates the master private key preset by the BeiDou Security Key Management Center, and the master public key pair (PK) preset by the BeiDou Security Key Management Center. m ,S m Satisfying PK m =[S m G, PK m This represents the master public key preset by the Beidou Security Key Management Center, and A represents the first preset national cryptographic algorithm;

[0018] Step A3. The communication object calculates its corresponding complete private key d based on d = d1 + d2, and stores its corresponding complete private key d and partial public key P.

[0019] As a preferred technical solution of the present invention: In step B, for each Beidou service terminal, the following steps B1 to B7 are executed to realize identity authentication and key negotiation between the Beidou service terminal and the Beidou access gateway.

[0020] Step B1. The Beidou service terminal generates a random number R. A The key is sent to the BeiDou access gateway to execute a key negotiation request, and the BeiDou service terminal uses its complete private key d to call the second preset national cryptographic algorithm B to process the random number R. A Perform a digital signature to obtain a digital signature (r,s), and combine it with its unique device identifier ID and part of its public key P=(x,y), send it to the Beidou access gateway to execute an identity authentication request, and then proceed to step B2;

[0021] Step B2. Based on the unique device identifier ID from the BeiDou service terminal and a partial public key P = (x, y), the BeiDou access gateway applies PK = P + h2·PK according to h2 = A(x||ID||y). m Obtain the complete public key PK of the Beidou service terminal, and use the complete public key PK of the Beidou service terminal to call the second preset national cryptographic algorithm B to verify whether the random number in the digital signature (r,s) from the Beidou service terminal is equal to R from the Beidou service terminal. AIf yes, it indicates successful verification, meaning the BeiDou service terminal has successfully authenticated its identity with the BeiDou access gateway, and then proceeds to step B3; otherwise, it indicates verification failure, meaning the BeiDou service terminal has failed to authenticate its identity with the BeiDou access gateway, the BeiDou access gateway refuses access to the BeiDou service terminal, and communication ends; where A represents the first preset national cryptographic algorithm, PK m This indicates the master public key preset by the BeiDou Security Key Management Center, and the master public-private key pair (PK) preset by the BeiDou Security Key Management Center. m ,S m Satisfying PK m =[S m G, S m G represents the master private key preset by the Beidou Security Key Management Center, and G represents the key based on the finite field F. q Elliptic curve E(F) q The base point on );

[0022] Step B3. The BeiDou access gateway generates a random number R. B Combined with R from Beidou service terminals A The second preset national cryptographic algorithm B is invoked to generate a session key K. B With key confirmation information S B , random number R B and key confirmation information S B Send it to the Beidou service terminal; and the Beidou access gateway uses its complete private key d' to call the second preset national cryptographic algorithm B to process the random number R. B Perform digital signing to obtain digital signature (r', s'), and combine it with its unique identifier ID' and its partial public key P' = (x', y'), send it to the Beidou service terminal, and then proceed to step B4;

[0023] Step B4. Based on the unique device identifier ID' from the BeiDou access gateway and the partial public key P' = (x', y'), the BeiDou service terminal applies PK' = P' + h3·PK according to h3 = A(x'||ID'||y'). m Obtain the complete public key PK' of the BeiDou access gateway, and use the complete public key PK' of the BeiDou access gateway to call the second preset national cryptographic algorithm B to verify whether the random number in the digital signature (r', s') from the BeiDou access gateway is equal to R from the BeiDou access gateway. B If yes, it means the verification is successful, that is, the BeiDou access gateway has successfully authenticated the identity of the BeiDou service terminal, and then proceeds to step B5; otherwise, it means the verification has failed, that is, the BeiDou access gateway has failed to authenticate the identity of the BeiDou service terminal, the BeiDou access gateway refuses the BeiDou service terminal to access, and the communication ends.

[0024] Step B5. The Beidou service terminal, according to R... A Combined with the random number R from the BeiDou access gatewayB The second preset national cryptographic algorithm B is invoked to generate a session key K. A The key verification information S1 is compared with the key confirmation information S1 from the Beidou access gateway, and it is verified whether the key verification information S1 is equal to the key confirmation information S from the Beidou access gateway. B If yes, it means that the BeiDou access gateway has successfully confirmed the key to the BeiDou service terminal, and then proceed to step B6; otherwise, it means that the BeiDou access gateway has failed to confirm the key to the BeiDou service terminal, the BeiDou access gateway refuses the BeiDou service terminal access, and the communication ends.

