Data transmission method and device, medium and equipment

Abstract

The invention discloses a data transmission method and device, a medium and equipment. And acquiring the acquired remote sensing data. A random number is determined, and a symmetric key of the symmetric cryptographic algorithm is determined based on the random number. And determining data summary information of the remote sensing data, and performing digital signature on the data summary information according to the satellite private key. And encrypting the digitally signed data summary information, the remote sensing data and the satellite public key through the symmetric key to obtain encrypted data. And asymmetrically encrypting the symmetric key through a public key of the ground base station to obtain an encrypted key. And forming a data packet by the encrypted data and the encryption key, and sending the data packet to a ground base station, so that the ground base station decrypts the encryption key in the data packet according to a private key of the ground base station to obtain a symmetric key, and decrypts the encrypted data through the symmetric key to obtain remote sensing data.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a data transmission method, device, medium and equipment. Background Art

[0002] With the continuous advancement of satellite technology, the number of satellites deployed in space is increasing. They are responsible for collecting images and environmental data of the earth, which are of great value for scientific research. However, given the limitations of the satellite's own computing power and storage capacity, the data collected by the satellite needs to be regularly transmitted to the ground base station for further computing, processing and storage. However, how to ensure that the data can be safely transmitted to the ground base station has become an urgent problem to be solved.

[0003] The current data transmission method mainly relies on microwave communication between satellites and ground base stations. However, this method has exposed some shortcomings in practical applications, especially in ensuring that data can reach the destination safely, which brings potential risks to data security.

[0004] To this end, this specification provides a data transmission method, device, medium and equipment. Summary of the invention

[0005] This specification provides a data transmission method, device, medium and equipment to partially solve the above problems existing in the prior art.

[0006] This manual adopts the following technical solutions: This specification provides a data transmission method, including: Obtaining collected remote sensing data; Determining a random number, and determining a symmetric key of a symmetric cryptographic algorithm based on the random number; Determining data summary information of the remote sensing data, and digitally signing the data summary information according to a satellite private key; The digitally signed data summary information, the remote sensing data and the satellite public key are encrypted by the symmetric key to obtain encrypted data; Asymmetrically encrypt the symmetric key using the public key of the ground base station to obtain an encryption key; The encrypted data and the encryption key form a data packet, and the data packet is sent to the ground base station, so that the ground base station decrypts the encryption key in the data packet according to the private key of the ground base station to obtain the symmetric key, and decrypts the encrypted data by the symmetric key to obtain the remote sensing data.

[0007] Optionally, determine the random number, including: Determining sensor noise introduced by a sensor in a satellite when collecting the remote sensing data; Digitally converting the sensor noise to obtain noise data; A random number is generated according to the noise data by a pseudo-random number generator.

[0008] Optionally, before combining the encrypted data and the encryption key into a data packet and sending the data packet to the ground base station, the method further includes: Decrypting the encrypted data using the symmetric key and re-determining data summary information of the remote sensing data; Determine whether the re-determined data summary information is the same as the digitally signed data summary information; If yes, determine the symmetric key for encrypting the remote sensing data, and re-encrypt the digitally signed data summary information, the remote sensing data and the satellite public key according to the determined symmetric key to determine the encrypted data; If not, the remote sensing data is discarded.

[0009] Optionally, before determining the data summary information of the remote sensing data, the method further includes: Acquire a system key from the ground base station; Encrypting and storing the symmetric key, the satellite public key and the satellite private key according to the system key; The data summary information is digitally signed according to the satellite private key, specifically including: Decrypting the encrypted satellite private key according to the system key, and digitally signing the data summary information according to the decrypted satellite private key; The digitally signed data summary information, the remote sensing data and the satellite public key are encrypted by the symmetric key to obtain encrypted data, specifically including: Decrypting the encrypted satellite public key and the symmetric key according to the system key; The digitally signed data summary information, the remote sensing data and the decrypted satellite public key are encrypted according to the decrypted symmetric key to obtain encrypted data.

[0010] Optionally, encrypting and storing the symmetric key, the satellite public key, and the satellite private key according to the system key specifically includes: Backing up the symmetric key, satellite public key and satellite private key in slices respectively; According to the system key, the backed-up symmetric key, satellite public key and satellite private key are encrypted and stored in segments.

