Satellite encryption call method and system based on quantum key distribution

Abstract

The embodiment of the invention provides a satellite encryption call method and system based on quantum key distribution. A satellite terminal sends a first session key acquisition request to a quantum key distribution management system through a communication satellite and a satellite ground base station; receiving a session key sent by the quantum key distribution management system; sending a session invitation to the VoLTE terminal through a communication satellite, a satellite ground base station, a server and a mobile phone base station; receiving a session confirmation sent by the VoLTE terminal; encrypting the first communication data according to the session key, and sending the encrypted first communication data to the VoLTE terminal; and receiving encrypted second communication data sent by the VoLTE terminal, and decrypting the encrypted second communication data according to the session key. Through satellite network transmission, the coverage range of a call can be effectively expanded, communication data are encrypted and decrypted through a session key generated by the quantum key distribution management system, and the security and privacy of the communication data can be guaranteed.

Description

Technical Field

[0001] The present invention relates to the field of quantum communication, and in particular to a satellite encrypted communication method based on quantum key distribution and a satellite encrypted communication system based on quantum key distribution. Background Art

[0002] With the development of mobile communication technology, VoLTE (Voice over LTE) technology has been widely used due to its efficient voice transmission quality and low latency. However, existing VoLTE calls mostly rely on ground base station networks. In some remote areas and ocean areas, the ground network coverage is insufficient, making it difficult to ensure call quality and signal stability.

[0003] Traditional VoLTE calls may face more complex network attacks, such as man-in-the-middle attacks and malware attacks. Attackers may obtain call data or interfere with call services by attacking the core network or IMS (IP Multimedia Subsystem) of mobile operators. Although VoLTE call data is usually transmitted in encrypted form, once an attacker successfully invades the operator's network, the communication data may be decrypted or tampered with during transmission, affecting the user's communication security. Summary of the invention

[0004] In view of the above problems, embodiments of the present invention are proposed to provide a satellite encrypted call method based on quantum key distribution and a satellite encrypted call system based on quantum key distribution that overcome the above problems or at least partially solve the above problems.

[0005] In a first aspect, an embodiment of the present invention provides a satellite encrypted call method based on quantum key distribution, which is applied to a satellite terminal. The method includes:

[0006] Sending a first session key acquisition request to a quantum key distribution management system via a communication satellite and a satellite ground base station;

[0007] Receiving a session key sent by the quantum key distribution management system via the satellite ground base station and the communication satellite;

[0008] Sending a session invitation to the VoLTE terminal through the communication satellite, the satellite ground base station, the server and the mobile phone base station;

[0009] Receiving a session confirmation sent by the VoLTE terminal through the mobile phone base station, the server, the satellite ground base station and the communication satellite;

[0010] Encrypting the first communication data according to the session key, and sending the encrypted first communication data to the VoLTE terminal through the communication satellite, the satellite ground base station, the server and the mobile phone base station;

[0011] Receive the encrypted second communication data sent by the VoLTE terminal through the mobile phone base station, the server, the satellite ground base station and the communication satellite, and decrypt the encrypted second communication data according to the session key.

[0012] Optionally, the first session key acquisition request includes the first working key handle and the session key identifier of the satellite terminal; the session key sent by the quantum key distribution management system is the session key encrypted by the quantum key distribution management system according to the first working key corresponding to the first working key handle; the session key identifier corresponds to the session key one by one;

[0013] The method further comprises:

[0014] Decrypt the encrypted session key sent by the quantum key distribution management system according to the first working key corresponding to the first working key handle.

[0015] Optionally, the satellite terminal includes a secure medium, in which the first working key provided in advance by the quantum key distribution management system is stored.

[0016] In a second aspect, an embodiment of the present invention provides a satellite encrypted call method based on quantum key distribution, which is applied to a VoLTE terminal. The method includes:

[0017] Receiving a session invitation sent by the satellite terminal via the communication satellite, the satellite ground base station, the server and the mobile phone base station;

[0018] Sending a second session key acquisition request to the quantum key distribution management system through the mobile phone base station and the server;

[0019] Receiving a session key sent by the quantum key distribution management system through the server and the mobile phone base station;

[0020] After obtaining the session key, sending a session confirmation to the satellite terminal through the mobile phone base station, the server, the satellite ground base station and the communication satellite;

[0021] Encrypting the second communication data according to the session key, and sending the encrypted second communication data to the satellite terminal through the mobile phone base station, the server, the satellite ground base station and the communication satellite;

[0022] The encrypted first communication data is received from the satellite terminal via the communication satellite, the satellite ground base station, the server and the mobile phone base station, and the encrypted first communication data is decrypted according to the session key.

[0023] Optionally, the second session key acquisition request includes a session key identifier and a second working key handle obtained by parsing the session invitation; the session key sent by the quantum key distribution management system is a session key encrypted by the quantum key distribution management system according to the second working key corresponding to the second working key handle; the session key identifier corresponds to the session key one-to-one;

[0024] The method further comprises:

[0025] Decrypt the encrypted session key sent by the quantum key distribution management system according to the second working key corresponding to the second working key handle.