[0025] Step B6. The Beidou service terminal, according to R... A Combined with the random number R from the BeiDou access gateway B The key exchange protocol of the second preset national cryptographic algorithm B is invoked to generate key confirmation information S. A And send it to the Beidou access gateway, and then proceed to step B7;

[0026] Step B7. The BeiDou access gateway, according to R... B Combined with random number R from Beidou service terminal A The key exchange protocol of the second preset national cryptographic algorithm B is invoked to generate key verification information S2, and to verify whether key verification information S2 is equal to key confirmation information S from the Beidou service terminal. A If yes, it means that the BeiDou service terminal has successfully confirmed the key with the BeiDou access gateway, that is, the key negotiation and identity authentication between the BeiDou service terminal and the BeiDou access gateway have been successful; otherwise, it means that the BeiDou service terminal has failed to confirm the key with the BeiDou access gateway, the BeiDou access gateway refuses the BeiDou service terminal to access, and the communication ends.

[0027] As a preferred technical solution of the present invention: In step B, based on the successful identity authentication and key negotiation between the Beidou service terminal and the Beidou access gateway, the Beidou service terminal communicates with the service server via the Beidou access gateway using the following method.

[0028] The BeiDou service terminal uses the SM3 hash algorithm to process the plaintext message m and the current timestamp T to obtain H(m||T), and then applies the session key K. A Encrypt the plaintext message m and the current timestamp T to obtain... The data is transmitted via BeiDou satellite to the BeiDou access gateway; the BeiDou access gateway uses the session key K. B The data sent from the Beidou service terminal is decrypted to obtain the corresponding plaintext, and then forwarded to the corresponding service server to realize the Beidou short message service communication between the Beidou service terminal and the service server.

[0029] The BeiDou access gateway receives data from the service server and, by applying the inverse of the above method, sends the data to the BeiDou service terminal, thus enabling BeiDou short message service communication between the service server and the BeiDou service terminal.

[0030] As a preferred technical solution of the present invention: the first preset national cryptographic algorithm A is SM3.

[0031] As a preferred technical solution of the present invention: the second preset national cryptographic algorithm B is SM2.

[0032] Corresponding to the above, the technical problem that this invention also needs to solve is to provide a system for a BeiDou short message secure communication method based on domestic cryptography, which modularly designs the connection between the BeiDou service terminal, the BeiDou access gateway and the BeiDou satellite, and executes the designed communication method, thereby improving the efficiency of data communication.

[0033] To solve the above-mentioned technical problems, the present invention adopts the following technical solution: The present invention designs a system for a BeiDou short message secure communication method based on domestic cryptography, including a BeiDou secure access module and a BeiDou RDSS / RNSS user terminal corresponding to each BeiDou service terminal. Each BeiDou service terminal is connected to its corresponding BeiDou secure access module and BeiDou RDSS / RNSS user terminal in sequence and then connected to the BeiDou satellite. Each BeiDou service terminal, through its connected BeiDou secure access module, combined with the BeiDou service terminal, executes steps A to B to realize communication between each BeiDou service terminal and each service server regarding BeiDou short messages.

[0034] As a preferred technical solution of the present invention: the structures of each BeiDou secure access module are identical. Each BeiDou secure access module includes a BeiDou secure communication module, and a short message data filtering module, an identity authentication module, and a hardware cryptographic module, which are respectively connected to the BeiDou secure communication module. The BeiDou service terminal connects to the corresponding BeiDou RDSS / RNSS user terminal via the BeiDou secure communication module in the corresponding BeiDou secure access module. The short message data filtering module is used to check the format and content of the BeiDou short message data collected by the BeiDou service terminal and filter illegal data. The hardware cryptographic module provides the BeiDou secure communication module with services such as generating random numbers, signing, verifying signatures, encryption / decryption, hash operations, and multi-point calculation on elliptic curves through an API interface, as well as providing secure storage for keys and unique device identifiers (IDs). The identity authentication module is used to complete the calculation of the public key and perform identity authentication based on the signature result.

