A method and device for distributing a key

Abstract

The present invention provides a key distribution method and device. The method comprises: obtaining multiple keys for satellite communication, multiple preset identifiers and preset update frequencies; grouping the multiple keys according to preset grouping conditions to obtain multiple key groups; binding the multiple preset identifiers with the multiple key groups to obtain multiple identified key groups; updating the keys in the multiple identified key groups according to the preset update frequency to obtain multiple updated key groups; distributing keys according to the multiple identified key groups and the multiple updated key groups. The present invention groups the keys and binds the preset identifiers with the keys, so that each type of key has its own specific purpose, achieving the effect of using a specific key in a specific scenario, and improving the efficiency of key distribution; in addition, the updated key is encrypted using the identified key and distributed to the satellite, thereby improving the security of key distribution.

Description

Technical Field

[0001] The present invention relates to the technical field of key distribution, and also to a key distribution method and device. Background Art

[0002] With the continuous development of satellite Internet, the security of communication is becoming more and more important. Due to the openness of satellite space links, satellite Internet is more vulnerable to attacks and information interception. Therefore, data transmission between satellites and between satellites and the ground needs to be encrypted. Data encryption protection is inseparable from keys. At present, most satellite key distribution uses a centralized key system, that is, a key management system is established to distribute keys to satellites offline or online. Before establishing communication and transmission business data, both parties of satellite communication nodes (satellite-satellite or satellite-ground) first need to obtain the key associated with the communication connection from the key management system, and communicate securely based on the key.

[0003] In the existing technical solution, the root key and key library are injected into the satellite offline through the ground key management system before the satellite is launched, and the relevant keys are subsequently used for communication and key online management. This key distribution method has the problems of complex operation, limited key capacity, high risk of key leakage, and low security. Summary of the invention

[0004] The technical problem to be solved by the present invention is to provide a key distribution method and device to improve the security of key distribution.

[0005] In order to solve the above technical problems, the technical solution of the present invention is as follows:

[0006] A first aspect of the present invention provides a key distribution method, comprising:

[0007] obtaining a plurality of keys for satellite communications, a plurality of preset identifiers, and a preset update frequency;

[0008] Grouping the multiple keys according to a preset grouping condition to obtain multiple key groups;

[0009] Binding the multiple preset identifiers with the multiple key groups to obtain multiple key groups with identifiers;

[0010] According to the preset update frequency, the keys in the multiple identified key groups are updated to obtain multiple updated key groups;

[0011] Key distribution is performed according to the multiple identified key groups and the multiple updated key groups.

[0012] Optionally, obtaining a plurality of keys for satellite communication, a plurality of preset identifiers, and a preset update frequency includes:

[0013] obtaining a plurality of keys for satellite communications from a key management system;

[0014] Obtain preset key usage and satellite lifespan;

[0015] Determining a plurality of preset identifiers according to the preset key usage;

[0016] A preset update frequency is determined according to the satellite service life.

[0017] Optionally, the multiple keys are grouped according to a preset grouping condition to obtain multiple key groups, including:

[0018] Acquire preset grouping conditions; the preset grouping conditions include communication between satellites, communication between satellites and ground communication terminals, and communication between a key management system and satellites;

[0019] According to the preset grouping condition, the multiple keys are divided into a secret management-satellite message encryption group, a secret management-satellite message integrity protection group, a secret management-satellite distribution protection group, a satellite-satellite transmission encryption group, a satellite-satellite transmission integrity protection group, a satellite-ground transmission encryption group and a satellite-ground transmission integrity protection group;

[0020] A plurality of key groups are obtained according to the key management-satellite message encryption group, the key management-satellite message integrity protection group, the key management-satellite distribution protection group, the satellite-satellite transmission encryption group, the satellite-satellite transmission integrity protection group, the satellite-ground transmission encryption group and the satellite-ground transmission integrity protection group.

[0021] Optionally, the plurality of preset identifiers are bound to the plurality of key groups to obtain a plurality of key groups with identifiers, including:

[0022] The multiple preset identifiers are bound to the multiple key groups in a one-to-one correspondence to obtain multiple key groups with identifiers.

[0023] Optionally, performing key distribution according to the multiple identified key groups and the multiple updated key groups includes:

[0024] In the case where the satellite is not launched, distributing the keys in the plurality of identified key groups to the satellite, the ground communication terminal and the key management system;

[0025] When the satellite is launched into orbit, encrypting the keys in the multiple updated key groups using the keys in the multiple identified key groups to obtain encrypted updated keys;

[0026] The encrypted update key is sent to the satellite.

