Endogenous security-based 5G AeroMACS terminal trusted access method

Abstract

The invention relates to a 5G AeroMACS terminal trusted access method based on endogenous security, belongs to the technical field of wireless communication, and solves the problem of limited security access during real-time communication of airport terminals with different security levels in the prior art aiming at the application requirement of security access of an airport scene communication terminal. The method comprises the following steps of: 1, establishing a multi-factor identity authentication model and an authentication success probability model of equipment; 2, establishing a key negotiation mechanism, deriving a session key mechanism and a session key use mechanism, and obtaining a session key and a management strategy; step 3, the control domain establishes and maintains an access relation between the airport terminal and the trusted network based on a trust transfer mechanism; and 4, based on the multi-factor identity authentication model and the authentication success probability model in the step 1, the key negotiation mechanism, the derived session key mechanism and the session key use mechanism in the step 2, and the access relationship between the airport terminal and the trusted network in the step 3, performing trusted network access authentication on the airport terminal to be accessed.

Description

Technical Field

[0001] The present invention belongs to the field of wireless communication technology and, in response to the application demand for secure access of airport communication terminals, specifically relates to a 5G AeroMACS terminal trusted access method based on intrinsic security. This method enables the 5G Aeronautical Mobile Airport Communications System (5GAeroMACS) to achieve trusted access to airport terminals through an intrinsic security architecture. Background Art

[0002] The rapid development of intelligent aviation has led to a surge in airport surface communication terminals, making the security and reliability of airport surface communication systems increasingly important. Traditional wireless communication systems primarily focus on connectivity during design, failing to incorporate security as an inherent capability. This makes the systems vulnerable to security threats such as unauthorized access and data leakage. In modern airports, the communication needs of airport terminals, such as taxiing aircraft, ground vehicles, and maintenance equipment, are constantly increasing. These terminals require fast and reliable network access to ensure efficient airport operations. However, traditional security measures primarily rely on peripheral devices such as firewalls and VPNs (Virtual Private Networks). This patch-based, passive defense model is no longer adaptable to the complex and diverse application scenarios of airports. Common security issues in traditional networks, such as IP address spoofing, man-in-the-middle attacks, and data leakage, are particularly vulnerable during the terminal access phase. Existing protection mechanisms are unable to effectively address these emerging security threats. Therefore, there is an urgent need for a secure and trusted access method for communication terminals that can comprehensively safeguard the communication security of airport surface terminals from the access layer onwards, adapting to the complexity and diverse demands of modern airport environments.

[0003] 5G AeroMACS is a next-generation communications standard designed specifically for airport environments. Combining the high bandwidth, low latency, and high reliability of 5G technology, it provides a comprehensive, secure, and efficient solution for airport surface communications. Its high bandwidth supports the rapid transmission of massive amounts of data, its low latency ensures the accuracy and reliability of real-time communications, and its robust connectivity enables seamless access and efficient collaboration among multiple terminals. Therefore, 5G AeroMACS has the potential to meet the diverse access needs of airport surface terminals. By leveraging its high bandwidth and low latency network, as well as trusted access technology, the system effectively prevents unauthorized access and data leakage, thereby enhancing communication security for all terminals.

[0004] Currently, airport wireless data communications are categorized into three levels based on security: Level I (aircraft safety communications), used for communications related to flight safety and requiring the highest reliability and real-time performance; Level II (other safety communications), used for communications related to safety, such as aircraft docking, and requiring compliance with relevant technical performance requirements; and Level III (non-safety communications), used for other non-safety-related services and requiring assurance that no interference with Level I or Level II communications will occur. Furthermore, existing airport communications primarily rely on civil aviation private networks, with communication architectures primarily focused on enhanced connectivity and secure access relying on relatively passive peripheral protection equipment. These capabilities are unable to meet the diverse and highly secure communication access needs of modern airports. Summary of the Invention

[0005] In view of the above problems, the present invention provides a 5G AeroMACS terminal trusted access method based on intrinsic security, which solves the problem of limited secure access during real-time communication between airport terminals of different security levels in the prior art.

