Ultra-high-speed terminal access and collaborative authentication method and program product in satellite networks

Abstract

The present invention provides a method and program product for ultra-high-speed terminal access and cooperative authentication in a satellite network. A ground control center configures an access point identity for an access point in response to a registration request sent by an access point and an ultra-high-speed terminal, and configures a long-term shared key, a terminal identity, a master public key, a generator on an elliptic curve, and an index table for an ultra-high-speed terminal. When any first ultra-high-speed terminal flies into the air and does not deviate from the coverage of the first access point during the access process, an access authentication request is sent to the ground control center through the first access point to complete the access authentication. When the first ultra-high-speed terminal flies into the air and is about to deviate from the coverage of the first access point during the access process, an access authentication request is sent to the ground control center through multiple access points on its route to complete the cooperative authentication to access the ground control center, thereby realizing flexible and rapid access of the ultra-high-speed terminal to the ground control center.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to an ultra-high-speed terminal access and collaborative authentication method and program product in a satellite network. Background Art

[0002] With the development of science and technology, more and more ultra-high-speed terminals are appearing in people's vision. Ultra-high-speed terminals are generally aircraft, such as airplanes, drones, rockets, etc. Ultra-high-speed terminals have ultra-high-speed characteristics, and their speed can reach several Mach or even dozens of Mach. If they are connected to the ground network, the communication will frequently switch between different ground base stations, resulting in high packet loss rate and poor service quality, which cannot meet the basic communication needs of ultra-high-speed terminals. In addition, the mobile span of ultra-high-speed terminals is generally large, and may pass over oceans, deserts, mountains and other areas. However, due to the high cost of ground network infrastructure construction, only 20% of the land area is covered by mobile services, which is less than 6% of the earth's surface area. Therefore, satellite networks (Satellite-Terrestrial Networks, STN) with characteristics such as ubiquitous connectivity and massive access have become one of the powerful solutions to solve the communication problems of ultra-high-speed terminals.

[0003] STN is a heterogeneous network with satellite networks as the main body. It is generally composed of various satellites or spacecraft deployed in different orbits, ground stations, and mobile terminals with satellite communication capabilities. Compared with traditional ground networks, STN can overcome the shortcomings of geographical restrictions, provide more flexible and ubiquitous access services, and provide continuous and stable access and data communication services for ultra-high-speed terminals. In addition, satellite networks have good prospects in providing communication services under extreme conditions such as aviation, navigation or disaster areas. At the same time, Low Earth Orbit (LEO) satellites are closer to the earth, and compared with Geosynchronous Earth Orbit (GEO) and Medium Earth Orbit (MEO) satellites, they have lower transmission delays and are more suitable as access points to form a network.

[0004] Moreover, with the continuous advancement of satellite technology and the expansion of data communication business types, on-board processing capabilities will be greatly enhanced, and on-board signal regeneration processing, routing switching and other functions will be realized. Different satellites can establish extensive and comprehensive connections through inter-satellite links; satellite networks will be oriented to diversified application scenarios and provide services for differentiated terminals on demand. Ultra-high-speed terminals combined with satellite networks can achieve long-distance, lightweight, secure and stable communications, which can improve national defense capabilities.

[0005] However, satellite networks have more security risks than traditional networks. On the one hand, the satellite-to-ground link is highly exposed, so information is vulnerable to illegal eavesdropping and malicious tampering. On the other hand, the satellite network topology is complex, and it is difficult to maintain a stable satellite link. Researchers have proposed various authentication schemes for terminal access to satellite networks, most of which cannot be changed during the execution of the protocol. Therefore, these schemes are not suitable for access authentication of ultra-high-speed terminals. In addition, existing terminal access authentication schemes mainly use digital signatures or public key cryptography systems, which have large signaling and computing overheads and are not suitable for ultra-high-speed terminals with limited computing power. Summary of the invention

[0006] In order to solve the above problems existing in the prior art, the present invention provides a method and program product for ultra-high-speed terminal access and collaborative authentication in a satellite network, specifically comprising:

[0007] In a first aspect, the present invention provides a method for ultra-high-speed terminal access and collaborative authentication in a satellite network, comprising:

[0008] Registration phase: In response to the registration request sent by each access point and each ultra-high-speed terminal, the ground control center configures an access point identity for each access point, and configures a long-term shared key, a terminal identity, a master public key, a generator on an elliptic curve, and an index table for each ultra-high-speed terminal to complete the registration of each access point and each ultra-high-speed terminal. The index table includes the access point identities of all access points.

[0009] First access stage: when any first ultra-high-speed terminal among the ultra-high-speed terminals flies into the air and does not deviate from the coverage of the first access point during the access process, the first ultra-high-speed terminal sends an access authentication request to the ground control center through the first access point to complete the access authentication;

[0010] Second access stage: When the first ultra-high-speed terminal flies into the air and is about to deviate from the coverage of the first access point during the access process, the first ultra-high-speed terminal sends an access authentication request to the ground control center through multiple access points on the route of the first ultra-high-speed terminal based on a preset navigation plan, completes collaborative authentication to access the ground control center, and the navigation plan includes the route and the time to fly to the corresponding position on the route.

[0011] In a second aspect, the present invention provides a program product, the program product comprising computer program instructions, and when the computer program instructions are executed, any method provided in the first aspect can be implemented.

[0012] Beneficial effects of the present invention:

[0013] The present invention provides a method and program product for ultra-high-speed terminal access and cooperative authentication in a satellite network, comprising a registration phase: a ground control center configures an access point identity for each access point in response to a registration request sent by each access point and each ultra-high-speed terminal, and configures a long-term shared key, a terminal identity, a master public key, a generator on an elliptic curve, and an index table for each ultra-high-speed terminal to complete the registration of each access point and each ultra-high-speed terminal, wherein the index table includes the access point identity of all access points; a first access phase: when any first ultra-high-speed terminal among the ultra-high-speed terminals flies into the air and does not deviate from the coverage of the first access point during the access process, the first ultra-high-speed terminal sends an access authentication request to the ground control center through the first access point to complete the access authentication; a second access phase: when the first ultra-high-speed terminal flies into the air and is about to deviate from the coverage of the first access point during the access process, the first ultra-high-speed terminal sends an access authentication request to the ground control center through multiple access points on the route of the first ultra-high-speed terminal based on a preset navigation plan, completes the cooperative authentication, and accesses the ground control center, so that the ultra-high-speed terminal can flexibly and quickly access the network under high-speed movement.

[0014] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 A schematic diagram of a flow chart of a method for ultra-high-speed terminal access and collaborative authentication in a satellite network provided by the present invention;

[0016] Figure 2 A schematic diagram of a satellite network scenario provided by the present invention. DETAILED DESCRIPTION

[0017] The present invention is further described in detail below with reference to specific embodiments, but the embodiments of the present invention are not limited thereto.

[0018] After the ultra-high-speed terminal is launched, it will run according to the trajectory set before launch, and will be monitored, managed and maintained in real time by the ground control center, which provides the possibility of collaborative authentication of multiple access points using the ultra-high-speed terminal's flight plan. According to this idea, the present invention provides a method for ultra-high-speed terminal access and collaborative authentication in a satellite network, such as Figure 1 As shown, this method is applied to Figure 2 In the scenario shown, the scenario includes multiple ultra-high-speed terminals, multiple satellites as access points, and ground stations deployed with a ground control center.

[0019] like Figure 1 As shown, the method includes:

[0020] S101, registration phase: the ground control center responds to the registration request sent by each access point and each ultra-high-speed terminal, configures an access point identity for each access point, and configures a long-term shared key, a terminal identity, a master public key, a generator on an elliptic curve, and an index table for each ultra-high-speed terminal to complete the registration of each access point and each ultra-high-speed terminal, wherein the index table includes the access point identities of all access points.