[0027] Optionally, distributing keys in the plurality of identified key groups to the satellites comprises:

[0028] The keys in the plurality of identified key groups are distributed to the satellites via a hardware security module or an optical or magnetic disk.

[0029] Optionally, sending the encrypted update key to the satellite includes:

[0030] receiving a key update request sent by the satellite;

[0031] The encrypted update key is sent to the satellite according to the key update request.

[0032] A second aspect of the present invention provides a key distribution device, comprising:

[0033] An acquisition module, used to acquire a plurality of keys for satellite communication, a plurality of preset identifiers and a preset update frequency;

[0034] A grouping module, used for grouping the multiple keys according to a preset grouping condition to obtain multiple key groups;

[0035] A binding module, used for binding the plurality of preset identifiers with the plurality of key groups to obtain a plurality of key groups with identifiers;

[0036] An updating module, configured to update the keys in the plurality of identified key groups according to the preset updating frequency to obtain a plurality of updated key groups;

[0037] A distribution module is used to distribute keys according to the multiple identified key groups and the multiple updated key groups.

[0038] According to a third aspect of the present invention, a computing device is provided, comprising: a processor and a memory storing a computer program, wherein when the computer program is executed by the processor, the method according to the first aspect is executed.

[0039] A fourth aspect of the present invention provides a computer-readable storage medium storing instructions, which, when executed on a computer, causes the computer to execute the method described in the first aspect.

[0040] The above solution of the present invention includes at least the following beneficial effects:

[0041] The above scheme of the present invention groups the keys and binds the preset identifiers to the keys. Each type of key has its own specific purpose, so that the specific key can be used in a specific scenario, thereby improving the efficiency of key distribution. In addition, the updated key is encrypted using the identified key and then distributed to the satellite, thereby improving the security of key distribution. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 is a flowchart of a key distribution method in an embodiment of the present invention;

[0043] Figure 2 It is a schematic diagram of the structure of a key distribution device in an embodiment of the present invention. DETAILED DESCRIPTION

[0044] The exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present invention and to enable the scope of the present invention to be fully communicated to those skilled in the art.

[0045] like Figure 1 As shown, an embodiment of the present invention proposes a key distribution method, comprising the following steps:

[0046] Step 101, obtaining a plurality of keys for satellite communication, a plurality of preset identifiers and a preset update frequency;

[0047] Step 102, grouping the multiple keys according to a preset grouping condition to obtain multiple key groups;

[0048] Step 103, binding the plurality of preset identifiers with the plurality of key groups to obtain a plurality of key groups with identifiers;

[0049] Step 104, updating the keys in the plurality of identified key groups according to the preset update frequency to obtain a plurality of updated key groups;

[0050] Step 105: Distribute keys according to the multiple identified key groups and the multiple updated key groups.

[0051] The key distribution method proposed in the embodiment of the present invention groups the keys and binds the preset identifiers to the keys. Each type of key has its own specific purpose, so that the specific key can be used in a specific scenario, thereby improving the key distribution efficiency. In addition, the updated key is encrypted using the identified key and then distributed to the satellite, thereby improving the security of key distribution.

[0052] In an optional embodiment of the present invention, step 101 includes:

[0053] Step 1011, obtaining a plurality of keys for satellite communication from a key management system;

[0054] Specifically, the key management system (hereinafter referred to as "key management") is generally located on the ground and is mainly responsible for the generation, update, storage, distribution and use of keys in satellite Internet. Therefore, multiple keys for satellite communications can be directly obtained from the key management system.

[0055] Step 1012, obtaining the preset key usage and satellite service life;

[0056] Specifically, keys are generally divided into message encryption keys, message integrity protection keys, etc. according to their uses. Therefore, it is necessary to obtain the preset key usage and provide a basis for subsequent preset identification based on the preset key usage. The service life of a satellite is usually between 10 and 15 years, depending on the type and design of the satellite. This time range is based on the designed operating life of the satellite, that is, the period from entering orbit to fuel exhaustion or technological obsolescence. The purpose of obtaining the service life of the satellite is to determine the frequency or version of subsequent key updates. If the service life of the satellite is 10 years, the key is updated once a year and distributed to the satellite and ground communication terminal (or ground station), key management system, etc., which helps to improve the security of satellite Internet message transmission.

