Authentication method and device and readable storage medium

Abstract

The invention discloses an authentication method and device and a readable storage medium, relates to the technical field of communication, and aims to realize authentication between a satellite system and a gateway station and reduce access delay. The method comprises the following steps: sending a registration request to a satellite system; an authentication request sent by the satellite system is received, and the authentication request is generated by the satellite system according to the registration request; and authenticating the satellite system according to the authentication request. According to the embodiment of the invention, the authentication between the satellite system and the gateway station can be realized, and the access time delay is reduced.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to an authentication method, device and readable storage medium. Background Art

[0002] The satellite feeder link refers to the communication link between the satellite system and the gateway (earth station). In the future 6G satellite-ground integrated network, many gateways may be set up around the world, and there may be a large number of mobile gateways to accommodate a variety of application scenarios. For these fixed or mobile gateways, satellite communication operators can manage them in a way similar to the Subscriber Identity Module (SIM) of a mobile phone to achieve two-way authentication between the gateway and the satellite. When using an authentication method similar to a SIM card, the typical approach is to require two-way authentication between the terrestrial core network and the mobile gateway, but this will involve a large delay and increase system overhead, and the time each gateway accesses a satellite is very short, so the traditional method may not be suitable.

[0003] Therefore, it is necessary to provide a solution for establishing a security association between a satellite and a gateway. Summary of the invention

[0004] The embodiments of the present application provide an authentication method, an apparatus, and a readable storage medium to implement authentication between a satellite system and a gateway station and reduce access delay.

[0005] In a first aspect, an embodiment of the present application provides an authentication method, which is applied to a gateway station, including:

[0006] Sending a registration request to a satellite system;

[0007] receiving an authentication request sent by the satellite system, wherein the authentication request is generated by the satellite system according to the registration request;

[0008] The satellite system is authenticated according to the authentication request.

[0009] Optionally, the method further includes:

[0010] Obtain a first key record from a core network device, wherein the first key record includes one or more of the following:

[0011] The key value of the authentication key;

[0012] Authentication key identifier;

[0013] Root key identifier;

[0014] Key generation parameters;

[0015] Validity period of authentication key;

[0016] Message authentication code.

[0017] Optionally, the registration request includes a gateway identifier, a gateway authentication key generation parameter, and a one-time value;

[0018] The gateway authentication key parameters include: a first authentication key identifier, a first root key identifier, a first key generation parameter, a first authentication key validity period, and a first message authentication code, wherein the first authentication key identifier, the first root key identifier, the first key generation parameter, the first authentication key validity period, and the first message authentication code are selected from the first key record.

[0019] Optionally, the authentication request includes a random number and an authentication token;

[0020] The authenticating the satellite system according to the authentication request comprises:

[0021] verifying the authentication token;

[0022] If the authentication token is verified, an authentication response is generated according to the random number, and the authentication response is sent to the satellite system.

[0023] In a second aspect, an embodiment of the present application provides an authentication method, which is applied to a satellite system, including:

[0024] Receive registration requests sent by the gateway;

[0025] Performing authentication according to the registration request, and generating an authentication request according to the authentication result;

[0026] The authentication request is sent to the gateway.

[0027] Optionally, the method further includes:

[0028] Obtain a second key record from a core network device, wherein the second key record includes one or more of the following:

[0029] The key value of the root key;

[0030] Root key identifier;

[0031] Key generation parameters;

[0032] Root key validity period;

[0033] Message authentication code to generate keys.

[0034] Optionally, the registration request includes a gateway identifier, a gateway authentication key generation parameter, and a one-time value;

[0035] The gateway authentication key parameters include: a first authentication key identifier, a first root key identifier, a first key generation parameter, a first authentication key validity period, and a first message authentication code, wherein the first authentication key identifier, the first root key identifier, the first key generation parameter, the first authentication key validity period, and the first message authentication code are selected from the first key record.

[0036] Optionally, performing authentication according to the registration request and generating an authentication request according to the authentication result includes:

[0037] authenticating a first root key corresponding to the first root key identifier;

[0038] If the authentication of the first root key is passed, authenticating the first message authentication code;

[0039] If the first message authentication code is authenticated, generating an authentication key according to the first root key, the first key generation parameter, and a second key generation parameter corresponding to the first root key;

[0040] generating an authentication vector according to the authentication key, the random number, and the one-time value, wherein the authentication vector includes the random number and an authentication token;

[0041] The authentication request is obtained according to the authentication vector, wherein the authentication request includes the random number and the authentication token.

[0042] Optionally, authenticating the first root key corresponding to the first root key identifier includes:

[0043] Verifying whether the first root key is within the root key validity period of the first root key;

[0044] and / or

[0045] The authenticating the first message authentication code includes:

[0046] The first message authentication code is authenticated according to the message authentication code generation key corresponding to the first root key, so as to determine the legitimacy of the first authentication key identifier, the first root key identifier, the first key generation parameter and the validity period of the first authentication key.

[0047] Optionally, the method further includes:

[0048] Acquire first key identification information from a core network device, wherein the first key identification information includes a root key identification that is permitted or prohibited from use; and / or

[0049] The gateway identification information is obtained from the core network device, wherein the gateway identification information includes an identification of a gateway to which access is prohibited.

[0050] Optionally, authenticating the first root key corresponding to the first root key identifier includes:

[0051] If it is determined that the gateway identifier is not located in the gateway identifier information, and / or if it is determined that the first root key corresponding to the first root key identifier is a root key identifier allowed for use in the first key identifier information, the first root key corresponding to the first root key identifier is authenticated.

[0052] Optionally, the method further includes:

[0053] Receiving an authentication response sent by the gateway;

[0054] verifying the authentication response;

[0055] If the authentication response is verified successfully, a key is generated.

[0056] In a third aspect, an embodiment of the present application provides an authentication method, which is applied to a core network device, including:

[0057] Sending a first key record to a gateway, wherein the first key record is used to obtain a registration request;

[0058] sending a second key record to the satellite system, wherein the second key record is used to obtain an authentication request;

[0059] The first key record includes one or more of the following:

[0060] The key value of the authentication key;

[0061] Authentication key identifier;

[0062] Root key identifier;

[0063] Key generation parameters;

[0064] Validity period of authentication key;

[0065] Message authentication code;

[0066] The second key record includes one or more of the following:

[0067] The key value of the root key;

[0068] Root key identifier;

[0069] Key generation parameters;

[0070] Root key validity period;

[0071] Message authentication code to generate keys.