[0035] As a preferred technical solution of the present invention: the BeiDou access gateway includes a communication module, and a short message data filtering module, an identity authentication module, a hardware cryptography module, and a BeiDou secure forwarding module respectively connected to the communication module. The BeiDou security key management center is connected to the BeiDou secure forwarding module in the BeiDou access gateway and each business server. The communication module in the BeiDou access gateway is connected to the BeiDou satellite. After receiving BeiDou short message data from the BeiDou satellite, the communication module calls the identity authentication module to complete the calculation of the public key and authenticates the BeiDou business terminal according to the signature result. At the same time, it calls the hardware cryptography module as required to realize the functions of signing, verifying signature, generating random numbers, calculating multiple points on the elliptic curve, and performing hash operations. The decrypted BeiDou short message data is sent to the short message data filtering module for format and content checks and filtering. Finally, the filtered secure data is sent to the BeiDou secure forwarding module, which forwards it to the corresponding business server.

[0036] As a preferred technical solution of the present invention: the Beidou access gateway is connected to the Beidou satellite in sequence via a switch and a Beidou command unit, and the Beidou security key management center and each business server are connected to the Beidou access gateway via a switch.

[0037] The BeiDou short message secure communication method and system based on domestically developed cryptography described in this invention has the following technical advantages compared with existing technologies:

[0038] (1) The present invention designs a Beidou short message secure communication method based on domestic cryptography. For the communication between each Beidou service terminal and the Beidou access gateway via Beidou satellite access to each service server, a Beidou security key management center is introduced to distribute keys and a certificateless authentication mechanism combined with national cryptographic algorithms is designed to realize identity authentication and key negotiation between each Beidou service terminal and the Beidou access gateway. Based on the successful authentication and negotiation, the Beidou service terminal communicates with the service server via Beidou access gateway for Beidou short message service. The design avoids certificate management and key custody issues, saves resources, and adopts national cryptographic key negotiation mechanism to negotiate session keys. The interaction process is simple and does not require the participation of protection keys, ensuring the security of Beidou short messages during satellite transmission. At the same time, it realizes two-way identity authentication between the terminal and the gateway, protecting the service system from interference or illegal access. Attached Figure Description

[0039] Figure 1 This is a schematic diagram of the system architecture of the BeiDou short message secure communication method based on domestic cryptography designed in this invention;

[0040] Figure 2 This is a schematic diagram of the architecture of the BeiDou secure access module in this invention.

[0041] Figure 3 This is a schematic diagram of the architecture of the BeiDou access gateway in the design of this invention;

[0042] Figure 4 This is an interactive schematic diagram of step A in the BeiDou short message secure communication method based on domestic cryptography designed in this invention;

[0043] Figure 5 This is an interactive schematic diagram of step B in the BeiDou short message secure communication method based on domestic cryptography designed in this invention;

[0044] Figure 6 This is a flowchart of step B in the BeiDou short message secure communication method based on domestic cryptography designed in this invention. Detailed Implementation

[0045] The specific embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

[0046] This invention designs a BeiDou short message secure communication method and system based on domestically developed cryptography, such as... Figure 1 As shown, based on the actual application scenario of each BeiDou service terminal accessing the BeiDou satellite, and the BeiDou security key management center and each service server accessing the BeiDou satellite via the BeiDou access gateway, the system realizes communication between each BeiDou service terminal and each service server regarding BeiDou short messages. In practical application, the system design here includes a BeiDou security access module and a BeiDou RDSS / RNSS user terminal corresponding to each BeiDou service terminal. Each BeiDou service terminal connects to its corresponding BeiDou security access module and BeiDou RDSS / RNSS user terminal in sequence before accessing the BeiDou satellite. The BeiDou access gateway connects to the BeiDou satellite in sequence via a switch and a BeiDou command unit. The BeiDou security key management center and each service server are connected to the BeiDou access gateway via a switch.

[0047] Among them, the structures of each BeiDou security access module are the same, such as Figure 2 As shown, the BeiDou secure access module includes a BeiDou secure communication module, and a short message data filtering module, an identity authentication module, and a hardware cryptographic module, all connected to the BeiDou secure communication module. The BeiDou service terminal connects to the corresponding BeiDou RDSS / RNSS user terminal via the BeiDou secure communication module within the BeiDou secure access module. The short message data filtering module checks the format and content of the BeiDou short message data collected by the BeiDou service terminal, filtering out illegal data. The hardware cryptographic module provides the BeiDou secure communication module with services such as random number generation, signature verification, encryption / decryption, hash calculation, and multi-point calculation on elliptic curves through an API interface, as well as providing secure storage for keys and unique device identifiers (IDs). The identity authentication module performs public key calculation and performs identity authentication based on the signature result.