[0011] Optionally, before asymmetrically encrypting the symmetric key using the public key of the ground base station to obtain the encryption key, the method further includes: Obtaining a base station identifier of the ground base station; Determine a combined character string according to the base station identifier and the public key of the ground base station; Convert the combined string according to the preset method to obtain the conversion value; Determining whether the conversion value falls within the numerical range corresponding to the ground base station; If yes, it is determined that the public key of the ground base station is valid; The symmetric key is asymmetrically encrypted using the public key of the ground base station to obtain an encryption key, specifically including: When it is determined that the public key of the ground base station is valid, the symmetric key is asymmetrically encrypted using the public key of the ground base station to obtain an encryption key.

[0012] Optionally, the method further includes: receiving a response instruction, wherein the response instruction is sent by the ground base station after receiving the data packet; According to the response instruction, the communication status information is returned to the ground base station, so that the ground base station determines the first data transmission duration according to the time of receiving the communication status information and the time of sending the response instruction, and estimates the transmission duration of the data packet as the second data transmission duration according to the communication status information, and determines the transmission duration range according to the first data transmission duration and the second data transmission duration, so as to verify the data packet according to the transmission duration range.

[0013] This specification provides a data transmission device, including: An acquisition module is used to acquire the collected remote sensing data; A determination module, configured to determine a random number, and determine a symmetric key of a symmetric cryptographic algorithm based on the random number; A signature module, used to determine data summary information of the remote sensing data, and digitally sign the data summary information according to a satellite private key; A first encryption module is used to encrypt the digitally signed data summary information, the remote sensing data and the satellite public key by using the symmetric key to obtain encrypted data; A second encryption module is used to asymmetrically encrypt the symmetric key using the public key of the ground base station to obtain an encryption key; The transmission module is used to combine the encrypted data and the encryption key into a data packet, and send the data packet to the ground base station, so that the ground base station decrypts the encryption key in the data packet according to the private key of the ground base station to obtain the symmetric key, and decrypts the encrypted data by the symmetric key to obtain the remote sensing data.

[0014] This specification provides a computer-readable storage medium, wherein the storage medium stores a computer program, and when the computer program is executed by a processor, the above-mentioned data transmission method is implemented.

[0015] The present specification provides a satellite device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements a data transmission method when executing the program.

[0016] At least one of the above technical solutions adopted in this specification can achieve the following beneficial effects: The data transmission method provided in this specification first obtains the collected remote sensing data. A random number is determined, and a symmetric key of a symmetric cryptographic algorithm is determined based on the random number. The data summary information of the remote sensing data is determined, and the data summary information is digitally signed according to the satellite private key. The digitally signed data summary information, remote sensing data, and satellite public key are encrypted by a symmetric key to obtain encrypted data. The symmetric key is asymmetrically encrypted by the public key of a ground base station to obtain an encryption key. The encrypted data and the encryption key are combined into a data packet, and the data packet is sent to the ground base station, so that the ground base station decrypts the encryption key in the data packet according to the private key of the ground base station to obtain a symmetric key, and decrypts the encrypted data by the symmetric key to obtain the remote sensing data.

[0017] By allowing the satellite to determine the random number and then the symmetric key by itself, information leakage is avoided when the satellite and the ground base station synchronize the symmetric key. The remote sensing data collected by the satellite is then encrypted and transmitted using the determined symmetric key. At the same time, in the face of the growing quantum computing capabilities and the threat of quantum computing, the security of satellite stored data and data transmission during satellite-to-ground data transmission can be ensured by adopting cryptographic algorithms that are more quantum resistant than the currently used algorithms. In addition, this solution can be implemented in pure software and does not require the support of hardware equipment currently used for auxiliary encryption and decryption on satellites, thereby improving versatility and reducing satellite resource consumption. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The drawings described herein are used to provide a further understanding of this specification and constitute a part of this specification. The illustrative embodiments and descriptions of this specification are used to explain this specification and do not constitute an improper limitation on this specification. In the drawings: Figure 1 A flowchart of a data transmission method provided in an embodiment of this specification; Figure 2 A schematic diagram of satellite-to-ground data transmission provided in this specification; Figure 3 A schematic diagram of a ground base station receiving data provided in this specification; Figure 4 A schematic diagram of a data transmission device provided in this specification; Figure 5 A method corresponding to the Figure 1 Schematic diagram of the structure of satellite equipment. DETAILED DESCRIPTION

[0019] In order to make the purpose, technical solutions and advantages of this specification more clear, the technical solutions of this specification will be clearly and completely described below in combination with the specific embodiments of this specification and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0020] The technical solutions provided by the embodiments of this specification are described in detail below in conjunction with the accompanying drawings.