[0072] In a fourth aspect, an embodiment of the present application provides an authentication device, which is applied to a gateway station, including: a memory, a transceiver, and a processor;

[0073] A memory for storing a computer program; a transceiver for transmitting and receiving data under the control of the processor; and a processor for reading the computer program in the memory and performing the following operations:

[0074] Sending a registration request to a satellite system;

[0075] receiving an authentication request sent by the satellite system, wherein the authentication request is generated by the satellite system according to the registration request;

[0076] The satellite system is authenticated according to the authentication request.

[0077] Optionally, the processor is further configured to read the computer program in the memory and perform the following operations:

[0078] Obtain a first key record from a core network device, wherein the first key record includes one or more of the following:

[0079] The key value of the authentication key;

[0080] Authentication key identifier;

[0081] Root key identifier;

[0082] Key generation parameters;

[0083] Validity period of authentication key;

[0084] Message authentication code.

[0085] Optionally, the registration request includes a gateway identifier, a gateway authentication key generation parameter, and a one-time value;

[0086] The gateway authentication key parameters include: a first authentication key identifier, a first root key identifier, a first key generation parameter, a first authentication key validity period, and a first message authentication code, wherein the first authentication key identifier, the first root key identifier, the first key generation parameter, the first authentication key validity period, and the first message authentication code are selected from the first key record.

[0087] Optionally, the authentication request includes a random number and an authentication token; and the processor is further configured to read a computer program in the memory and perform the following operations:

[0088] verifying the authentication token;

[0089] If the authentication token is verified, an authentication response is generated according to the random number, and the authentication response is sent to the satellite system.

[0090] In a fifth aspect, an embodiment of the present application provides an authentication device, which is applied to a satellite system, including: a memory, a transceiver, and a processor;

[0091] A memory for storing a computer program; a transceiver for transmitting and receiving data under the control of the processor; and a processor for reading the computer program in the memory and performing the following operations:

[0092] Receive registration requests sent by the gateway;

[0093] Performing authentication according to the registration request, and generating an authentication request according to the authentication result;

[0094] The authentication request is sent to the gateway.

[0095] Optionally, the processor is further configured to read the computer program in the memory and perform the following operations:

[0096] Obtain a second key record from a core network device, wherein the second key record includes one or more of the following:

[0097] The key value of the root key;

[0098] Root key identifier;

[0099] Key generation parameters;

[0100] Root key validity period;

[0101] Message authentication code to generate keys.

[0102] Optionally, the registration request includes a gateway identifier, a gateway authentication key generation parameter, and a one-time value;

[0103] The gateway authentication key parameters include: a first authentication key identifier, a first root key identifier, a first key generation parameter, a first authentication key validity period, and a first message authentication code, wherein the first authentication key identifier, the first root key identifier, the first key generation parameter, the first authentication key validity period, and the first message authentication code are selected from the first key record.

[0104] Optionally, the processor is further configured to read the computer program in the memory and perform the following operations:

[0105] authenticating a first root key corresponding to the first root key identifier;

[0106] If the authentication of the first root key is passed, authenticating the first message authentication code;

[0107] If the first message authentication code is authenticated, generating an authentication key according to the first root key, the first key generation parameter, and a second key generation parameter corresponding to the first root key;

[0108] generating an authentication vector according to the authentication key, the random number, and the one-time value, wherein the authentication vector includes the random number and an authentication token;

[0109] The authentication request is obtained according to the authentication vector, wherein the authentication request includes the random number and the authentication token.

[0110] Optionally, the processor is further configured to read the computer program in the memory and perform the following operations:

[0111] Verifying whether the first root key is within the root key validity period of the first root key; and / or

[0112] The first message authentication code is authenticated according to the message authentication code generation key corresponding to the first root key, so as to determine the legitimacy of the first authentication key identifier, the first root key identifier, the first key generation parameter and the validity period of the first authentication key.

[0113] Optionally, the processor is further configured to read the computer program in the memory and perform the following operations:

[0114] Acquire first key identification information from a core network device, wherein the first key identification information includes a root key identification that is permitted or prohibited from use; and / or

[0115] The gateway identification information is obtained from the core network device, wherein the gateway identification information includes an identification of a gateway to which access is prohibited.

[0116] Optionally, the processor is further configured to read the computer program in the memory and perform the following operations:

[0117] If it is determined that the gateway identifier is not located in the gateway identifier information, and / or if it is determined that the first root key corresponding to the first root key identifier is a root key identifier allowed for use in the first key identifier information, the first root key corresponding to the first root key identifier is authenticated.

[0118] Optionally, the processor is further configured to read the computer program in the memory and perform the following operations:

[0119] Receiving an authentication response sent by the gateway;

[0120] verifying the authentication response;

[0121] If the authentication response is verified successfully, a key is generated.

[0122] In a sixth aspect, an authentication device is characterized in that it is applied to a core network device, comprising: a memory, a transceiver, and a processor;

[0123] A memory for storing a computer program; a transceiver for transmitting and receiving data under the control of the processor; and a processor for reading the computer program in the memory and performing the following operations:

[0124] Sending a first key record to a gateway, wherein the first key record is used to obtain a registration request;

[0125] sending a second key record to the satellite system, wherein the second key record is used to obtain an authentication request;

[0126] The first key record includes one or more of the following:

[0127] The key value of the authentication key;

[0128] Authentication key identifier;

[0129] Root key identifier;

[0130] Key generation parameters;

[0131] Validity period of authentication key;

[0132] Message authentication code;

[0133] The second key record includes one or more of the following:

[0134] The key value of the root key;

[0135] Root key identifier;

[0136] Key generation parameters;

[0137] Root key validity period;

[0138] Message authentication code to generate keys.

[0139] In a seventh aspect, an embodiment of the present application provides an authentication device, which is applied to a gateway station, including:

[0140] A first sending unit, configured to send a registration request to a satellite system;

[0141] A first receiving unit, configured to receive an authentication request sent by the satellite system, wherein the authentication request is generated by the satellite system according to the registration request;

[0142] The first authentication unit is configured to authenticate the satellite system according to the authentication request.