[0021] S102, first access stage: when any first ultra-high-speed terminal among the ultra-high-speed terminals flies into the air and does not deviate from the coverage of the first access point during the access process, the first ultra-high-speed terminal sends an access authentication request to the ground control center through the first access point to complete the access authentication.

[0022] It should be noted that the first ultra-high-speed terminal does not deviate from the coverage of the first access point during the entire access process of the first access phase.

[0023] S103, second access stage: when the first ultra-high-speed terminal flies into the air and is about to leave the coverage of the first access point, the first ultra-high-speed terminal sends an access authentication request to the ground control center through multiple access points on the route of the first ultra-high-speed terminal based on a preset navigation plan, and completes collaborative authentication to access the ground control center.

[0024] The flight plan includes the route and the time to fly to the corresponding location on the route. That is, the location of the ultra-high-speed terminal at a certain point in time can be known through the flight plan.

[0025] It should be noted that, in the second access phase, the first ultra-high-speed terminal gradually begins to deviate from the coverage of the first access point that it originally accesses, and deviates from the coverage of the first access point in subsequent access processes.

[0026] This method fully considers the situation that the ultra-high-speed terminal deviates from its original access point during the access process due to its ultra-high-speed characteristics, resulting in the original access point being unable to support the ultra-high-speed terminal and the ground control center to complete access and identity authentication. It is designed according to the characteristics of the ultra-high-speed terminal and based on the navigation plan, enabling the ultra-high-speed terminal to access the network flexibly and quickly under high-speed movement.

[0027] Optionally, the method further includes:

[0028] S104, fast communication establishment phase: each ultra-high-speed terminal sends a terminal communication fast connection request to the currently accessed access point, and establishes a communication connection with the corresponding access point based on the response message of each currently accessed access point.

[0029] The efficient and secure communication rapid establishment method can ensure the communication continuity and real-time controllability of the ultra-high-speed terminal, and overcome the problem of intermittent communication connectivity between the ultra-high-speed terminal and the access satellite (access point).

[0030] Further optional, such as Figure 2 As shown, when the system includes other terminal devices, the method further includes:

[0031] S105, inter-terminal collaboration stage: After each ultra-high-speed terminal is connected to the ground control center, it completes inter-terminal collaborative authentication through the access point accessed by other terminal devices and establishes a secure channel between the terminals.

[0032] This lightweight inter-terminal collaboration method can meet the needs of secure data transmission between ultra-high-speed terminals and other terminal devices.

[0033] The following is a detailed description of each stage:

[0034] The registration phase includes:

[0035] (1) The ground control center selects a random number As the master private key, as the master public key, and , is a generator on the elliptic curve.

[0036] (2) The ground control center presets a long-term shared key for each ultra-high-speed terminal , terminal identity, master public key , Generators on elliptic curves And the index table Tab . Configure an access point identity for each access point.

[0037] Among them, the index table Tab Contains the access point identities of all access points.

[0038] When the ultra-high-speed terminal flies into the air and wants to access the ground control center, the ultra-high-speed terminal can send an access authentication request to the ground control center through the access point.

[0039] In the first access phase, the ultra-high-speed terminal never deviates from the first access point during access. Specifically, in a possible implementation, the first access stage includes the following steps:

[0040] S301: The first ultra-high-speed terminal generates a random number and random numbers , according to the random number and generators on elliptic curves , generate intermediate variables ; Generate a timestamp based on the current time , according to the random number , Timestamp and the master public key configured by the ground control center for the first ultra-high-speed terminal , generate an anonymous key ; Use anonymous key Encrypted by the terminal identity of the first ultra-high-speed terminal , random numbers and access information The composed plaintext is obtained ; According to the long-term shared key configured by the ground control center for the first ultra-high-speed terminal and the anonymous key , derive the encryption key and integrity protection key ; Based on the integrity protection key and random numbers , generate a message verification code ; Based on timestamp 、Ciphertext , Message Verification Code and intermediate variables , generating a first terminal access authentication request , and the first terminal access authentication request Send to first access point , the corresponding expression is:

[0041] ,

[0042] ,

[0043] ,

[0044] ,

[0045] ,

[0046] ,

[0047] in, Indicates the first terminal access authentication request, operator represents the multiplication operation of points on the elliptic curve, Represents a hash operation, Indicates the use of anonymous keys Perform encryption operations. Indicates cascade, Indicates access information, including the flight plan and speed information of the first ultra-high-speed terminal, symbol Indicates that its internal elements constitute a message.

[0048] S302: First access point The corresponding access point identity Add the first terminal access authentication request , get the first access authentication request , and the first access authentication request Sent to ground control center.

[0049] The corresponding expression is:

[0050] .

[0051] S303, the ground control center checks the timestamp according to the current time The validity of the timestamp If valid, then according to the master public key The corresponding master private key , intermediate variables and timestamp , generate an anonymous key ; Based on the anonymous key , decrypt the first access authentication request The ciphertext in , get the first decryption result ; Based on the long-term shared key and the anonymous key , generate encryption key and integrity protection key ; According to the random number in the first decryption result and integrity protection key , generate a message verification code ; Determine the first access authentication request Message verification code in With message verification code Are they consistent? If so, generate a random number , based on the integrity protection key and random numbers , generate a message verification code ; According to the message verification code and random numbers , generate a first access authentication response , and the first access authentication response Send to first access point .

[0052] The corresponding expression is:

[0053] ,

[0054] ,

[0055] ,

[0056] ,

[0057] ,

[0058] ,

[0059] in, Indicates the first access authentication response, Indicates the use of anonymous keys Perform decryption operation.

[0060] Optionally, if the first access authentication request Message verification code in With message verification code If they are inconsistent, it means that the ground control center does not trust the first ultra-high-speed terminal, and the access process is terminated.

[0061] S304: First access point The corresponding access point identity Add first access authentication response , get the first terminal access authentication response , and the first terminal access authentication response Sent to the first ultra-high-speed terminal.

[0062] The corresponding expression is:

[0063] .

[0064] S305: The first ultra-high-speed terminal generates a random number. and integrity protection key Generate message verification code ; Determine the message verification code With message verification code Are they consistent? If so, protect the key based on integrity , random numbers and random numbers , generate terminal access authentication confirmation message , and the terminal access authentication confirmation message , sent to the first access point .

[0065] The corresponding expression is:

[0066] ,

[0067] .

[0068] It is understood that the first ultra-high-speed terminal uses and the ground control center calculates the message verification code The corresponding method calculates the message verification code .

[0069] S306: First access point Terminal access authentication confirmation message , forwarded to the ground control center.

[0070] S307, the ground control center protects the key according to the integrity , random numbers and random numbers , generate terminal access authentication confirmation message ; Confirm terminal access authentication confirmation message Confirm the terminal access authentication message Are they consistent? If so, then use the encryption key , the terminal identity of the first ultra-high-speed terminal , random numbers , random numbers and timestamp , generate a session key between the first ultra-high-speed terminal and the ground control center ; Based on the session key , the terminal identity of the first ultra-high-speed terminal and the first access point Access point ID , generating a first ultra-high-speed terminal and a first access point The session key between , according to the terminal identity of the first ultra-high-speed terminal , Anonymous Key and the first access point Access point ID , generating a first ultra-high-speed terminal and a first access point Temporary status between , the session key and temporary status , sent to the first access point .

[0071] The corresponding expression is:

[0072] ,

[0073] ,

[0074] ,

[0075] ,

[0076] Among them, the operator Represents the exclusive-or operation.

[0077] S308: The first ultra-high-speed terminal uses the encryption key , the terminal identity of the first ultra-high-speed terminal , random numbers , random numbers and timestamp , generate a session key between the first ultra-high-speed terminal and the ground control center , based on the session key , the terminal identity of the first ultra-high-speed terminal and the first access point Access point ID , generating a first ultra-high-speed terminal and a first access point The session key between , according to the terminal identity of the first ultra-high-speed terminal , Anonymous Key and the first access point Access point ID , generating a first ultra-high-speed terminal and a first access point Temporary status between .

