An identity authentication method in satellite-to-ground random access

Abstract

The present invention provides an identity authentication method in satellite-to-ground random access, comprising: sending a forward broadcast frame to enable an on-orbit satellite to obtain a first group of response numbers based on the forward broadcast frame and return a return access frame containing the first group of response numbers; obtaining a first response number based on the return access frame; performing an identity confirmation of the on-orbit satellite based on the first response number and the first group of response numbers, and if the confirmation is successful, obtaining a second group of response numbers; sending a network access response frame containing the second group of response numbers to enable the on-orbit satellite to obtain a second response number based on the network access response frame, and then enabling the on-orbit satellite to perform a second identity confirmation based on the second response number and the second group of response numbers, and if the confirmation is successful, returning a network access confirmation frame to complete the identity authentication in satellite-to-ground random access. The identity authentication method realizes two-way identity authentication between a ground node and an on-orbit satellite through a forward broadcast frame, a return access frame, a network access response frame and a network access confirmation frame, thereby improving the security of satellite-to-ground random access.

Description

Technical Field

[0001] The present invention relates to the field of aerospace measurement and control technology, and in particular to an identity authentication method in satellite-to-ground random access. Background Art

[0002] In-orbit satellites exchange information with the ground measurement, operation and control network through wireless radio frequency signals. Due to the spatial openness of the interaction method, they may be subject to unintentional interference or malicious attacks from the outside world. For a long time, aerospace measurement and control technology has been continuously updated in terms of signal modulation methods, working systems, coding methods, data encryption methods, etc., to ensure the normal development of measurement and control services. In particular, after the emergence of the spread spectrum measurement and control system, different spread spectrum polynomials are set for each group of satellites, and different spread spectrum code groups are assigned to different satellites. Due to the pseudo-randomness of the spread spectrum sequence and the confidentiality of the spread spectrum code group, the reliability of satellite-ground identity authentication and the security of information interaction are guaranteed.

[0003] With the construction of large satellite constellations, the number of satellites in orbit will increase rapidly, and the traditional planned link-building measurement and control mode will inevitably change to the random access measurement and control mode. At present, many research institutions have analyzed and discussed the random access measurement and control technology, and have designed the system composition structure and satellite-ground interaction process under the random access system. In terms of system structure, a "dual-channel design" is carried out, that is, both the satellite and the ground need to add an "access channel" (also called a "control channel") in addition to the traditional measurement and control channel, and control the opening or closing of the measurement and control channel through the access channel status; in terms of the interaction process, the search, capture, authentication, network access, business development, and network disconnection links are designed.

[0004] In the random access mode, due to the uncertainty of the link establishment requirements between the in-orbit satellite and the ground measurement and control network, the access application of a single satellite in the constellation to a single node of the ground measurement and control network occurs randomly. In order to ensure the accuracy and security of the satellite-ground interaction process, identity authentication becomes an indispensable part of the access process. However, the random access system and the traditional measurement and control system have significant differences in system structure and interaction process, making it difficult to use existing means for identity authentication technology.

[0005] In recent years, some scholars have studied the satellite-ground identity authentication methods under the random access mode. For example, in 2017, Fu Jiang et al. proposed "A method for in-orbit satellite identity authentication", which performs position authentication based on the relative position of the ground station and the satellite, and uses public key verification and private key decryption in the interactive authentication process to achieve two-way authentication between the satellite and the ground; in 2020, Cui Lidong / Zheng Xuan et al. proposed "A GEO satellite Internet of Things authentication method and system", in which the terminal generates a random number based on the time frame number, and uses the random number and the key in the SIM (Subscriber Identity Module) card to generate authentication data through an algorithm, and sends the IMSI (International Mobile Subscriber Identity) information and authentication data to the ground station via satellite. The ground station generates the same random number as the terminal based on the received frame number and time, and then uses the random number and the key corresponding to the satellite IMSI card to generate authentication data according to the same algorithm as the terminal, and compares the authentication data sent by the terminal with the authentication data calculated locally to complete the authentication process.