[0143] In an eighth aspect, an embodiment of the present application provides an authentication device, which is applied to a satellite system, including:

[0144] A first receiving unit, configured to receive a registration request sent by a gateway;

[0145] A first authentication unit, configured to perform authentication according to the registration request and generate an authentication request according to the authentication result;

[0146] The first sending unit is configured to send the authentication request to the gateway.

[0147] In a ninth aspect, an embodiment of the present application provides an authentication device, which is applied to a core network device, including:

[0148] A first sending unit, configured to send a first key record to a gateway, wherein the first key record is used to obtain a registration request;

[0149] A second sending unit, configured to send a second key record to the satellite system, wherein the second key record is used to obtain an authentication request;

[0150] The first key record includes one or more of the following:

[0151] The key value of the authentication key;

[0152] Authentication key identifier;

[0153] Root key identifier;

[0154] Key generation parameters;

[0155] Validity period of authentication key;

[0156] Message authentication code;

[0157] The second key record includes one or more of the following:

[0158] The key value of the root key;

[0159] Root key identifier;

[0160] Key generation parameters;

[0161] Root key validity period;

[0162] Message authentication code to generate keys.

[0163] In the tenth aspect, an embodiment of the present application further provides a processor-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps in the authentication method as described above are implemented.

[0164] In the embodiment of the present application, direct authentication between the gateway and the satellite system can be achieved, thereby reducing the access delay of the gateway. BRIEF DESCRIPTION OF THE DRAWINGS

[0165] Figure 1 is a schematic diagram of a satellite feeder link security architecture in an embodiment of the present application;

[0166] Figure 2 This is one of the flow charts of the authentication method provided in the embodiment of the present application;

[0167] Figure 3 This is the second flowchart of the authentication method provided in the embodiment of the present application;

[0168] Figure 4 This is the third flowchart of the authentication method provided in the embodiment of the present application;

[0169] Figure 5 This is the fourth flowchart of the authentication method provided in the embodiment of the present application;

[0170] Figure 6 It is one of the structural diagrams of the authentication device provided in the embodiment of the present application;

[0171] Figure 7 This is the second structural diagram of the authentication device provided in the embodiment of the present application;

[0172] Figure 8 This is the third structural diagram of the authentication device provided in the embodiment of the present application;

[0173] Fig. 9 This is the fourth structural diagram of the authentication device provided in the embodiment of the present application;

[0174] Fig.10 This is the fifth structural diagram of the authentication device provided in the embodiment of the present application;

[0175] Fig.11 This is the sixth structural diagram of the authentication device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0176] In the embodiments of the present application, the term "and / or" describes the association relationship of the associated objects, indicating that three relationships may exist. For example, A and / or B may represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the associated objects before and after are in an "or" relationship.

[0177] In the embodiments of the present application, the term "plurality" refers to two or more than two, and other quantifiers are similar.

[0178] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0179] The embodiments of the present application provide an authentication method and device for implementing authentication between a satellite system and a gateway station and reducing access delay.

[0180] Among them, the method and the device are based on the same application concept. Since the method and the device solve the problem in a similar principle, the implementation of the device and the method can refer to each other, and the repeated parts will not be repeated.

[0181] like Figure 1 As shown, in an embodiment of the present application, a satellite feeder link security architecture is proposed. Through this architecture, the satellite system can independently authenticate the gateway station without going through the core network, and there is no need to store the authentication key of the gateway station. To this end, in an embodiment of the present application, a plurality of superior keys that can generate authentication keys for authenticating gateway stations are stored in the satellite system. The gateway station stores a plurality of gateway station authentication keys and corresponding key derivation materials. During authentication, the gateway station provides key derivation materials for generating the gateway station authentication key. The satellite system uses the key derivation materials provided by the gateway station and the key derivation materials stored locally to derive the gateway station authentication key, and then uses the key to generate an authentication vector and authenticate the gateway station.

[0182] Among them, this scheme is not only applicable to the patent scheme describing the authentication mechanism of 5G, but also applicable to the authentication mechanism based on 3G and 4G, and should be able to be extended to the authentication mechanism adopted by the future 6G satellite-ground integrated network.

[0183] Combination Figure 1 ,The functional entities and concepts in the satellite feeder link security architecture are described as follows:

[0184] Gateway 101: A special terminal with gateway capabilities. The gateway can complete two-way authentication with the satellite without the involvement of the terrestrial core network and establish a secure satellite feed connection.

[0185] Onboard gateway authentication function 102: used to store the root key from which the gateway authentication key can be derived, and can derive the gateway authentication key according to the parameters provided by the gateway and the parameters stored locally; generate the authentication vector for authenticating the gateway according to the parameters provided locally and by the gateway; interact with the gateway to complete the two-way authentication with the gateway, and generate the key for achieving power feeding security.

[0186] Satellite feed function 103: a functional entity in the satellite system that establishes feed communication with the gateway.

[0187] The gateway authentication key management function 104 provides the root key and related parameters from which the gateway authentication key can be derived to the onboard gateway authentication function. Generate a gateway authentication key for the gateway and provide the key and related parameters to the gateway.

[0188] Among them, the onboard gateway authentication function 102 and the satellite feed function 103 may be located in the satellite system, and the gateway authentication key management function 104 may be located in the core network. In actual applications, when performing authentication, the onboard gateway authentication function may perform authentication. In the embodiment of the present application, it is not limited in which device in the satellite system the onboard gateway authentication function is specifically set.

[0189] See also Figure 2 , Figure 2 is a flowchart of an authentication method provided in an embodiment of the present application, which is applied to a gateway station, such as Figure 2 As shown, the following steps are included:

[0190] Step 201: Send a registration request to a satellite system.

[0191] When a gateway station joins the system or needs to update the authentication key of the gateway station, the gateway station sends a registration request to the satellite system. The registration request includes the gateway station identifier, the gateway station authentication key generation parameter and the one-time value;

[0192] The gateway authentication key parameters include: a first authentication key identifier, a first root key identifier, a first key generation parameter, a first authentication key validity period, and a first message authentication code, wherein the first authentication key identifier, the first root key identifier, the first key generation parameter, the first authentication key validity period, and the first message authentication code are selected from the first key record.

