Ultra-high-speed terminal secure access and intra-group secure communication method in satellite network scenario

Abstract

The present invention discloses a method for secure access of an ultra-high-speed terminal and secure communication within a group in a satellite network scenario, aiming to solve the communication problem of quickly establishing a group when the ultra-high-speed terminal serves as a group owner. The method first initializes a ground control center, an ultra-high-speed terminal and multiple access points. Then, the ground control center determines multiple access points that the ultra-high-speed terminal passes through by calculating the trajectory of the ultra-high-speed terminal. Subsequently, the ultra-high-speed terminal and the ground control center complete access authentication through these access points and calculate session keys to ensure secure communication between the two parties. In addition, the ultra-high-speed terminal launches multiple payload devices, and determines some of the payload devices as group members based on their trajectories, thereby constructing a group and calculating a group key. Within the group, members use the group key for secure communication. This method ensures that when the ultra-high-speed terminal quickly leaves the ground, it can securely and continuously access the ground control center through the space access point and achieve secure communication within the group.

Description

Technical Field

[0001] The present invention relates to the field of satellite communication technology, and in particular to a method for ultra-high-speed terminal secure access and intra-group secure communication in a satellite network scenario. Background Art

[0002] As humans explore the space field, ultra-high-speed terminals are needed to carry payloads to designated locations to deliver various types of equipment in various scenarios. For example, a space shuttle will carry modules or supplies for a space station, and when it arrives near the International Space Station, it will be installed on the space station through a robotic arm or other mechanism.

[0003] The ultra-high-speed terminal has a fixed trajectory and will leave the ground quickly, so that it cannot connect to the access point on the ground to communicate with the ground station. This requires access to space access points, such as satellites, based on the trajectory, and setting up access points on their trajectories to ensure the real-time access authentication and the continuity of communication. In addition, the ultra-high-speed terminal and the payload equipment it carries also need to communicate to check the status of the payload equipment, etc. The payload equipment needs to be able to access the network to maintain network communication after the ultra-high-speed terminal releases it, that is, when it is out of the range of the ultra-high-speed terminal. However, there is no solution in the prior art to achieve secure communication in the above scenario. Summary of the invention

[0004] The present invention provides a method for secure access and secure intra-group communication of an ultra-high-speed terminal in a satellite network scenario, thereby solving the problem in the prior art that the coordinated transmission between the ultra-high-speed terminal and other devices or other terminals, or the problem of quickly establishing group communication with the ultra-high-speed terminal as the group owner, is not considered. The present invention enables the ultra-high-speed terminal to securely and continuously access the ground control center through a space access point when quickly leaving the ground, and use a group key for intra-group communication.

[0005] The present invention provides a method for ultra-high-speed terminal secure access and intra-group secure communication in a satellite network scenario, the method comprising:

[0006] The ground control center and the ultra-high-speed terminal are initialized to obtain the initialization result of the ground control center and the initialization result of the ultra-high-speed terminal; wherein the ultra-high-speed terminal carries a plurality of payload devices;

[0007] The ground control center calculates a plurality of access points on the track of the ultra-high-speed terminal using the track of the ultra-high-speed terminal, the ultra-high-speed terminal and the ground control center complete access authentication using the plurality of access points, the initialization result of the ground control center and the initialization result of the ultra-high-speed terminal, the ground control center calculates session keys between the plurality of access points and the ultra-high-speed terminal respectively, and the ultra-high-speed terminal and the ground control center perform secure communication using the session keys;

[0008] The ultra-high-speed terminal transmits multiple payload devices, determines some of the multiple payload devices as group members according to the trajectory of the ultra-high-speed terminal, builds a group according to the some of the payload devices, calculates the group key in the group using the initialization result of the ultra-high-speed terminal, and the members in the group communicate securely according to the group key.

[0009] In a possible implementation, the ground control center and the ultra-high-speed terminal are initialized, including:

[0010] The ground control center generates a master key of the ground control center ;

[0011] The ground control center distributes a long-term first shared key to the ultra-high-speed terminal and a first identity identifier of the ultra-high-speed terminal ;

[0012] The ground control center randomly generates a first random number , according to the first random number Calculate the hidden identity value of the ultra-high-speed terminal ;

[0013] The ground control center sends the first identity , the first shared key , the hidden identity value and the first random number..as a first offline preset message sent to the ultra-high-speed terminal;

[0014] The ultra-high-speed terminal is based on each load device The first payload device identity Generate the payload device The corresponding first key , and generate a second random number , according to the second random number Calculate the load device The payload device hides the identity value ;

[0015] The ultra-high-speed terminal identifies the first payload device , the first key , the load device hides the identity value and the second random number Sent as the second offline preset message to each load device ;

[0016] The ground control center determines the identity of the access point as , and a secure channel is established between the access point and the ground control center;

[0017] The ground control center initialization result includes the first identity , the first random number and the identity is The ultra-high-speed terminal initialization result includes the hidden identity value and the first shared key .