[0021] Figure 1 A flowchart of a data transmission method provided in an embodiment of this specification includes the following steps: S100: Acquire collected remote sensing data.

[0022] In the present specification, the process of collecting and encrypting remote sensing data is performed. In the embodiments of the present specification, the process of collecting and encrypting remote sensing data can be performed by satellite equipment such as a computer on a satellite. Of course, the present specification does not limit which equipment is used to perform the process of collecting and encrypting remote sensing data, and a client with logical functions can also be used. For the convenience of description, the following description is based on the satellite equipment as the execution subject.

[0023] In one or more embodiments of the present specification, a satellite device acquires remote sensing data collected by a sensor on a satellite. The sensor may be a remote sensing camera, a radar sensor, or other equipment, and the type of sensor is not limited in the present specification. Of course, after acquiring the remote sensing data, the satellite device may pre-process the remote sensing data, such as converting the format of the remote sensing data or compressing the remote sensing data, in order to save storage space and to enable the remote sensing data collected by different sensors to be processed uniformly and quickly.

[0024] S102: Determine a random number, and determine a symmetric key of a symmetric cryptographic algorithm based on the random number.

[0025] In one or more embodiments of the present specification, in order to ensure the security of the encrypted remote sensing data, not only a reliable encryption algorithm is required, but also the key for decrypting the encrypted remote sensing data needs to be as reliable as possible. Therefore, in order to make the key more unpredictable and reduce the possibility of the key being cracked, the satellite device can determine a random number, and determine the symmetric key of the symmetric encryption algorithm used to encrypt the remote sensing data based on the random number. Among them, the symmetric key is used to decrypt the data encrypted by the symmetric encryption algorithm.

[0026] Specifically, the method of determining the random number can be that the satellite equipment determines the sensor noise introduced by the sensor in the satellite when collecting remote sensing data. Since noise itself is highly random and unpredictable, and noise is ubiquitous in nature and can come from various physical phenomena, such as thermal noise, shot noise, cosmic rays, etc., these processes are essentially random, so noise has a high entropy, that is, uncertainty. Then, a random number with high security can be generated based on noise. Then, the satellite equipment digitizes the collected sensor noise to obtain the noise data after analog-to-digital conversion. The satellite equipment generates a random number based on the noise data through a pseudo-random number generator.

[0027] It is worth noting that the symmetric encryption algorithm used in this specification is the SM4 block encryption algorithm. Of course, this specification does not limit the specific symmetric encryption algorithm used.

[0028] S104: Determine data summary information of the remote sensing data, and digitally sign the data summary information according to a satellite private key.

[0029] In one or more embodiments of the present specification, in order to ensure that the remote sensing data can be detected after being tampered with during the transmission process or storage process, thereby preventing possible security risks. Therefore, the satellite device can determine the data summary information of the remote sensing data according to the one-way hash function algorithm. And, in order to further ensure the correctness of the data summary information, the satellite device digitally signs the data summary information according to the digital signature algorithm and the satellite's own satellite private key.

[0030] The one-way hash function algorithm for determining the data summary information may be an SM3 cryptographic hash algorithm. Of course, it may also be other one-way hash function algorithms, and the type thereof is not limited in this specification. The digital signature algorithm may use the post-quantum cryptographic algorithm Dilithium algorithm to digitally sign the data summary information, and of course, the type of the digital signature algorithm is not limited in this specification.

[0031] S106: The digitally signed data summary information, the remote sensing data and the satellite public key are encrypted using the symmetric key to obtain encrypted data.

[0032] S108: Asymmetrically encrypt the symmetric key using the public key of the ground base station to obtain an encryption key.

[0033] In one or more embodiments of the present specification, the satellite device symmetrically encrypts the digitally signed data summary information, remote sensing data, and the satellite's own satellite public key using a symmetric key to obtain encrypted data, wherein the satellite public key is used to verify the correctness of the digital signature of the data summary information.