[0057] Step 1013, determining a plurality of preset identifiers according to the preset key usage;

[0058] Specifically, according to the different uses of the preset keys, the corresponding preset identifiers can be determined to facilitate the distinction of the keys, so that each type of key has its own specific purpose, and the effect of using a specific key in a specific scenario is achieved. If the preset key purpose is message encryption of the key management system, the corresponding preset identifier may include a secret management-satellite message encryption identifier, a secret management-satellite message integrity identifier, and a secret management-satellite distribution protection identifier; if the preset key purpose is message encryption between satellites, the corresponding preset identifier may include a satellite-satellite transmission encryption identifier and a satellite-satellite transmission integrity protection identifier; if the preset key purpose is message encryption between satellites and the ground, the corresponding preset identifier may include a satellite-ground transmission encryption identifier and a satellite-ground transmission integrity protection identifier. The above is only an example. According to actual needs, other preset key purposes can be set to determine the corresponding preset identifier.

[0059] Step 1014: Determine a preset update frequency based on the satellite's service life.

[0060] Specifically, the preset update frequency is determined according to the service life of the satellite. If the service life of the satellite is 10 years, the preset update frequency can be set to one year, that is, the key is updated once a year. If the service life of the satellite is 1 year, the preset update frequency can be set to one month, that is, the key is updated once a month. The longer the service life of the satellite, the longer the preset update frequency is to meet actual needs and save costs. Distributing the updated key to the satellite and ground communication terminals, key management systems, etc. will help improve the security of satellite Internet message transmission.

[0061] In an optional embodiment of the present invention, step 102 includes:

[0062] Step 1021, obtaining preset grouping conditions; the preset grouping conditions include communication between satellites, communication between satellites and ground communication terminals, and communication between a key management system and satellites;

[0063] Specifically, the message transmission of satellite Internet generally includes a satellite communication terminal and a ground communication terminal (located on the earth). In order to distribute keys, the key management system is also required to establish a communication connection with the satellite communication terminal. Therefore, the preset grouping conditions can include three grouping conditions, namely, communication between satellites, communication between satellites and ground communication terminals, and communication between the key management system and satellites. According to these three grouping conditions, the keys are grouped to facilitate the subsequent binding of corresponding preset identifiers according to different key groups, thereby realizing targeted distribution of keys according to specific usage scenarios.

[0064] Step 1022, according to the preset grouping condition, the multiple keys are divided into a key management-satellite message encryption group, a key management-satellite message integrity protection group, a key management-satellite distribution protection group, a satellite-satellite transmission encryption group, a satellite-satellite transmission integrity protection group, a satellite-terrestrial transmission encryption group and a satellite-terrestrial transmission integrity protection group;

[0065] Specifically, although the preset grouping conditions include three grouping conditions, these three grouping conditions can be further subdivided, such as communication between satellites includes transmission encryption between satellites and transmission integrity protection between satellites; communication between satellites and ground communication terminals includes user data transmission encryption between satellites and ground communication terminals, and user data transmission integrity protection between satellites and ground communication terminals; communication between the key management system and satellites includes message encryption of the key management system and integrity protection of the key management system messages, and can also include key distribution protection. The above seven grouping conditions can be used to divide all keys into seven groups, and each group can contain multiple keys. Other groupings can also be performed according to actual needs, and the above is only an illustrative description.

[0066] Step 1023, obtaining multiple key groups according to the key management-satellite message encryption group, the key management-satellite message integrity protection group, the key management-satellite distribution protection group, the satellite-satellite transmission encryption group, the satellite-satellite transmission integrity protection group, the satellite-ground transmission encryption group and the satellite-ground transmission integrity protection group.

[0067] Here, the key management-satellite message encryption group, the key management-satellite message integrity protection group, the key management-satellite distribution protection group, the satellite-satellite transmission encryption group, the satellite-satellite transmission integrity protection group, the satellite-ground transmission encryption group and the satellite-ground transmission integrity protection group constitute all the key groups in this embodiment. These key groups are convenient for subsequent binding of preset identifiers, and each key group is bound to a preset identifier, which is convenient for subsequent key distribution. When distributing keys, keys in different key groups are selected according to actual needs for distribution, which is conducive to improving the efficiency of key distribution.

[0068] In an optional embodiment of the present invention, step 103 includes:

[0069] The multiple preset identifiers are bound to the multiple key groups in a one-to-one correspondence to obtain multiple key groups with identifiers.