[0006] The present invention provides a 5G AeroMACS terminal trusted access method based on intrinsic security, the specific steps are as follows: Step 1. Establish a multi-factor identity authentication model and an authentication success probability model for the device; Among them, the equipment includes airport terminals and access switches; Step 2. Establish a key negotiation mechanism, a session key derivation mechanism, and a session key usage mechanism to obtain the session key and management strategy. Step 3. The control domain establishes and maintains the access relationship between the airport terminal and the trusted network based on the trust transfer mechanism; Step 4. Based on the multi-factor identity authentication model and authentication success probability model in step 1, the key negotiation mechanism, derived session key mechanism and session key usage mechanism in step 2, and the access relationship between the airport terminal and the trusted network in step 3, the airport terminal to be connected is authenticated for trusted network access.

[0007] Optionally, the specific steps of step 2 are as follows: Step 21. Establish a key negotiation mechanism and obtain a temporary shared key; Step 22. Based on the temporary shared key, the airport terminal and the access switch calculate and exchange the encrypted comprehensive identity information encoding sequence, and derive the session key after two-way identity authentication. Step 23. Based on the session key, establish a session key usage mechanism and obtain a session key management policy.

[0008] Optionally, the specific steps of step 21 are as follows: Step 211. Obtain the temporary public keys of the airport terminal and access switch according to the elliptic curve encryption equation of the device; Step 212: Obtain a temporary shared key based on the temporary public keys of the airport terminal and the access switch.

[0009] Optionally, the specific steps of step 22 are as follows: Step 221. Obtain an encrypted comprehensive identity information coding sequence based on the temporary shared key, the comprehensive identity information data of the airport terminal and the access switch; Step 222. Based on the temporary shared key and the encrypted comprehensive identity information code sequence, the airport terminal and the access switch perform bidirectional identity information decryption to obtain the other party's comprehensive identity information data; Step 223. The airport terminal and the access switch perform bidirectional identity verification based on the decrypted comprehensive identity information data of the other party and the multi-factor identity authentication value obtained in step 1. Step 224. For the airport terminal and access switch that have passed the two-way identity information authentication, a key derivation function is used to derive a session key.

[0010] Optionally, the specific steps of step 3 are as follows: Step 31. The control domain issues a digital certificate to the airport terminal in the source domain that has passed the two-way identity verification and authorizes the source domain to access the terminal. Step 32. The control domain establishes a cross-domain trust transfer mechanism to expand airport terminal access permissions; Step 33. The control domain monitors the behavior of airport terminals and maintains the dynamic trust chain of airport terminals.

[0011] Optionally, the specific steps of step 4 are as follows: Step 41. The airport terminal initiates an access request; Step 42. The airport terminal to be connected and the access switch obtain each other's temporary public key and calculate the temporary shared key based on the key negotiation mechanism in step 2; Step 43. The airport terminal to be connected and the access switch encrypt their own comprehensive identity information data using the temporary shared key. After exchanging this data, each decrypts the other's comprehensive identity information data. The airport terminal to be connected and the access switch use each other's comprehensive identity information data to calculate the multi-factor identity authentication value, completing bidirectional identity verification and accepting management by the control domain. Step 44. Based on the bidirectional identity information verification result of step 33, the control domain evaluates the security of the airport terminal and returns the evaluation result; Step 45. The control domain transmits the access management policy obtained based on the method in steps 2 and 3 to the access switch; Step 46. The airport terminal to be connected establishes a connection with the trusted network and accesses the trusted network.

[0012] Optionally, step 4 also includes step 47, where the control domain monitors the behavior of the terminals that have been connected to the airport and adjusts the access strategy based on the detection results.

[0013] Compared with the prior art, the present invention has at least the following beneficial effects: (1) The method of the present invention is based on the 5G AeroMACS standard, adopts an intrinsic security architecture design, combines multi-factor identity authentication and simplified key management to build a trusted network access authentication, and realizes network trusted access connectivity guarantee through a trust transfer mechanism, thereby solving the problems of illegal access and data leakage in airport terminal communications and meeting the high-security and diversified access requirements of airport terminals.

[0014] (2) The method of the present invention introduces multi-factor identity authentication, which can more accurately identify airport terminals of different security levels. Combined with terminal trusted identification technology, the airport terminal identity is bound to the dynamic network address to prevent unauthorized terminal access. This method provides strong security protection, effectively resisting forgery and tampering attacks in the early stages of network access.

[0015] (3) The method of the present invention simplifies the key management process and adopts lightweight encryption technology, significantly reducing computing and energy consumption requirements. It enables efficient and secure communication on resource-constrained airport terminals, allowing airport terminals to quickly and securely access the network without compromising security due to limited computing resources.