[0193] The first key record may be pre-stored in the gateway, or may be obtained from a gateway authentication key management function located in a core network device.

[0194] The first key record includes one or more of the following:

[0195] The key value of the authentication key;

[0196] Authentication key identifier;

[0197] Root key identifier;

[0198] Key generation parameters, used to generate authentication keys;

[0199] Authentication key validity period, used to indicate the validity period of the authentication key;

[0200] Message authentication code. Used to protect the gateway authentication key parameters.

[0201] Of course, the content included in the first key record can be adjusted as needed.

[0202] Step 202: Receive an authentication request sent by the satellite system, wherein the authentication request is generated by the satellite system according to the registration request and includes a random number and an authentication token.

[0203] Step 203: Authenticate the satellite system according to the authentication request.

[0204] In this step, the gateway station can verify the authentication token. If the authentication token is verified, an authentication response (RES*) is generated according to the random number, and the authentication response is sent to the satellite system. Here, the specific authentication method of the authentication token by the gateway station is not limited.

[0205] In the embodiment of the present application, direct authentication between the gateway and the satellite system can be achieved, thereby reducing the access delay of the gateway.

[0206] See also Figure 3 , Figure 3 is a flow chart of the authentication method provided in the embodiment of the present application, which is applied to a satellite system, such as Figure 3 As shown, the following steps are included:

[0207] Step 301: Receive a registration request sent by a gateway.

[0208] Step 302: Perform authentication according to the registration request, and generate an authentication request according to the authentication result.

[0209] The registration request includes a gateway identifier, a gateway authentication key generation parameter, and a one-time value. The gateway authentication key parameters include: a first authentication key identifier, a first root key identifier, a first key generation parameter, a first authentication key validity period, and a first message authentication code, wherein the first authentication key identifier, the first root key identifier, the first key generation parameter, the first authentication key validity period, and the first message authentication code are selected from a first key record. The first key record is stored by the gateway, and may also be obtained from a gateway authentication key management function located in a core network device.

[0210] In this embodiment, the satellite system may pre-store the second key record, or obtain the second key record from a gateway authentication key management function located in a core network device. The second key record includes one or more of the following:

[0211] The key value of the root key;

[0212] Root key identifier;

[0213] Key generation parameters;

[0214] Root key validity period, used to indicate the validity period of the root key;

[0215] The message authentication code generates a key, which is used to verify the gateway authentication key parameters.

[0216] Of course, the content of the second key record can be adjusted as needed. Since the satellite stores the superior key from which the gateway authentication key can be derived, the satellite system does not need to store and manage a large amount of gateway authentication key information, thereby saving its storage space.

[0217] In this step, the satellite system may authenticate the first root key corresponding to the first root key identifier. Here, the satellite system may verify whether the first root key is within the root key validity period of the first root key according to the second key record. If it is within the validity period, that is, if the first root key is authenticated, the first message authentication code is authenticated.

[0218] Here, the satellite system authenticates the first message authentication code according to the message authentication code generation key corresponding to the first root key, so as to determine the legitimacy of the first authentication key identifier, the first root key identifier, the first key generation parameter and the validity period of the first authentication key.

[0219] If the first message authentication code is authenticated, the satellite system may generate an authentication key according to the first root key, the first key generation parameter, and a second key generation parameter corresponding to the first root key.

[0220] Afterwards, the satellite system generates an authentication vector according to the authentication key, the random number, and the one-time value, wherein the authentication vector includes the random number and an authentication token.

[0221] Then, the satellite system obtains the authentication request according to the authentication vector, wherein the authentication request includes the random number and the authentication token.

[0222] In an embodiment of the present application, the satellite system may obtain first key identification information from a core network device, wherein the first key identification information includes a root key identification that is allowed or prohibited from use. And / or, the satellite system may obtain gateway identification information from a core network device, wherein the gateway identification information includes an identification of a gateway that is prohibited from access.

[0223] Correspondingly, if it is determined that the gateway station identifier is not located in the gateway station identifier information (indicating that the gateway station is a gateway station allowed to access), and / or if it is determined that the first root key corresponding to the first root key identifier is a root key identifier allowed to be used in the first key identifier information, the satellite system authenticates the first root key corresponding to the first root key identifier.

[0224] Step 303: Send the authentication request to the information gateway.

[0225] In the embodiment of the present application, direct authentication between the gateway and the satellite system can be achieved, thereby reducing the access delay of the gateway.

[0226] Optionally, in the embodiment of the present application, the satellite system may also receive an authentication response sent by the gateway and verify the authentication response. If the authentication response is verified, a key is generated to continue the subsequent process.

[0227] See also Figure 4 , Figure 4 is a flowchart of the authentication method provided in the embodiment of the present application, which is applied to core network equipment, such as Figure 4 As shown, the following steps are included:

[0228] Step 401, sending a first key record to a gateway, wherein the first key record is used to obtain a registration request, and sending a second key record to a satellite system, wherein the second key record is used to obtain an authentication request;

[0229] The first key record includes one or more of the following:

[0230] The key value of the authentication key;

[0231] Authentication key identifier;

[0232] Root key identifier;

[0233] Key generation parameters;

[0234] Validity period of authentication key;

[0235] Message authentication code;

[0236] The second key record includes one or more of the following:

[0237] The key value of the root key;

[0238] Root key identifier;

[0239] Key generation parameters;

[0240] Root key validity period;

[0241] Message authentication code to generate keys.

[0242] For the explanation of the first key record and the second key record, reference may be made to the description of the aforementioned embodiment. The core network device may provide the above key record according to the request of the gateway or the satellite system, or may actively provide the above key record, which is not limited in the embodiments of the present application.

[0243] In the embodiment of the present application, direct authentication between the gateway and the satellite system can be achieved, thereby reducing the access delay of the gateway.