[0026] Optionally, the VoLTE terminal has a built-in security chip, and the security chip stores the second working key provided in advance by the quantum key distribution management system.

[0027] In a third aspect, an embodiment of the present invention provides a satellite encrypted call system based on quantum key distribution, the system comprising: a satellite terminal, a communication satellite, a satellite ground base station, a quantum key distribution management system, a server, a mobile phone base station and a VoLTE terminal;

[0028] The satellite terminal is used to send a first session key acquisition request to the quantum key distribution management system through the communication satellite and the satellite ground base station; receive the session key sent by the quantum key distribution management system through the satellite ground base station and the communication satellite; send a session invitation to the VoLTE terminal through the communication satellite, the satellite ground base station, the server and the mobile phone base station; receive a session confirmation sent by the VoLTE terminal through the mobile phone base station, the server, the satellite ground base station and the communication satellite; encrypt the first communication data according to the session key, and send the encrypted first communication data to the VoLTE terminal through the communication satellite, the satellite ground base station, the server and the mobile phone base station; receive the encrypted second communication data sent by the VoLTE terminal through the mobile phone base station, the server, the satellite ground base station and the communication satellite, and decrypt the encrypted second communication data according to the session key;

[0029] The VoLTE terminal is used to receive a session invitation sent by the satellite terminal through the communication satellite, the satellite ground base station, the server and the mobile phone base station; send a second session key acquisition request to the quantum key distribution management system through the mobile phone base station and the server; receive the session key sent by the quantum key distribution management system through the server and the mobile phone base station; after obtaining the session key, send a session confirmation to the satellite terminal through the mobile phone base station, the server, the satellite ground base station and the communication satellite; encrypt the second communication data according to the session key, and send the encrypted second communication data to the satellite terminal through the mobile phone base station, the server, the satellite ground base station and the communication satellite; receive the encrypted first communication data sent by the satellite terminal through the communication satellite, the satellite ground base station, the server and the mobile phone base station, and decrypt the encrypted first communication data according to the session key;

[0030] The quantum key distribution and management system is used to send the session key to the satellite terminal according to the first session key acquisition request, and send the session key to the VoLTE terminal according to the second session key acquisition request.

[0031] Optionally, the server is configured to send a third session key acquisition request to the quantum key distribution management system; the third session key acquisition request includes a session key identifier parsed from the session invitation; and receive a session key sent by the quantum key distribution management system;

[0032] After receiving the encrypted first communication data, decrypt the encrypted first communication data according to the session key, and transcode the decrypted first communication data; encrypt the transcoded first communication data according to the session key, and send the encrypted and transcoded first communication data to the VoLTE terminal;

[0033] After receiving the encrypted second communication data, the encrypted second communication data is decrypted according to the session key and the decrypted second communication data is transcoded; the transcoded second communication data is encrypted according to the session key and the encrypted and transcoded second communication data is sent to the satellite terminal.

[0034] Optionally, the first session key acquisition request includes the first working key handle and session key identifier of the satellite terminal;

[0035] The quantum key distribution management system is used to obtain a one-to-one corresponding session key according to the session key identifier; encrypt the session key according to the first working key corresponding to the first working key handle; and send the encrypted session key to the satellite terminal through the satellite ground base station and the communication satellite;

[0036] The satellite terminal is used to decrypt the encrypted session key sent by the quantum key distribution management system according to the first working key corresponding to the first working key handle.

[0037] Optionally, the second session key acquisition request includes a session key identifier and a second working key handle obtained by parsing the session invitation;

[0038] The quantum key distribution management system is used to obtain a one-to-one corresponding session key according to the session key identifier; encrypt the session key according to the second working key corresponding to the second working key handle; and send the session key to the VoLTE terminal through the server and the mobile phone base station;

[0039] The VoLTE terminal is used to decrypt the encrypted session key sent by the quantum key distribution management system according to the second working key corresponding to the second working key handle.

[0040] In a fourth aspect, the present invention shows an electronic device, comprising: a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein when the computer program is executed by the processor, the steps of a satellite encrypted call method based on quantum key distribution as described above are implemented.

[0041] In a fifth aspect, the present invention shows a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of a satellite encrypted call method based on quantum key distribution as described above are implemented.