[0016] (4) The method of the present invention implements a two-way authentication mechanism for trusted network access. The airport terminal and the access management device complete two-way identity authentication through a temporary shared key, ensuring the authenticity of both parties' identities and preventing unauthorized access and man-in-the-middle attacks. In addition, after the access management device completes the identity authentication of the airport terminal that accesses the network for the first time, it binds the trusted identifier to the dynamically allocated network address, achieving traceability of network security, resource management, and access control, ensuring that only authenticated airport terminals can obtain network configurations, and preventing illegal terminals from accessing the network.

[0017] (5) The method of the present invention establishes a cross-domain trust transfer mechanism, which is implemented by verifying the digital certificate issued by the access management device to the airport terminal. This reduces the complexity of authentication while solving the cross-domain access trust problem. This mechanism ensures the security and traceability of cross-domain access, allowing the airport terminal to establish a secure and reliable communication link with different network domains, ensuring the connectivity of the communication network while improving the security of cross-domain collaboration. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The drawings are only for purposes of illustrating particular embodiments and are not to be considered limiting of the invention.

[0019] Figure 1 Schematic diagram of the inherent security architecture of the 5G AeroMACS terminal trusted access method of the present invention.

[0020] Figure 2This is a flow chart of encrypting and decrypting comprehensive identity information data using the ECC encryption algorithm adopted by the 5G AeroMACS terminal trusted access method of the present invention.

[0021] Figure 3 This is a relationship diagram of the trust transfer mechanism of the 5G AeroMACS terminal trusted access method of the present invention.

[0022] Figure 4 This is a trusted access authentication flow chart of the 5G AeroMACS terminal trusted access method of the present invention.

[0023] Figure 5 This is a flow chart of the 5G AeroMACS terminal trusted access method of the present invention. DETAILED DESCRIPTION

[0024] In order to more clearly understand the above-mentioned objects, features and advantages of the present invention, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments. It should be noted that, in the absence of conflict, the embodiments of the present invention and the features therein may be combined with each other. In addition, the present invention may also be implemented in other ways different from those described herein. Therefore, the scope of protection of the present invention is not limited by the specific embodiments disclosed below.

[0025] A specific embodiment of the present invention, as Figure 1-Figure 5 , discloses a 5G AeroMACS terminal trusted access method based on intrinsic security, the specific steps are as follows: Step 1. Establish a multi-factor identity authentication model and an authentication success probability model for the device.

[0026] The equipment includes airport terminals and access switches.

[0027] Specifically, the expression of the multi-factor identity authentication model is: (1) in, Indicates the comprehensive identity authentication value, represents the mean of the verification results of the knowledge factor; Indicates the mean of the verification results of the factors; It represents the mean value of the verification results of environmental factors; Represent the weights of knowledge factors, possession factors and environmental factors respectively.

[0028] Furthermore, if the corresponding factor passes the verification, the corresponding verification result is recorded as 1, otherwise it is recorded as 0. The result mean is the sum of the verification results divided by the number of verifications.

[0029] Furthermore, the expression of the authentication success probability model is: (2) in, represents the probability of successful multi-factor authentication, Represent the probability of successful authentication of knowledge factors, possession factors and environmental factors respectively, Respectively represent the number of times the knowledge factor, possession factor and environmental factor are tested.

[0030] Furthermore, the knowledge factor is the password or PIN code (personal identification code) provided by the device; the possession factor is the physical and / or software token, such as the device's security key or the hardware device on the aircraft used to generate access codes; the environmental factor is the device's network location and access time, etc.

[0031] Furthermore, when performing multi-factor identity authentication, data is transmitted using a secure channel with encrypted data transmission.

[0032] Furthermore, by adjusting the weight of the multi-factor authentication mechanism and the number of times multiple factors were tested Implement feasible policies and rules to manage the verification process of different factors and complete access authentication settings of different security levels.