[0070] Specifically, in actual use, if the key is not bound to a preset identifier, and the key is retrieved from a large number of keys for distribution, errors in key distribution may occur due to incorrect key type retrieval. In this embodiment, one key group is bound to one preset identifier, that is, one key group can contain multiple keys, and the keys in the same key group have the same preset identifier. According to actual needs, the keys in the key group can be retrieved quickly and specifically for rapid distribution, which is conducive to improving the efficiency and security of key distribution.

[0071] In an optional embodiment of the present invention, in step 104, the keys in the plurality of identified key groups are updated according to the preset update frequency to obtain a plurality of updated key groups.

[0072] Specifically, the preset update frequency is determined according to the service life of the satellite. If the service life of the satellite is 10 years, the preset update frequency can be set to one year, that is, the key is updated once a year. The preset update frequency is sent to the key management system, and the key management system automatically updates the key according to the preset update frequency.

[0073] In an optional embodiment of the present invention, step 105 includes:

[0074] Step 1051, when the satellite is not launched, distributing the keys in the plurality of identified key groups to the satellite, the ground communication terminal and the key management system;

[0075] Specifically, before the satellite is launched, the identified keys in the multiple identified key groups are injected into the satellite offline, and at the same time, the same key is also injected into the satellite-bound peer (referring to the ground communication terminal or key management system that has communication contact with the satellite). Before the satellite is launched, the identified key and the two communication terminals (such as the satellite and the ground communication terminal, the satellite and the key management system, the key management system and the ground communication terminal, etc.) are authorized and bound on the ground. Compared with the authorization binding after the satellite is launched, this can reduce the complex authorization operation after the satellite is launched, especially when the number of satellites is large, the operation is simpler using this method. Due to the air environment problem, advance authorization on the ground can better verify the key data and is safer.

[0076] Step 1052, when the satellite is launched into orbit, encrypting the keys in the multiple updated key groups using the keys in the multiple identified key groups to obtain encrypted updated keys;

[0077] Specifically, after the satellite is launched into space, the updated key needs to be encrypted with the previously grouped and identified key and then sent to the satellite to improve security. Specifically, the updated key is encrypted using the key distribution protection key in the secret management-satellite distribution protection group to form an online distribution message, the secret management system message encryption key in the secret management-satellite message encryption group is used to encrypt the online distributed message, and the secret management system message integrity protection key in the secret management-satellite message integrity protection group is used to perform integrity calculation on the online distributed message to obtain the encrypted updated key.

[0078] Step 1053: Send the encrypted update key to the satellite.

[0079] Specifically, after receiving the key update request from the satellite, the encrypted update key may be sent to the satellite.

[0080] In an optional embodiment of the present invention, distributing the keys in the plurality of identified key groups to the satellite in step 1051 includes:

[0081] The keys in the plurality of identified key groups are distributed to the satellites via a hardware security module or an optical or magnetic disk.

[0082] It should be noted that any offline method in the hardware security module or the optical disc or disk is only an example. According to the actual situation, other offline methods can be selected, such as a dedicated key distribution device, a paper document, etc. Specifically, the keys in multiple identified key groups are stored in any physical medium in the hardware security module or the optical disc or disk, and can be properly encrypted and signed to protect the integrity and authenticity of the keys. Before transmission, it is necessary to perform a security check on any physical medium in the hardware security module or the optical disc or disk to ensure that these physical media have not been tampered with or damaged, thereby improving the security of transmission. After that, the physical medium storing the identified key is transported to the satellite ground station, and verified again to confirm the integrity and authenticity of the key. After confirmation, the key in the physical medium is read using a security device and its validity is verified. The satellite ground station transmits the verified identified key to the satellite through the secure channel of the satellite communication system. After receiving the key, the satellite will perform the final verification and storage for subsequent use.

[0083] In an optional embodiment of the present invention, step 1053 includes:

[0084] Step 10531, receiving a key update request sent by the satellite;

[0085] Specifically, when the satellite needs a new key, it will send a key update request to the ground station. The request may include the satellite's identity information, the required key type, etc., so that the ground station can quickly identify and verify the satellite's identity, and retrieve the key in the corresponding group according to the required key type and send it to the satellite.

[0086] Step 10532: Send the encrypted update key to the satellite according to the key update request.