[0042] The embodiments of the present invention include the following advantages:

[0043] The embodiment of the present invention provides a satellite encrypted call method based on quantum key distribution, which is applied to a satellite terminal, and sends a first session key acquisition request to a quantum key distribution management system through a communication satellite and a satellite ground base station; receives a session key sent by the quantum key distribution management system through a satellite ground base station and a communication satellite; sends a session invitation to a VoLTE terminal through a communication satellite, a satellite ground base station, a server and a mobile phone base station; receives a session confirmation sent by a VoLTE terminal through a mobile phone base station, a server, a satellite ground base station and a communication satellite; encrypts the first communication data according to the session key, and sends the encrypted first communication data to the VoLTE terminal through a communication satellite, a satellite ground base station, a server and a mobile phone base station; receives the encrypted second communication data sent by the VoLTE terminal through a mobile phone base station, a server, a satellite ground base station and a communication satellite, and decrypts the encrypted second communication data according to the session key. Transmitting through a satellite network can effectively expand the coverage of the call, and encrypting and decrypting the communication data through the session key generated by the quantum key distribution management system can ensure the security and privacy of the communication data. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 It is a flowchart of the steps of a satellite encrypted communication method based on quantum key distribution according to an embodiment of the present invention;

[0045] Figure 2 is a flowchart of another satellite encrypted call method based on quantum key distribution according to an embodiment of the present invention;

[0046] Figure 3 It is a structural block diagram of a satellite encrypted communication system based on quantum key distribution according to an embodiment of the present invention;

[0047] Figure 4 is a structural block diagram of an electronic device provided by an embodiment of the present invention;

[0048] Figure 5 It is a structural block diagram of a computer-readable storage medium provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0049] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0050] One of the core concepts of the embodiments of the present invention is that existing VoLTE calls mostly rely on ground base station networks. In some remote areas and ocean areas, the ground network coverage is insufficient, and it is difficult to ensure call quality and signal stability. During the call, more complex network attacks may be faced, such as man-in-the-middle attacks, malware attacks, etc., to obtain call data or interfere with call services, posing a threat to information security.

[0051] Therefore, a satellite encrypted call method based on quantum key distribution is proposed. The satellite terminal obtains the session key from the quantum key distribution management system through the communication satellite and the satellite ground base station, and sends a session invitation to the VoLTE terminal through the communication satellite, the satellite ground base station, the server and the mobile phone base station to realize call transmission through the satellite network, which can effectively expand the communication coverage and solve the problem of insufficient coverage of the ground base station. The first communication data is encrypted according to the session key, and the encrypted first communication data is sent to the VoLTE terminal through the communication satellite, the satellite ground base station, the server and the mobile phone base station; the encrypted second communication data sent by the VoLTE terminal through the mobile phone base station, the server, the satellite ground base station and the communication satellite is received, and the encrypted second communication data is decrypted according to the session key. The encryption and decryption of the communication data is realized based on the quantum key technology to ensure the security and privacy of the communication data transmission process.

[0052] Reference Figure 1 , shows a flowchart of a satellite encrypted call method based on quantum key distribution according to an embodiment of the present invention, which is applied to a satellite terminal, and the method includes:

[0053] Step 101, sending a first session key acquisition request to a quantum key distribution management system via a communication satellite and a satellite ground base station;

[0054] A satellite terminal is a device that communicates via satellite. It is usually used to communicate in areas that are not covered by ground networks. It can be used in a variety of application scenarios such as voice communication, data transmission, and Internet access. Communication satellites are artificial satellites used to transmit information between different locations. They communicate via radio waves and are widely used in broadcasting, television, telephone, Internet access, military communications, and other fields. A satellite ground station is a ground facility used to communicate with satellites. It is mainly responsible for sending and receiving satellite signals and is an indispensable part of a satellite communication system.

[0055] Quantum Key Distribution (QKD) management system is a system used to generate, distribute and manage quantum keys. Quantum key distribution uses the principles of quantum mechanics, such as quantum superposition and quantum entanglement, to achieve secure key distribution, thereby ensuring the security of communications.

[0056] In this embodiment, the satellite terminal first initiates a session key acquisition request to the communication satellite, the communication satellite sends the session key acquisition request to the satellite ground base station, and the ground base station applies for the session key from the quantum key distribution management system.

[0057] Step 102, receiving a session key sent by the quantum key distribution management system through the satellite ground base station and the communication satellite;

[0058] A session key is a symmetric key used in a communication session to encrypt and decrypt data. Session keys are usually generated at the beginning of communication and destroyed after the session ends to ensure the security and timeliness of communication.

[0059] In this embodiment, after receiving the session key acquisition request, the quantum key distribution management system will generate a session key, encrypt it according to the working key and then return it to the satellite ground base station. The satellite ground base station returns the session key to the communication satellite, and finally the communication satellite returns the session key to the satellite terminal.

[0060] In some embodiments, the first session key acquisition request includes the first working key handle and the session key identifier of the satellite terminal; the session key sent by the quantum key distribution management system is the session key encrypted by the quantum key distribution management system according to the first working key corresponding to the first working key handle; the session key identifier corresponds to the session key one by one;

[0061] The step 102 may include the following sub-steps:

[0062] Sub-step S11, decrypting the encrypted session key sent by the quantum key distribution management system according to the first working key corresponding to the first working key handle.