[0244] See also Figure 5 , Figure 5 It is a flow chart of the authentication method of the embodiment of the present application. It may include:

[0245] Step 501: The gateway authentication key management function provides a set of key records including a gateway authentication root key (Kroot) used to generate a gateway authentication key (Kauth) to the onboard gateway authentication function in the satellite. Each key record includes one or more of the following information:

[0246] The key value of the root key: the value of Kroot;

[0247] Root key identifier (Kroot-ID): uniquely identifies a Kroot;

[0248] Key generation parameter 1: One of the input parameters when using Kroot to derive the gateway authentication key. This parameter is uniquely associated with Kroot, saved by the satellite, and not provided to the gateway;

[0249] Root key validity period (Valid-Time): the validity period of Kroot;

[0250] Message Authentication Code Generation Key (Kmac): used to generate and verify whether the gateway authentication key generation information transmitted by the gateway through the air interface has been tampered with.

[0251] Step 502: When a new gateway joins the system or the gateway authentication key needs to be updated, the gateway authentication key management function generates a set of key records containing the gateway authentication key (Kauth) for the gateway. Each key record includes one or more of the following information:

[0252] Key value of authentication key: the value of Kauth. It is obtained by performing cryptographic operations on key generation parameters 1 and 2 using Kroot determined by the root key identifier (Kroot-ID). When deriving Kauth using Kroot, in addition to key generation parameters 1 and 2, there may be other input parameters, such as Kauth-ID, Kroot-ID, key validity period, etc. The specific parameters used depend on the system design;

[0253] Authentication key identifier (Kauth-ID): uniquely identifies a Kauth;

[0254] Root key identifier: the identifier (Kroot-ID) of the parent key (Kroot) used to derive Kauth;

[0255] Key generation parameter 2: One of the input parameters when using Kroot to derive the gateway authentication key. This parameter is unique to the gateway.

[0256] Authentication key validity period: the validity period of Kauth;

[0257] Message Authentication Code (MAC): used to protect the key generation information (Kauth-ID, Kroot-ID, key generation parameter 2, key validity period) transmitted by the gateway to the satellite over the air interface from being tampered with during transmission. The calculation of MAC can use the same method as the calculation of Kmac in the Kroot record.

[0258] Step 503: Optionally, the gateway authentication key management function provides the generated gateway authentication key record set to the gateway.

[0259] Step 504: Optionally, the gateway authentication key management function may provide the onboard gateway authentication function with a list of root key identifiers that are currently allowed or prohibited to be used.

[0260] Step 505: Optionally, the gateway authentication key management function may provide the onboard gateway authentication function with a list of identifications of gateways that are prohibited from access (ie, a blacklist). In this way, key management may be made more convenient.

[0261] Step 506: The gateway establishes a Radio Resource Control (RRC) connection with the satellite base station.

[0262] Step 507: When the gateway needs to establish a secure connection with the satellite, the gateway generates a one-time value Nonce. Nonce can be a value that changes according to a rule or a random number. The gateway, as a special terminal, initiates a registration request to the satellite base station. The registration request contains:

[0263] Gateway station logo;

[0264] Gateway authentication key generation parameters: (Kauth-ID, Kroot-ID, key generation parameter 2, key validity period, MAC);

[0265] Nonce.

[0266] Here, the gateway provides the Nonce value in plain text to replace the SQN value required for generating the authentication vector, thereby avoiding the problem caused by data synchronization.

[0267] Step 508: The onboard gateway authentication function performs the following operations:

[0268] 1) Use the gateway station ID to check whether the gateway station ID is in the gateway station blacklist. If it is in the blacklist, terminate this operation.

[0269] 2) Use Kroot-ID to determine the Kroot record to be used, determine whether the Kroot corresponding to the Kroot-ID is within the validity period, and use the root key identification list currently allowed or prohibited to be used to determine whether the Kroot corresponding to the Kroot-ID is in an activated state (i.e., whether it is usable). If the check fails, terminate this operation.

[0270] 3) Use the Kmac in the Kroot record to verify the MAC value in the message to determine whether the received (Kauth-ID, Kroot-ID, key generation parameter 2, key validity period) has been tampered with. If the verification fails, terminate this operation.

[0271] 4) Using Kroot corresponding to Kroot-ID, key generation parameter 1, received key generation parameter 2, and other possible key derivation parameters, Kauth is generated in the same way as the gateway authentication key management function.

[0272] 5) Generate a local random number RAND, and then use Kauth, Nonce (as the SQN value in the algorithm), RAND and other related parameters to generate a 5G authentication vector.

[0273] Step 509: The onboard gateway authentication function sends an authentication request to the gateway, which includes: RAND, AUTN.

[0274] Step 510: The gateway verifies AUTN and calculates the authentication response RES*.

[0275] Step 511: The gateway returns RES* via an authentication response. The onboard gateway authentication function verifies RES*.

[0276] Step 512: The onboard gateway authentication function and the gateway calculate Kseaf, Kamf, and KgNB respectively.

[0277] Step 513: The onboard gateway authentication function provides the KgNB to the satellite feeding function.

[0278] Step 514: The satellite feed function and the gateway perform access stratum (AS) security mode control (SMC).

[0279] Optionally, during actual deployment, the onboard gateway authentication function can be split into two or more functional entities according to actual deployment needs. For example, the functions implemented by the onboard gateway authentication function can be split into an onboard key management function and an onboard authentication function. Among them, the onboard key management function is responsible for the storage of the gateway authentication root key, MAC verification and key derivation and authentication vector generation (such as steps 501 to 508, etc.), and the onboard authentication function is responsible for using the authentication vector to interact with the gateway, complete the authentication of the gateway and the subsequent key derivation and issuance functions (such as steps 509 to 514, etc.).

[0280] The technical solution provided in the embodiment of the present application can be applicable to a variety of systems, especially 5G systems. For example, the applicable system can be a global system of mobile communication (GSM) system, a code division multiple access (CDMA) system, a wideband code division multiple access (WCDMA) general packet radio service (GPRS) system, a long term evolution (LTE) system, a LTE frequency division duplex (FDD) system, a LTE time division duplex (TDD) system, an advanced long term evolution (LTE-A) system, a universal mobile telecommunication system (UMTS), a world-wide interoperability for microwave access (WiMAX) system, a 5G new air interface (NR) system, etc. These various systems include terminal equipment and network equipment. The system may also include a core network part, such as an evolved packet system (EPS), a 5G system (5GS), etc.