[0018] In a possible implementation, the ground control center calculates a plurality of access points on the trajectory of the ultra-high-speed terminal using the trajectory of the ultra-high-speed terminal, and the ultra-high-speed terminal and the ground control center complete access authentication using the plurality of access points, the initialization result of the ground control center, and the initialization result of the ultra-high-speed terminal, including:

[0019] The ultra-high-speed terminal generates a first access authentication request message, and sends the first access authentication request message to a first access point among the multiple access points; wherein the first access point is closest to the ultra-high-speed terminal;

[0020] The first access point identifies the first access point Add to the first access authentication request message, and obtain the first request authentication message according to the ultra-high-speed terminal initialization result ;in, represents the initial calculated value; Indicates the first timestamp;

[0021] The first access point forwards the first authentication request message to said ground control center;

[0022] The ground control center sends the first authentication request message In response, a first request response authentication message is generated according to the initialization result of the ground control center, and an access point receiving the first request response authentication message is determined to be a second access point according to the trajectory of the ultra-high-speed terminal, and the first request response authentication message is forwarded to the ultra-high-speed terminal through the second access point;

[0023] The ground control center calculates a second key between the ground control center and the ultra-high-speed terminal , and according to the second key Calculating a second shared key between the ultra-high-speed terminal and the second access point ;

[0024] The ground control center calculates the connection with the first Temporary ID corresponding to the access point ;

[0025] The ground control center uses the second shared key and temporary identification Complete the access response authentication of the corresponding access point.

[0026] In a possible implementation, the group includes: the partial load equipment and an ultra-high-speed terminal.

[0027] In a possible implementation, the ultra-high-speed terminal calculates the group key in the group using the ultra-high-speed terminal initialization result, including:

[0028] The ultra-high-speed terminal broadcasts a first group authentication notification message; wherein the first group authentication notification message includes: a first identity identifier of the ultra-high-speed terminal and the first challenge value ;

[0029] The load equipment receiving the first group authentication notification message, and using the first group authentication notification message to send a first group access authentication request message to the corresponding ultra-high-speed terminal; wherein the first group access authentication request message includes: the load device The corresponding load device hidden identity value , the second random number and the first calculated value ;

[0030] The ultra-high-speed terminal obtains the load device by using the group access authentication request message. The first payload device identity , the load equipment The corresponding first key , first encryption key and the first integrity protection key ;

[0031] The ultra-high-speed terminal uses the first payload device identity , the first key , the first encryption key and the first integrity protection key The first calculated value After successful verification, the first payload device identity and the first encryption key To store;

[0032] The ultra-high-speed terminal generates a third random number , construct the first interpolation polynomial ; Select the first interpolation polynomial In point, according to this points and the third random number Calculate the second calculated value and the key identifier of the group , broadcast group key establishment request message; wherein the group key establishment request message Including: the first identity of the ground control center , the key identifier The second calculated value and stated Points ;

[0033] The load equipment Receive the group key establishment request message, and The first payload device identity stored in and the first encryption key Construct the first interpolation polynomial , using the first interpolation polynomial Calculate the third random number ;

[0034] Using the third random number Verify the second calculated value If valid, the third random number is determined is the group key.

[0035] In a possible implementation, the load device , using the first interpolation polynomial Calculate the third random number ,include:

[0036] According to the points and the first interpolation polynomial Calculate the third random number .

[0037] In a possible implementation, the first calculated value According to the load equipment The first payload device identity and the load device The corresponding first integrity protection key Calculated.

[0038] In a possible implementation, after calculating the group key in the group, the method further includes: updating the members of the group to obtain a second group, and calculating an updated key of the second group to complete secure communication within the second group;

[0039] The updating of the members of the group to obtain a second group and calculating an update key of the second group includes:

[0040] Second load equipment Sending a group join request message to the ultra-high-speed terminal;

[0041] The ultra-high-speed terminal generates a second challenge value , and broadcast to the second payload device Related second group authentication notification message; wherein, the second group authentication notification message includes: the first identity of the ultra-high-speed terminal and the second challenge value ;

[0042] The second load device receiving the second group authentication notification message, and using the second group authentication notification message to send a second group access authentication request message to the corresponding ultra-high-speed terminal, wherein the second group access authentication request message includes: the second load device The corresponding second encryption key , second integrity protection key and the second calculated value ;

[0043] The ultra-high-speed terminal calculates the second load device using the second group access authentication request message Second identity , Second load equipment The corresponding key , the second encryption key and the second integrity protection key , and for the second calculated value After successful verification, the second identity and the second encryption key To store;

[0044] The ultra-high-speed terminal uses the second identity and the second encryption key An updated group key is calculated to complete secure communication within the second group.

[0045] In a possible implementation, the second calculated value is according to the second load device Second identity and second load equipment The corresponding second integrity protection key Calculated.