[0063] A key handle is an abstract identifier used to manage and manipulate keys in cryptography and security systems. It is usually a unique identifier used to reference keys stored in a key management system without directly exposing the key itself. The use of a key handle can improve the security and efficiency of key management. A session key identifier is an identifier used to uniquely identify a session key in a communication session. It is usually a short, unique string or number used to reference and manage session keys between communicating parties.

[0064] In some embodiments, the satellite terminal includes a secure medium, in which the first working key provided in advance by the quantum key distribution management system is stored.

[0065] The satellite terminal has a built-in secure medium, and quantum keys are charged to the secure medium through the quantum key distribution management system. When charging the working key, the charging machine is connected to the quantum key distribution management system, and one copy of the random working key generated by the quantum key distribution system is charged into the terminal device and the other copy is saved in the quantum key distribution system. The working key is in duplicate: one copy for the secure medium and one copy for the quantum key distribution management system. The working key includes a key handle.

[0066] In this embodiment, the session key acquisition request sent by the satellite terminal to the quantum key distribution management system will carry the session key identifier and the working key handle. After receiving the session key acquisition request, the quantum key distribution management system will randomly generate a session key based on the quantum random number generator in the quantum key distribution management system, and the quantum key distribution management system will bind the session key and the session key identifier in the session key acquisition request for storage.

[0067] Before the session key is returned to the satellite terminal, the working key handle in the session key acquisition request is used to obtain the complete working key. The session key is then symmetrically encrypted based on the complete working key. After the encryption is completed, the encrypted session key is returned to the satellite terminal.

[0068] The session key received by the satellite terminal is encrypted by the quantum key distribution management system. After receiving the session key, the satellite terminal performs symmetrical decryption on the session key according to the working key corresponding to the working key handle to obtain the original session key.

[0069] Step 103, sending a session invitation to the VoLTE terminal through the communication satellite, the satellite ground base station, the server and the mobile phone base station;

[0070] The server includes IMS services. IMS is a multimedia communication architecture based on IP networks, which aims to provide the integration of voice, video, data and multimedia services to support multimedia services in mobile networks.

[0071] Mobile Base Station, also known as Base Station or Cellular Base Station, is a key infrastructure in mobile communication networks, responsible for wireless communication with mobile devices (such as mobile phones, tablets, etc.). Mobile base stations transmit data with mobile devices through radio waves, supporting a variety of services such as voice calls, text messages, and Internet access.

[0072] VoLTE terminals refer to devices that support voice calls over LTE networks. VoLTE technology uses the high bandwidth and low latency characteristics of LTE networks to provide high-quality voice calls and multimedia services.

[0073] In this embodiment, after obtaining the session key, the satellite terminal initiates an encrypted session invitation to the VoLTE terminal. The session invitation passes through the communication satellite, satellite ground base station, server, mobile phone base station in sequence, and finally reaches the recipient's VoLTE terminal.

[0074] Step 104, receiving a session confirmation sent by the VoLTE terminal through the mobile phone base station, the server, the satellite ground base station and the communication satellite;

[0075] The VoLTE terminal has a built-in security chip, which is injected with quantum keys through the quantum key distribution management system. The quantum key is the working key, which is in duplicate: one for the security chip and one for the quantum key distribution management system. The session invitation will carry the session key identifier.

[0076] In this embodiment, when the VoLTE terminal accepts a session invitation, it first obtains the real session key from the quantum key distribution management system through the session key identifier in the session invitation and the key handle of the security chip's built-in key. The session key is encrypted with the working key and returned. After the VoLTE terminal obtains the session key, it accepts the session invitation. The answering operation passes through the mobile phone base station, server, satellite ground base station, communication satellite, and finally reaches the satellite terminal of the caller.

[0077] Step 105, encrypting the first communication data according to the session key, and sending the encrypted first communication data to the VoLTE terminal through the communication satellite, the satellite ground base station, the server and the mobile phone base station;

[0078] The session invitation carries a session key identifier. When the session invitation reaches the server during transmission, the server records the session key identifier.

[0079] Since the satellite terminal communication data and the VoLTE terminal communication data use different encoding formats, it is necessary to perform data transcoding operation on the communication data.

[0080] In this embodiment, the satellite terminal symmetrically encrypts the first communication data through the session key. The first communication data passes through the communication satellite and the satellite ground base station, and then reaches the server. However, the communication data is encrypted at this time, and the server cannot directly transcode the communication data. Therefore, the server obtains the session key from the quantum key distribution management system according to the recorded session key identifier, and decrypts the first communication data according to the obtained session key to obtain the decrypted first communication data, and transcodes the decrypted first communication data. After the transcoding is completed, the successfully transcoded first communication data is re-encrypted by the session key, and then sent to the VoLTE terminal through the mobile phone base station.

[0081] Step 106, receiving the encrypted second communication data sent by the VoLTE terminal through the mobile phone base station, the server, the satellite ground base station and the communication satellite, and decrypting the encrypted second communication data according to the session key.