[0281] like Figure 6 As shown, the authentication device of the embodiment of the present application is applied to a gateway station, including: a processor 600, which is used to read the program in the memory 620 and execute the following process:

[0282] Sending a registration request to a satellite system;

[0283] receiving an authentication request sent by the satellite system, wherein the authentication request is generated by the satellite system according to the registration request;

[0284] The satellite system is authenticated according to the authentication request.

[0285] The transceiver 610 is configured to receive and send data under the control of the processor 600 .

[0286] Among them, Figure 6In the embodiment, the bus architecture may include any number of interconnected buses and bridges, specifically linking various circuits of one or more processors represented by processor 600 and memory represented by memory 620. The bus architecture may also link various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface. The transceiver 610 may be a plurality of components, i.e., including a transmitter and a receiver, providing a unit for communicating with various other devices on a transmission medium. The processor 600 is responsible for managing the bus architecture and general processing, and the memory 620 may store data used by the processor 600 when performing operations.

[0287] The processor 600 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or a complex programmable logic device (CPLD). The processor may also adopt a multi-core architecture.

[0288] The processor 600 is responsible for managing the bus architecture and general processing, and the memory 620 can store data used by the processor 600 when performing operations.

[0289] The processor 600 is further configured to read the program and execute the following steps:

[0290] Obtain a first key record from a core network device, wherein the first key record includes one or more of the following:

[0291] The key value of the authentication key;

[0292] Authentication key identifier;

[0293] Root key identifier;

[0294] Key generation parameters;

[0295] Validity period of authentication key;

[0296] Message authentication code.

[0297] Optionally, the registration request includes a gateway identifier, a gateway authentication key generation parameter, and a one-time value;

[0298] The gateway authentication key parameters include: a first authentication key identifier, a first root key identifier, a first key generation parameter, a first authentication key validity period, and a first message authentication code, wherein the first authentication key identifier, the first root key identifier, the first key generation parameter, the first authentication key validity period, and the first message authentication code are selected from the first key record.

[0299] Optionally, the authentication request includes a random number and an authentication token;

[0300] The processor 600 is further configured to read the program and execute the following steps:

[0301] verifying the authentication token;

[0302] If the authentication token is verified, an authentication response is generated according to the random number, and the authentication response is sent to the satellite system.

[0303] It should be noted here that the above-mentioned device provided in the embodiment of the present application can implement all the method steps implemented in the above-mentioned method embodiment, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as those in the method embodiment will not be described in detail here.

[0304] like Figure 7 As shown, the authentication device of the embodiment of the present application is applied to a satellite system, including: a processor 700, which is used to read the program in the memory 720 and execute the following process:

[0305] Receive registration requests sent by the gateway;

[0306] Performing authentication according to the registration request, and generating an authentication request according to the authentication result;

[0307] The authentication request is sent to the gateway.

[0308] The transceiver 710 is configured to receive and send data under the control of the processor 700 .

[0309] Among them, Figure 7In the embodiment, the bus architecture may include any number of interconnected buses and bridges, specifically linking together various circuits of one or more processors represented by processor 700 and memory represented by memory 720. The bus architecture may also link together various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface. The transceiver 710 may be a plurality of components, namely, a transmitter and a receiver, providing a unit for communicating with various other devices on a transmission medium. The processor 700 is responsible for managing the bus architecture and general processing, and the memory 720 may store data used by the processor 700 when performing operations.

[0310] The processor 700 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or a complex programmable logic device (CPLD). The processor may also adopt a multi-core architecture.

[0311] The processor 700 is responsible for managing the bus architecture and general processing, and the memory 720 can store data used by the processor 700 when performing operations.

[0312] The processor 700 is further configured to read the program and execute the following steps:

[0313] Obtain a second key record from a core network device, wherein the second key record includes one or more of the following:

[0314] The key value of the root key;

[0315] Root key identifier;

[0316] Key generation parameters;

[0317] Root key validity period;

[0318] Message authentication code to generate keys.

[0319] Optionally, the registration request includes a gateway identifier, a gateway authentication key generation parameter, and a one-time value;

[0320] The gateway authentication key parameters include: a first authentication key identifier, a first root key identifier, a first key generation parameter, a first authentication key validity period, and a first message authentication code, wherein the first authentication key identifier, the first root key identifier, the first key generation parameter, the first authentication key validity period, and the first message authentication code are selected from the first key record.

[0321] The processor 700 is further configured to read the program and execute the following steps:

[0322] authenticating a first root key corresponding to the first root key identifier;

[0323] If the authentication of the first root key is passed, authenticating the first message authentication code;

[0324] If the first message authentication code is authenticated, generating an authentication key according to the first root key, the first key generation parameter, and a second key generation parameter corresponding to the first root key;

[0325] generating an authentication vector according to the authentication key, the random number, and the one-time value, wherein the authentication vector includes the random number and an authentication token;

[0326] The authentication request is obtained according to the authentication vector, wherein the authentication request includes the random number and the authentication token.

[0327] The processor 700 is further configured to read the program and execute the following steps:

[0328] Verifying whether the first root key is within the root key validity period of the first root key;

[0329] and / or

[0330] The first message authentication code is authenticated according to the message authentication code generation key corresponding to the first root key, so as to determine the legitimacy of the first authentication key identifier, the first root key identifier, the first key generation parameter and the validity period of the first authentication key.

[0331] The processor 700 is further configured to read the program and execute the following steps:

[0332] Acquire first key identification information from a core network device, wherein the first key identification information includes a root key identification that is permitted or prohibited from use; and / or

[0333] The gateway identification information is obtained from the core network device, wherein the gateway identification information includes an identification of a gateway to which access is prohibited.

[0334] The processor 700 is further configured to read the program and execute the following steps:

[0335] If it is determined that the gateway identifier is not located in the gateway identifier information, and / or if it is determined that the first root key corresponding to the first root key identifier is a root key identifier allowed for use in the first key identifier information, the first root key corresponding to the first root key identifier is authenticated.

[0336] The processor 700 is further configured to read the program and execute the following steps:

[0337] Receiving an authentication response sent by the gateway;

[0338] verifying the authentication response;

[0339] If the authentication response is verified successfully, a key is generated.

[0340] It should be noted here that the above-mentioned device provided in the embodiment of the present application can implement all the method steps implemented in the above-mentioned method embodiment, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as those in the method embodiment will not be described in detail here.