[0034] In one or more embodiments of the present specification, in order to enable the ground base station to successfully decrypt the encrypted data, the satellite device also asymmetrically encrypts the symmetric key through the public key of the ground base station to obtain an encryption key.

[0035] S110: The encrypted data and the encryption key are combined into a data packet, and the data packet is sent to the ground base station, so that the ground base station decrypts the encryption key in the data packet according to the private key of the ground base station to obtain the symmetric key, and decrypts the encrypted data by the symmetric key to obtain the remote sensing data.

[0036] In one or more embodiments of the present specification, after encrypting the remote sensing data and the symmetric key, the satellite device can form a data packet with the encrypted data and the encryption key, and send the data packet to the ground base station. The ground base station can decrypt the encryption key according to the private key of the ground base station itself to obtain the symmetric key. The ground base station then decrypts the encrypted data in the data packet using the symmetric key, verifies the correctness of the digital signature according to the satellite public key, and extracts the data summary information of the remote sensing data as the first data summary information, and uses the data summary information in the encrypted data as the second data summary information. When the first data summary information is the same as the second data summary information, the ground base station can believe that the remote sensing data transmitted by the satellite device is accurate, and then use the remote sensing data for scientific research and other tasks.

[0037] Figure 2 This is a schematic diagram of satellite-to-ground data transmission provided in this manual. Figure 2 As shown in the figure, the satellite equipment on the satellite extracts the data summary information from the collected remote sensing data and digitally signs it with the satellite private key, and then encrypts it together with the remote sensing data and the satellite public key with the symmetric key to obtain encrypted data. The satellite equipment then encrypts the symmetric key with the public key of the ground base station to determine the encryption key. Finally, the satellite equipment sends the encrypted data and the encryption key to the ground base station.

[0038] Figure 3 This is a schematic diagram of a ground base station receiving data provided in this manual. Figure 3 As shown, after the ground base station receives the data packet sent by the satellite device, it decrypts the encryption key in the data packet using its own private key to obtain a symmetric key. Afterwards, the ground base station encrypts the encrypted data in the data packet using the symmetric key to obtain the digitally signed data summary information 1, remote sensing data, and the satellite public key. In order to verify the security of the remote sensing data, the ground base station verifies the digitally signed data summary information 1 using the satellite public key. At the same time, the ground base station will also determine the data summary information 2 of the remote sensing data, and compare the data summary information 1 with the data summary information 2. If the two are equal, the ground base station can confirm that the remote sensing data has not been tampered with. Otherwise, it is confirmed that the remote sensing data has been tampered with.

[0039] In addition, in this specification, after the encrypted data and the encryption key are encrypted and before they are sent to the ground base station, the satellite device can also decrypt the encrypted data through the symmetric key, and then re-determine the data summary information of the remote sensing data. After that, the satellite device can determine whether the re-determined data summary information is the same as the data summary information after the digital signature. If so, the satellite device determines the symmetric key for encrypting the remote sensing data, and re-encrypts the digitally signed data summary information, the remote sensing data and the satellite public key according to the determined symmetric key to determine the encrypted data. At this time, the satellite device determines the symmetric key for encrypting the remote sensing data, which can be either a symmetric key that has been used to encrypt the remote sensing data before, or a new symmetric key determined by the satellite device and the ground base station through a key encapsulation algorithm. If not, the satellite device discards the remote sensing data, no longer transmits the remote sensing data with security risks to the ground base station, and can send an alarm notification to the ground base station. Among them, the key encapsulation algorithm can adopt the post-quantum cryptographic algorithm Kyber algorithm to increase the security of symmetric key synchronization. Of course, the type of key encapsulation algorithm is not limited in this specification.

[0040] In one or more embodiments of the present specification, the satellite device may encrypt and store symmetric keys and even the satellite's own public key and private key to increase the security of the keys on the satellite.