[0033] The multi-factor identity authentication model of the present invention significantly enhances the security of the airport communication system, provides a safe and strict access environment for 5GAeroMACS, effectively avoids potential security threats and unauthorized access, and thus protects critical data and communications from infringement. By combining multiple identity authentication factors, the model greatly reduces the risk of a single authentication method being cracked, ensuring that each airport terminal accessing the network is authorized and trustworthy. In addition, the present invention significantly improves the defense capability of the airport communication system and reduces the possibility of unauthorized access by increasing the number of checks for each factor and considering different types of authentication factors. Furthermore, the airport communication system can achieve identity authentication at different security levels by setting weight parameters and the number of checks. This authentication method is suitable for communication authentication between aircraft, ground service equipment and other critical infrastructure.

[0034] Step 2. Establish a key negotiation mechanism, a session key derivation mechanism, and a session key usage mechanism to obtain the session key and its management strategy.

[0035] Step 21: Establish a key negotiation mechanism and obtain a temporary shared key.

[0036] Step 211. Obtain the temporary public keys of the airport terminal and access switch according to the elliptic curve encryption equation of the device; Specifically, the elliptic curve encryption equation of the device is expressed as: (3) in, Respectively represent the horizontal and vertical coordinates of a point on the elliptic curve; Represent the finite field of elliptic curves Integer argument over finite field The value of is A non-negative integer (i.e., 0 to integers between ); Represents prime numbers take the remainder; Describe prime numbers.

[0037] All points on the elliptic curve are points that conform to the elliptic curve equation, and these points belong to a finite field And together they form an elliptic curve.

[0038] Furthermore, the parameters of the elliptic curve and The constraints are: .

[0039] Preferably, is a large prime number.

[0040] Furthermore, the temporary public keys of the airport terminal and the access switch are expressed as:

[0041] in, Indicates airport terminal A temporary random private key is chosen The corresponding temporary public key; Indicates access switch A temporary random private key is chosen The corresponding temporary public key; It is the base point on the elliptic curve of the airport terminal and access switch.

[0042] Furthermore, , is the base point on the elliptic curve The order of the ellipse base point The minimum number of times required to obtain a point at infinity after multiple self-additions.

[0043] Step 212: Obtain a temporary shared key based on the temporary public keys of the airport terminal and the access switch.

[0044] Specifically, the airport terminal is obtained by the commutative law of elliptic curve point multiplication and access switches The temporary shared key expression equation is:

[0045] in, Indicates airport terminal and access switches Temporary shared key.

[0046] Furthermore, the airport terminal and access switches Exchange their respective temporary public keys and , temporary shared key The two parties calculate the key independently, and when the calculation is completed, it means that the two parties have completed the key negotiation.

[0047] Step 22. Based on the temporary shared key, the airport terminal and the access switch calculate and exchange the encrypted comprehensive identity information encoding sequence, and derive the session key after two-way identity authentication. like Figure 2 As shown, the process of encrypting and decrypting comprehensive identity information data using the ECC encryption algorithm is demonstrated.

[0048] Step 221. Based on the temporary shared key, the comprehensive identity information data of the airport terminal and the access switch, an encrypted comprehensive identity information coding sequence is obtained.

[0049] Specifically, airport terminals and access switches The comprehensive identity information data containing knowledge factors, possession factors and environmental factors is translated into an ASCII encoded string, and then the ASCII encoded string is mapped into an unencrypted elliptic curve equation point sequence. Finally, the unencrypted elliptic curve equation point sequence is encrypted into an encrypted comprehensive identity information encoding sequence using the Elliptic Curve Cryptography (ECC) encryption algorithm.

[0050] Further, the comprehensive identity information data is translated into an ASCII encoding string according to an ASCII encoding table; Furthermore, each ASCII byte encodes Mapping to mapping encoding through hash function (SHA-256) , using mapping encoding Prime numbers Take the remainder to get a horizontal coordinate , the horizontal axis Substitute into the elliptic curve encryption equation for calculation, if there is a vertical coordinate Make the elliptic curve encryption equation have a solution and map it to the unencrypted elliptic curve equation point ; If the horizontal axis No corresponding vertical coordinate So that the elliptic curve encryption equation has a solution, then the horizontal coordinate Increase the value by 1 and continue to search for the vertical coordinate Solution; if there are multiple vertical coordinates Make the elliptic curve encryption equation have a solution and take the smallest ordinate The value is used as the solution, thereby obtaining the ASCII encoding table.

[0051] Specifically, substitute the ASCII code (0 to 255) into the ASCII byte code in sequence The calculation obtains the correspondence table between ASCII codes and elliptic curve equation points. The sender maps the ASCII code string into an unencrypted elliptic curve equation point sequence by looking up the ASCII code table.