[0078] The corresponding expression is:

[0079] ,

[0080] ,

[0081] .

[0082] After the above method is used, the ground control center stores the terminal identity of the first ultra-high-speed terminal. , and a session key between the first ultra-high-speed terminal and the ground control center generated by the ground control center , a first ultra-high-speed terminal and a first access point The session key between , a first ultra-high-speed terminal and a first access point Temporary status between and the anonymous key The access point side stores the session key between the first ultra-high-speed terminal and the ground control center generated by the ground control center , a first ultra-high-speed terminal and a first access point The session key between and a first ultra-high-speed terminal and a first access point Temporary status between The terminal side stores the terminal identity of the first ultra-high-speed terminal , and a session key between the first ultra-high-speed terminal and the ground control center generated by the first ultra-high-speed terminal , a first ultra-high-speed terminal and a first access point Temporary status between , a session key between the first ultra-high-speed terminal and the first access point and the anonymous key It should be noted that the anonymous key and the anonymous key Generated by devices on different sides, but it is not difficult to see from the above that their generation methods are the same, so it is not difficult to understand that the anonymous key and the anonymous key The corresponding encryption key and encryption keys , integrity protection key and integrity protection key , Message Verification Code and message verification code , Message Verification Code and message verification code , Terminal access authentication confirmation message and terminal access authentication confirmation message , the session key between the first ultra-high-speed terminal and the ground control center and the session key between the first ultra-high-speed terminal and the ground control center , a first ultra-high-speed terminal and a first access point The session key between and a first ultra-high-speed terminal and a first access point The session key between , a first ultra-high-speed terminal and a first access point Temporary status between and a first ultra-high-speed terminal and a first access point Temporary status between Therefore, through this method, the session key is shared between the ultra-high-speed terminal and the access point, and the session key is shared between the ultra-high-speed terminal and the ground control center, so that the security of the interactive data on the above channel can be ensured, and the secure access of the ultra-high-speed terminal can be realized.

[0083] Furthermore, when the ultra-high-speed terminal flies into the air and is about to deviate from the first access point If the ultra-high-speed terminal wants to access the ground control center when the ultra-high-speed terminal is out of coverage and the access authentication has not been completed yet, it will enter the second access stage, and the ultra-high-speed terminal will send an access authentication request to the ground control center through other access points.

[0084] Specifically, in a possible implementation, the second access phase includes the following steps:

[0085] S401: The first ultra-high-speed terminal generates a random number and random numbers , according to the random number and generators on elliptic curves , generate intermediate variables ; Generate a timestamp based on the current time , according to the random number , Timestamp and the master public key configured by the ground control center for the first ultra-high-speed terminal , generate an anonymous key ; Use anonymous key Encrypted by the terminal identity of the first ultra-high-speed terminal , random numbers and access information The composed plaintext is obtained ; According to the long-term shared key configured by the ground control center for the first ultra-high-speed terminal and the anonymous key , derive the encryption key and integrity protection key ; Based on the integrity protection key and random numbers , generate a message verification code ; Based on timestamp 、Ciphertext , Message Verification Code and intermediate variables , generate a second terminal access authentication request , and the second terminal access authentication request Send to the first access point currently connected .

[0086] The corresponding expression is:

[0087] ,

[0088] ,

[0089] ,

[0090] ,

[0091] ,

[0092] ,

[0093] in, Indicates the second terminal access authentication request, operator represents the multiplication operation of points on the elliptic curve, Represents a hash operation, Indicates the use of anonymous keys Perform encryption operations. Indicates cascade.

[0094] It should be noted that after the first ultra-high-speed terminal moves, it deviates from the first access point without completing the access authentication. coverage and enter other areas.

[0095] S402: First access point The corresponding access point identity Add the second terminal access authentication request , get the second access authentication request , the second access authentication request Sent to ground control center.

[0096] The corresponding expression is:

[0097] .

[0098] S403, the ground control center uses the master private key , intermediate variables and timestamp , generate an anonymous key ; Based on the anonymous key , decrypt the second access authentication request The ciphertext in , and get the decryption result ; Based on the long-term shared key and the anonymous key , generate encryption key and integrity protection key ; According to the random number and integrity protection key , generate a message verification code ; Determine the second access authentication request Message verification code in With message verification code Are they consistent? If so, then the access information obtained by decryption is used , determine the flight plan and speed information of the first ultra-high-speed terminal, and determine whether there is a second access point based on the flight plan and speed information of the first ultra-high-speed terminal , and based on the second access point The existence of the second access point determines the index information set corresponding to each potential access point. To deviate from the first access point Afterwards, during the access authentication process of the first ultra-high-speed terminal, the registered access points of the first ultra-high-speed terminal are always covered, and the potential access points are the registered access points that the first ultra-high-speed terminal can access during the operation along the route; a random number is generated , based on the integrity protection key , random numbers and the index information set corresponding to each potential access point, and generating a target message verification code corresponding to each potential access point.

[0099] The corresponding expression is:

[0100] ,

[0101] ,

[0102] ,

[0103] ,

[0104] ,

[0105] in, Indicates the use of anonymous keys Perform decryption operation, Indicates A set of index information corresponding to potential access points, Indicates The target message verification code corresponding to the potential access points.

[0106] S404, the ground control center uses the encryption key , the terminal identity of the first ultra-high-speed terminal , random numbers , random numbers and timestamp , generate a session key between the first ultra-high-speed terminal and the ground control center ; Based on the session key , the terminal identity of the first ultra-high-speed terminal and The access point identities of the potential access points are used to generate session keys between the first ultra-high-speed terminal and each potential access point; and the anonymous key is used to generate session keys between the first ultra-high-speed terminal and each potential access point. , the terminal identity of the first ultra-high-speed terminal and the access point identity of each potential access point, and generate a temporary identity between the first ultra-high-speed terminal and each potential access point.

[0107] The corresponding expression is:

[0108] ,

[0109] ,

[0110] ,

[0111] in, represents the index of a potential access point, , represents the total number of potential access points, Indicates the first ultra-high-speed terminal generated by the ground control center and the The session key between potential access points, Indicates The access point identities of the potential access points, Indicates the first ultra-high-speed terminal generated by the ground control center and the A temporary identity between potential access points.

[0112] S405, the ground control center is based on the second access point Based on the existence of each potential access point, a second access authentication response is generated and issued according to the index information set corresponding to each potential access point.

[0113] Specifically, the ground control center is based on the second access point According to the existence of each potential access point, a second access authentication response is generated and sent according to the index information set corresponding to each potential access point, including:

[0114] If there is a second access point , that is, when deviating from the first access point Afterwards, during the access authentication process of the first ultra-high-speed terminal, the second access point Always cover the first ultra-high-speed terminal and assist the first ultra-high-speed terminal to complete access authentication. The ground control center determines the second access point The corresponding index information set is , except for the second access point The index information sets corresponding to all potential access points other than , a target message verification code corresponding to each potential access point, a session key between the first ultra-high-speed terminal and each potential access point, a temporary identity between the first ultra-high-speed terminal and each potential access point, and an index information set corresponding to each potential access point, generate a second access authentication response corresponding to each potential access point, and distribute each second access authentication response to each potential access point.

[0115] The corresponding expression is:

[0116] ,

[0117] ,

[0118] in, Indicates that it is sent to A second access authentication response from a potential access point, Indicates The access point identity information index of potential access points, Indicates the first ultra-high-speed terminal and the first Temporary identities between potential access points, Indicates A set of index information corresponding to potential access points, represents the empty set, Indicates the first ultra-high-speed terminal and the first session keys between potential access points.