[0087] Specifically, after receiving the key update request, the ground communication terminal will identify and verify the satellite's identity information (such as type, name, etc.). If it meets the preset verification conditions, it will retrieve the corresponding key from the grouped, identified, and updated key group according to the required key type, encrypt it, and send it to the satellite.

[0088] A specific embodiment of the key distribution method of the embodiment of the present invention is:

[0089] Step 111, in a key management system (hereinafter referred to as "key management system"), keys are identified by purpose. Based on the communication link, keys are classified into the following purpose identifications:

[0090] (1) The encryption key (EK) of the secret management system is used to encrypt and protect the secret management message;

[0091] (2) The message integrity protection key (IK) of the secret management system is used to protect the integrity of the entire secret management message and prevent the message from being tampered with;

[0092] (3) Key distribution protection key (DK), used to encrypt and protect the key to be distributed;

[0093] (4) Intersatellite Encryption Key (EKS), which is used to encrypt and protect business data transmitted between satellites. Each intersatellite transmission key is different, and there is a different EKS between any two satellites.

[0094] (5) Intersatellite transmission integrity protection key (IKS), used for integrity protection of intersatellite transmission service data;

[0095] (6) Encryption key for satellite-to-ground user data transmission (EKSD), which is used to encrypt and protect the business data transmitted between the satellite and the ground (satellite and ground communication terminal); the EKSD between each satellite and the ground communication terminal is different, and there is a different EKSD between any satellite and the ground;

[0096] (7) Satellite-to-ground user data transmission integrity protection key (IKSD), used for integrity protection of satellite-to-ground transmission service data.

[0097] According to the different usage (purpose) of the keys, multiple keys are distinguished to achieve the effect of using specific keys only for specific purposes, increasing the security of the data transmission process. At the same time, it is also convenient to quickly retrieve the corresponding keys for distribution according to needs, thereby improving the distribution efficiency. In this implementation, the key uses are divided into 9 types according to the communication link, and each type of key has its own specific purpose, so that the effect of using specific keys in specific scenarios is achieved.

[0098] Step 112, configure the number of key versions. According to the update frequency of the key between satellites and the maximum usage, generate multiple versions of the key for each purpose. For example, if one version is generated every year and the satellite is used for a maximum of 8 years, then 8 versions of the key for each purpose are generated to meet the requirement of updating one version every year. The number of key versions can be determined based on the service life of the satellite (or the actual needs of the satellite). Generally speaking, the longer the service life of the satellite, the lower the update frequency and the fewer the number of key versions.

[0099] Step 113, bind and authorize the key and the communication end. Bind the key and the two ends of the communication according to the key purpose of step 111. The following keys are bound in an end-to-end mode. The keys bound to the two ends of any communication entity are different. For example, the data encryption key between satellites uses a unique data encryption key and integrity key between the two satellites, which realizes the key isolation of specific keys for specific purposes. The leakage of any single key will not affect the security of other keys, and the entire key system has higher security. Each key has multiple different versions as described in step 112. EK, IK, and DK are bound between the key management system and a single satellite (these keys are used for communication between the key management system and multiple satellites); EKS and IKS are bound between satellites and satellites (used for communication between multiple satellites); EKSD and IKSD are bound between satellites and ground stations (used for communication between multiple satellites and ground communication terminals).

[0100] Step 114, pre-setting the key distribution in the satellite in an offline manner. Before the satellite is launched, the above-mentioned large number of keys bound and authorized are injected into the satellite in an offline manner, and the same key is also injected into the satellite-bound counterpart (i.e., the other end in communication with the satellite).

[0101] Before the satellite is launched, the key and the two ends of the communication are authorized and bound on the ground, which has obvious advantages over authorization binding after the satellite is launched. This embodiment can reduce the complex authorization operation after the satellite is launched, especially when the number of satellites is large, the operation is simpler. Due to the air environment problem, the advance authorization on the ground can better verify the key data and is safer.

[0102] When the satellite storage is sufficient, more keys can be imported into the satellite at one time in an offline manner.

[0103] Step 115, use the above preset key (the key distributed in step 114) to distribute the key online securely. After the satellite is launched into orbit, the key is subsequently updated by online distribution. In the process of online distribution of satellite keys, different key management system message encryption keys (EK), key management system message integrity protection keys (IK), and key distribution protection keys (DK) in step 111 are used according to different satellites; DK encrypts the updated key to form an online distribution message, EK encrypts the online distributed message, and IK performs integrity calculation on the online distributed message.