[0046] In a possible implementation, after calculating the group key in the group, the method further includes: a third load device in the group interacting with the ultra-high-speed terminal or the access point; wherein the third load device A payload device that exits the group or a payload device that needs to communicate with the network individually;

[0047] The third load device in the group Interacting with the ultra-high-speed terminal or the access point includes:

[0048] Third load equipment Sending a network access pre-request message to the ultra-high-speed terminal; wherein the network access pre-request message includes: a key validity period ;

[0049] The ultra-high-speed terminal calculates the third load device according to the network pre-request message The corresponding second payload device identity ;

[0050] The ultra-high-speed terminal determines a second key between the ultra-high-speed terminal and the ground control center , according to the second load device identity , the key validity period and the second key , calculate the ciphertext ;

[0051] According to the temporary identity of the ultra-high-speed terminal The third load device Calculate temporary key value , sending the first message to the third load device ; Wherein, the first message includes: a temporary key value , a temporary identity of the ultra-high-speed terminal 、Third load equipment The corresponding second payload device identity and ciphertext ;

[0052] Third load equipment Sending a second access authentication request to the ground control center through the access point;

[0053] The ground control center verifies the second access authentication request, and if the verification is successful, calculates different access points and the third load device The third shared key between and the third calculated value , and sends the second message to the third load device ; Wherein, the second message includes: the third calculated value , a fifth random number generated by the ultra-high-speed terminal and the current timestamp in ground control ;

[0054] The third load device Verify the current timestamp in the ground control center and the third calculated value If the verification is successful, the third shared key As a secure communication key for communicating with the ground control center to complete the third payload equipment Interactively communicate with the ground control center.

[0055] One or more technical solutions provided in the present invention have at least the following technical effects or advantages:

[0056] (1) After the ultra-high-speed terminal in the present invention is launched, the ground control center uses trajectory prediction to learn the access point it is about to access; at the same time, the session key between the access point and the ultra-high-speed terminal is derived by the ground control center, and the access point only plays a relay role, so that the change of the access point during the access authentication process can be realized, and the problem that the ultra-high-speed terminal deviates from the access point due to its ultra-high-speed characteristics during the access authentication process, thereby solving the problem of access failure;

[0057] (2) The present invention uses trajectory prediction and long-term shared keys to negotiate session keys for ultra-high-speed terminals and multiple access points, thereby avoiding the frequent switching authentication problem faced by ultra-high-speed terminals in subsequent ultra-high-speed mobility. The ultra-high-speed terminal and the access point can directly use the negotiated keys to communicate, ensuring the continuous stability of the terminal network service. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 A flowchart of the steps of a method for ultra-high-speed terminal secure access and intra-group secure communication in a satellite network scenario provided by an embodiment of the present invention;

[0059] Figure 2 A scenario diagram of a method for ultra-high-speed terminal secure access and intra-group secure communication in a satellite network scenario provided by an embodiment of the present invention;

[0060] Figure 3 An overview diagram of a method for ultra-high-speed terminal secure access and intra-group secure communication in a satellite network scenario provided by an embodiment of the present invention;

[0061] Figure 4 A diagram of an ultra-high-speed terminal access authentication process based on trajectory prediction provided by an embodiment of the present invention;

[0062] Figure 5 A schematic diagram of a group formation process provided by an embodiment of the present invention;

[0063] Figure 6 A diagram of a process of load equipment accessing a network based on ultra-high-speed terminal authorization provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0064] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0065] The present invention provides a method for ultra-high-speed terminal secure access and intra-group secure communication in a satellite network scenario, such as Figure 1 As shown, the method includes the following steps S101 to S103: Figure 2 Shown is a scene diagram of the present invention.

[0066] S101, the ground control center and the ultra-high speed terminal are initialized to obtain the initialization results of the ground control center and the ultra-high speed terminal; wherein the ultra-high speed terminal carries multiple payload devices;

[0067] Specifically, in step S101, the ground control center (NCC, Network Control Center) and the ultra-high-speed terminal are initialized respectively, including:

[0068] Initialization to the ground control center:

[0069] (1) The ground control center generates the master key of the ground control center ;

[0070] (2) The ground control center assigns a long-term first shared key to the ultra-high-speed terminal and the first identity of the ultra-high-speed terminal ;

[0071] (3) The ground control center randomly generates the first random number , according to the first random number Calculate the hidden identity value of the ultra-high-speed terminal ;

[0072] Here, the identity value is hidden The calculation formula is: ,in, Indicates the first identity; Represents a hash algorithm; Represents the master key; represents the first random number; Represents the exclusive OR operator.

[0073] (4) The ground control center will identify the first , first shared key , Hide identity value and the first random number The first offline preset message is sent to the ultra-high-speed terminal.

[0074] Here, the first offline preset message is represented as: .

[0075] When initializing the ultra-high-speed terminal, it should be noted that the load device assigned to each ultra-high-speed terminal Relatively fixed.

[0076] (1) Ultra-high-speed terminals are based on each load device The first payload device identity Generate the payload device The corresponding first key , and generate a second random number , according to the second random number Calculate the load device The payload device hides the identity value ;

[0077] Here, the first key The specific calculation formula is: ,in, represents the first key; Represents a hash algorithm; represents the first shared key; Indicates the first load device identity. Load device hidden identity value The specific calculation formula is: ,in: Indicates the identity of the first payload device; Represents a hash algorithm; represents the first shared key; Represents the second random number.

[0078] (2) The ultra-high-speed terminal identifies the first payload device , first key , Load device hidden identity value and the second random number Sent as the second offline preset message to each load device .

[0079] Here, the second offline preset message is expressed as: .