[0119] If there is no second access point , that is, when deviating from the first access point After that, at least two access points are needed to assist the first ultra-high-speed terminal to complete access authentication. Choose from among the potential access points potential access points, selected The potential access points include the access point currently accessed by the first ultra-high-speed terminal; determine the selected The index information sets corresponding to the potential access points are , except for the selected The index information sets corresponding to all potential access points other than the potential access points are empty sets; , a target message verification code corresponding to each potential access point, a session key between the first ultra-high-speed terminal and each potential access point, a temporary identity between the first ultra-high-speed terminal and each potential access point, and an index information set corresponding to each potential access point, generate a second access authentication response corresponding to each potential access point, and distribute each second access authentication response to each potential access point.

[0120] S406. The target potential access point that receives the target second access authentication response obtains a second terminal access authentication response according to the corresponding access point identity and the target second access authentication response, and sends the second terminal access authentication response to the first ultra-high-speed terminal, wherein the target second access authentication response is a second access authentication response in which the index information set included is a non-empty set.

[0121] Specifically, all potential access points that receive the second access authentication response store the session key between the first ultra-high-speed terminal and the potential access point, and the temporary identity between the first ultra-high-speed terminal and the potential access point. If the index information set in the received second access authentication response is a non-empty set, the potential access point is the target potential access point. The target potential access point obtains the second terminal access authentication response based on the corresponding access point identity and the received second access authentication response, and sends the second terminal access authentication response to the first ultra-high-speed terminal. If the index information set in the received second access authentication response is an empty set, the potential access point does not forward the message. After this process, the index information sets that the first ultra-high-speed terminal can receive are all non-empty sets and the content is unique.

[0122] S407: The first ultra-high-speed terminal responds to the second terminal access authentication response, and , integrity protection key and the index information set corresponding to the second terminal access authentication response to generate a message verification code ; Determine the message verification code Whether the target message verification code corresponding to the second terminal access authentication response is consistent, if so, then generate a session key between the first ultra-high-speed terminal and the ground control center according to the access point identity information index of each potential access point contained in the second terminal access authentication response , a session key between the first ultra-high-speed terminal and each potential access point, and a temporary identity between the first ultra-high-speed terminal and each potential access point; according to the session key between the first ultra-high-speed terminal and each potential access point, the random number and random numbers , generate a sub-terminal access authentication confirmation message corresponding to each potential access point; generate a terminal access authentication confirmation message based on each sub-terminal access authentication confirmation message , and the terminal access authentication confirmation message , sent to any potential access point currently covering the first ultra-high-speed terminal, the corresponding expression is:

[0123] ,

[0124] ,

[0125] ,

[0126] ,

[0127] ,

[0128] ,

[0129] in, The first ultra-high-speed terminal determines that the first ultra-high-speed terminal is The session key between potential access points, The first ultra-high-speed terminal determines that the first ultra-high-speed terminal is Temporary identities between potential access points, Indicates The sub-terminal access authentication confirmation message corresponding to the potential access point, the operator Represents the exclusive OR operation;

[0130] S408: Receive terminal access authentication confirmation message The potential access point of the terminal adds the corresponding access point identity to the terminal access authentication confirmation message In the process, an access authentication confirmation message is generated and sent to the ground control center.

[0131] The corresponding expression is:

[0132] ,

[0133] in, Indicates Receive terminal access authentication confirmation message An access authentication confirmation message generated by a potential access point.

[0134] S409, the ground control center, based on the session key and random number between the first ultra-high-speed terminal and each potential access point and random numbers , generate terminal access authentication confirmation message , according to the terminal access authentication confirmation message Verify the received terminal access authentication confirmation message If the verification is successful, the first ultra-high-speed terminal is successfully connected to the ground control center.

[0135] According to the above formula, if the verification is successful, it means the anonymous key and the anonymous key The values ​​are essentially the same, and the corresponding encryption keys and encryption keys , integrity protection key and integrity protection key , Message Verification Code and message verification code , Message Verification Code and message verification code , Terminal access authentication confirmation message and terminal access authentication confirmation message , the session key between the first ultra-high-speed terminal and the ground control center and the session key between the first ultra-high-speed terminal and the ground control center , the first ultra-high-speed terminal generated by the first ultra-high-speed terminal and the session key between potential access points and the first ultra-high-speed terminal generated by the first ultra-high-speed terminal and the first session key between potential access points and the first ultra-high-speed terminal and the Temporary identities between potential access points and the first ultra-high-speed terminal and the Temporary identities between potential access points The values ​​are essentially the same.

[0136] In the above access process, the ground control center can negotiate keys for the ultra-high-speed terminal and all access points on its track. After this process, the ground control center stores the information tuple corresponding to the first ultra-high-speed terminal. , each access point stores the corresponding information tuple , the first ultra-high-speed terminal side stores the information tuple That is, the session key is shared between the ultra-high-speed terminal and the access point, and the session key is shared between the ultra-high-speed terminal and the ground control center, thereby ensuring the security of the interactive data on the above channel.

[0137] This method realizes the flexible replacement of access points during the access process, without the need to be fully bound to a certain access point during the process, so that the access protocol can be successfully completed; and, based on the navigation plan and long-term shared keys, this method centrally completes the key negotiation and identity authentication between the ultra-high-speed terminal and multiple access points on the subsequent trajectory, so that the ultra-ultra-high-speed terminal does not need to frequently perform key negotiation and identity authentication. In addition, in order to protect the true identity of the ultra-high-speed terminal, this method also generates a temporary identity, which can protect the privacy of the terminal in the subsequent process. In terms of overhead, this method is mainly based on lightweight operations such as hashing, as well as a small amount of symmetric key encryption and decryption. The signaling overhead, computing overhead and bandwidth overhead are small, which is suitable for resource-constrained satellite communication systems.

[0138] Considering that after the ultra-high-speed terminal accesses the corresponding access point, it needs to quickly establish a communication connection with the access point. In addition, for satellite communications, near-space high-speed aircraft / drones, etc. are limited by the angle between the satellite antenna and the satellite coverage, which leads to problems such as communication quality, that is, intermittent communication connectivity. Based on this, in a possible implementation, when there is a shared session key between the first ultra-high-speed terminal and the currently accessed access point, The communication rapid establishment phase includes:

[0139] S501: The first ultra-high-speed terminal obtains the current timestamp , based on the current timestamp A shared session key between the first ultra-high-speed terminal and the currently accessed access point , determine the temporary encryption key and Temporary Integrity Protection Key .

[0140] The corresponding expression is:

[0141] .

[0142] S502: The first ultra-high-speed terminal calculates the current timestamp , Temporary Integrity Protection Key A temporary identity between the first ultra-high-speed terminal and the currently accessed access point , confirm the message verification code .

[0143] The corresponding expression is:

[0144] .

[0145] S503: The first ultra-high-speed terminal verifies the message verification code , Current timestamp A temporary identity between the first ultra-high-speed terminal and the currently accessed access point , generate terminal communication fast connection request , and the terminal communication fast connection request Sent to the currently connected access point.

[0146] The corresponding expression is:

[0147] .

[0148] S504: The currently accessed access point is based on the current timestamp A shared session key between the first ultra-high-speed terminal and the currently accessed access point , determine the temporary encryption key and Temporary Integrity Protection Key .

[0149] The corresponding expression is:

[0150] .

[0151] S505: The currently accessed access point uses a temporary integrity protection key , Current timestamp , a temporary identity between the first ultra-high-speed terminal and the currently accessed access point , generate a message verification code ; Use message verification code Verification message verification code If the verification is successful, the temporary integrity protection key is used , a temporary identity between the first ultra-high-speed terminal and the currently accessed access point and the current access point ID , generate a message verification code .

[0152] The corresponding expression is:

[0153] ,

[0154] .

[0155] S506: The currently accessed access point sends the message verification code As a terminal communication fast connection response, it is sent to the first super high speed terminal.

[0156] S507: The first ultra-high-speed terminal uses a temporary integrity protection key , a temporary identity between the first ultra-high-speed terminal and the currently accessed access point and the current access point ID , generate a message verification code ; Use message verification code Verification message verification code If the verification is successful, the identity authentication of the currently accessed access point is completed and a secure channel is established.

[0157] The corresponding expression is:

[0158] .