[0104] In this embodiment, the online distribution of keys adopts a double-layer encryption structure, in which DK encrypts the updated key to form an online distribution message, EK encrypts the online distributed message, and IK performs integrity calculation on the online distributed message. This method makes the online distribution of keys more secure and ensures the security of the keys distributed online to the satellite.

[0105] The key distribution method proposed in the embodiment of the present invention realizes the rapid and secure distribution of keys through the above steps. Inter-satellite and inter-satellite-ground communications can use the distributed keys to perform end-to-end secure communications, thereby ensuring the security of satellite Internet communications.

[0106] like Figure 2 As shown, an embodiment of the present invention provides a key distribution device 200, comprising:

[0107] An acquisition module 201 is used to acquire a plurality of keys for satellite communication, a plurality of preset identifiers and a preset update frequency;

[0108] A grouping module 202, configured to group the plurality of keys according to a preset grouping condition to obtain a plurality of key groups;

[0109] A binding module 203, used for binding the plurality of preset identifiers with the plurality of key groups to obtain a plurality of key groups with identifiers;

[0110] An updating module 204, configured to update the keys in the plurality of identified key groups according to the preset updating frequency to obtain a plurality of updated key groups;

[0111] The distribution module 205 is configured to distribute keys according to the multiple identified key groups and the multiple updated key groups.

[0112] Optionally, obtaining a plurality of keys for satellite communication, a plurality of preset identifiers, and a preset update frequency includes:

[0113] obtaining a plurality of keys for satellite communications from a key management system;

[0114] Obtain preset key usage and satellite lifespan;

[0115] Determining a plurality of preset identifiers according to the preset key usage;

[0116] A preset update frequency is determined according to the satellite service life.

[0117] Optionally, the multiple keys are grouped according to a preset grouping condition to obtain multiple key groups, including:

[0118] Acquire preset grouping conditions; the preset grouping conditions include communication between satellites, communication between satellites and ground communication terminals, and communication between a key management system and satellites;

[0119] According to the preset grouping condition, the multiple keys are divided into a secret management-satellite message encryption group, a secret management-satellite message integrity protection group, a secret management-satellite distribution protection group, a satellite-satellite transmission encryption group, a satellite-satellite transmission integrity protection group, a satellite-ground transmission encryption group and a satellite-ground transmission integrity protection group;

[0120] A plurality of key groups are obtained according to the key management-satellite message encryption group, the key management-satellite message integrity protection group, the key management-satellite distribution protection group, the satellite-satellite transmission encryption group, the satellite-satellite transmission integrity protection group, the satellite-ground transmission encryption group and the satellite-ground transmission integrity protection group.

[0121] Optionally, the plurality of preset identifiers are bound to the plurality of key groups to obtain a plurality of key groups with identifiers, including:

[0122] The multiple preset identifiers are bound to the multiple key groups in a one-to-one correspondence to obtain multiple key groups with identifiers.

[0123] Optionally, performing key distribution according to the multiple identified key groups and the multiple updated key groups includes:

[0124] In the case where the satellite is not launched, distributing the keys in the plurality of identified key groups to the satellite, the ground communication terminal and the key management system;

[0125] When the satellite is launched into orbit, encrypting the keys in the multiple updated key groups using the keys in the multiple identified key groups to obtain encrypted updated keys;

[0126] The encrypted update key is sent to the satellite.

[0127] Optionally, distributing keys in the plurality of identified key groups to the satellites comprises:

[0128] The keys in the plurality of identified key groups are distributed to the satellites via a hardware security module or an optical or magnetic disk.

[0129] Optionally, sending the encrypted update key to the satellite includes:

[0130] receiving a key update request sent by the satellite;

[0131] The encrypted update key is sent to the satellite according to the key update request.

[0132] It should be noted that the device is a device corresponding to the above method, and all implementations in the above method embodiment are applicable to the embodiment of the device and can achieve the same technical effect. This embodiment will not be repeated.

[0133] The key distribution device proposed in the embodiment of the present invention groups keys and binds preset identifiers to the keys. Each type of key has its own specific purpose, so that a specific key can be used in a specific scenario, thereby improving the efficiency of key distribution. In addition, the updated key is encrypted using the identified key and then distributed to the satellite, thereby improving the security of key distribution.