[0341] like Figure 8 As shown, the authentication device of the embodiment of the present application is applied to a core network device, including: a processor 800, which is used to read the program in the memory 820 and execute the following process:

[0342] Sending a first key record to a gateway, wherein the first key record is used to obtain a registration request;

[0343] sending a second key record to the satellite system, wherein the second key record is used to obtain an authentication request;

[0344] The first key record includes one or more of the following:

[0345] The key value of the authentication key;

[0346] Authentication key identifier;

[0347] Root key identifier;

[0348] Key generation parameters;

[0349] Validity period of authentication key;

[0350] Message authentication code;

[0351] The second key record includes one or more of the following:

[0352] The key value of the root key;

[0353] Root key identifier;

[0354] Key generation parameters;

[0355] Root key validity period;

[0356] Message authentication code to generate keys.

[0357] The transceiver 810 is configured to receive and send data under the control of the processor 800 .

[0358] Among them, Figure 8 In the embodiment, the bus architecture may include any number of interconnected buses and bridges, specifically linking together various circuits of one or more processors represented by processor 800 and memory represented by memory 820. The bus architecture may also link together various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface. The transceiver 810 may be a plurality of components, namely, a transmitter and a receiver, providing a unit for communicating with various other devices on a transmission medium. The processor 800 is responsible for managing the bus architecture and general processing, and the memory 820 may store data used by the processor 800 when performing operations.

[0359] The processor 800 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or a complex programmable logic device (CPLD). The processor may also adopt a multi-core architecture.

[0360] The processor 800 is responsible for managing the bus architecture and general processing, and the memory 820 can store data used by the processor 800 when performing operations.

[0361] It should be noted here that the above-mentioned device provided in the embodiment of the present application can implement all the method steps implemented in the above-mentioned method embodiment, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as those in the method embodiment will not be described in detail here.

[0362] like Fig. 9 As shown, the authentication device of the embodiment of the present application is applied to a gateway station, including:

[0363] The first sending unit 901 is used to send a registration request to a satellite system; the first receiving unit 902 is used to receive an authentication request sent by the satellite system, wherein the authentication request is generated by the satellite system according to the registration request; the first authentication unit 903 is used to authenticate the satellite system according to the authentication request.

[0364] Optionally, the device may further include:

[0365] A second receiving unit is configured to obtain a first key record from a core network device, wherein the first key record includes one or more of the following:

[0366] The key value of the authentication key;

[0367] Authentication key identifier;

[0368] Root key identifier;

[0369] Key generation parameters;

[0370] Validity period of authentication key;

[0371] Message authentication code.

[0372] Optionally, the registration request includes a gateway identifier, a gateway authentication key generation parameter, and a one-time value;

[0373] The gateway authentication key parameters include: a first authentication key identifier, a first root key identifier, a first key generation parameter, a first authentication key validity period, and a first message authentication code, wherein the first authentication key identifier, the first root key identifier, the first key generation parameter, the first authentication key validity period, and the first message authentication code are selected from the first key record.

[0374] Optionally, the authentication request includes a random number and an authentication token; the first authentication unit is further configured to:

[0375] verifying the authentication token;

[0376] If the authentication token is verified, an authentication response is generated according to the random number, and the authentication response is sent to the satellite system.

[0377] It should be noted here that the above-mentioned device provided in the embodiment of the present application can implement all the method steps implemented in the above-mentioned method embodiment, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as those in the method embodiment will not be described in detail here.

[0378] like Fig.10 As shown, the authentication device of the embodiment of the present application is applied to a satellite system, including:

[0379] The first receiving unit 1001 is used to receive a registration request sent by a gateway; the first authentication unit 1002 is used to perform authentication according to the registration request and generate an authentication request according to the authentication result; the first sending unit 1003 is used to send the authentication request to the gateway.

[0380] Optionally, the device may further include:

[0381] A first acquiring unit is configured to acquire a second key record from a core network device, wherein the second key record includes one or more of the following:

[0382] The key value of the root key;

[0383] Root key identifier;

[0384] Key generation parameters;

[0385] Root key validity period;

[0386] Message authentication code to generate keys.

[0387] Optionally, the registration request includes a gateway identifier, a gateway authentication key generation parameter, and a one-time value;

[0388] The gateway authentication key parameters include: a first authentication key identifier, a first root key identifier, a first key generation parameter, a first authentication key validity period, and a first message authentication code, wherein the first authentication key identifier, the first root key identifier, the first key generation parameter, the first authentication key validity period, and the first message authentication code are selected from the first key record.

[0389] Optionally, the first authentication unit is further used for:

[0390] authenticating a first root key corresponding to the first root key identifier;

[0391] If the authentication of the first root key is passed, authenticating the first message authentication code;

[0392] If the first message authentication code is authenticated, generating an authentication key according to the first root key, the first key generation parameter, and a second key generation parameter corresponding to the first root key;

[0393] generating an authentication vector according to the authentication key, the random number, and the one-time value, wherein the authentication vector includes the random number and an authentication token;

[0394] The authentication request is obtained according to the authentication vector, wherein the authentication request includes the random number and the authentication token.

[0395] Optionally, the first authentication unit is further used for:

[0396] Verifying whether the first root key is within the root key validity period of the first root key;

[0397] and / or

[0398] The first message authentication code is authenticated according to the message authentication code generation key corresponding to the first root key, so as to determine the legitimacy of the first authentication key identifier, the first root key identifier, the first key generation parameter and the validity period of the first authentication key.

[0399] Optionally, the device further comprises:

[0400] The second acquisition unit is used for:

[0401] Acquire first key identification information from a core network device, wherein the first key identification information includes a root key identification that is permitted or prohibited from use; and / or

[0402] The gateway identification information is obtained from the core network device, wherein the gateway identification information includes an identification of a gateway to which access is prohibited.

[0403] Optionally, the first authentication unit is further used for:

[0404] If it is determined that the gateway identifier is not located in the gateway identifier information, and / or if it is determined that the first root key corresponding to the first root key identifier is a root key identifier allowed for use in the first key identifier information, the first root key corresponding to the first root key identifier is authenticated.