[0159] Furthermore, the rapid communication establishment phase also includes:

[0160] During the communication process, the first ultra-high-speed terminal generates a timestamp , using a temporary encryption key Encrypt the target message , get the ciphertext ; According to the ciphertext , Temporary Integrity Protection Key , Timestamp A temporary identity between the first ultra-high-speed terminal and the currently accessed access point , confirm the message verification code ; According to the message verification code 、Ciphertext , Timestamp A temporary identity between the first ultra-high-speed terminal and the currently accessed access point , generating the first message , and the first message Sent to the currently connected access point, the corresponding expression is:

[0161] ,

[0162] ,

[0163] ;

[0164] The currently accessed access point responds to the received first message , according to the ciphertext , Temporary Integrity Protection Key , Timestamp A temporary identity between the first ultra-high-speed terminal and the currently accessed access point , confirm the message verification code ; According to the message verification code Verification message verification code If the verification is successful, the temporary encryption key Decrypting ciphertext , get the target message .

[0165] The timestamp of the access point currently connected , using a temporary encryption key Encrypt the target message , get the ciphertext ; According to the ciphertext , Temporary Integrity Protection Key , Timestamp A temporary identity between the first ultra-high-speed terminal and the currently accessed access point , confirm the message verification code ; According to the message verification code 、Ciphertext , Timestamp A temporary identity between the first ultra-high-speed terminal and the currently accessed access point , generating the second message , and the second message Sent to the first ultra-high-speed terminal, the corresponding expression is:

[0166] ,

[0167] ,

[0168] ;

[0169] The first ultra-high-speed terminal responds to the received second message , according to the ciphertext , Temporary Integrity Protection Key , Timestamp A temporary identity between the first ultra-high-speed terminal and the currently accessed access point , confirm the message verification code ; According to the message verification code Verification message verification code If the verification is successful, the temporary encryption key Decrypting ciphertext , get the target message .

[0170] In the process of rapid communication establishment based on the shared session key and temporary identity, the update of the session key does not require the participation of the ground control center, which effectively reduces the delay of communication establishment.

[0171] Furthermore, when the ultra-high-speed terminal A communicates collaboratively with other terminal devices B, such as drones, special aircraft, or even other ultra-high-speed terminals, collaborative communication can be achieved through a collaborative authentication process between terminals.

[0172] Assume that the ultra-high-speed terminal A and terminal device B have accessed the ground control center through the access point and established a secure channel. In a possible implementation, if the ultra-high-speed terminal A and terminal device B use the same access point Access to the ground control center, the terminal coordination stage, specifically includes:

[0173] S601, ultra-high-speed terminal A to access point , send a collaboration request message.

[0174] S602, access point , according to the ultra-high-speed terminal A and the access point The session key between , terminal device B and access point The session key between , calculate the shared session key between ultra-high-speed terminal A and terminal device B ; and respectively transmit the shared session key through the corresponding secure channel Sent to ultra-high-speed terminal A and terminal device B.

[0175] The corresponding expression is:

[0176] ,

[0177] in, Indicates the terminal identity of the ultra-high-speed terminal A. Indicates the identity of terminal device B. Indicates access point The access point identity, Indicates a timestamp.

[0178] In a possible implementation, if ultra-high-speed terminal A passes through access point Access the ground control center, terminal device B through the access point Access to ground control center, access point and access point The coordination phase between terminals at different access points includes:

[0179] S701, ultra-high-speed terminal A to access point , send a collaboration request message.

[0180] S702, if the access point and access point There is a secure channel between the access points Access point through the corresponding secure channel Send cooperative reply message and timestamp , if the access point and access point There is no secure channel between the access points The ground control center sends the access point Send cooperative reply message and timestamp .

[0181] The corresponding expression is:

[0182] ,

[0183] in, Indicates ultra-high-speed terminal A and access point The session key between Indicates the terminal identity of the ultra-high-speed terminal A. Indicates access point The access point identity.

[0184] S703, Access Point Verify Timestamp If the verification is successful, the shared session key is calculated. .

[0185] The corresponding expression is:

[0186] ,

[0187] in, Indicates terminal device B and access point The session key between Indicates the identity of terminal device B. Indicates access point The access point identity.

[0188] S704, Access Point The shared session key Through the corresponding security channel, they are sent to the access point and terminal device B.

[0189] S705, Access Point The shared session key It is sent to ultra-high-speed terminal A through the corresponding secure channel.

[0190] This method flexibly and efficiently implements the establishment of secure channels between terminals at the same or different access points in response to the need for ultra-high-speed terminals to conduct collaborative communications with other terminal devices or even other ultra-high-speed terminals.

[0191] In summary, the present invention proposes an access authentication mechanism applicable to various types of terminals in satellite networks. The mechanism uses a large number of lightweight hashing, symmetric encryption operations and a small number of point multiplication operations, which is applicable to terminals with limited resources and can provide confidentiality, integrity, anonymity and other security protections; the present invention aims at the access authentication problem of terminals with ultra-high-speed characteristics in satellite networks, and proposes a lightweight access and collaborative authentication method. After being launched into space, the ultra-high-speed terminal will basically fly along the set route. Therefore, by using trajectory prediction, the ground control center can know the satellite it is about to access. At the same time, the session keys of the satellite and the terminal are derived from the ground control center. The satellite, as an access point, only plays a relay role. The change of the access point during the access authentication process can be realized, thereby solving the problem that the terminal deviates from the access point due to its ultra-high-speed characteristics during the access authentication process, resulting in access failure; the present invention uses a navigation plan and is based on a long-term shared key to negotiate session keys for the terminal and multiple access points respectively, avoiding the problem of frequent switching authentication faced by the terminal during subsequent ultra-high-speed movement, so that the terminal and the access point can directly use the negotiated key to communicate, avoiding the frequent execution of switching authentication; the present invention uses the hash value derived from the anonymous key or the real identity to generate a temporary identity, thereby protecting the identity information of the terminal and preventing linkable attacks. At the same time, this way of generating temporary identities enables the ground control center to retain the right to trace the real identity of the ultra-high-speed terminal. When the terminal exhibits malicious behavior, the real identity of the terminal can be locked through the temporary identity. The present invention fully considers the intermittent connection problem between the ultra-high-speed terminal and the satellite access point in the satellite network, and uses the negotiated session key to derive a new session key after the communication is quickly established, with few interaction rounds and low computing overhead. The present invention fully considers the communication needs of the ultra-high-speed terminal and other terminals, and the access point calculates the session key between the two terminals based on the session key between the terminal and the access point, and supports the scenarios of two terminals accessing the same access point and accessing different access points, with few interaction rounds and low computing overhead.

[0192] Safety analysis of the present invention:

[0193] (1) Mutual authentication and key negotiation: In the proposed method, the ultra-high-speed terminal and the ground control center complete identity authentication and key negotiation based on the long-term shared key and the public-private key pair of the ground control center. Specifically, the ground control center configures a long-term shared key for the ultra-high-speed terminal. When performing access authentication, the two parties use the public-private key pair of the ground control center to negotiate an anonymous key based on an elliptic curve through a key exchange algorithm. Then, they use the long-term shared key and the negotiated anonymous key to negotiate the encryption key and integrity protection key. The ultra-high-speed terminal and the ground control center use the negotiated integrity protection key to calculate the message authentication code to complete mutual identity authentication. The negotiated encryption key is used to derive the session key between the terminal and the ground control center to complete key negotiation. Then, the ground control center uses the session key between the ground control center and the ultra-high-speed terminal to derive the session key between the ultra-high-speed terminal and the access point to complete the key negotiation between the ultra-high-speed terminal and the access point. For the identity authentication of both parties, since the ground control center trusts the access point, the ultra-high-speed terminal trusts the corresponding access point based on its trust in the ground control center. The same is true for the access point.