[0134] The embodiment of the present invention further provides a computing device, comprising: a processor, and a memory storing a computer program, wherein when the computer program is executed by the processor, the method described in any one of the above embodiments is executed. All implementations in the above method embodiments are applicable to the embodiments of the device, and can achieve the same technical effects. They will not be described in detail in this embodiment.

[0135] The embodiment of the present invention further provides a computer-readable storage medium on which instructions are stored. When the instructions are executed on a computer, the computer executes the method as described in any one of the above embodiments. All implementations in the above method embodiments are applicable to the embodiments of the device and can achieve the same technical effects. They will not be described in detail in this embodiment.

[0136] The above is a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A key distribution method, characterized in that: include: obtaining a plurality of keys for satellite communications, a plurality of preset identifiers, and a preset update frequency; Grouping multiple keys according to preset grouping conditions to obtain multiple key groups; Binding the multiple preset identifiers with the multiple key groups to obtain multiple key groups with identifiers; According to the preset update frequency, the keys in the multiple identified key groups are updated to obtain multiple updated key groups; Distributing keys according to the multiple identified key groups and the multiple updated key groups; The step of obtaining a plurality of keys for satellite communication, a plurality of preset identifiers and a preset update frequency includes: Acquire multiple keys for satellite communications from a key management system; the key management system is located on the ground and is used for generating, updating, storing, distributing and using keys in satellite Internet; Obtaining the purpose of a preset key and the service life of a satellite; the purpose of the preset key is divided into a message encryption key and a message integrity protection key; According to the preset key usage, multiple preset identifiers are determined; wherein the preset key usage is message encryption of the key management system, and the corresponding preset identifiers include a key management-satellite message encryption identifier, a key management-satellite message integrity identifier, and a key management-satellite distribution protection identifier; the preset key usage is message encryption between satellites, and the corresponding preset identifiers include a satellite-satellite transmission encryption identifier and a satellite-satellite transmission integrity protection identifier; the preset key usage is message encryption between satellites and the ground, and the corresponding preset identifiers include a satellite-ground transmission encryption identifier and a satellite-ground transmission integrity protection identifier; According to the service life of the satellite, the preset update frequency is determined; if the service life of the satellite is 10 years, the preset update frequency is one year; if the service life of the satellite is 1 year, the preset update frequency is one month; The multiple keys are grouped according to a preset grouping condition to obtain multiple key groups, including: Acquire preset grouping conditions; the preset grouping conditions include communication between satellites, communication between satellites and ground communication terminals, and communication between a key management system and satellites; According to the preset grouping condition, the multiple keys are divided into a secret management-satellite message encryption group, a secret management-satellite message integrity protection group, a secret management-satellite distribution protection group, a satellite-satellite transmission encryption group, a satellite-satellite transmission integrity protection group, a satellite-ground transmission encryption group and a satellite-ground transmission integrity protection group; Obtaining a plurality of key groups according to the key management-satellite message encryption group, the key management-satellite message integrity protection group, the key management-satellite distribution protection group, the satellite-satellite transmission encryption group, the satellite-satellite transmission integrity protection group, the satellite-terrestrial transmission encryption group and the satellite-terrestrial transmission integrity protection group; The multiple preset identifiers are bound to the multiple key groups to obtain multiple key groups with identifiers, including: Binding the multiple preset identifiers to the multiple key groups in a one-to-one correspondence to obtain multiple key groups with identifiers; wherein one key group is bound to one preset identifier, one key group contains multiple keys, and the keys in the same key group have the same preset identifier; The key distribution according to the multiple identified key groups and the multiple updated key groups includes: In the case where the satellite is not launched, the keys in the multiple identified key groups are distributed to the satellite, the ground communication terminal and the key management system; before the satellite is launched, the identified keys in the multiple identified key groups are injected into the satellite in an offline manner, and the same keys are injected into the satellite-bound peer terminal; In the case where the satellite is launched into orbit, the keys in the multiple updated key groups are encrypted using the keys in the multiple identified key groups to obtain the encrypted updated keys; wherein the updated keys are encrypted using the key distribution protection key in the key management-satellite distribution protection group to form an online distribution message, the online distribution message is encrypted using the key management system message encryption key in the key management-satellite message encryption group, and the online distribution message is calculated by the key management system message integrity protection key in the key management-satellite message integrity protection group to obtain the encrypted updated keys; The encrypted update key is sent to the satellite.

2. The key distribution method according to claim 1, characterized in that: Distributing keys from the plurality of identified key groups to the satellites comprises: The keys in the plurality of identified key groups are distributed to the satellites via a hardware security module or an optical or magnetic disk.