[0006] The above-mentioned satellite-to-ground identity authentication methods have technical advancement and practical value for specific scenarios and conditions. However, in the measurement and control mode of large-scale satellite constellations and ground nodes being randomly accessed, the existing technologies have at least the following three deficiencies:

[0007] 1. Using the visibility of satellites and ground nodes as one of the judgment bases, both parties need to call the satellite's real-time orbital elements and orbit calculation software to calculate visibility, which requires a large amount of calculation and a long time;

[0008] 2. Use the current time frame number to estimate the time when the ground station receives the request and generate a random number as a calculation parameter. Because the relative position between the medium and low orbit satellite and the ground node continues to change, the communication delay cannot be estimated, and the time data cannot be used to participate in the calculation of the random number. Therefore, the method of using the time frame number to participate in the calculation is not suitable for the random number generation of medium and low orbit satellites when they are randomly accessed;

[0009] 3. It focuses on one-way authentication. Only the ground network verifies the user's identity. There is a lack of user authentication of network nodes, which poses a risk of the satellite being "induced". Summary of the invention

[0010] The present invention provides an identity authentication method in satellite-to-ground random access to solve the above technical problems, and adopts a two-way interactive method to realize the identity authentication of ground nodes and on-orbit satellites, thereby improving the security of satellite-to-ground random access.

[0011] In order to solve the above technical problems, an embodiment of the present invention provides an identity authentication method in satellite-to-ground random access, comprising the following steps: sending a forward broadcast frame to enable the on-orbit satellite to obtain a first group of response numbers based on the forward broadcast frame and return a return access frame containing the first group of response numbers; obtaining a first response number based on the return access frame; performing an identity confirmation of the on-orbit satellite based on the first response number and the first group of response numbers, and if the confirmation is successful, obtaining a second group of response numbers; sending a network access response frame containing the second group of response numbers to enable the on-orbit satellite to obtain a second response number based on the network access response frame, and then enabling the on-orbit satellite to perform a second identity confirmation based on the second response number and the second group of response numbers, and if the confirmation is successful, returning the network access confirmation frame to complete the identity authentication in satellite-to-ground random access.

[0012] The executor of the above scheme is the ground node. The scheme realizes two-way interaction between the ground node and the in-orbit satellite through forward broadcast frames, return access frames, network access response frames and network access confirmation frames. The two-way interaction method can quickly and effectively realize the identity authentication of the ground node and the in-orbit satellite, thereby improving the security of the satellite-to-ground access.

[0013] Further, the sending of a forward broadcast frame so that the on-orbit satellite obtains a first group of response numbers based on the forward broadcast frame and returns a return access frame containing the first group of response numbers includes: the forward broadcast frame includes access node ID information and a random number; the sending of a forward broadcast frame so that the on-orbit satellite obtains a first group of response numbers based on a random number and a preset first algorithm and returns a return access frame containing the first group of response numbers based on the access node ID information.

[0014] Further, the method of obtaining a first group of response numbers based on a random number and a preset first algorithm and returning a return access frame containing the first group of response numbers based on the access node ID information is specifically as follows: obtaining a first group of response numbers based on a random number and a first algorithm f1, specifically expressed as: first group of response numbers = f1 (satellite code, satellite authentication key, random number); the return access frame includes access node ID information, satellite ID information and the first group of response numbers.

[0015] Further, the obtaining of the first response number based on the return access frame is specifically: obtaining satellite ID information and a first group of response numbers based on the return access frame; obtaining a satellite code and a satellite authentication key corresponding to the in-orbit satellite according to the satellite ID information; and obtaining the first response number based on the satellite code, the satellite authentication key, a random number and a preset first algorithm.

[0016] Furthermore, the in-orbit satellite identity confirmation is performed based on the first response number and the first group of response numbers. If the confirmation is successful, a second group of response numbers is obtained. Specifically, the consistency of the first response number and the first group of response numbers is confirmed. If they are consistent, the identity confirmation is successful and the second group of response numbers are obtained: the node code, the local authentication key and the random number are obtained, and the second group of response numbers are obtained based on a preset second algorithm.