[0194] (2) Identity anonymity: The ultra-high-speed terminal and the ground control center derive a synchronized anonymous key and obtain a temporary identity based on the real identity of the ultra-high-speed terminal and the anonymous key to protect the identity privacy of the terminal and retain the right to track the real identity of the terminal. In addition, the ground control center sends the temporary identity corresponding to the ultra-high-speed terminal to the corresponding access point so that the corresponding access point can retrieve the session key based on the temporary identity. At the same time, any entity other than the ground control center and the ultra-high-speed terminal cannot calculate the real identity of the ultra-high-speed terminal through the temporary identity.

[0195] (3) Key confirmation: During access authentication, the ultra-high-speed terminal and the ground control center use the integrity protection key to protect the integrity of the negotiated materials of the session key, that is, to generate the corresponding message authentication code, and complete the identity authentication and key confirmation at the same time. At the same time, during the rapid communication establishment phase, the ultra-high-speed terminal and the access point use the original session key to derive a temporary encryption key and a temporary integrity protection key. The temporary encryption key is used to ensure confidentiality, while the temporary integrity protection key is used to protect integrity, and key confirmation is completed at the same time. In the inter-terminal collaboration phase, since the session keys of both communication terminals are calculated and distributed by the access point, there is no need to confirm the key.

[0196] (4) Data integrity protection: The links of satellite networks are highly open and vulnerable to attacks such as eavesdropping, tampering and forgery. To ensure data integrity, integrity protection keys are used between ultra-high-speed terminals and access points during the access phase; temporary integrity protection keys are used between communication terminals during the rapid communication establishment phase to ensure data integrity.

[0197] (5) Anti-counterfeiting attack: If an attacker wants to launch a counterfeiting attack on the collaborative authentication mechanism, he needs to forge a message authentication code and a terminal access authentication response that can be verified by the ground control center. The confidentiality of these two messages depends on the long-term shared key between the ultra-high-speed terminal and the ground control center. Since the attacker cannot have a legitimate key, the counterfeiting attack is invalid for this protocol. The same is true for the communication rapid establishment process. The inter-terminal collaboration phase is carried out through the established secure channel, so it can achieve anti-counterfeiting attack.

[0198] (6) Anti-man-in-the-middle attack: Since attackers cannot forge message authentication codes and terminal access authentication responses that can be verified by ultra-high-speed terminals and ground control centers, man-in-the-middle attacks cannot be carried out. The inter-terminal collaboration phase is carried out through an established secure channel, so it can achieve anti-man-in-the-middle attack.

[0199] (7) Anti-replay attack: In the method provided by the present invention, all information transmitted through the public channel contains a timestamp to ensure its freshness, and all timestamps are integrity protected and cannot be tampered with, so the above protocol can resist replay attacks. The inter-terminal collaboration phase is carried out through the established secure channel, so it can achieve anti-replay attack.

[0200] (8) Perfect forward / backward confidentiality: In the method provided by the present invention, the session keys between different ultra-high-speed terminals and access points are derived from the session keys between the ultra-high-speed terminal and the ground control center. Based on the properties of the hash function, it is impossible to calculate the corresponding session key between the ultra-high-speed terminal and the ground control center from the session key between the ultra-high-speed terminal and the access point within polynomial time, and it is also impossible to derive the session keys between other ultra-high-speed terminals and access points that are legal and within the validity period. Furthermore, even if the long-term shared key is leaked, based on the difficulty in calculating the key exchange algorithm, the attacker cannot calculate the anonymous key within polynomial time, that is, it is impossible to calculate the session key between the ultra-high-speed terminal and the ground control center. In summary, perfect forward / backward confidentiality is achieved.

[0201] (9) Unlinkability: In the access authentication process, timestamps, random numbers, etc. are used, and the ultra-high-speed terminal will use different temporary identities when accessing different access points, making it impossible for attackers to determine whether two messages belong to the same user. Therefore, this method is unlinkable.

[0202] (10) Resistance to long-term shared key leakage attack: If an attacker obtains the long-term shared key, in order to calculate the session key between the ultra-high-speed terminal and the ground control center, it is necessary to calculate the encryption key. The long-term shared key and the anonymous key are both key calculation materials for the encryption key. The anonymous key is calculated from the intermediate variable and the private key determined by the ground control center. The attacker can obtain the intermediate variable through eavesdropping, but cannot obtain the private key of the ground control center. Therefore, it is still impossible to calculate the session key between the ultra-high-speed terminal and the ground control center, and it is also impossible to obtain the session key between the ultra-high-speed terminal and the access point derived from the session key between the ultra-high-speed terminal and the ground control center.

[0203] The present invention also provides a program product, which includes computer program instructions. When the computer program instructions are executed, the steps provided in the above method embodiment can be implemented.

[0204] As for the program product embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the specific contents and beneficial effects and other related matters can be referred to the partial description of the method embodiment.

[0205] The terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of the present invention, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0206] The above contents are further detailed descriptions of the present invention in combination with specific preferred embodiments, and it cannot be determined that the specific implementation of the present invention is limited to these descriptions. For ordinary technicians in the technical field to which the present invention belongs, several simple deductions or substitutions can be made without departing from the concept of the present invention, which should be regarded as falling within the protection scope of the present invention.