3. The key distribution method according to claim 1, characterized in that: Sending the encrypted update key to the satellite comprises: receiving a key update request sent by the satellite; The encrypted update key is sent to the satellite according to the key update request.

4. A key distribution device, characterized in that: include: An acquisition module, used to acquire a plurality of keys for satellite communication, a plurality of preset identifiers and a preset update frequency; A grouping module, used for grouping multiple keys according to preset grouping conditions to obtain multiple key groups; A binding module, used for binding the plurality of preset identifiers with the plurality of key groups to obtain a plurality of key groups with identifiers; An updating module, configured to update the keys in the plurality of identified key groups according to the preset updating frequency to obtain a plurality of updated key groups; A distribution module, used for distributing keys according to the multiple identified key groups and the multiple updated key groups; The step of obtaining a plurality of keys for satellite communication, a plurality of preset identifiers and a preset update frequency includes: Acquire multiple keys for satellite communications from a key management system; the key management system is located on the ground and is used for generating, updating, storing, distributing and using keys in satellite Internet; Obtaining the purpose of a preset key and the service life of a satellite; the purpose of the preset key is divided into a message encryption key and a message integrity protection key; According to the preset key usage, multiple preset identifiers are determined; wherein the preset key usage is message encryption of the key management system, and the corresponding preset identifiers include a key management-satellite message encryption identifier, a key management-satellite message integrity identifier, and a key management-satellite distribution protection identifier; the preset key usage is message encryption between satellites, and the corresponding preset identifiers include a satellite-satellite transmission encryption identifier and a satellite-satellite transmission integrity protection identifier; the preset key usage is message encryption between satellites and the ground, and the corresponding preset identifiers include a satellite-ground transmission encryption identifier and a satellite-ground transmission integrity protection identifier; According to the service life of the satellite, the preset update frequency is determined; if the service life of the satellite is 10 years, the preset update frequency is one year; if the service life of the satellite is 1 year, the preset update frequency is one month; The multiple keys are grouped according to a preset grouping condition to obtain multiple key groups, including: Acquire preset grouping conditions; the preset grouping conditions include communication between satellites, communication between satellites and ground communication terminals, and communication between a key management system and satellites; According to the preset grouping condition, the multiple keys are divided into a secret management-satellite message encryption group, a secret management-satellite message integrity protection group, a secret management-satellite distribution protection group, a satellite-satellite transmission encryption group, a satellite-satellite transmission integrity protection group, a satellite-ground transmission encryption group and a satellite-ground transmission integrity protection group; Obtaining a plurality of key groups according to the key management-satellite message encryption group, the key management-satellite message integrity protection group, the key management-satellite distribution protection group, the satellite-satellite transmission encryption group, the satellite-satellite transmission integrity protection group, the satellite-terrestrial transmission encryption group and the satellite-terrestrial transmission integrity protection group; The multiple preset identifiers are bound to the multiple key groups to obtain multiple key groups with identifiers, including: Binding the multiple preset identifiers to the multiple key groups in a one-to-one correspondence to obtain multiple key groups with identifiers; wherein the keys in the same key group have the same preset identifier; The key distribution according to the multiple identified key groups and the multiple updated key groups includes: In the case where the satellite is not launched, the keys in the multiple identified key groups are distributed to the satellite, the ground communication terminal and the key management system; before the satellite is launched, the identified keys in the multiple identified key groups are injected into the satellite in an offline manner, and the same keys are injected into the satellite-bound peer terminal; In the case where the satellite is launched into orbit, the keys in the multiple updated key groups are encrypted using the keys in the multiple identified key groups to obtain the encrypted updated keys; wherein the updated keys are encrypted using the key distribution protection key in the key management-satellite distribution protection group to form an online distribution message, the online distribution message is encrypted using the key management system message encryption key in the key management-satellite message encryption group, and the online distribution message is calculated by the key management system message integrity protection key in the key management-satellite message integrity protection group to obtain the encrypted updated keys; The encrypted update key is sent to the satellite.

5. A computing device, characterized in that: include: A processor and a memory storing a computer program, wherein when the computer program is executed by the processor, the method according to any one of claims 1 to 3 is performed.

6. A computer-readable storage medium, characterized in that: Instructions are stored, and when the instructions are executed on a computer, the computer is caused to execute the method according to any one of claims 1 to 3.

Images