[0048] like Figure 3 As shown, the BeiDou access gateway includes a communication module, and short message data filtering module, identity authentication module, hardware cryptography module, and BeiDou secure forwarding module, all connected to the communication module. The BeiDou security key management center is connected to the BeiDou secure forwarding module in the BeiDou access gateway, and the communication module in the BeiDou access gateway is connected to the BeiDou satellite. After receiving BeiDou short message data from the BeiDou satellite, the communication module calls the identity authentication module to calculate the public key and authenticate the BeiDou service terminal based on the signature result. At the same time, it calls the hardware cryptography module as required to perform signature, signature verification, random number generation, calculation of multiple points on the elliptic curve, and hash operation functions. The decrypted BeiDou short message data is sent to the short message data filtering module for format and content checks and filtering. Finally, the filtered secure data is sent to the BeiDou secure forwarding module, which forwards it to the corresponding service server.

[0049] Based on the above-mentioned system design, each BeiDou service terminal, through its connected BeiDou security access module, performs the following steps A to B to achieve communication between each BeiDou service terminal and each service server regarding BeiDou short messages.

[0050] Step A. Based on the BeiDou Security Key Management Center and combined with national cryptographic algorithms, generate complete private keys and partial public keys corresponding to the BeiDou access gateway and each BeiDou service terminal.

[0051] In practical applications, step A above refers to the BeiDou access gateway and each BeiDou service terminal as communication targets, such as... Figure 4 As shown, the specific design executes the following steps A1 to A3 to obtain the complete private key and partial public key corresponding to each communication object, namely the complete private key and partial public key corresponding to the Beidou access gateway and each Beidou service terminal.

[0052] Step A1. The communication object generates a random number d1 and bases it on the finite field F. q Elliptic curve E(F) q The base point G on the elliptic curve E(F) q The multiplication operation is performed, i.e., P1 = [d1]G, to calculate the public parameter P1 corresponding to the communication object, and then combined with the unique device identifier ID of the communication object, and sent to the Beidou Security Key Management Center, and then proceed to step A2.

[0053] Step A2. The Beidou Security Key Management Center generates a random number k. Using P = [k]G + P1 = (x, y), it calculates the partial public key P corresponding to the communication object. (x, y) represents P with respect to the elliptic curve E(F... q The coordinates of the point on the ), and based on h1=A(x||ID||y), according to d2=k+S mh1, calculate and obtain the partial private key d2 corresponding to the communication object, then send the partial public key P and the partial private key d2 to the communication object, and then proceed to step A3; where S m This indicates the master private key preset by the BeiDou Security Key Management Center, and the master public key pair (PK) preset by the BeiDou Security Key Management Center. m ,S m Satisfying PK m =[S m G, PK m This indicates the master public key preset by the Beidou Security Key Management Center, and A indicates the first preset national cryptographic algorithm, such as the SM3 national cryptographic algorithm used in specific implementation.

[0054] Step A3. The communication object calculates its corresponding complete private key d based on d = d1 + d2, and stores its corresponding complete private key d and partial public key P.

[0055] Step B. For each BeiDou service terminal, based on the national cryptographic algorithm and the certificateless authentication mechanism, realize identity authentication and key negotiation between the BeiDou service terminal and the BeiDou access gateway. If both authentication and negotiation are successful, the BeiDou service terminal communicates with the service server via the BeiDou access gateway. If at least one of the authentication and negotiation fails, the BeiDou service terminal does not communicate with the service server.

[0056] In practical applications, step B above is applied to various BeiDou service terminals, such as... Figure 5 and Figure 6 As shown, perform steps B1 to B7 to achieve identity authentication and key negotiation between the BeiDou service terminal and the BeiDou access gateway.

[0057] Step B1. The Beidou service terminal generates a random number R. A The key is sent to the BeiDou access gateway to execute a key negotiation request, and the BeiDou service terminal uses its complete private key d to call the SM2 national cryptographic algorithm to process the random number R. A Perform a digital signature to obtain a digital signature (r,s), and combine it with its unique device identifier ID and part of its public key P=(x,y), send it to the Beidou access gateway to execute an identity authentication request, and then proceed to step B2.