[0041] Specifically, the satellite device obtains the system key from the ground base station, and then the satellite device can encrypt and store the symmetric key, the satellite public key and the satellite private key according to the system key. When the data summary information needs to be digitally signed by the satellite private key, the satellite device decrypts the encrypted satellite private key according to the system key, and digitally signs the data summary information according to the decrypted satellite private key. In addition, when the digitally signed data summary information, the remote sensing data and the satellite public key need to be encrypted by the symmetric key, the satellite device can decrypt the encrypted satellite public key and the symmetric key according to the system key. Then, the digitally signed data summary information, the remote sensing data and the decrypted satellite public key are encrypted according to the decrypted symmetric key to obtain encrypted data.

[0042] In one or more embodiments of the present specification, in order to further improve the security of the key, the satellite device may also re-determine the random number according to a preset update period, and update the symmetric key of the symmetric algorithm based on the re-determined random number, and the satellite device then stores the updated symmetric key and may also delete the symmetric key before the update.

[0043] Furthermore, in this specification, in order to prevent the satellite from losing the key after a system failure, restart, or restart due to a computing attack, the satellite device can back up the symmetric key, satellite public key, and satellite private key in slices. Afterwards, the satellite device can encrypt and store the backed-up symmetric key, satellite public key, and satellite private key in slices according to the system key. In this way, when the satellite has a system failure or restart, the sliced ​​stored key can be reorganized to restore the complete key. The satellite device can back up the key in slices through the erasure coding technology. Of course, this specification does not limit the technology used to back up the key in slices.

[0044] In one or more embodiments of the present specification, in order to enable the ground base station to completely receive the data packet sent by the satellite, the satellite device can establish information according to the preset transmission error control mechanism, establish a transmission error control mechanism, and detect problems in the data packet transmission process. Specifically, the satellite device forms a data packet with encrypted data and an encryption key, and establishes a transmission error control mechanism. After that, the satellite device sends the data packet to the ground base station, and detects whether the ground base station receives the data packet through the transmission error control mechanism. If so, the satellite device continues to communicate with the ground base station and continues to send the remaining data packets to the ground base station. If not, the satellite device resends the data packet to the ground base station.

[0045] Among them, the transmission error control mechanism can be two different error control mechanisms: forward error correction (FEC) and acknowledgment (ACK). FEC, by adding redundant information (error correction code) to the transmitted data packet, enables the ground base station to correct a certain number of errors by itself without retransmission. FEC is suitable for satellite communication environments with high retransmission costs to prevent retransmissions that may cause large delays or consume precious bandwidth resources. The ACK error control mechanism requires the ground base station to confirm the received data packet to inform the satellite equipment on the satellite whether the data packet is successfully received. If the satellite equipment does not receive the ACK signal, or receives a negative acknowledgment (NACK), the lost or damaged data packet can be resent to the ground base station.

[0046] In one or more embodiments of this specification, in order to further ensure that the ground base station can more securely receive the data packets sent by the satellite device and can normally decrypt the encryption key through its private key, it is necessary to ensure the security of the public key of the ground base station obtained by the satellite device from the ground base station in this specification. Therefore, when the ground base station sends its public key to the satellite, it needs to send its public key together with its base station identifier to the satellite, so that the satellite device on the satellite can determine that the public key of the ground base station is valid based on the public key and base station identifier of the ground base station.

[0047] Specifically, the satellite device obtains the base station identifier of the ground base station. The satellite device then determines the combined string based on the base station identifier and the public key of the ground base station. Afterwards, the satellite device converts the combined string in a preset manner to obtain a conversion value. And determine whether the conversion value falls within the numerical range corresponding to the ground base station. If so, the satellite device determines that the public key of the ground base station is valid. If not, the public key of the ground base station can be re-acquired and determined to be valid. When it is determined that the public key of the ground base station is valid, the satellite device can asymmetrically encrypt the symmetric key through the public key of the ground base station to obtain the encryption key.

[0048] Among them, the satellite equipment combines the base station identifier and the public key of the ground base station into a combined string, and determines a fixed byte output according to the combined string through a preset method, such as through a key derivation function, and then performs a modulo operation on the output, so that the result of the modulo operation (conversion value) can fall into the specified numerical range. Therefore, when the base station identifier of each ground base station is different, through the above method, even if the public key of each ground base station is the same, the conversion value obtained by the modulo operation will be different. This increases the security of the public key of the ground base station obtained by the satellite equipment from the ground base station.