Claims

1. A method for ultra-high-speed terminal access and collaborative authentication in a satellite network, characterized in that: include: Registration stage: In response to the registration request sent by each access point and each ultra-high-speed terminal, the ground control center configures an access point identity for each access point, and configures a long-term shared key, a terminal identity, a master public key, a generator on an elliptic curve, and an index table for each ultra-high-speed terminal to complete the registration of each access point and each ultra-high-speed terminal, wherein the index table includes the access point identities of all access points; First access stage: when any first ultra-high-speed terminal among the ultra-high-speed terminals flies into the air and does not deviate from the coverage of the first access point during the access process, the first ultra-high-speed terminal sends an access authentication request to the ground control center through the first access point to complete the access authentication; Second access stage: when the first ultra-high-speed terminal flies into the air and is about to deviate from the coverage of the first access point during the access process, the first ultra-high-speed terminal sends an access authentication request to the ground control center through multiple access points on the route of the first ultra-high-speed terminal based on a preset flight plan, completes collaborative authentication to access the ground control center, and the flight plan includes the route and the time to fly to the corresponding position on the route; The second access stage specifically includes: The first ultra-high-speed terminal generates a random number and random numbers , according to the random number and the generators on the elliptic curve , generate intermediate variables ; Generate a timestamp based on the current time , according to the random number , the timestamp and the master public key configured by the ground control center for the first ultra-high-speed terminal , generate an anonymous key ; Use the anonymous key Encrypted by the terminal identity of the first ultra-high-speed terminal , the random number and access information The composed plaintext is obtained ; According to the long-term shared key configured by the ground control center for the first ultra-high-speed terminal and the anonymous key , derive the encryption key and integrity protection key ; Based on the integrity protection key and the random number , generate a message verification code ; According to the timestamp , the ciphertext , the message verification code and the intermediate variable , generate a second terminal access authentication request , and the second terminal access authentication request Send to the first access point currently accessed , the corresponding expression is: ， ， ， ， ， ， in, Indicates the second terminal access authentication request, operator represents the multiplication operation of points on the elliptic curve, Represents a hash operation, Indicates the use of anonymous keys Perform encryption operations. Indicates cascade; The first access point The corresponding access point identity Add the second terminal access authentication request , get the second access authentication request , the second access authentication request Sent to the ground control center, the corresponding expression is: ； The ground control center uses the master public key The corresponding master private key , the intermediate variable and the timestamp , generate an anonymous key ; According to the anonymous key , decrypt the second access authentication request The ciphertext in , and get the decryption result ; According to the long-term shared key and the anonymous key , generate encryption key and integrity protection key ; According to the random number and the integrity protection key , generate a message verification code ; Determine the second access authentication request Message verification code in With the message verification code Are they consistent? If so, then the access information obtained by decryption is used , determining the flight plan and speed information of the first ultra-high-speed terminal, and determining whether there is a second access point according to the flight plan and speed information of the first ultra-high-speed terminal , and based on the second access point The existence of the second access point determines the index information set corresponding to each potential access point. For the first access point Afterwards, during the access authentication process of the first ultra-high-speed terminal, the registered access points of the first ultra-high-speed terminal are always covered, and the potential access points are the registered access points that the first ultra-high-speed terminal can access during the operation along the route; generating a random number , according to the integrity protection key , the random number and the index information set corresponding to each of the potential access points, generate a target message verification code corresponding to each of the potential access points, and the corresponding expression is: ， ， ， ， ， in, Indicates the use of anonymous keys Perform decryption operation, Indicates A set of index information corresponding to potential access points, Indicates The target message verification code corresponding to the potential access points; The ground control center uses the encryption key , the terminal identity of the first ultra-high-speed terminal , the random number , the random number and the timestamp , generating a session key between the first ultra-high-speed terminal and the ground control center ; According to the session key , the terminal identity of the first ultra-high-speed terminal and The access point identities of the potential access points are used to generate session keys between the first ultra-high-speed terminal and each of the potential access points; and the anonymous key is used to generate session keys between the first ultra-high-speed terminal and each of the potential access points. , the terminal identity of the first ultra-high-speed terminal and the access point identity of each of the potential access points, to generate a temporary identity between the first ultra-high-speed terminal and each of the potential access points, and the corresponding expression is: ， ， ， in, represents the index of a potential access point, , represents the total number of potential access points, Indicates the first ultra-high-speed terminal generated by the ground control center and the The session key between potential access points, Indicates The access point identities of the potential access points, Indicates the first ultra-high-speed terminal generated by the ground control center and the Temporary identities between potential access points; The ground control center is based on the second access point generating and issuing a second access authentication response according to the index information set corresponding to each of the potential access points; The target potential access point that receives the target second access authentication response obtains a second terminal access authentication response according to the corresponding access point identity and the target second access authentication response, and sends the second terminal access authentication response to the first ultra-high-speed terminal, wherein the target second access authentication response is a second access authentication response in which the index information set included is a non-empty set; The first ultra-high-speed terminal responds to the second terminal access authentication response according to the random number , the integrity protection key and the index information set corresponding to the second terminal access authentication response, generating a message verification code ; Determine the message verification code whether the target message verification code corresponding to the second terminal access authentication response is consistent, and if so, generating a session key between the first ultra-high-speed terminal and the ground control center according to the access point identity information index of each potential access point contained in the second terminal access authentication response , a session key between the first ultra-high-speed terminal and each of the potential access points and a temporary identity between the first ultra-high-speed terminal and each of the potential access points; according to the session key between the first ultra-high-speed terminal and each of the potential access points, the random number and the random number , generating a sub-terminal access authentication confirmation message corresponding to each of the potential access points; generating a terminal access authentication confirmation message according to each of the sub-terminal access authentication confirmation messages , and the terminal access authentication confirmation message , is sent to any potential access point currently covering the first ultra-high-speed terminal, and the corresponding expression is: ， ， ， ， ， ， in, The first ultra-high-speed terminal determines that the first ultra-high-speed terminal is The session key between potential access points, The first ultra-high-speed terminal determines that the first ultra-high-speed terminal is Temporary identities between potential access points, Indicates The sub-terminal access authentication confirmation message corresponding to the potential access point, the operator Represents XOR operation; Receive the terminal access authentication confirmation message The potential access point of the terminal is added to the corresponding access point identity identifier in the terminal access authentication confirmation message In the example, an access authentication confirmation message is generated and sent to the ground control center. The corresponding expression is: ， in, Indicates Receive terminal access authentication confirmation message an access authentication confirmation message generated by a potential access point; The ground control center uses the session key between the first ultra-high-speed terminal and each of the potential access points, the random number and the random number , generate terminal access authentication confirmation message , according to the terminal access authentication confirmation message Verify the received terminal access authentication confirmation message If the verification is successful, the first ultra-high-speed terminal successfully accesses the ground control center; Wherein, based on the second access point and generating and issuing a second access authentication response according to the index information set corresponding to each of the potential access points, including: If the second access point exists , the ground control center determines the second access point The corresponding index information set is , except for the second access point The index information sets corresponding to all potential access points other than , a target message authentication code corresponding to each of the potential access points, a session key between the first ultra-high-speed terminal and each of the potential access points, a temporary identity between the first ultra-high-speed terminal and each of the potential access points, and an index information set corresponding to each of the potential access points, generating a second access authentication response corresponding to each of the potential access points, and distributing each of the second access authentication responses to each of the potential access points, the corresponding expression is: ， ， in, Indicates that it is sent to A second access authentication response from a potential access point, Indicates The access point identity information index of potential access points, Indicates the first ultra-high-speed terminal and the first Temporary identities between potential access points, Indicates A set of index information corresponding to potential access points, represents the empty set, Indicates the first ultra-high-speed terminal and the first session keys between potential access points; If the second access point does not exist The ground control center then uses the ephemeris of the ground control center to Select from among the potential access points potential access points, selected The potential access points include the access point currently accessed by the first ultra-high-speed terminal; determining the selected The index information sets corresponding to the potential access points are , except for the selected The index information sets corresponding to all potential access points other than the potential access points are empty sets; according to the random number , a target message verification code corresponding to each of the potential access points, a session key between the first ultra-high-speed terminal and each of the potential access points, a temporary identity between the first ultra-high-speed terminal and each of the potential access points, and an index information set corresponding to each of the potential access points, generating a second access authentication response corresponding to each of the potential access points, and distributing each of the second access authentication responses to each of the potential access points.

2. The method according to claim 1, characterized in that Also includes: Fast communication establishment phase: each of the ultra-high-speed terminals sends a terminal communication fast connection request to the currently accessed access point, and establishes a communication connection with the corresponding access point based on a response message from each of the currently accessed access points.

3. The method according to claim 2, characterized in that Also includes: Inter-terminal collaboration stage: After each of the ultra-high-speed terminals accesses the ground control center, collaborative authentication between terminals is completed through the access point accessed by other terminal devices, and a secure channel between terminals is established.