[0058] Step B2. Based on the unique device identifier ID from the BeiDou service terminal and a partial public key P = (x, y), the BeiDou access gateway applies PK = P + h2·PK according to h2 = A(x||ID||y). m Obtain the complete public key PK of the Beidou service terminal, and use the complete public key PK of the Beidou service terminal to call the SM2 national cryptographic algorithm to verify whether the random number in the digital signature (r,s) from the Beidou service terminal is equal to R from the Beidou service terminal.A If yes, it indicates successful verification, meaning the BeiDou service terminal has successfully authenticated its identity with the BeiDou access gateway, and then proceeds to step B3; otherwise, it indicates verification failure, meaning the BeiDou service terminal failed to authenticate its identity with the BeiDou access gateway, the BeiDou access gateway rejects the BeiDou service terminal's access, and communication ends; where PK m This indicates the master public key preset by the BeiDou Security Key Management Center, and the master public-private key pair (PK) preset by the BeiDou Security Key Management Center. m ,S m Satisfying PK m =[S m G, S m G represents the master private key preset by the Beidou Security Key Management Center, and G represents the key based on the finite field F. q Elliptic curve E(F) q The base point on ).

[0059] Step B3. The BeiDou access gateway generates a random number R. B Combined with R from Beidou service terminals A The SM2 national cryptographic algorithm key exchange protocol is invoked to generate session key K. B With key confirmation information S B , random number R B and key confirmation information S B Send it to the Beidou service terminal; and the Beidou access gateway uses its complete private key d' to call the SM2 national cryptographic algorithm to process the random number R. B Perform a digital signature to obtain a digital signature (r', s'), and combine it with its unique identifier ID' and its partial public key P' = (x', y'), send it to the Beidou service terminal, and then proceed to step B4.

[0060] Step B4. Based on the unique device identifier ID' from the BeiDou access gateway and the partial public key P' = (x', y'), the BeiDou service terminal applies PK' = P' + h3·PK according to h3 = A(x'||ID'||y'). m Obtain the complete public key PK' of the BeiDou access gateway, and use the complete public key PK' of the BeiDou access gateway to call the SM2 national cryptographic algorithm to verify whether the random number in the digital signature (r', s') from the BeiDou access gateway is equal to R from the BeiDou access gateway. B If yes, it means the verification is successful, that is, the BeiDou access gateway has successfully authenticated the identity of the BeiDou service terminal, and then proceeds to step B5; otherwise, it means the verification has failed, that is, the BeiDou access gateway has failed to authenticate the identity of the BeiDou service terminal, the BeiDou access gateway refuses the BeiDou service terminal to access, and the communication ends.

[0061] Step B5. The Beidou service terminal, according to R... A Combined with the random number R from the BeiDou access gatewayB The SM2 national cryptographic algorithm key exchange protocol is invoked to generate session key K. A The key verification information S1 is compared with the key confirmation information S1 from the Beidou access gateway, and it is verified whether the key verification information S1 is equal to the key confirmation information S from the Beidou access gateway. B If yes, it means that the BeiDou access gateway has successfully confirmed the key with the BeiDou service terminal, and then proceeds to step B6; otherwise, it means that the BeiDou access gateway has failed to confirm the key with the BeiDou service terminal, the BeiDou access gateway refuses the BeiDou service terminal access, and the communication ends.

[0062] Step B6. The Beidou service terminal, according to R... A Combined with the random number R from the BeiDou access gateway B The key exchange protocol of the SM2 national cryptographic algorithm is invoked to generate key confirmation information S. A The data is then sent to the BeiDou access gateway, and then proceeds to step B7.

[0063] Step B7. The BeiDou access gateway, according to R... B Combined with random number R from Beidou service terminal A The key exchange protocol of the SM2 national cryptographic algorithm is invoked to generate key verification information S2, and to verify whether key verification information S2 is equal to key confirmation information S from the Beidou service terminal. A If yes, it means that the BeiDou service terminal has successfully confirmed the key with the BeiDou access gateway, that is, the key negotiation and identity authentication between the BeiDou service terminal and the BeiDou access gateway have been successful; otherwise, it means that the BeiDou service terminal has failed to confirm the key with the BeiDou access gateway, the BeiDou access gateway refuses the BeiDou service terminal to access, and the communication ends.