[0017] Furthermore, the node code, local authentication key and random number are obtained, and a second group of response numbers are obtained based on a preset second algorithm, specifically: the node code, local authentication key and random number are obtained; the second group of response numbers are obtained based on the second algorithm f2, specifically expressed as: the second group of response numbers = f2 (node ​​code, local authentication key, random number).

[0018] Further, the sending of a network access response frame containing a second group of response numbers so that the on-orbit satellite obtains a second response number based on the network access response frame, and then the on-orbit satellite performs a secondary identity confirmation based on the second response number and the second group of response numbers, and if the confirmation is successful, returns a network access confirmation frame to complete the identity authentication in the satellite-to-ground random access, including: the network access response frame includes node ID information, satellite ID information, and the second group of response numbers; sending a network access response frame containing the second group of response numbers so that the on-orbit satellite obtains a node code, a local authentication key, and a random number based on the node ID information, and then the on-orbit satellite obtains a second response number based on the second algorithm, the node code, the local authentication key, and the random number, so that the on-orbit satellite performs a secondary identity confirmation based on the second response number and the second group of response numbers, and if the confirmation is successful, returns a network access confirmation frame to complete the identity authentication in the satellite-to-ground random access.

[0019] Further, the secondary identity confirmation is performed based on the second response number and the second group of response numbers. If the confirmation is successful, a network access confirmation frame is returned to complete the identity authentication in the satellite-to-ground access. Specifically, the consistency of the second response number and the second group of response numbers is confirmed. If they are consistent, the secondary identity confirmation is successful and a network access confirmation frame is returned to complete the identity authentication in the satellite-to-ground access.

[0020] Furthermore, the first algorithm and the second algorithm are both hash algorithms.

[0021] In the above scheme, the calculation of the first group response number, the first response number, the second group response number and the second response number is realized by the hash algorithm, and there is no need to perform visibility calculation of the positions of both the satellite and the ground. This can effectively reduce the amount of calculation of the in-orbit satellite and the ground node in the authentication process and improve the efficiency of satellite-ground random access.

[0022] It should be noted that the first algorithm and the second algorithm are not unique. As long as the calculation of the number of responses can be achieved, this solution can achieve two-way authentication between ground nodes and in-orbit satellites by changing the parameters of the algorithms and responses.

[0023] Furthermore, the random number includes a first random number and a second random number; wherein: the first random number is used to obtain a first group of response numbers and a first response number; and the second random number is used to obtain a second group of response numbers and a second response number.

[0024] In the above scheme, the first random number and the second random number may be the same or different. When the first random number and the second random number are different, the uniqueness of the primary identity authentication and the secondary identity authentication can be ensured, further ensuring the security of the identity authentication process.

[0025] It should be noted that the random number can be directly generated by the ground node without the need to calculate the satellite-to-ground delay parameter, thereby making the identity authentication method applicable to random access between medium and low orbit satellites and ground nodes with uncertain delay.

[0026] The present invention provides an identity authentication method in satellite-to-ground random access, wherein information such as a random number, a first group response number, a first response number, a second group response number and a second response number required for identity authentication are embedded in the original frame of satellite-to-ground interaction, including a forward broadcast frame, a return access frame, a network access response frame and a network access confirmation frame, and corresponding authentication information (the first group response number, the first response number, the second group response number and the second response number) can be carried through a specified field on the frame, without the need to set a transmission frame separately, thereby reducing the authentication interaction link of the transmission frame, effectively saving signal transmission time, and improving the efficiency of satellite-to-ground interaction. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 A schematic flow chart of an identity authentication method in satellite-to-ground random access provided by an embodiment of the present invention;

[0028] Figure 2 A specific authentication flow chart of an identity authentication method in satellite-to-ground random access provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0029] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0030] See also Figure 1 In the random access measurement and control scenario of a large-scale satellite constellation, this embodiment provides an identity authentication method in random satellite-to-ground access, including the following steps:

[0031] S1: Send a forward broadcast frame to enable the on-orbit satellite to obtain a first set of response numbers based on the forward broadcast frame and return a return access frame containing the first set of response numbers;

[0032] S2: Obtain the first response number based on the return access frame;

[0033] S3: Perform an identity confirmation of the on-orbit satellite based on the first response number and the first group of response numbers. If the confirmation is successful, obtain the second group of response numbers.