[0052] Further, using the airport terminal and access switches Temporary shared key Encrypt the unencrypted elliptic curve equation point sequence. Encrypted to the corresponding ciphertext point , the expression is: .

[0053] Furthermore, the unencrypted elliptic curve equation point sequence is encrypted point by point in the above manner to obtain an encrypted comprehensive identity information coding sequence.

[0054] Step 222. Based on the temporary shared key and the encrypted comprehensive identity information code sequence, the airport terminal and the access switch perform bidirectional identity information decryption to obtain the other party's comprehensive identity information data; Specifically, airport terminals and access switches Exchange their respective encrypted comprehensive identity information encoding sequences and use the temporary shared key Decrypt the encrypted comprehensive identity information code sequence received by each party, and reverse map the obtained unencrypted elliptic curve equation point sequence using the ASCII code table. The airport terminal and access switch respectively translate the ASCII code string into the other party's comprehensive identity information data.

[0055] Furthermore, the device party will encrypt the ciphertext point of the comprehensive identity information encoding sequence Solve the plaintext points corresponding to the unencrypted elliptic curve equation point sequence , the expression is:

[0056] Furthermore, the encrypted comprehensive identity information coding sequence is decrypted point by point to obtain the other party's unencrypted elliptic curve equation point sequence.

[0057] Furthermore, the other party's unencrypted elliptic curve equation point sequence is inversely mapped into the other party's ASCII encoding string through a correspondence table between ASCII encoding and elliptic curve equation points.

[0058] Furthermore, the ASCII encoding string of the other party is translated into the other party's comprehensive identity information data through an ASCII encoding table.

[0059] Furthermore, the airport terminal and access switches The above process is carried out independently, each party decrypts and obtains the other party's comprehensive identity information data and realizes two-way identity information decryption.

[0060] Step 223. The airport terminal and the access switch perform bidirectional identity verification based on the decrypted comprehensive identity information data of the other party and the multi-factor identity authentication value obtained in step 1. Specifically, airport terminals and access switches According to the decrypted comprehensive identity information data of the other party, the comprehensive identity authentication model of step 1 is used to obtain the comprehensive identity authentication value of the other party. If the comprehensive identity authentication value does not meet the identity authentication threshold, the control domain terminates the airport terminal. and access switches If the access process is satisfied, proceed to step 224; Furthermore, the weight and number of two-way identity information verification are set according to the control domain. The control domain uses the authentication success probability model in step 1 to calculate the success probability of multi-factor identity authentication. , according to the success probability of multi-factor authentication Adjust the weight and number of two-way identity information verification.

[0061] Step 224. For the airport terminal and access switch that have passed the two-way identity information authentication, a key derivation function is used to derive a session key.

[0062] Specifically, airport terminals and access switches After passing the two-way identity information verification, the control domain uses the key derivation function to derive the session key and send it to the airport terminal and access switches , the expression is:

[0063] in, represents the derived session key; represents the session key derivation function; Indicates the salt value generated by the control domain; Indicates airport terminal Additional Information.

[0064] The session key derivation function of the present invention takes into account the temporary shared key , salt value (Random string to ensure uniqueness of derived key) and additional information (such as application identification, device information, security attribute requirements and other optional information), realize automatic key update and derive session key based on session state information (such as timestamp, session identifier, session count and other information), avoid full key negotiation for each communication, and reduce computing overhead.

[0065] This invention utilizes a lightweight ECC encryption algorithm to simplify key negotiation and derivation. Compared to the RSA (Rivest Shamir Adleman) encryption algorithm, the ECC encryption algorithm requires a smaller key length and lower computational complexity while providing the same level of security, effectively reducing the system resource requirements for encryption operations. Furthermore, through a key update mechanism based on session state information, this invention avoids the need for a full key negotiation for each communication, thereby improving system efficiency. Furthermore, in the highly dynamic environment of airports, this approach avoids the burdensome and inflexible nature of key management strategies due to frequent key updates and the diverse support requirements of airport terminals.

[0066] Step 23. Based on the session key, establish a session key usage mechanism and obtain a session key management policy.

[0067] Specifically, the session key usage mechanism includes a data encryption method, a data decryption method, a session key update frequency method, a session key update period method, and a session key update efficiency method.