[0080] Initialize multiple access points: Ground control determines the identity of the access point , and a secure channel is established between the access point and the ground control center;

[0081] Initialization result of the ground control center, including the first identity , the first random number and the identity is ; Ultra-high-speed terminal initialization results, including ultra-high-speed terminal initialization results, including hidden identity value and the first shared key .

[0082] S102, the ground control center uses the trajectory of the ultra-high-speed terminal to calculate multiple access points on the trajectory of the ultra-high-speed terminal, the ultra-high-speed terminal and the ground control center use the multiple access points, the ground control center initialization result and the ultra-high-speed terminal initialization result to complete access authentication, the ground control center calculates the session keys between the multiple access points and the ultra-high-speed terminal respectively, and the ultra-high-speed terminal and the ground control center use the session keys to communicate securely.

[0083] like Figure 3The figure shows an overview of the ultra-high-speed terminal secure access and intra-group secure communication method in a satellite network scenario.

[0084] like Figure 4 As shown in the figure, it is a diagram of the ultra-high-speed terminal access authentication process based on trajectory prediction. The ultra-high-speed terminal and the ground control center complete mutual authentication. In this process, considering that the ultra-high-speed terminal moves very fast, after sending the first access authentication request message, the ultra-high-speed terminal may deviate from the first access point. Figure 4 Access Points in The ground control center can send a first access request response authentication message to the second access point on the track route of the pre-configured ultra-high-speed terminal in advance. Figure 4 Access Points in When sending the first request response authentication message and it is uncertain through which access point the ultra-high-speed terminal can receive the response message, the response message may be sent to the first access point and the second access point at the same time.

[0085] Specifically, in step S102, the ground control center uses the trajectory of the ultra-high-speed terminal to calculate multiple access points on the trajectory of the ultra-high-speed terminal. The ultra-high-speed terminal and the ground control center use the multiple access points, the initialization result of the ground control center and the initialization result of the ultra-high-speed terminal to complete the access authentication, including the following steps S1021 to S1027.

[0086] S1021, the ultra-high-speed terminal generates a first access authentication request message, and sends the first access authentication request message to a first access point among multiple access points; wherein the first access point is closest to the ultra-high-speed terminal;

[0087] Here, the specific generation process of the first access authentication request message is as follows: First, the ultra-high-speed terminal generates a first timestamp , using the first shared key and the first timestamp Deriving encryption keys and integrity protection key , , and use the integrity protection key , Hide identity value , the first random number and the first timestamp Generate initial calculation value , , the initial calculated value Used for identity authentication, generating the first access authentication request message ;in, Represents a hash algorithm; represents the first shared key; Indicates the first timestamp.

[0088] S1022: The first access point identifies the first access point as the first access point Add to the first access authentication request message, and obtain the first request authentication message according to the ultra-high-speed terminal initialization result ;in, represents the initial calculated value; Indicates the first timestamp;

[0089] Here, if the ultra-high-speed terminal first sends a request to the first access point, that is, the access point Send the first authentication request message , by the access point Attach access point The first access point identity .

[0090] S1023: The first access point forwards the first authentication request message To ground control center;

[0091] S1024: The ground control center authenticates the first request message Respond, generate a first request response authentication message according to the initialization result of the ground control center; determine the access point receiving the first request response authentication message as the second access point according to the trajectory of the ultra-high-speed terminal, and forward the first request response authentication message to the ultra-high-speed terminal through the second access point;

[0092] Here, the ground control center first uses the hidden identity value , Master Key And the first random number Calculate the first identity of the ultra-high-speed terminal , and according to the first identity of the ultra-high-speed terminal Query the first shared key of the ultra-high-speed terminal ;

[0093] Then, the ground control center uses the first shared key and the first timestamp Calculating the encryption key and integrity protection key , , based on the integrity protection key , Hide identity value , first timestamp And the first random number Generate initial calculation value , the initial calculated value Used for identity verification; if correct, the ground control center generates a second timestamp , generate the first request response authentication message .

[0094] S1025, the ground control center calculates the second key between the ground control center and the ultra-high-speed terminal , and according to the second key Calculate a second shared key between the ultra-high-speed terminal and the second access point ;

[0095] Here, the second key between the ground control center and the ultra-high-speed terminal is calculated The formula is: , for ultra-high-speed terminals and second access points, i.e., access points Establishing a second shared key ,in, Indicates the identity of the ground control center.

[0096] S1026, the ground control center calculates the first and second access points for each of the multiple access points on the track of the ultra-high-speed terminal. Temporary ID corresponding to the access point ;

[0097] Here, the ground control center generates a temporary identifier associated with each access point on the track for the ultra-high-speed terminal. .

[0098] S1027, the ground control center uses the second shared key and temporary identification Complete the access response authentication of the corresponding access point.

[0099] Here, the ground control center sends an access first authentication response message to each access point on the track , complete the access response authentication of the corresponding access point.

[0100] In a specific embodiment provided by the present invention, each access point on the track receives a first authentication response message Then, a super-high-speed terminal access authentication response message is sent to the corresponding super-high-speed terminal. ;

[0101] The ultra-high-speed terminal receives the ultra-high-speed terminal access authentication response message After that, verify the first request response authentication message Is it correct? If it is correct, the ultra-high-speed terminal calculates the second key between it and the ground control center. , , and then calculate the ultra-high-speed terminal and access point The second shared key between , ;

[0102] Subsequently, the ultra-high-speed terminal, the ground control center and the access point use different second keys. Communicate to ensure the security of subsequent data exchange between each other.