[0034] S4: Send a network access response frame containing a second group of response numbers, so that the on-orbit satellite obtains the second response number based on the network access response frame, and then the on-orbit satellite performs a secondary identity confirmation based on the second response number and the second group of response numbers. If the confirmation is successful, the network access confirmation frame is returned to complete the identity authentication in the satellite-to-ground random access.

[0035] In the specific implementation process of this embodiment, the executor is a ground node, and two-way interaction between the ground node and the on-orbit satellite is achieved through forward broadcast frames, return access frames, network access response frames and network access confirmation frames. The two-way interaction method can quickly and effectively realize the identity authentication of the ground node and the on-orbit satellite, thereby improving the security of satellite-to-ground access.

[0036] Specifically, see Figure 2 , specifically providing a schematic diagram of the authentication interaction execution between the ground node and the satellite in orbit. Among them: the measurement and control equipment of the ground node and the satellite in orbit are both equipped with measurement and control channels and access channels, and the opening and closing of the measurement and control channels are controlled according to the interaction of the access channels. In addition, the user satellite code and its corresponding code are stored in the random access function module of the ground node; the ground node code and its corresponding code are stored in the random access module of the satellite.

[0037] The ground node can periodically send forward broadcast frames to space. In addition to the access node ID information and random numbers, the forward broadcast frames can also contain information such as frame type and time code; the random number can be provided by the random number generation circuit of the ground node. The ground node sends a forward broadcast frame. After the in-orbit satellite enters the signal coverage area of ​​the ground node, if there is a need to establish a link, it can receive and parse the forward broadcast frame, and then obtain the access node ID (Identity document) information and the random number RAND. Using the satellite code IDsat, the satellite authentication key Ki and the random number RAND, according to the preset first algorithm f1, the in-orbit satellite can calculate the first set of response numbers RES, which are:

[0038] The first set of response numbers RES=f1 (satellite code IDsat, satellite authentication key Ki, random number RAND).

[0039] After obtaining the first group of response numbers RES, the in-orbit satellite can send a return access frame to the ground node. The return access frame includes access node ID information, satellite ID information and the first group of response numbers RES. It can also include satellite orbit information, service application type and access application level and other information to achieve normal information interaction between the satellite and the ground.

[0040] After receiving the return access frame sent by the in-orbit satellite, the ground node can demodulate the satellite ID information and the first group of response numbers RES, and search the satellite code IDsat and satellite authentication key Ki corresponding to the satellite ID information from the local database, and calculate the first response number XRES by combining the random number RAND and the first algorithm.

[0041] XRES=f1 (IDsat, Ki, RAND)

[0042] The ground node compares the consistency of the RES transmitted by the in-orbit satellite with the XRES calculated by itself. If the two are consistent, the identity authentication is passed once, the identity of the in-orbit satellite is confirmed, and the network access response frame can be sent to the in-orbit satellite; if they are inconsistent, the data is discarded and the network access response frame is not sent to the in-orbit satellite.

[0043] Specifically, after confirming the identity of the satellite in orbit, the ground node can use the second algorithm to calculate the second group of response numbers GRES according to the node code IDsta, the local authentication key Ki and the random number RAND, as follows:

[0044] GRES=f2 (IDsta, Ki, RAND)

[0045] Specifically, the ground node sends a network access response frame to the on-orbit satellite. The network access response frame may include node ID information, satellite ID information and a second group response number GRES, and may also include access response, post-network access work arrangements and other information.