[0064] Based on the above design, in step B, assuming that both identity authentication and key negotiation between the BeiDou service terminal and the BeiDou access gateway are successful, as follows: Figure 5 and Figure 6 As shown, the BeiDou service terminal communicates with the service server via the BeiDou access gateway using the following method:

[0065] The BeiDou service terminal uses the SM3 hash algorithm to process the plaintext message m and the current timestamp T to obtain H(m||T), and then applies the session key K. A Encrypt the plaintext message m and the current timestamp T to obtain... The data is transmitted via BeiDou satellite to the BeiDou access gateway; the BeiDou access gateway uses the session key K. B The data sent from the Beidou service terminal is decrypted to obtain the corresponding plaintext, and then forwarded to the corresponding service server to realize the Beidou short message service communication between the Beidou service terminal and the service server.

[0066] The BeiDou access gateway receives data from the service server and, by applying the inverse of the above method, sends the data to the BeiDou service terminal, thus enabling BeiDou short message service communication between the service server and the BeiDou service terminal.

[0067] The above design is based on a domestically developed cryptographic method for secure BeiDou short message communication. For communication between BeiDou service terminals and the BeiDou access gateway via BeiDou satellites and various service servers, a BeiDou secure key management center is introduced to distribute keys. A certificate-free authentication mechanism incorporating domestic cryptographic algorithms is designed to enable authentication and key negotiation between each BeiDou service terminal and the BeiDou access gateway. If both authentication and negotiation are successful, the BeiDou service terminal can then communicate with the service server via the BeiDou access gateway using BeiDou short message service. This design avoids certificate management and key escrow issues, saving resources. Furthermore, the use of a domestic cryptographic key negotiation mechanism to negotiate session keys simplifies the interaction process, eliminates the need for protection keys, and ensures the security of BeiDou short messages during satellite transmission. Simultaneously, it achieves two-way authentication between the terminal and the gateway, protecting the service system from interference or unauthorized access.

[0068] The embodiments of the present invention have been described in detail above with reference to the accompanying drawings. However, the present invention is not limited to the above embodiments. Within the scope of knowledge possessed by those skilled in the art, various changes can be made without departing from the spirit of the present invention.

Claims

1. A Beidou short message security communication method based on a domestic cipher, characterized in that: Based on the access of each BeiDou service terminal to the BeiDou satellite, and the access of the BeiDou Security Key Management Center and each service server to the BeiDou satellite via the BeiDou access gateway, the following steps are taken to realize the communication between each BeiDou service terminal and each service server regarding BeiDou short messages. Step A. Based on the BeiDou Security Key Management Center and combined with national cryptographic algorithms, generate complete private keys and partial public keys corresponding to the BeiDou access gateway and each BeiDou service terminal respectively; In step A above, the BeiDou access gateway and each BeiDou service terminal are taken as communication objects, and the following steps A1 to A3 are executed to obtain the complete private key and partial public key corresponding to each communication object, that is, the complete private key and partial public key corresponding to the BeiDou access gateway and each BeiDou service terminal respectively. Step A1. The communication object generates random numbers. And based on finite fields Elliptic curve The base point on According to the elliptic curve The doubling operation, i.e. Calculate the public parameters corresponding to the communication object. Combined with the unique device identifier of the communication object Send it to the Beidou Security Key Management Center, and then proceed to step A2; Step A2. The Beidou Security Key Management Center generates random numbers. ,according to Calculate the partial public key corresponding to the communication object. and based on ,according to Calculate and obtain a portion of the private key corresponding to the communication object. Then, part of the public key and part of the private key Send to the communication object, then proceed to step A3; wherein, This indicates the master private key preset by the BeiDou Security Key Management Center, and the master public key pair preset by the BeiDou Security Key Management Center. satisfy , This indicates the master public key preset by the Beidou Security Key Management Center. This indicates the first preset national cryptographic algorithm; Step A3. The communication object is based on Calculate to obtain its corresponding complete private key And store its corresponding complete private key. With partial public keys ; Step B. For each BeiDou service terminal, based on the national cryptographic algorithm and the certificateless authentication mechanism, realize identity authentication and key negotiation between the BeiDou service terminal and the BeiDou access gateway. If both authentication and negotiation are successful, the BeiDou service terminal communicates with the service server via the BeiDou access gateway. If at least one of the authentication and negotiation fails, the BeiDou service terminal does not communicate with the service server.