[0049] In one or more embodiments of the present specification, in order to prevent the data packets sent by the satellite device to the ground base station from being obtained by a third party, and the third party disguises itself as a satellite to send data packets to the ground base station, although the ground base station may still obtain the correct data packet in this case, the third party obtaining the data packet will still cause the problem of data security cannot be guaranteed.

[0050] Therefore, after the satellite device sends a data packet to the ground base station, the satellite device will receive a response instruction, which is sent by the ground base station to the satellite device after receiving the data packet. Afterwards, the satellite device can return communication status information to the ground base station according to the response instruction, so that the ground base station can determine the first data transmission duration according to the time of receiving the communication status information and the time of sending the response instruction, and estimate the transmission duration of the data packet according to the communication status information as the second data transmission duration. The ground base station then determines the transmission duration range according to the first data transmission duration and the second data transmission duration, so as to verify the data packet according to the transmission duration range. The ground base station can verify the data packet in the following way: the ground base station determines whether the transmission duration of the data packet actually received is within the transmission duration range, so as to determine whether the data packet has been intercepted and obtained by a third party.

[0051] In this specification, through the above-mentioned data transmission method, the satellite determines the random number by itself, and then determines the symmetric key, so that the key has higher unpredictability, reduces the possibility of the key being cracked, and avoids the situation of information leakage when the satellite and the ground base station synchronize the symmetric key. After that, the remote sensing data collected by the satellite is encrypted and transmitted by the determined symmetric key. At the same time, in the face of the growing quantum computing capabilities, under the threat of quantum computing, it is also possible to ensure the data security of satellite storage and the data security during satellite-to-ground data transmission by adopting a cryptographic algorithm with stronger quantum resistance than the currently used algorithms. It can also ensure that the remote sensing data can be detected after being tampered with during the transmission process or storage process, thereby preventing possible security risks. In addition, in order to prevent the satellite from losing the key after system failure, restart or restart after being attacked by computing, the satellite equipment can back up the symmetric key, satellite public key and satellite private key separately, and establish a transmission error control mechanism to detect problems in the data packet transmission process. In addition, this solution can be implemented in a pure software manner, without the support of the auxiliary encryption and decryption hardware equipment currently used on satellites, improving versatility and reducing satellite resource consumption.

[0052] The above is a data transmission method provided by one or more embodiments of this specification. Based on the same idea, this specification also provides a corresponding data transmission device, such as Figure 4 shown.

[0053] Figure 4A schematic diagram of a data transmission device provided in this specification specifically includes: An acquisition module 400 is used to acquire collected remote sensing data; A determination module 402, configured to determine a random number, and determine a symmetric key of a symmetric cryptographic algorithm based on the random number; The signature module 404 is used to determine the data summary information of the remote sensing data, and digitally sign the data summary information according to the satellite private key; The first encryption module 406 is used to encrypt the digitally signed data summary information, the remote sensing data and the satellite public key by using the symmetric key to obtain encrypted data; The second encryption module 408 is used to asymmetrically encrypt the symmetric key using the public key of the ground base station to obtain an encryption key; The transmission module 410 is used to combine the encrypted data and the encryption key into a data packet, and send the data packet to the ground base station, so that the ground base station decrypts the encryption key in the data packet according to the private key of the ground base station to obtain the symmetric key, and decrypts the encrypted data through the symmetric key to obtain the remote sensing data.

[0054] Optionally, the determination module 402 is used to determine the sensor noise introduced by the sensor in the satellite when collecting the remote sensing data, digitally convert the sensor noise to obtain noise data, and generate a random number based on the noise data through a pseudo-random number generator.

[0055] Optionally, the transmission module 410 is used to decrypt the encrypted data using the symmetric key, and re-determine the data summary information of the remote sensing data, and determine whether the re-determined data summary information is the same as the data summary information after the digital signature. If so, determine the symmetric key used to encrypt the remote sensing data, and re-encrypt the digitally signed data summary information, the remote sensing data, and the satellite public key according to the determined symmetric key to determine the encrypted data. If not, discard the remote sensing data.