[0082] A call is a two-way operation, and the VoLTE terminal transmitting the second communication data to the satellite terminal is the same operation. The satellite terminal also receives encrypted second communication data sent by the VoLTE terminal.

[0083] In this embodiment, the VoLTE terminal sends the second communication data to the satellite terminal via the mobile phone base station, server, satellite ground base station, and communication satellite. The satellite terminal decrypts the second communication data according to the session key, and plays the call content transmitted by the VoLTE terminal on the satellite terminal after decryption.

[0084] In the embodiment provided by the present invention, a first session key acquisition request is sent to a quantum key distribution management system through a communication satellite and a satellite ground base station; a session key sent by the quantum key distribution management system through a satellite ground base station and a communication satellite is received; a session invitation is sent to a VoLTE terminal through a communication satellite, a satellite ground base station, a server and a mobile phone base station; a session confirmation is received from a VoLTE terminal through a mobile phone base station, a server, a satellite ground base station and a communication satellite; the first communication data is encrypted according to the session key, and the encrypted first communication data is sent to the VoLTE terminal through a communication satellite, a satellite ground base station, a server and a mobile phone base station; the encrypted second communication data sent by the VoLTE terminal through a mobile phone base station, a server, a satellite ground base station and a communication satellite is received, and the encrypted second communication data is decrypted according to the session key. Transmission through a satellite network can effectively expand the coverage of a call, and encryption and decryption of communication data by a session key generated by a quantum key distribution management system can ensure the security and privacy of the communication data.

[0085] Reference Figure 2 , shows another satellite encrypted call method based on quantum key distribution according to an embodiment of the present invention, which is applied to a VoLTE terminal, and the method includes:

[0086] Step 201, receiving a session invitation sent by the satellite terminal via the communication satellite, the satellite ground base station, the server and the mobile phone base station;

[0087] In this embodiment, after obtaining the session key, the satellite terminal initiates an encrypted session invitation to the VoLTE terminal. The session invitation passes through the communication satellite, satellite ground base station, server, mobile phone base station in sequence, and finally reaches the recipient's VoLTE terminal.

[0088] Step 202, sending a second session key acquisition request to the quantum key distribution management system through the mobile phone base station and the server;

[0089] When a VoLTE terminal accepts a session invitation, it first goes to the quantum key distribution management system to obtain the real session key through the session key identifier in the session invitation and the key handle of the built-in working key of the security chip.

[0090] In this embodiment, the VoLTE terminal sends a session key acquisition request to the quantum key distribution management system through the mobile phone base station and the server. After receiving the session key acquisition request, the quantum key distribution management system will generate a session key, encrypt it according to the working key and then return it to the server. The server returns the session key to the mobile phone base station, and finally the mobile phone base station returns the session key to the VoLTE terminal.

[0091] In some embodiments, the second session key acquisition request includes a session key identifier and a second working key handle obtained by parsing the session invitation; the session key sent by the quantum key distribution management system is a session key encrypted by the quantum key distribution management system according to the second working key corresponding to the second working key handle; the session key identifier corresponds to the session key one by one;

[0092] The step 202 may include the following sub-steps:

[0093] Sub-step S21, decrypting the encrypted session key sent by the quantum key distribution management system according to the second working key corresponding to the second working key handle.

[0094] In this embodiment, the working key is pre-charged into the security chip of the VoLTE terminal. When obtaining the real session key from the quantum key distribution management system: first, a working key is taken from the security chip, and the handle of the working key and the unique identifier of the session key are sent to the quantum key distribution management system as parameters in the session key acquisition request. After receiving the request, the quantum key distribution management system queries the complete session key through the session key identifier; then, the complete working key is queried through the key handle, and the session key is symmetrically encrypted with the working key and returned to the VoLTE terminal;

[0095] The session key received by the VoLTE terminal is encrypted by the quantum key distribution management system. After receiving the session key, the VoLTE terminal decrypts it using the working key to obtain the original and complete session key.

[0096] In some embodiments, the VoLTE terminal has a built-in security chip, and the security chip stores the second working key provided in advance by the quantum key distribution management system.

[0097] The VoLTE terminal has a built-in security chip, which is injected with a key through the quantum key distribution management system. The key is the second working key in duplicate: one for the security chip and one for the quantum key distribution management system. The second working key includes a second working key handle.

[0098] Step 203, receiving the session key sent by the quantum key distribution management system through the server and the mobile phone base station;

[0099] In this embodiment, after receiving the session key acquisition request, the quantum key distribution management system will generate a session key, encrypt it according to the working key and then return it to the server. The server returns the session key to the mobile base station, and finally the mobile base station returns the session key to the VoLTE terminal.

[0100] Step 204, after obtaining the session key, sending a session confirmation to the satellite terminal through the mobile phone base station, the server, the satellite ground base station and the communication satellite;

[0101] In this embodiment, when the VoLTE terminal accepts a session invitation, it first obtains the real session key from the quantum key distribution management system through the session key identifier in the session invitation and the key handle of the security chip's built-in key. The session key is encrypted with the working key and returned. After the VoLTE terminal obtains the session key, it accepts the session invitation. The answering operation passes through the mobile phone base station, server, satellite ground base station, communication satellite, and finally reaches the satellite terminal of the caller.