[0103] During this access process, in order to ensure the anonymity and unlinkability of the ultra-high-speed terminal access identity, the ground control center also generates a temporary identifier associated with the ultra-high-speed terminal for each access point on the trajectory. and securely sends it to the ultra-high-speed terminal and different access points. Subsequently, different access points can use different temporary identifiers To identify the ultra-high-speed terminal, this method can effectively prevent the terminal from being tracked.

[0104] The method provided by the present invention predicts multiple access points on the trajectory route of the ultra-high-speed terminal in advance, and sends access requests to multiple access points during access to ensure successful access. After the terminal successfully accesses, the ground control center presets the shared key between the ultra-high-speed terminal and each access point on the travel trajectory to all access points in advance, thereby ensuring the network continuity and stability of the ultra-high-speed terminal. In this method, after the ground control center and the ultra-high-speed terminal complete identity authentication, the key calculation is performed according to the pre-agreed key generation rules, and key confirmation is not required, reducing cumbersome information interaction. The key generation is based on a confidential long-term shared key, so the confidentiality of the key can be guaranteed.

[0105] S103, the ultra-high-speed terminal launches multiple payload devices, determines some of the multiple payload devices as group members according to the trajectory of the ultra-high-speed terminal, and builds a group according to some of the payload devices, calculates the group key in the group using the initialization result of the ultra-high-speed terminal, and the members in the group communicate securely according to the group key.

[0106] In step S103, Figure 5 The figure shows a schematic diagram of the group formation process, where the group includes: some load equipment and an ultra-high-speed terminal.

[0107] In step S103, the ultra-high speed terminal calculates the group key in the group using the ultra-high speed terminal initialization result, including the following steps S1031 to S1037.

[0108] S1031, the ultra-high-speed terminal broadcasts a first group authentication notification message; wherein the first group authentication notification message includes: a first identity identifier of the ultra-high-speed terminal and the first challenge value ;

[0109] S1032, Load Equipment Receive a first group authentication notification message, and use the first group authentication notification message to send a group access first authentication request message to the corresponding ultra-high-speed terminal; wherein the first group access authentication request message includes: load device The corresponding load device hidden identity value , the second random number and the first calculated value ;

[0110] Here, each load device Generate the first encryption key , first integrity protection key , , calculate the first calculated value , load equipment Send group access authentication request message Sent to a very high speed terminal.

[0111] S1033, the ultra-high-speed terminal uses the group access authentication request message to obtain the payload device The first payload device identity , Load Equipment The corresponding first key , first encryption key and the first integrity protection key ;

[0112] Here, the ultra-high-speed terminal hides the identity value through the load device and the second random number Obtaining payload equipment The first payload device identity , and calculate the first key , first encryption key and the first integrity protection key , .

[0113] S1034, the ultra-high-speed terminal uses the first payload device identity , first key , first encryption key and the first integrity protection key For the first calculated value After successful verification, the first payload device is identified and the first encryption key To store; specifically, the first calculated value According to the load equipment The first payload device identity and load equipment The corresponding first integrity protection key Calculated.

[0114] Here, verify the first calculated value Correct or not; stored after successful verification .

[0115] In this process, in order to ensure the load equipment Identity anonymity and unlinkability, ultra-high-speed terminals can provide each payload device Generate a new hidden identity , and By first encryption key Safely sent to each payload device ,in, Represents the sixth random number.

[0116] S1035: The ultra-high-speed terminal generates a third random number , construct the first interpolation polynomial ; Select the first interpolation polynomial In point, according to this points and the third random number Calculate the second calculated value and the key identifier of the group , broadcast group key establishment request message; wherein, the group key establishment request message Includes: The first identity of the ground control center , key identifier , the second calculated value and the above points;

[0117] Here, it is assumed that the ultra-high-speed terminal has received The group access authentication request message of the load device is obtained .

[0118] Ultra-high-speed terminal generates third random number , and construct a The Passage of Wei The first interpolation polynomial of points , Points include and .

[0119] The ultra-high-speed terminal then selects a first interpolation polynomial on Points .

[0120] Finally, the ultra-high-speed terminal calculates the second calculated value , and generate the key identifier of the group , and finally broadcast the group key establishment request message, which is expressed as: .

[0121] S1036, Load Equipment Receive the group key establishment request message, according to the load device The first payload device identity stored in and the first encryption key Construct the first interpolation polynomial , using the first interpolation polynomial Calculate the third random number Specifically, using the first interpolation polynomial Calculate the third random number , including: according to points and the first interpolating polynomial Calculate the third random number .

[0122] Here, the load equipment After receiving the group key establishment request message, use the first payload device identity stored in itself and the first encryption key , construct the first interpolation polynomial ,calculate Get the third random number .

[0123] S1037, using the third random number Verify the second calculated value If valid, the third random number is determined is the group key.

[0124] Here, verify the second calculated value If valid, the third random number is accepted. is the group key, followed by a third random number Communicate within the group.