[0068] It can be understood that the data is the transmission data of the airport terminal accessing the 5G AreoMACS network through the access switch.

[0069] Furthermore, the session key usage mechanism includes a data encryption method and a data decryption method: the airport terminal uses the derived session key , using the ECC encryption algorithm and encrypting the data in accordance with the agreed data transmission protocol (to ensure data security, integrity and confidentiality of both parties to the transmission). The data recipient uses the same session key and ECC encryption algorithm to decrypt the data according to the agreed data transmission protocol, realizing data encrypted transmission using the session key.

[0070] Furthermore, the session key update frequency method and the session key update period method are as follows: the derived session key has a usage time and a period, so the rationality of the session key usage time and period is evaluated by using the airport terminal access security improvement amount, which is expressed as: (4) in, Indicates the amount of safety improvement; Indicates the frequency of session key update; Indicates a time period; Represents the base of natural logarithms.

[0071] Furthermore, the session key update efficiency method is to evaluate the access switch working efficiency by considering the resource consumption and time consumption caused by the session key update of the access switch. , the expression is: (5) in, represents the resource expenditure impact coefficient, Indicates the time expenditure impact coefficient.

[0072] Furthermore, by adjusting the frequency and period of session key updates, airport terminal access security can be improved and the communication interruption interval caused by key updates can be controlled. At the same time, session key updates can affect the efficiency of access switches. Therefore, it is necessary to rationally set a session key management policy that includes the frequency and period of session key updates to balance security improvements with access switch efficiency.

[0073] Step 3. The control domain establishes and maintains the access relationship between the airport terminal and the trusted network based on the trust transfer mechanism.

[0074] Among them, the 5G AreoMACS network is divided into four parts: source domain, transmission domain, target domain and control domain. The control domain completes the identity authentication and domain management of the other three domains. The specific composition of each part is as follows Figure 1 shown.

[0075] Step 31. The control domain issues a digital certificate to the airport terminal in the source domain that has passed the two-way identity verification and authorizes the source domain to access the terminal. Specifically, when the airport terminal accesses the transmission domain, bidirectional identity verification has already been completed in step 223, ensuring the security of its identity. The control domain authorizes and manages the airport terminal according to pre-set security policies, granting it access to devices in the source domain, such as access switches and border routers. Furthermore, to ensure the trustworthiness of all access within the domain, the control domain issues digital certificates to airport devices, including the airport terminal, establishing a root of trust for each device and implementing digital certificate management. This allows all devices, including the airport terminal, to mutually verify digital certificates, ensuring the legitimacy of each other's identities and establishing a strong trust relationship.

[0076] Step 32. The control domain establishes a cross-domain trust transfer mechanism to expand airport terminal access permissions; After the airport terminal successfully establishes a trust relationship in the source domain, the control domain dynamically expands its access rights to other domains based on the airport terminal's interaction needs. If the airport terminal needs to access resources in other domains (such as servers in the target domain), the control domain adopts a domain-by-domain expansion approach to implement a trust transfer mechanism, securely extending the airport terminal's trust relationship from the transmission domain to the target domain. While ensuring the security and effectiveness of cross-domain trust, the airport terminal can securely access multiple domains. Figure 3 As shown in Figure 2, a diagram of the trust transfer mechanism is shown.

[0077] Specifically, the control domain relies on the trust root and digital certificate management established in step 31. By verifying the validity of the airport terminal digital certificate domain by domain, access rights are granted to the airport terminal that passes the inspection. The trust relationship is extended from the source domain to the target access domain in sequence to realize the trust transfer mechanism to ensure that cross-domain communication access is secure and effective.

[0078] Step 33. The control domain monitors the behavior of the airport terminal and maintains the dynamic trust chain of the airport terminal; Specifically, after completing the cross-domain transfer of the trust relationship in step 31, a dynamic trust chain is formed for the airport terminal. The control domain continuously monitors the behavior of the airport terminal to ensure that its operations in each domain comply with security regulations. The control domain ensures that the trust relationship of the airport terminal remains effective in a constantly changing environment through regular audits and real-time monitoring. If the needs of the airport terminal change or its behavior does not meet security requirements, the control domain promptly adjusts or disconnects its transmission link to maintain the overall security of the network. This dynamic trust chain maintenance mechanism allows the trust relationship to flexibly respond to various changes, ensuring that the access behavior of the airport terminal between different domains is always secure and trustworthy.