[0102] Step 205, encrypting the second communication data according to the session key, and sending the encrypted second communication data to the satellite terminal through the mobile phone base station, the server, the satellite ground base station and the communication satellite;

[0103] Since the satellite terminal communication data and the VoLTE terminal communication data use different encoding formats, it is necessary to perform data transcoding operation on the communication data.

[0104] In this embodiment, the VoLTE terminal symmetrically encrypts the second communication data through the session key. The second communication data passes through the mobile phone base station and then reaches the server. However, the communication data is encrypted at this time, and the server cannot directly transcode the communication data. Therefore, the server obtains the session key from the quantum key distribution management system according to the recorded session key identifier, and decrypts the second communication data according to the obtained session key to obtain the decrypted second communication data, and transcodes the decrypted second communication data. After the transcoding is completed, the successfully transcoded second communication data is re-encrypted by the session key, and then sent to the satellite terminal through the satellite ground base station and the communication satellite.

[0105] Step 206, receiving the encrypted first communication data sent by the satellite terminal via the communication satellite, the satellite ground base station, the server and the mobile phone base station, and decrypting the encrypted first communication data according to the session key.

[0106] In this embodiment, the satellite terminal sends the first communication data to the VoLTE terminal via the communication satellite, satellite ground base station, server and mobile phone base station. The VoLTE terminal decrypts the first communication data according to the session key, and plays the call content transmitted by the satellite terminal on the VoLTE terminal after decryption.

[0107] In addition, the method steps provided in the embodiment of the present invention also include the following steps:

[0108] After the transmission of the first communication data and the second communication data is completed, the satellite terminal and the VoLTE terminal will clear the used working key and session key, and generate a new working key and session key during the next communication data transmission.

[0109] In this embodiment, after the transmission of the first communication data and the second communication data is completed, the satellite terminal and the VoLTE terminal will clear the used working key in the security medium and the security chip and the session key generated during the communication data transmission process. Subsequent calls use a new key for encryption and decryption, so that each call uses a new key, which guarantees the security of communication data transmission to the highest extent.

[0110] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0111] Reference Figure 3 , shows a structural block diagram of a satellite encrypted call system based on quantum key distribution provided by an embodiment of the present invention, the system comprising: a satellite terminal 30, a communication satellite 31, a satellite ground base station 32, a quantum key distribution management system 33, a server 34, a mobile phone base station 35 and a VoLTE terminal 36;

[0112] The satellite terminal 30 is used to send a first session key acquisition request to the quantum key distribution management system 33 through the communication satellite 31 and the satellite ground base station 32; receive the session key sent by the quantum key distribution management system 33 through the satellite ground base station 32 and the communication satellite 31; send a session invitation to the VoLTE terminal 36 through the communication satellite 31, the satellite ground base station 32, the server 34 and the mobile phone base station 35; receive the session confirmation sent by the VoLTE terminal 36 through the mobile phone base station 35, the server 34, the satellite ground base station 32 and the communication satellite 31; encrypt the first communication data according to the session key, and send the encrypted first communication data to the VoLTE terminal 36 through the communication satellite 31, the satellite ground base station 32, the server 34 and the mobile phone base station 35; receive the encrypted second communication data sent by the VoLTE terminal 36 through the mobile phone base station 35, the server 34, the satellite ground base station 32 and the communication satellite 31, and decrypt the encrypted second communication data according to the session key;

[0113] The VoLTE terminal 36 is used to receive a session invitation sent by the satellite terminal 30 through the communication satellite 31, the satellite ground base station 32, the server 34 and the mobile phone base station 35; send a second session key acquisition request to the quantum key distribution management system 33 through the mobile phone base station 35 and the server 34; receive the session key sent by the quantum key distribution management system 33 through the server 34 and the mobile phone base station 35; after obtaining the session key, send a session confirmation to the satellite terminal 30 through the mobile phone base station 35, the server 34, the satellite ground base station 32 and the communication satellite 31; encrypt the second communication data according to the session key, and send the encrypted second communication data to the satellite terminal 30 through the mobile phone base station 35, the server 34, the satellite ground base station 32 and the communication satellite 31; receive the encrypted first communication data sent by the satellite terminal 30 through the communication satellite 31, the satellite ground base station 32, the server 34 and the mobile phone base station 35, and decrypt the encrypted first communication data according to the session key;

[0114] The quantum key distribution management system 33 is used to send the session key to the satellite terminal 30 according to the first session key acquisition request, and to send the session key to the VoLTE terminal 36 according to the second session key acquisition request.