[0056] Optionally, the signature module 404 is configured to obtain a system key from the ground base station, encrypt and store the symmetric key, the satellite public key and the satellite private key according to the system key; decrypt the encrypted satellite private key according to the system key, and digitally sign the data summary information according to the decrypted satellite private key; The first encryption module 406 is used to decrypt the encrypted satellite public key and the symmetric key according to the system key, and to encrypt the digitally signed data summary information, the remote sensing data and the decrypted satellite public key according to the decrypted symmetric key to obtain encrypted data.

[0057] Optionally, the signature module 404 is used to back up the symmetric key, satellite public key and satellite private key in slices respectively, and encrypt and store the backed-up symmetric key, satellite public key and satellite private key in slices according to the system key.

[0058] Optionally, the second encryption module 408 is used to obtain the base station identifier of the ground base station, determine a combined character string based on the base station identifier and the public key of the ground base station, convert the combined character string in a preset manner to obtain a conversion value, and determine whether the conversion value falls within the numerical range corresponding to the ground base station. If so, it is determined that the public key of the ground base station is valid. When it is determined that the public key of the ground base station is valid, the symmetric key is asymmetrically encrypted through the public key of the ground base station to obtain an encryption key.

[0059] Optionally, the device further includes a response module 412; The response module 412 is used to receive a response instruction, which is sent by the ground base station after receiving the data packet. According to the response instruction, the communication status information is returned to the ground base station, so that the ground base station determines the first data transmission duration according to the time of receiving the communication status information and the time of sending the response instruction, and estimates the transmission duration of the data packet as the second data transmission duration according to the communication status information, and determines the transmission duration range according to the first data transmission duration and the second data transmission duration, so as to verify the data packet according to the transmission duration range.

[0060] This specification also provides a computer-readable storage medium, which stores a computer program, which can be used to execute the above Figure 1 A data transmission method is provided.

[0061] This manual also provides Figure 5 The schematic diagram of the satellite equipment is shown in Figure 1. Figure 5 As shown in FIG. 1 , at the hardware level, the satellite equipment includes a processor, an internal bus, a network interface, a memory, and a non-volatile memory, and may also include hardware required for other services. The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it to achieve the above Figure 1 The data transmission method.

[0062] Of course, in addition to software implementation, this specification does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc., that is to say, the executor of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0063] In the 1990s, it was very clear whether the improvement of a technology was hardware improvement (for example, improvement of the circuit structure of diodes, transistors, switches, etc.) or software improvement (improvement of the method flow). However, with the development of technology, many improvements of the method flow today can be regarded as direct improvements of the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that the improvement of a method flow cannot be implemented with hardware entity modules. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to ask chip manufacturers to design and make dedicated integrated circuit chips. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one kind of HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0064] The controller may be implemented in any suitable manner, for example, the controller may take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (e.g., software or firmware) executable by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller, examples of which include but are not limited to the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320, and the memory controller may also be implemented as part of the control logic of the memory. It is also known to those skilled in the art that, in addition to implementing the controller in a purely computer-readable program code manner, the controller may be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, such a controller may be considered as a hardware component, and the devices for implementing various functions included therein may also be considered as structures within the hardware component. Or even, the devices for implementing various functions may be considered as both software modules for implementing the method and structures within the hardware component.

[0065] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0066] For the convenience of description, the above device is described in various units according to their functions. Of course, when implementing this specification, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0067] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems, or computer program products. Therefore, this specification may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0068] This specification is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of this specification. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0069] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0070] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0071] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0072] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0073] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0074] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0075] It should be understood by those skilled in the art that the embodiments of this specification may be provided as methods, systems or computer program products. Therefore, this specification may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0076] This specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. This specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0077] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0078] The above description is only an embodiment of the present specification and is not intended to limit the present specification. For those skilled in the art, the present specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present specification shall be included in the scope of the claims of the present specification.

Claims

1. A data transmission method, characterized in that: include: Obtaining collected remote sensing data; Determining a random number, and determining a symmetric key of a symmetric cryptographic algorithm based on the random number; Determining data summary information of the remote sensing data, and digitally signing the data summary information according to a satellite private key; The digitally signed data summary information, the remote sensing data and the satellite public key are encrypted by the symmetric key to obtain encrypted data; Asymmetrically encrypt the symmetric key using the public key of the ground base station to obtain an encryption key; The encrypted data and the encryption key form a data packet, and the data packet is sent to the ground base station, so that the ground base station decrypts the encryption key in the data packet according to the private key of the ground base station to obtain the symmetric key, and decrypts the encrypted data by the symmetric key to obtain the remote sensing data.