2. The BeiDou short message secure communication method based on domestically developed cryptography as described in claim 1, characterized in that: In step B, steps B1 to B7 are executed for each BeiDou service terminal to achieve identity authentication and key negotiation between the BeiDou service terminal and the BeiDou access gateway. Step B1. The BeiDou service terminal generates random numbers. The key is sent to the BeiDou access gateway to execute a key negotiation request, and the BeiDou service terminal uses its complete private key. Call the second preset national cryptographic algorithm For random numbers Perform digital signature, obtain digital signature and combined with its unique device identifier and some of its public keys The request is sent to the BeiDou access gateway to execute the identity authentication request, and then proceeds to step B2. Step B2. The BeiDou access gateway is based on a unique device identifier from the BeiDou service terminal. Partial public key ,according to ,application Obtain the complete public key of the Beidou service terminal And apply the complete public key of the Beidou business terminal Call the second preset national cryptographic algorithm Verify digital signatures from BeiDou service terminals Is the random number in the data equal to the one from the Beidou service terminal? If yes, it means the verification is successful, that is, the Beidou service terminal has successfully authenticated its identity with the Beidou access gateway, and then proceed to step B3; Otherwise, it indicates verification failure, meaning the BeiDou service terminal failed to authenticate with the BeiDou access gateway, the BeiDou access gateway refused access to the BeiDou service terminal, and communication ended; among them, This indicates the first preset national cryptographic algorithm. This indicates the master public key preset by the BeiDou Security Key Management Center, and the master public-private key pair preset by the BeiDou Security Key Management Center. satisfy , This indicates the master private key preset by the Beidou Security Key Management Center. Representation based on finite field Elliptic curve The base point on; Step B3. The BeiDou access gateway generates random numbers. Combined with data from Beidou service terminals Call the second preset national cryptographic algorithm The key exchange protocol generates session keys. Confirmation information with key , random number and key confirmation information Send it to the BeiDou service terminal; and the BeiDou access gateway uses its complete private key. Call the second preset national cryptographic algorithm For random numbers Perform digital signature, obtain digital signature and combined with its unique identifier and part of its public key It is sent to the Beidou service terminal, and then proceeds to step B4; Step B4. The BeiDou service terminal is based on a unique device identifier from the BeiDou access gateway. Partial public key ,according to ,application Obtain the complete public key of the BeiDou access gateway. And apply the complete public key of the Beidou access gateway. Call the second preset national cryptographic algorithm Verify the digital signature from the BeiDou access gateway. Is the random number in the data equal to the one from the BeiDou access gateway? If yes, it means the verification is successful, that is, the BeiDou access gateway has successfully authenticated the identity of the BeiDou service terminal, and then proceeds to step B5; otherwise, it means the verification has failed, that is, the BeiDou access gateway has failed to authenticate the identity of the BeiDou service terminal, the BeiDou access gateway refuses the BeiDou service terminal to access, and the communication ends. Step B5. The Beidou service terminal, according to... Combined with random numbers from the BeiDou access gateway Call the second preset national cryptographic algorithm The key exchange protocol generates session keys. With key verification information And verify the key verification information. Is it equal to the key confirmation information from the BeiDou access gateway? If yes, it means that the BeiDou access gateway has successfully confirmed the key to the BeiDou service terminal, and then proceed to step B6; otherwise, it means that the BeiDou access gateway has failed to confirm the key to the BeiDou service terminal, the BeiDou access gateway refuses the BeiDou service terminal access, and the communication ends. Step B6. The Beidou service terminal, according to... Combined with random numbers from the BeiDou access gateway Call the second preset national cryptographic algorithm The key exchange protocol generates key confirmation information. And send it to the Beidou access gateway, and then proceed to step B7; Step B7. BeiDou access gateway according to Combined with random numbers from Beidou service terminals Call the second preset national cryptographic algorithm The key exchange protocol generates key verification information. And verify the key verification information. Is it equal to the key confirmation information from the Beidou service terminal? If yes, it means that the BeiDou service terminal has successfully confirmed the key with the BeiDou access gateway, that is, the key negotiation and identity authentication between the BeiDou service terminal and the BeiDou access gateway have been successful; otherwise, it means that the BeiDou service terminal has failed to confirm the key with the BeiDou access gateway, the BeiDou access gateway refuses the BeiDou service terminal to access, and the communication ends.