[0115] In the embodiment of the present invention, the server 34 is further used to send a third session key acquisition request to the quantum key distribution management system 33; the third session key acquisition request includes a session key identifier parsed from the session invitation; receive the session key sent by the quantum key distribution management system 33;

[0116] After receiving the encrypted first communication data, decrypt the encrypted first communication data according to the session key, and transcode the decrypted first communication data; encrypt the transcoded first communication data according to the session key, and send the encrypted and transcoded first communication data to the VoLTE terminal 36;

[0117] After receiving the encrypted second communication data, the encrypted second communication data is decrypted according to the session key, and the decrypted second communication data is transcoded; the transcoded second communication data is encrypted according to the session key, and the encrypted and transcoded second communication data is sent to the satellite terminal 30.

[0118] In the embodiment of the present invention, the first session key acquisition request includes the first working key handle and the session key identifier of the satellite terminal 30;

[0119] The quantum key distribution management system 33 is used to obtain a one-to-one corresponding session key according to the session key identifier; encrypt the session key according to the first working key corresponding to the first working key handle; and send the encrypted session key to the satellite terminal 30 through the satellite ground base station 32 and the communication satellite 31;

[0120] The satellite terminal 30 is used to decrypt the encrypted session key sent by the quantum key distribution management system 33 according to the first working key corresponding to the first working key handle.

[0121] In the embodiment of the present invention, the second session key acquisition request includes the session key identifier and the second working key handle obtained by parsing the session invitation;

[0122] The quantum key distribution management system 33 is used to obtain a one-to-one corresponding session key according to the session key identifier; encrypt the session key according to the second working key corresponding to the second working key handle; and send the session key to the VoLTE terminal 36 through the server 34 and the mobile phone base station 35;

[0123] The VoLTE terminal 36 is used to decrypt the encrypted session key sent by the quantum key distribution management system 33 according to the second working key corresponding to the second working key handle.

[0124] Reference Figure 4 , showing a structural block diagram of an electronic device 40 provided in an embodiment of the present invention, comprising: a processor 401, a memory 402, and a computer program 4021 stored in the memory and capable of running on the processor. When the computer program is executed by the processor, the steps of the satellite encrypted call method based on quantum key distribution described in any one of the above items are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0125] Reference Figure 5 , showing a structural block diagram of a computer-readable storage medium 50 provided in an embodiment of the present invention, on which a computer program 501 is stored. When the computer program is executed by a processor, the steps of the satellite encrypted call method based on quantum key distribution described in any one of the above items are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be described here.

[0126] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0127] Those skilled in the art will appreciate that the embodiments of the embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the embodiments of the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present invention may take the form of a computer program product implemented on one or more machine-readable media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0128] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0129] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0130] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable terminal device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0131] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0132] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0133] The above is a detailed introduction to a satellite encrypted call method based on quantum key distribution and a satellite encrypted call system based on quantum key distribution provided by the present invention. Specific examples are used in this article to illustrate the principle and implementation mode of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation mode and application scope. In summary, the content of this specification should not be understood as limiting the present invention.

Claims

1. A satellite encrypted communication method based on quantum key distribution, characterized in that: Applied to a satellite terminal, the method comprises: Sending a first session key acquisition request to a quantum key distribution management system via a communication satellite and a satellite ground base station; Receiving a session key sent by the quantum key distribution management system via the satellite ground base station and the communication satellite; Sending a session invitation to the VoLTE terminal through the communication satellite, the satellite ground base station, the server and the mobile phone base station; Receiving a session confirmation sent by the VoLTE terminal through the mobile phone base station, the server, the satellite ground base station and the communication satellite; Encrypting the first communication data according to the session key, and sending the encrypted first communication data to the VoLTE terminal through the communication satellite, the satellite ground base station, the server and the mobile phone base station; Receive the encrypted second communication data sent by the VoLTE terminal through the mobile phone base station, the server, the satellite ground base station and the communication satellite, and decrypt the encrypted second communication data according to the session key.

2. The method according to claim 1, characterized in that The first session key acquisition request includes the first working key handle and the session key identifier of the satellite terminal; the session key sent by the quantum key distribution management system is the session key encrypted by the quantum key distribution management system according to the first working key corresponding to the first working key handle; The session key identifier corresponds to the session key one by one; The method further comprises: Decrypt the encrypted session key sent by the quantum key distribution management system according to the first working key corresponding to the first working key handle.

3. The method according to claim 2, characterized in that The satellite terminal includes a secure medium, in which the first working key provided in advance by the quantum key distribution management system is stored.

4. A satellite encrypted communication method based on quantum key distribution, characterized in that: Applied to a VoLTE terminal, the method comprises: Receiving a session invitation sent by the satellite terminal via the communication satellite, the satellite ground base station, the server and the mobile phone base station; Sending a second session key acquisition request to the quantum key distribution management system through the mobile phone base station and the server; Receiving a session key sent by the quantum key distribution management system through the server and the mobile phone base station; After obtaining the session key, sending a session confirmation to the satellite terminal through the mobile phone base station, the server, the satellite ground base station and the communication satellite; Encrypting the second communication data according to the session key, and sending the encrypted second communication data to the satellite terminal through the mobile phone base station, the server, the satellite ground base station and the communication satellite; Receive the encrypted first communication data sent by the satellite terminal via the communication satellite, the satellite ground base station, the server and the mobile phone base station, and decrypt the encrypted first communication data according to the session key.