[0046] After receiving the network access response frame, the satellite in orbit searches for the corresponding node code IDsta and local authentication key Ki according to the node ID information, combines the random number RAND and uses the second algorithm to calculate the second response number SRES, which is:

[0047] SRES=f2 (IDsta, Ki, RAND)

[0048] The in-orbit satellite compares SRES and GRES for consistency. If they are consistent, the secondary identity authentication is completed. The in-orbit satellite confirms the identity of the ground node and can send a network access confirmation frame to the ground node. If they are inconsistent, the access is terminated and the ground node uplink broadcast frame is searched again.

[0049] It should be noted that the satellite authentication key and the local authentication key can be secret keys, and the two can be the same or different. That is, the method provided in the above embodiment is a comparison method in which random numbers, identity codes and secret keys are involved in the calculation, which can be applied to identity authentication in the process of satellite-to-ground random access.

[0050] Specifically, the first algorithm and the second algorithm are both hash algorithms, which can be specifically expressed as:

[0051] RES=f1(IDsat,Ki,RAND)=RAND h(Ki||IDsat)

[0052] GRES=f2(IDsta,Ki,RAND)=RAND h(Ki||IDsta)

[0053] In the formula, "⊕" is the XOR operator in logical operations, "||" is the "concatenation" operator in the field of computers and cryptography, and "h()" is a hash function (Hash), which can be a cryptographic algorithm such as MD5, SHA-1, SHA-2, etc. That is, the hash function generates a hash value for the concatenated "Ki ||IDsat", and the hash value is XORed with RAND to obtain the corresponding response number.

[0054] It should be noted that the first algorithm and the second algorithm are not unique, as long as the calculation of the number of responses can be achieved, this embodiment can achieve two-way authentication between the ground node and the in-orbit satellite by changing the parameters of the algorithm and the response.

[0055] In this embodiment, the calculation of the first group response number, the first response number, the second group response number and the second response number is implemented by a hash algorithm, without the need to perform visibility calculations of the positions of both the satellite and the ground. This can effectively reduce the amount of calculations of the on-orbit satellite and the ground node during the authentication process and improve the efficiency of random access between the satellite and the ground.

[0056] Specifically, the random number includes a first random number and a second random number; wherein: the first random number is used to obtain a first group of response numbers and a first response number; the second random number is used to obtain a second group of response numbers and a second response number.

[0057] In this embodiment, the first random number and the second random number may be the same or different. When the first random number and the second random number are different, the uniqueness of the primary identity authentication and the secondary identity authentication can be ensured, further ensuring the security of the identity authentication process.

[0058] It should be noted that the random number can be directly generated by the ground node without the need to calculate the satellite-to-ground delay parameter, thereby making the identity authentication method applicable to random access between medium and low orbit satellites and ground nodes with uncertain delay.

[0059] The above embodiment provides an identity authentication method in satellite-to-ground random access, in which information such as the random number, the first group response number, the first response number, the second group response number and the second response number required for identity authentication are embedded in the original frame of satellite-to-ground interaction, including the forward broadcast frame, the return access frame, the network access response frame and the network access confirmation frame. The corresponding authentication information (the first group response number, the first response number, the second group response number and the second response number) can be carried through the specified field on the frame, without the need to set up a separate transmission frame, thereby reducing the authentication interaction link of the transmission frame, effectively saving signal transmission time, and improving the efficiency of satellite-to-ground interaction.

[0060] The above embodiment is an identity authentication method designed for the "ground node sends a forward broadcast frame" working mode. In this working mode, the in-orbit satellite in the broadcast signal coverage area sends a return access application to the ground node, and the forward broadcast frame, return access frame and network access response frame all contain authentication information. The satellite and the ground compare the set algorithms and parameters to complete the identity authentication process. This method only involves the generation of random numbers and the calculation of response numbers. There is no need to call complex algorithms, and the amount of calculation is small; and the parameters involved in the calculation include both random numbers and authentication keys and codes, which can ensure the security of the authentication process. This method uses a two-way interactive method to realize the identity authentication of the ground node and the in-orbit satellite, which greatly improves the security of the satellite-ground random access.