[0125] After calculating the group key in the group, the method of the present invention further comprises: updating the members of the group to obtain a second group, and calculating the updated key of the second group to complete secure communication within the second group;

[0126] Updating the members of the group to obtain a second group and calculating an updated key of the second group includes:

[0127] (1) Second load equipment Sending a group joining request message to the ultra-high-speed terminal;

[0128] (2) The ultra-high-speed terminal generates a second challenge value , and broadcast to the second payload device Related second group authentication notification message; wherein the second group authentication notification message includes: the first identity identifier of the ultra-high-speed terminal and the second challenge value ;

[0129] (3) Second load equipment Receive a second group authentication notification message, and use the second group authentication notification message to send a second group access authentication request message to the corresponding ultra-high-speed terminal, wherein the second group access authentication request message includes: a second load device The corresponding load device hidden identity value , the eighth random number and the second calculated value ;

[0130] (4) The ultra-high-speed terminal calculates the second load device using the second group access authentication request message Second identity , Second load equipment The corresponding key , the second encryption key and the second integrity protection key , and the second calculated value Verify the second identity after successful verification and the second encryption key To store;

[0131] Here, the second calculated value According to the second load device Second identity and second load equipment The corresponding second integrity protection key Calculated.

[0132] (5) Ultra-high-speed terminal uses a second identity and the second encryption key An updated group key is calculated to complete secure communication within the second group.

[0133] Specifically, considering the presence of the second load device The scenario of new members joining the group needs to be considered. During the group member joining process, the payload device sends a group joining request to the ultra-high-speed terminal, and the ultra-high-speed terminal generates a new second challenge value. , and execute the process of calculating the group key in the group in S103.

[0134] In the method provided by the present invention, the payload devices carried by the ultra-high-speed terminal can share the group key and communicate securely. At the same time, the method supports the dynamic joining and exiting of the payload devices and the dynamic updating of the group key in the process, thereby ensuring the forward and backward security of the group key.

[0135] like Figure 6 As shown in the figure, it is a diagram of the process of payload equipment accessing the network based on ultra-high-speed terminal authorization.

[0136] After calculating the group key in the group, the method of the present invention further includes: a third load device in the group Interact with ultra-high-speed terminals or access points; wherein the third load device A payload device that has exited the group or needs to communicate with the network individually;

[0137] The third load device in the group Interact with ultra-high-speed terminals or access points, including:

[0138] (1) Third load equipment Send a pre-request message for accessing the network to the ultra-high-speed terminal; wherein the pre-request message for accessing the network includes: the validity period of the key ;

[0139] (2) The ultra-high-speed terminal calculates the third load device according to the network pre-request message The corresponding second payload device identity ;

[0140] (3) The ultra-high-speed terminal determines the second key between the ultra-high-speed terminal and the ground control center , according to the second payload device identity , Key validity period and the second key , calculate the ciphertext ;

[0141] (4) The ultra-high-speed terminal uses the temporary identity of the ultra-high-speed terminal For the third load device Calculate temporary key value , sending the first message to the third load device ; Wherein, the first message includes: temporary key value , Temporary identification of ultra-high-speed terminals 、Third load equipment The corresponding second payload device identity and ciphertext ;

[0142] (5) Third load equipment Sending a second access authentication request to the ground control center through the access point;

[0143] (6) The ground control center verifies the second access authentication request. If the verification is successful, the ground control center calculates the different access points and the third payload device. The third shared key between and the third calculated value , and the second message Send to the third payload device ; Wherein, the second message includes: the third calculated value , the fifth random number generated by the ultra-high-speed terminal and the current timestamp in ground control ;

[0144] (7) Third load equipment Verify the current timestamp in ground control and the third calculated value If the verification is successful, the third shared key As a secure communication key to communicate with the ground control center to complete the third payload equipment Interactive communication with the ground control center.

[0145] Exemplary, third load device Send a pre-request message to the ultra-high-speed terminal to access the network in advance , the ultra-high-speed terminal identifies the payload device and key validity period , through the second key between the ultra-high-speed terminal and the ground control center Encrypt; obtain ciphertext , ciphertext , indicating that according to the second key right and Encryption is performed; wherein, Indicates the new hidden identity generated by the ultra-high-speed terminal for the payload device after the group authentication is completed; Indicates the seventh random number. For the third load device Calculate temporary key value , and the first message By first encryption key Safely sent to third payload device ,in It is a temporary identification for ultra-high-speed terminals. Indicates cascade;

[0146] Third load equipment Send a second access authentication request to the ground control center through the access point, the second access authentication request includes , , Indicates the third load device The current timestamp on .

[0147] After receiving the second access authentication request, the ground control center first verifies the third payload device Current timestamp on The ground control center uses the ultra-high-speed terminal temporary identity Analyze the first identity of the ultra-high-speed terminal The ground control center uses the second key with the ultra-high-speed terminal Decrypting ciphertext , obtain the second payload device identity and key validity period , and verify the key validity period After successful verification, the temporary key value is calculated , calculate and verify After successful verification, the ground control center generates the fifth random number , calculate the third load device Shared session key with ground control , calculate the third calculated value In addition, the ground control center calculates As a third load device With access point The third shared key between Then the ground control center will Send to the third payload device ,in, is the current timestamp in the ground control center.