4. The method according to claim 3, characterized in that The first access stage specifically includes: The first ultra-high-speed terminal generates a random number and random numbers , according to the random number and generators on elliptic curves , generate intermediate variables ; Generate a timestamp based on the current time , according to the random number , the timestamp and the master public key configured by the ground control center for the first ultra-high-speed terminal , generate an anonymous key ; Use the anonymous key Encrypted by the terminal identity of the first ultra-high-speed terminal , the random number and access information The composed plaintext is obtained ; According to the long-term shared key configured by the ground control center for the first ultra-high-speed terminal and the anonymous key , derive the encryption key and integrity protection key ; Based on the integrity protection key and the random number , generate a message verification code ; According to the timestamp , the ciphertext , the message verification code and the intermediate variable , generating a first terminal access authentication request , and the first terminal access authentication request Send to first access point , the corresponding expression is: ， ， ， ， ， ， in, Indicates the first terminal access authentication request, operator represents the multiplication operation of points on the elliptic curve, Represents a hash operation, Indicates the use of anonymous keys Perform encryption operations. Indicates cascade, Indicates access information, including the flight plan and speed information of the first ultra-high-speed terminal; The first access point The corresponding access point identity Add the first terminal access authentication request , get the first access authentication request , and the first access authentication request Sent to the ground control center, the corresponding expression is: ； The ground control center checks the timestamp according to the current time The validity of the timestamp is valid, then according to the master public key The corresponding master private key , the intermediate variable and the timestamp , generate an anonymous key ; According to the anonymous key , decrypt the first access authentication request The ciphertext in , get the first decryption result ; According to the long-term shared key and the anonymous key , generate encryption key and integrity protection key ; According to the random number in the first decryption result and the integrity protection key , generate a message verification code ; Determine the first access authentication request Message verification code in With the message verification code Are they consistent? If so, generate a random number , according to the integrity protection key and the random number , generate a message verification code ; According to the message verification code and the random number , generate a first access authentication response , and the first access authentication response Send to the first access point , the corresponding expression is: ， ， ， ， ， ， in, Indicates the first access authentication response, Indicates the use of anonymous keys Perform decryption operation; The first access point The corresponding access point identity Add the first access authentication response , get the first terminal access authentication response , and the first terminal access authentication response Sent to the first ultra-high-speed terminal, the corresponding expression is: ； The first ultra-high-speed terminal determines the random number and the integrity protection key Generate message verification code ; Determine the message verification code With the message verification code Are they consistent? If so, then use the integrity protection key , the random number and the random number , generate terminal access authentication confirmation message , and the terminal access authentication confirmation message , sent to the first access point , the corresponding expression is: ， ； The first access point The terminal access authentication confirmation message , forwarded to the ground control center; The ground control center protects the integrity of the key , the random number and the random number , generate terminal access authentication confirmation message ; Determine the terminal access authentication confirmation message Access authentication confirmation message with the terminal Are they consistent? If so, then the encryption key , the terminal identity of the first ultra-high-speed terminal , the random number , the random number and the timestamp , generating a session key between the first ultra-high-speed terminal and the ground control center ; According to the session key , the terminal identity of the first ultra-high-speed terminal and the first access point Access point ID , generating the first ultra-high-speed terminal and the first access point The session key between ; According to the terminal identity of the first ultra-high-speed terminal , the anonymous key and the first access point Access point ID , generating the first ultra-high-speed terminal and the first access point Temporary status between ; The session key and said temporary identity , sent to the first access point , the corresponding expression is: ， ， ， ， Among them, the operator Represents XOR operation; The first ultra-high-speed terminal uses the encryption key , the terminal identity of the first ultra-high-speed terminal , the random number , the random number and the timestamp , generating a session key between the first ultra-high-speed terminal and the ground control center ; According to the session key , the terminal identity of the first ultra-high-speed terminal and the first access point Access point ID , generating the first ultra-high-speed terminal and the first access point The session key between ; According to the terminal identity of the first ultra-high-speed terminal , the anonymous key and the first access point Access point ID , generating the first ultra-high-speed terminal and the first access point Temporary status between , the corresponding expression is: ， ， 。 5. The method according to claim 4, characterized in that The communication rapid establishment phase specifically includes: The first ultra-high-speed terminal obtains the current timestamp , according to the current timestamp and a shared session key between the first ultra-high-speed terminal and the currently accessed access point , determine the temporary encryption key and Temporary Integrity Protection Key , the corresponding expression is: ； The first ultra-high-speed terminal determines the current timestamp according to the , the temporary integrity protection key and a temporary identity between the first ultra-high-speed terminal and the currently accessed access point , confirm the message verification code , the corresponding expression is: ； The first ultra-high-speed terminal verifies the message authentication code , the current timestamp and a temporary identity between the first ultra-high-speed terminal and the currently accessed access point , generate terminal communication fast connection request , and the terminal communication fast connection request Sent to the currently accessed access point, the corresponding expression is: ； The currently accessed access point is based on the current timestamp and a shared session key between the first ultra-high-speed terminal and the currently accessed access point , determine the temporary encryption key and Temporary Integrity Protection Key , the corresponding expression is: ； The currently accessed access point uses the temporary integrity protection key , the current timestamp and a temporary identity between the first ultra-high-speed terminal and the currently accessed access point , generate a message verification code ; Use the message verification code Verify the message verification code If the verification is successful, the temporary integrity protection key is used , a temporary identity between the first ultra-high-speed terminal and the currently accessed access point and the access point identity of the current access , generate a message verification code , the corresponding expression is: ， ； The currently accessed access point sends the message verification code sending it to the first ultra-high-speed terminal as a terminal communication fast connection response; The first ultra-high-speed terminal, based on the temporary integrity protection key , a temporary identity between the first ultra-high-speed terminal and the currently accessed access point and the access point identity of the current access , generate a message verification code ; Use the message verification code Verify the message verification code If the verification is successful, the identity authentication of the currently accessed access point is completed and a secure channel is established. The corresponding expression is: 。 6. The method according to claim 5, characterized in that Also includes: During the communication process, the first ultra-high-speed terminal generates a timestamp , using the temporary encryption key Encrypt the target message , get the ciphertext ; According to the ciphertext , the temporary integrity protection key , the timestamp and a temporary identity between the first ultra-high-speed terminal and the currently accessed access point , confirm the message verification code ; According to the message verification code , the ciphertext , the timestamp and a temporary identity between the first ultra-high-speed terminal and the currently accessed access point , generating the first message , and the first message Sent to the currently accessed access point, the corresponding expression is: ， ， ； The currently accessed access point responds to the received first message , according to the ciphertext , the temporary integrity protection key , the timestamp and a temporary identity between the first ultra-high-speed terminal and the currently accessed access point , confirm the message verification code ; According to the message verification code Verify the message verification code If the verification is successful, the temporary encryption key Decrypt the ciphertext , obtain the target message ; The access point currently accessed generates a timestamp , using the temporary encryption key Encrypt the target message , get the ciphertext ; According to the ciphertext , the temporary integrity protection key , the timestamp and a temporary identity between the first ultra-high-speed terminal and the currently accessed access point , confirm the message verification code ; According to the message verification code , the ciphertext , the timestamp and a temporary identity between the first ultra-high-speed terminal and the currently accessed access point , generating the second message and the second message Sent to the first ultra-high-speed terminal, the corresponding expression is: ， ， ； The first ultra-high-speed terminal responds to the received second message , according to the ciphertext , the temporary integrity protection key , the timestamp and a temporary identity between the first ultra-high-speed terminal and the currently accessed access point , confirm the message verification code ; According to the message verification code Verify the message verification code If the verification is successful, the temporary encryption key Decrypt the ciphertext , obtain the target message .

7. The method according to claim 6, characterized in that If ultra-high-speed terminal A and terminal device B pass through the same access point Accessing the ground control center, the inter-terminal coordination stage specifically includes: The ultra-high-speed terminal A sends a signal to the access point , send a collaboration request message; The access point , according to the ultra-high-speed terminal A and the access point The session key between , the terminal device B and the access point The session key between , calculate the shared session key between the ultra-high-speed terminal A and the terminal device B ; and respectively transmit the shared session key through the corresponding secure channel Sent to the ultra-high-speed terminal A and the terminal device B, the corresponding expression is: ， in, Indicates the terminal identity of the ultra-high-speed terminal A. Indicates the identity of terminal device B, Indicates access point The access point identity, Indicates a timestamp.

8. The method according to claim 6, characterized in that If ultra-high-speed terminal A passes through access point Access the ground control center, and the terminal device B passes the access point Access to the ground control center, the access point and the access point For different access points, the inter-terminal coordination stage specifically includes: The ultra-high-speed terminal A sends a signal to the access point , send a collaboration request message; If the access point and access point There is a secure channel between the access points to the access point through the corresponding secure channel Send cooperative reply message and timestamp , if the access point and the access point There is no secure channel between the access points The ground control center sends a signal to the access point Send the collaborative response message and the timestamp , the corresponding expression is: ， in, Indicates ultra-high-speed terminal A and access point The session key between Indicates the terminal identity of the ultra-high-speed terminal A. Indicates access point The access point identity of The access point Verify the timestamp If the verification is successful, the shared session key is calculated. , the corresponding expression is: ， in, Indicates terminal device B and access point The session key between Indicates the identity of terminal device B, Indicates access point The access point identity of The access point The shared session key Through the corresponding secure channel, they are sent to the access point and the terminal device B; The access point The shared session key It is sent to the ultra-high-speed terminal A through a corresponding secure channel.

9. A program product, characterized in that The program product comprises computer program instructions, and when the computer program instructions are executed, the method according to any one of claims 1 to 8 can be implemented.

Images