[0079] Step 4. Based on the multi-factor identity authentication model and authentication success probability model from Step 1, the key agreement mechanism, session key derivation mechanism, and session key usage mechanism from Step 2, and the access relationship between the airport terminal and the trusted network from Step 3, perform trusted network access authentication for the airport terminal to be connected. like Figure 4 As shown in FIG, a flow chart of trusted access authentication is shown.

[0080] Step 41. The terminal at the airport to be accessed initiates an access request; Specifically, the terminal to be accessed at the airport initiates an access request to the access switch, and proceeds to the next step after waiting for the access switch's approval.

[0081] Step 42. The airport terminal to be connected and the access switch obtain each other's temporary public key and calculate the temporary shared key based on the key negotiation mechanism in step 2; Specifically, the airport terminal to be accessed and the access switch complete the temporary public key exchange and temporary shared key calculation according to steps 211 and 212.

[0082] Step 43. The airport terminal to be connected and the access switch encrypt their own comprehensive identity information data using the temporary shared key. After exchanging this data, each decrypts the other's comprehensive identity information data. The airport terminal to be connected and the access switch use each other's comprehensive identity information data to calculate the multi-factor identity authentication value, completing bidirectional identity verification and accepting management by the control domain. Specifically, the airport terminal to be accessed and the access switch complete bidirectional identity information verification according to steps 221 , 222 , and 223 .

[0083] Step 44. Based on the bidirectional identity information verification result of step 33, the control domain evaluates the security of the airport terminal and returns the evaluation result; Specifically, the control domain compares the multi-factor identity authentication thresholds preset for different services based on the bidirectional identity information verification results of step 33. If the thresholds are met, the evaluation passes and proceeds to the next step. Otherwise, the evaluation fails and the results are returned to the access switch and the airport terminal to be accessed.

[0084] Furthermore, if the security of the airport terminal to be accessed passes the assessment, the control domain will bind the trusted identifier of the airport terminal and the assigned network address to ensure that only the airport terminal that has passed the assessment can access the network and proceed to the next step; if the security of the airport terminal fails the assessment, the access request will be rejected and the reason for rejection will be returned.

[0085] Step 45: The management and control domain transmits the access policy obtained based on the methods in steps 2 and 3 to the access switch.

[0086] Specifically, the access policy refers to the behavior specifications of the airport terminal in the 5G AreoMACS network, including the session key generated in step 224, the session key update frequency and time period selected in step 23, the source domain access authority obtained in step 31, the other domain access authority obtained in step 32, as well as resource usage restrictions and data transmission protocol agreements.

[0087] Furthermore, the access policy is transmitted via a secure channel encrypted using a temporary shared key.

[0088] Step 46. The airport terminal to be connected establishes a connection with the trusted network and accesses the trusted network.

[0089] Specifically, when the access policy is set and delivered, the airport terminal to be accessed accesses the trusted network based on steps 31 and 32, and accepts behavior monitoring by the control domain to ensure security after accessing the trusted network.

[0090] Step 47. The control domain monitors the behavior of the terminals connected to the airport and adjusts the access policy based on the detection results.

[0091] Specifically, the control domain continuously monitors the behavior of the connected airport terminal based on step 33. If any abnormal behavior or behavior that does not comply with the access policy is detected, the control domain adjusts the access policy or takes measures to prevent potential security threats, including adjusting the access rights of the connected airport terminal, restricting certain activities, or cutting off its network connection in extreme cases.

[0092] The trusted network access authentication mechanism implemented in this invention within 5G AeroMACS encompasses three primary intermediaries: airport terminals, access switches, and the control domain. As the requestor, the airport terminal initiates an access request to the access switch. Only authenticated airport terminals are granted network access. The access switch's core function is to enforce the access policies defined and provided by the control domain, ensuring that only authenticated airport terminals can access the trusted network. The control domain implements authentication and access control for airport terminals, and also formulates and updates access policies for airport terminals.

[0093] like Figure 4 The figure below illustrates each key step in the trusted network access authentication mechanism, from initiating access requests to monitoring behavior and making adjustments. This ensures that each step is carried out under strict security oversight. Through rigorous identity verification and security assessments, only authorized airport terminals can access the network, effectively preventing unauthorized access and network attacks, and maintaining network security and overall stability.