[0148] Third load equipment After receiving the message, check the current timestamp in the ground control center , calculate the third load device according to the message Shared session key with ground control , calculation verification After successful verification, the key is accepted as the secure communication key between it and the ground control center NCC. As a third load device With access point The third shared key between .

[0149] Through this method, the ultra-high-speed terminal can safely and continuously access the ground control center through the space access point when it quickly leaves the ground, and use the group key for intra-group communication.

[0150] The ultra-high-speed terminal can authorize the payload device to access the network, and the ultra-high-speed terminal can assist the payload device to access the network to maintain network communication when it is out of the range of the ultra-high-speed terminal.

[0151] Mutual authentication and key negotiation between the ultra-high-speed terminal and the ground control center, between the payload device and the ultra-high-speed terminal, and between the payload device and the ground control center; the present invention also realizes the anonymity, unlinkability, front and back key separation, and forward and backward security of the payload device and the ultra-high-speed terminal.

[0152] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referenced to each other. Each embodiment focuses on the differences from other embodiments.

[0153] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, it should be understood by those skilled in the art that the technical solutions described in the aforementioned embodiments may still be modified, or some or all of the technical features thereof may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the responsive technical solutions from the scope of the technical solutions of the present invention.

Claims

1. A method for ultra-high-speed terminal secure access and intra-group secure communication in a satellite network scenario, characterized in that: include: The ground control center and the ultra-high speed terminal are initialized to obtain the initialization result of the ground control center and the initialization result of the ultra-high speed terminal; wherein the ultra-high speed terminal carries a plurality of payload devices; specifically, the ground control center and the ultra-high speed terminal are initialized, including: The ground control center generates a master key of the ground control center ; The ground control center distributes a long-term first shared key to the ultra-high-speed terminal and a first identity of the ultra-high-speed terminal ; The ground control center randomly generates a first random number , according to the first random number Calculate the hidden identity value of the ultra-high-speed terminal ; The ground control center sends the first identity , the first shared key , the hidden identity value and the first random number Sending it to the ultra-high-speed terminal as a first offline preset message; The ultra-high-speed terminal is based on each load device The first payload device identity Generate the payload device The corresponding first key , and generate a second random number , according to the second random number Calculate the load equipment The payload device hides the identity value ; The ultra-high-speed terminal identifies the first payload device , the first key , the load device hides the identity value and the second random number Sent as the second offline preset message to each load device ; The ground control center determines the identity of the access point as , and a secure channel is established between the access point and the ground control center; The ground control center initialization result includes the first identity , the first random number and the identity is The ultra-high-speed terminal initialization result includes the hidden identity value and the first shared key ; The ground control center calculates a plurality of access points on the track of the ultra-high-speed terminal using the track of the ultra-high-speed terminal, the ultra-high-speed terminal and the ground control center complete access authentication using the plurality of access points, the initialization result of the ground control center and the initialization result of the ultra-high-speed terminal, the ground control center calculates session keys between the plurality of access points and the ultra-high-speed terminal respectively, and the ultra-high-speed terminal and the ground control center perform secure communication using the session keys; The ultra-high-speed terminal transmits multiple payload devices, determines some of the multiple payload devices as group members according to the trajectory of the ultra-high-speed terminal, builds a group according to the some of the payload devices, calculates the group key in the group using the initialization result of the ultra-high-speed terminal, and the members in the group communicate securely according to the group key.

2. The method for ultra-high-speed terminal secure access and intra-group secure communication in a satellite network scenario according to claim 1, characterized in that: The ground control center calculates a plurality of access points on the track of the ultra-high-speed terminal using the track of the ultra-high-speed terminal, and the ultra-high-speed terminal and the ground control center complete access authentication using the plurality of access points, the initialization result of the ground control center, and the initialization result of the ultra-high-speed terminal, including: The ultra-high-speed terminal generates a first access authentication request message, and sends the first access authentication request message to a first access point among the multiple access points; wherein the first access point is closest to the ultra-high-speed terminal; The first access point identifies the first access point Add to the first access authentication request message, and obtain the first request authentication message according to the ultra-high-speed terminal initialization result ;in, Indicates the initial calculated value; Indicates the first timestamp; The first access point forwards the first authentication request message to said ground control center; The ground control center sends the first authentication request message In response, a first request response authentication message is generated according to the initialization result of the ground control center, and an access point receiving the first request response authentication message is determined to be a second access point according to the trajectory of the ultra-high-speed terminal, and the first request response authentication message is forwarded to the ultra-high-speed terminal through the second access point; The ground control center calculates a second key between the ground control center and the ultra-high-speed terminal , and according to the second key Calculating a second shared key between the ultra-high-speed terminal and the second access point ; The ground control center calculates corresponding temporary identifiers for multiple access points on the track of the ultra-high-speed terminal ; The ground control center uses the second shared key and temporary identification Complete the access response authentication of the corresponding access point.

3. The method for ultra-high-speed terminal secure access and intra-group secure communication in a satellite network scenario according to claim 1, characterized in that: The group includes: the partial load equipment and an ultra-high speed terminal.