3. The BeiDou short message secure communication method based on domestically developed cryptography as described in claim 1 or 2, characterized in that: In step B, based on the successful identity authentication and key negotiation between the Beidou service terminal and the Beidou access gateway, the Beidou service terminal communicates with the service server via the Beidou access gateway using the following method: Beidou service terminals adopt Hash algorithms for plaintext messages and current timestamp Processing, obtaining and further apply session keys Regarding plaintext messages and current timestamp Encryption processing is performed to obtain The data is transmitted via BeiDou satellites to the BeiDou access gateway; the BeiDou access gateway uses the session key. The data sent from the Beidou service terminal is decrypted to obtain the corresponding plaintext, and then forwarded to the corresponding service server to realize the Beidou short message service communication between the Beidou service terminal and the service server. The BeiDou access gateway receives data from the service server and, by applying the inverse of the above method, sends the data to the BeiDou service terminal, thus enabling BeiDou short message service communication between the service server and the BeiDou service terminal.

4. A BeiDou short message secure communication method based on domestically developed cryptography as described in claim 1 or 2, characterized in that: The first preset national cryptographic algorithm for .

5. The BeiDou short message secure communication method based on domestically developed cryptography as described in claim 2, characterized in that: The second preset national cryptographic algorithm for .

6. A system for implementing the BeiDou short message secure communication method based on domestically developed cryptography as described in any one of claims 1 to 5, characterized in that: This includes a BeiDou security access module and a BeiDou RDSS / RNSS user terminal corresponding to each BeiDou service terminal. Each BeiDou service terminal connects to its corresponding BeiDou security access module and BeiDou RDSS / RNSS user terminal in sequence to access the BeiDou satellite. Each BeiDou service terminal, through its connected BeiDou security access module, performs steps A to B in conjunction with the BeiDou service terminal to realize communication between each BeiDou service terminal and each service server regarding BeiDou short messages.

7. The system of a Beidou short message secure communication method based on domestically developed cryptography as described in claim 6, characterized in that: Each BeiDou security access module has the same structure. Each BeiDou security access module includes a BeiDou secure communication module, and a short message data filtering module, an authentication module, and a hardware cryptographic module, each connected to the BeiDou secure communication module. The BeiDou service terminal connects to the corresponding BeiDou RDSS / RNSS user terminal via the BeiDou secure communication module within the corresponding BeiDou security access module. The short message data filtering module checks the format and content of the BeiDou short message data collected by the BeiDou service terminal, filtering out illegal data. The hardware cryptographic module provides the BeiDou secure communication module with services such as random number generation, signature verification, signature authentication, encryption / decryption, hash calculation, and multi-point calculation on elliptic curves, as well as providing keys and unique device identifiers via an API interface. Provides secure storage; the identity authentication module is used to calculate the public key and perform identity authentication based on the signature result.

8. The system of a Beidou short message secure communication method based on domestically developed cryptography as described in claim 6, characterized in that: The BeiDou access gateway includes a communication module and a short message data filtering module, an identity authentication module, a hardware cryptography module, and a BeiDou secure forwarding module, all connected to the communication module. The BeiDou security key management center is connected to the BeiDou secure forwarding module in the BeiDou access gateway, and the communication module in the BeiDou access gateway is connected to the BeiDou satellite. After receiving BeiDou short message data from the BeiDou satellite, the communication module calls the identity authentication module to calculate the public key and authenticate the BeiDou service terminal based on the signature result. At the same time, it calls the hardware cryptography module as required to perform signature, signature verification, random number generation, calculation of multiple points on the elliptic curve, and hash operation functions. The decrypted BeiDou short message data is sent to the short message data filtering module for format and content checks and filtering. Finally, the filtered secure data is sent to the BeiDou secure forwarding module, which forwards it to the corresponding service server.

9. The system of a Beidou short message secure communication method based on domestically developed cryptography according to claim 6, characterized in that: The BeiDou access gateway connects to the BeiDou satellites via a switch and a BeiDou command unit in sequence. The BeiDou security key management center and each business server are connected to the BeiDou access gateway via a switch.

Images