[0061] It should be noted that the authentication keys and algorithms involved in the method can be adaptively modified during actual application, such as replacing the authentication keys and algorithms through the management center to upgrade the corresponding equipment programs. At the same time, it is also convenient to add new satellite users and improve the controllability and applicability of the method.

[0062] The above is a preferred embodiment of the present invention. It should be pointed out that a person skilled in the art can make several improvements and modifications without departing from the principle of the present invention. These improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. An identity authentication method in satellite-to-ground random access, characterized in that: The following steps are involved: Sending a forward broadcast frame to enable the on-orbit satellite to obtain a first group of response numbers based on the forward broadcast frame and return a return access frame containing the first group of response numbers; Acquire a first response number based on the return access frame; Confirm the consistency of the first response number and the first group of response numbers. If they are consistent, the identity confirmation is passed once and the second group of response numbers is obtained; obtain the node code, the local authentication key and the random number, and obtain the second group of response numbers based on the preset second algorithm; The network access response frame includes node ID information, satellite ID information and the second group response number; A network access response frame containing a second group of response numbers is sent to enable the on-orbit satellite to obtain a node code, a local authentication key and a random number based on the node ID information, and then the on-orbit satellite obtains a second response number based on the second algorithm, the node code, the local authentication key and the random number, so that the on-orbit satellite performs a secondary identity confirmation based on the second response number and the second group of response numbers. If the confirmation is successful, a network access confirmation frame is returned to complete the identity authentication in the satellite-to-ground random access.

2. The identity authentication method in satellite-to-ground random access according to claim 1, characterized in that: The sending of the forward broadcast frame so that the on-orbit satellite obtains a first group of response numbers based on the forward broadcast frame and returns a return access frame containing the first group of response numbers includes: The forward broadcast frame includes access node ID information and a random number; A forward broadcast frame is sent to enable the on-orbit satellite to obtain a first group of response numbers based on a random number and a preset first algorithm and return a return access frame containing the first group of response numbers based on the access node ID information.

3. The identity authentication method in satellite-to-ground random access according to claim 2, characterized in that: The step of obtaining a first group of response numbers based on a random number and a preset first algorithm and returning a return access frame containing the first group of response numbers based on the access node ID information is specifically as follows: The first group of response numbers is obtained based on the random number and the first algorithm f1, which is specifically expressed as: The first set of response number = f1 (satellite code, satellite authentication key, random number); The return access frame includes access node ID information, satellite ID information and a first group of response numbers.

4. The identity authentication method in satellite-to-ground random access according to claim 3, characterized in that: The obtaining of the first response number based on the return access frame is specifically: Acquire satellite ID information and a first group of response numbers based on a return access frame; Obtain the satellite code and satellite authentication key corresponding to the in-orbit satellite according to the satellite ID information; A first response number is obtained based on the satellite code, the satellite authentication key, the random number and the preset first algorithm.

5. The identity authentication method in satellite-to-ground random access according to claim 4, characterized in that: The node code, the local authentication key and the random number are obtained, and a second set of response numbers are obtained based on a preset second algorithm, specifically: Get the node code, local authentication key and random number; The second set of response numbers is obtained based on the second algorithm f2, which is specifically expressed as: The second set of responses = f2 (node ​​code, local authentication key, random number).

6. The identity authentication method in satellite-to-ground random access according to claim 5, characterized in that: The secondary identity confirmation is performed based on the second response number and the second group of response numbers. If the confirmation is successful, a network access confirmation frame is returned to complete the identity authentication in the satellite-to-ground random access, specifically: Confirm the consistency of the second response number and the second group of response numbers. If they are consistent, the secondary identity confirmation is passed and the network access confirmation frame is returned to complete the identity authentication in the satellite-to-ground access.

7. The identity authentication method in satellite-to-ground random access according to claim 6, characterized in that: The first algorithm and the second algorithm are both hash algorithms.

8. The identity authentication method in satellite-to-ground random access according to any one of claims 2 to 7, characterized in that: The random number includes a first random number and a second random number; wherein: The first random number is used to obtain a first group of response numbers and a first response number; The second random number is used to obtain a second group of response numbers and a second response number.

Images