4. The method for ultra-high-speed terminal secure access and intra-group secure communication in a satellite network scenario according to claim 1, characterized in that: The ultra-high-speed terminal calculates the group key in the group using the ultra-high-speed terminal initialization result, including: The ultra-high-speed terminal broadcasts a first group authentication notification message; wherein the first group authentication notification message includes: a first identity identifier of the ultra-high-speed terminal and the first challenge value ; The load equipment receiving the first group authentication notification message, and using the first group authentication notification message to send a first group access authentication request message to the corresponding ultra-high-speed terminal; wherein the first group access authentication request message includes: the load device The corresponding load device hidden identity value , the second random number and the first calculated value ; The ultra-high-speed terminal obtains the load device by using the group access authentication request message. The first payload device identity , the load equipment The corresponding first key , first encryption key and the first integrity protection key ; The ultra-high-speed terminal uses the first payload device identity , the first key , the first encryption key and the first integrity protection key The first calculated value After successful verification, the first payload device identity and the first encryption key To store; The ultra-high-speed terminal generates a third random number , construct the first interpolation polynomial ; Select the first interpolation polynomial In point, according to this points and the third random number Calculate the second calculated value and the key identifier of the group , broadcast group key establishment request message; wherein the group key establishment request message Including: the first identity of the ground control center , the key identifier The second calculated value and stated Points ; The load equipment Receive the group key establishment request message, and The first payload device identity stored in and the first encryption key Construct the first interpolation polynomial , using the first interpolation polynomial Calculate the third random number ; Using the third random number Verify the second calculated value If valid, the third random number is determined is the group key.

5. The method for ultra-high-speed terminal secure access and intra-group secure communication in a satellite network scenario according to claim 4, characterized in that: The load equipment , using the first interpolation polynomial Calculate the third random number ,include: According to the points and the first interpolation polynomial Calculate the third random number .

6. The method for ultra-high-speed terminal secure access and intra-group secure communication in a satellite network scenario according to claim 4, characterized in that: The first calculated value According to the load equipment The first payload device identity and the load device The corresponding first integrity protection key Calculated.

7. The method for ultra-high-speed terminal secure access and intra-group secure communication in a satellite network scenario according to claim 1, characterized in that: After calculating the group key in the group, the method further includes: updating the members of the group to obtain a second group, and calculating an updated key of the second group to complete secure communication within the second group; The updating of the members of the group to obtain a second group and calculating an update key of the second group includes: Second load equipment Sending a group join request message to the ultra-high-speed terminal; The ultra-high-speed terminal generates a second challenge value , and broadcast to the second payload device Related second group authentication notification message; wherein, the second group authentication notification message includes: the first identity of the ultra-high-speed terminal and the second challenge value ; The second load device receiving the second group authentication notification message, and using the second group authentication notification message to send a second group access authentication request message to the corresponding ultra-high-speed terminal, wherein the second group access authentication request message includes: the second load device The corresponding second encryption key , second integrity protection key and the second calculated value ; The ultra-high-speed terminal calculates the second load device using the second group access authentication request message Second identity , Second load equipment The corresponding key , the second encryption key and the second integrity protection key , and for the second calculated value After successful verification, the second identity and the second encryption key To store; The ultra-high-speed terminal uses the second identity and the second encryption key An updated group key is calculated to complete secure communication within the second group.

8. The method for ultra-high-speed terminal secure access and intra-group secure communication in a satellite network scenario according to claim 7, characterized in that: The second calculated value is according to the second load device Second identity and second load equipment The corresponding second integrity protection key Calculated.

9. The method for ultra-high-speed terminal secure access and intra-group secure communication in a satellite network scenario according to claim 1, characterized in that: After calculating the group key in the group, the method further includes: a third load device in the group interacting with the ultra-high-speed terminal or the access point; wherein the third load device A payload device that exits the group or a payload device that needs to communicate with the network individually; The third load device in the group Interacting with the ultra-high-speed terminal or the access point includes: Third load equipment Sending a network access pre-request message to the ultra-high-speed terminal; wherein the network access pre-request message includes: a key validity period ; The ultra-high-speed terminal calculates the third load device according to the network pre-request message The corresponding second payload device identity ; The ultra-high-speed terminal determines a second key between the ultra-high-speed terminal and the ground control center , according to the second load device identity , the validity period of the key and the second key , calculate the ciphertext ; The ultra-high-speed terminal uses a temporary identity of the ultra-high-speed terminal The third load device Calculate temporary key value , sending the first message to the third load device ; Wherein, the first message includes: a temporary key value , a temporary identity of the ultra-high-speed terminal 、Third load equipment The corresponding second payload device identity and ciphertext ; Third load equipment Sending a second access authentication request to the ground control center through the access point; The ground control center verifies the second access authentication request, and if the verification is successful, calculates different access points and the third load device The third shared key between and the third calculated value , and sends the second message to the third load device ; Wherein, the second message includes: the third calculated value , a fifth random number generated by the ultra-high-speed terminal and the current timestamp in ground control ; The third load device Verify the current timestamp in the ground control center and the third calculated value If the verification is successful, the third shared key As a secure communication key for communicating with the ground control center to complete the third payload equipment Interactively communicate with the ground control center.

Images