5. The method according to claim 4, characterized in that The second session key acquisition request includes a session key identifier and a second working key handle obtained by parsing the session invitation; the session key sent by the quantum key distribution management system is a session key encrypted by the quantum key distribution management system according to the second working key corresponding to the second working key handle; The session key identifier corresponds to the session key one by one; The method further comprises: Decrypt the encrypted session key sent by the quantum key distribution management system according to the second working key corresponding to the second working key handle.

6. The method according to claim 5, characterized in that The VoLTE terminal has a built-in security chip, and the security chip stores the second working key provided in advance by the quantum key distribution management system.

7. A satellite encrypted communication system based on quantum key distribution, characterized in that: The system includes: a satellite terminal, a communication satellite, a satellite ground base station, a quantum key distribution management system, a server, a mobile phone base station and a VoLTE terminal; The satellite terminal is used to send a first session key acquisition request to the quantum key distribution management system through the communication satellite and the satellite ground base station; receive the session key sent by the quantum key distribution management system through the satellite ground base station and the communication satellite; send a session invitation to the VoLTE terminal through the communication satellite, the satellite ground base station, the server and the mobile phone base station; receive a session confirmation sent by the VoLTE terminal through the mobile phone base station, the server, the satellite ground base station and the communication satellite; encrypt the first communication data according to the session key, and send the encrypted first communication data to the VoLTE terminal through the communication satellite, the satellite ground base station, the server and the mobile phone base station; receive the encrypted second communication data sent by the VoLTE terminal through the mobile phone base station, the server, the satellite ground base station and the communication satellite, and decrypt the encrypted second communication data according to the session key; The VoLTE terminal is used to receive a session invitation sent by the satellite terminal through the communication satellite, the satellite ground base station, the server and the mobile phone base station; send a second session key acquisition request to the quantum key distribution management system through the mobile phone base station and the server; receive the session key sent by the quantum key distribution management system through the server and the mobile phone base station; after obtaining the session key, send a session confirmation to the satellite terminal through the mobile phone base station, the server, the satellite ground base station and the communication satellite; encrypt the second communication data according to the session key, and send the encrypted second communication data to the satellite terminal through the mobile phone base station, the server, the satellite ground base station and the communication satellite; receive the encrypted first communication data sent by the satellite terminal through the communication satellite, the satellite ground base station, the server and the mobile phone base station, and decrypt the encrypted first communication data according to the session key; The quantum key distribution and management system is used to send the session key to the satellite terminal according to the first session key acquisition request, and send the session key to the VoLTE terminal according to the second session key acquisition request.

8. The system according to claim 7, characterized in that The server is configured to send a third session key acquisition request to the quantum key distribution management system; the third session key acquisition request includes a session key identifier parsed from the session invitation; and receive a session key sent by the quantum key distribution management system; After receiving the encrypted first communication data, decrypting the encrypted first communication data according to the session key, and performing transcoding processing on the decrypted first communication data; encrypting the transcoded first communication data according to the session key, and sending the encrypted and transcoded first communication data to the VoLTE terminal; After receiving the encrypted second communication data, decrypting the encrypted second communication data according to the session key, and performing transcoding processing on the decrypted second communication data; The transcoded second communication data is encrypted according to the session key, and the encrypted and transcoded second communication data is sent to the satellite terminal.

9. The system according to claim 7, characterized in that The first session key acquisition request includes the first working key handle and the session key identifier of the satellite terminal; The quantum key distribution management system is used to obtain a one-to-one corresponding session key according to the session key identifier; encrypt the session key according to the first working key corresponding to the first working key handle; and send the encrypted session key to the satellite terminal through the satellite ground base station and the communication satellite; The satellite terminal is used to decrypt the encrypted session key sent by the quantum key distribution management system according to the first working key corresponding to the first working key handle.

10. The system according to claim 7, characterized in that The second session key acquisition request includes a session key identifier and a second working key handle obtained by parsing the session invitation; The quantum key distribution management system is used to obtain a one-to-one corresponding session key according to the session key identifier; encrypt the session key according to the second working key corresponding to the second working key handle; and send the session key to the VoLTE terminal through the server and the mobile phone base station; The VoLTE terminal is used to decrypt the encrypted session key sent by the quantum key distribution management system according to the second working key corresponding to the second working key handle.

11. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein when the computer program is executed by the processor, the steps of the satellite encrypted call method based on quantum key distribution as described in any one of claims 1-3 or 4-6 are implemented.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the satellite encrypted call method based on quantum key distribution as described in any one of claims 1-3 or 4-6 are implemented.

Images