2. The method according to claim 1, characterized in that Determine the random number, including: Determining sensor noise introduced by a sensor in a satellite when collecting the remote sensing data; Digitally converting the sensor noise to obtain noise data; A random number is generated according to the noise data by a pseudo-random number generator.

3. The method according to claim 1, characterized in that Before the encrypted data and the encryption key are combined into a data packet and the data packet is sent to the ground base station, the method further includes: Decrypting the encrypted data using the symmetric key and re-determining data summary information of the remote sensing data; Determine whether the re-determined data summary information is the same as the digitally signed data summary information; If yes, determine the symmetric key for encrypting the remote sensing data, and re-encrypt the digitally signed data summary information, the remote sensing data and the satellite public key according to the determined symmetric key to determine the encrypted data; If not, the remote sensing data is discarded.

4. The method according to claim 1, characterized in that Before determining the data summary information of the remote sensing data, the method further includes: Acquire a system key from the ground base station; Encrypting and storing the symmetric key, the satellite public key and the satellite private key according to the system key; The data summary information is digitally signed according to the satellite private key, specifically including: Decrypting the encrypted satellite private key according to the system key, and digitally signing the data summary information according to the decrypted satellite private key; The digitally signed data summary information, the remote sensing data and the satellite public key are encrypted by the symmetric key to obtain encrypted data, specifically including: Decrypting the encrypted satellite public key and the symmetric key according to the system key; The digitally signed data summary information, the remote sensing data and the decrypted satellite public key are encrypted according to the decrypted symmetric key to obtain encrypted data.

5. The method according to claim 4, characterized in that Encrypting and storing the symmetric key, the satellite public key, and the satellite private key according to the system key specifically includes: Backing up the symmetric key, satellite public key and satellite private key in slices respectively; According to the system key, the backed-up symmetric key, satellite public key and satellite private key are encrypted and stored in segments.

6. The method according to claim 1, characterized in that Before asymmetrically encrypting the symmetric key by using the public key of the ground base station to obtain the encryption key, the method further includes: Obtaining a base station identifier of the ground base station; Determine a combined character string according to the base station identifier and the public key of the ground base station; Convert the combined string according to the preset method to obtain the conversion value; Determining whether the conversion value falls within the numerical range corresponding to the ground base station; If yes, it is determined that the public key of the ground base station is valid; The symmetric key is asymmetrically encrypted using the public key of the ground base station to obtain an encryption key, specifically including: When it is determined that the public key of the ground base station is valid, the symmetric key is asymmetrically encrypted using the public key of the ground base station to obtain an encryption key.

7. The method according to claim 1, characterized in that The method further comprises: receiving a response instruction, wherein the response instruction is sent by the ground base station after receiving the data packet; According to the response instruction, the communication status information is returned to the ground base station, so that the ground base station determines the first data transmission duration according to the time of receiving the communication status information and the time of sending the response instruction, and estimates the transmission duration of the data packet as the second data transmission duration according to the communication status information, and determines the transmission duration range according to the first data transmission duration and the second data transmission duration, so as to verify the data packet according to the transmission duration range.

8. A data transmission device, characterized in that: include: An acquisition module is used to acquire the collected remote sensing data; A determination module, configured to determine a random number, and determine a symmetric key of a symmetric cryptographic algorithm based on the random number; A signature module, used to determine data summary information of the remote sensing data, and digitally sign the data summary information according to a satellite private key; A first encryption module is used to encrypt the digitally signed data summary information, the remote sensing data and the satellite public key by using the symmetric key to obtain encrypted data; A second encryption module is used to asymmetrically encrypt the symmetric key using the public key of the ground base station to obtain an encryption key; The transmission module is used to combine the encrypted data and the encryption key into a data packet, and send the data packet to the ground base station, so that the ground base station decrypts the encryption key in the data packet according to the private key of the ground base station to obtain the symmetric key, and decrypts the encrypted data by the symmetric key to obtain the remote sensing data.

9. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the method described in any one of claims 1 to 7 is implemented.

10. A satellite device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the method described in any one of claims 1 to 7 is implemented.

Images