[0094] The above description is only a preferred specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by any technician familiar with this technical field within the technical scope disclosed by the present invention should be covered by the scope of protection of the present invention.

Claims

1. A 5G AeroMACS terminal trusted access method based on intrinsic security, characterized in that: The specific steps are as follows: Step 1. Establish a multi-factor identity authentication model and an authentication success probability model for the device; Among them, the equipment includes airport terminals and access switches; Step 2. Establish a key negotiation mechanism, a session key derivation mechanism, and a session key usage mechanism to obtain session keys and management strategies; Step 3. The control domain establishes and maintains the access relationship between the airport terminal and the trusted network based on the trust transfer mechanism; Step 4. Based on the multi-factor identity authentication model and authentication success probability model of step 1, the key negotiation mechanism, derived session key mechanism and session key usage mechanism of step 2, and the access relationship between the airport terminal and the trusted network in step 3, the airport terminal to be accessed is authenticated for trusted network access.

2. The 5G AeroMACS terminal trusted access method according to claim 1, characterized in that: The specific steps of step 2 are as follows: Step 21. Establish a key negotiation mechanism and obtain a temporary shared key; Step 22. Based on the temporary shared key, the airport terminal and the access switch calculate and exchange the encrypted comprehensive identity information encoding sequence, and derive the session key after two-way identity authentication; Step 23. Based on the session key, establish a session key usage mechanism and obtain a session key management policy.

3. The 5G AeroMACS terminal trusted access method according to claim 2, characterized in that: The specific steps of step 21 are as follows: Step 211. Obtain the temporary public keys of the airport terminal and the access switch according to the elliptic curve encryption equation of the device; Step 212. Obtain a temporary shared key based on the temporary public keys of the airport terminal and the access switch.

4. The 5G AeroMACS terminal trusted access method according to claim 2, characterized in that: The specific steps of step 22 are as follows: Step 221. Based on the temporary shared key, the comprehensive identity information data of the airport terminal and the access switch, an encrypted comprehensive identity information coding sequence is obtained; Step 222. Based on the temporary shared key and the encrypted comprehensive identity information coding sequence, the airport terminal and the access switch perform bidirectional identity information decryption to obtain the comprehensive identity information data of the other party; Step 223. The airport terminal and the access switch perform two-way identity information verification based on the decrypted comprehensive identity information data of the other party and the multi-factor identity authentication value obtained in step 1; Step 224. For the airport terminal and access switch that have passed the two-way identity information authentication, a key derivation function is used to derive the session key.

5. The 5G AeroMACS terminal trusted access method according to claim 1, characterized in that: The specific steps of step 3 are as follows: Step 31. The control domain issues a digital certificate to the airport terminal in the source domain that has passed the two-way identity information verification and authorizes the source domain to access the terminal; Step 32. The control domain establishes a cross-domain trust transfer mechanism to achieve the expansion of airport terminal access rights; Step 33. The control domain monitors the behavior of airport terminals and maintains the dynamic trust chain of airport terminals.

6. The 5G AeroMACS terminal trusted access method according to claim 1, characterized in that: The specific steps of step 4 are as follows: Step 41. The airport terminal initiates an access request; Step 42. The airport terminal to be accessed and the access switch obtain each other's temporary public key based on the key negotiation mechanism in step 2 and calculate a temporary shared key; Step 43. The airport terminal to be accessed and the access switch encrypt their own comprehensive identity information data according to the temporary shared key, and after exchanging the data, each decrypts the other party's comprehensive identity information data; the airport terminal to be accessed and the access switch use the other party's comprehensive identity information data to calculate the multi-factor identity authentication value, complete the two-way identity information verification, and accept the management of the control domain; Step 44. Based on the bidirectional identity information verification result of step 33, the control domain evaluates the security of the airport terminal and returns the evaluation result; Step 45. The control domain transmits the access management policy obtained based on the method of step 2 and step 3 to the access switch; Step 46. The airport terminal to be accessed establishes a connection with the trusted network and accesses the trusted network.

7. The 5G AeroMACS terminal trusted access method according to claim 6, characterized in that: Step 4 also includes step 47, where the control domain monitors the behavior of the terminals that have been connected to the airport and adjusts the access strategy based on the detection results.

Images