[0405] Optionally, the device further comprises:

[0406] A second receiving unit, configured to receive an authentication response sent by the gateway;

[0407] A first verification unit, used to verify the authentication response;

[0408] The second sending unit is used to generate a key if the verification of the authentication response is successful.

[0409] It should be noted here that the above-mentioned device provided in the embodiment of the present application can implement all the method steps implemented in the above-mentioned method embodiment, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as those in the method embodiment will not be described in detail here.

[0410] like Fig.11 As shown, the authentication device of the embodiment of the present application is applied to a core network device, including:

[0411] The first sending unit 1101 is configured to send a first key record to a gateway, wherein the first key record is used to obtain a registration request; and to send a second key record to a satellite system, wherein the second key record is used to obtain an authentication request;

[0412] The first key record includes one or more of the following:

[0413] The key value of the authentication key;

[0414] Authentication key identifier;

[0415] Root key identifier;

[0416] Key generation parameters;

[0417] Validity period of authentication key;

[0418] Message authentication code;

[0419] The second key record includes one or more of the following:

[0420] The key value of the root key;

[0421] Root key identifier;

[0422] Key generation parameters;

[0423] Root key validity period;

[0424] Message authentication code to generate keys.

[0425] It should be noted here that the above-mentioned device provided in the embodiment of the present application can implement all the method steps implemented in the above-mentioned method embodiment, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as those in the method embodiment will not be described in detail here.

[0426] It should be noted that the division of units in the embodiments of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation. In addition, each functional unit in each embodiment of the present application may be integrated into a processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0427] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a processor-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) or a processor (processor) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), disk or optical disk and other media that can store program codes.

[0428] An embodiment of the present application also provides a communication device, including: a memory, a processor, and a program stored in the memory and executable on the processor, wherein the processor implements the steps in the authentication method described above when executing the program.

[0429] The embodiment of the present application also provides a processor-readable storage medium, on which a program is stored. When the program is executed by the processor, each process of the above-mentioned authentication method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it is not repeated here. Among them, the readable storage medium can be any available medium or data storage device that can be accessed by the processor, including but not limited to magnetic storage (such as floppy disk, hard disk, magnetic tape, magneto-optical disk (MO), etc.), optical storage (such as CD, DVD, BD, HVD, etc.), and semiconductor storage (such as ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid-state drive (SSD)), etc.

[0430] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0431] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, disk, CD), and includes a number of instructions for a terminal (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0432] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

Claims

1. An authentication method, characterized in that: Applied to gateway stations, including: Sending a registration request to a satellite system; receiving an authentication request sent by the satellite system, wherein the authentication request is generated by the satellite system according to the registration request; The satellite system is authenticated according to the authentication request.

2. The method according to claim 1, characterized in that The method further comprises: Obtain a first key record from a core network device, wherein the first key record includes one or more of the following: The key value of the authentication key; Authentication key identifier; Root key identifier; Key generation parameters; Validity period of authentication key; Message authentication code.

3. The method according to claim 2, characterized in that The registration request includes a gateway identifier, a gateway authentication key generation parameter, and a one-time value; The gateway authentication key parameters include: a first authentication key identifier, a first root key identifier, a first key generation parameter, a first authentication key validity period, and a first message authentication code, wherein the first authentication key identifier, the first root key identifier, the first key generation parameter, the first authentication key validity period, and the first message authentication code are selected from the first key record.

4. The method according to claim 1, characterized in that The authentication request includes a random number and an authentication token; The authenticating the satellite system according to the authentication request comprises: verifying the authentication token; If the authentication token is verified, an authentication response is generated according to the random number, and the authentication response is sent to the satellite system.

5. An authentication method, characterized in that: Applications in satellite systems, including: Receive registration requests sent by the gateway; Performing authentication according to the registration request, and generating an authentication request according to the authentication result; The authentication request is sent to the gateway.

6. The method according to claim 5, characterized in that The method further comprises: Obtain a second key record from a core network device, wherein the second key record includes one or more of the following: The key value of the root key; Root key identifier; Key generation parameters; Root key validity period; Message authentication code to generate keys.

7. The method according to claim 5 or 6, characterized in that: The registration request includes a gateway identifier, a gateway authentication key generation parameter, and a one-time value; The gateway authentication key parameters include: a first authentication key identifier, a first root key identifier, a first key generation parameter, a first authentication key validity period, and a first message authentication code, wherein the first authentication key identifier, the first root key identifier, the first key generation parameter, the first authentication key validity period, and the first message authentication code are selected from the first key record.

8. The method according to claim 7, characterized in that The performing authentication according to the registration request and generating an authentication request according to the authentication result includes: authenticating a first root key corresponding to the first root key identifier; If the authentication of the first root key is passed, authenticating the first message authentication code; If the first message authentication code is authenticated, generating an authentication key according to the first root key, the first key generation parameter, and a second key generation parameter corresponding to the first root key; generating an authentication vector according to the authentication key, the random number, and the one-time value, wherein the authentication vector includes the random number and an authentication token; The authentication request is obtained according to the authentication vector, wherein the authentication request includes the random number and the authentication token.

9. The method according to claim 8, characterized in that The authenticating the first root key corresponding to the first root key identifier includes: Verifying whether the first root key is within the root key validity period of the first root key; and / or The authenticating the first message authentication code includes: The first message authentication code is authenticated according to the message authentication code generation key corresponding to the first root key, so as to determine the legitimacy of the first authentication key identifier, the first root key identifier, the first key generation parameter and the validity period of the first authentication key.

10. The method according to claim 8, characterized in that The method further comprises: Acquire first key identification information from a core network device, wherein the first key identification information includes a root key identification that is permitted or prohibited from use; and / or The gateway identification information is obtained from the core network device, wherein the gateway identification information includes an identification of a gateway to which access is prohibited.

11. The method according to claim 10, characterized in that The authenticating the first root key corresponding to the first root key identifier includes: If it is determined that the gateway identifier is not located in the gateway identifier information, and / or if it is determined that the first root key corresponding to the first root key identifier is a root key identifier allowed for use in the first key identifier information, the first root key corresponding to the first root key identifier is authenticated.

12. The method according to claim 5, characterized in that The method further comprises: Receiving an authentication response sent by the gateway; verifying the authentication response; If the authentication response is verified successfully, a key is generated.

13. An authentication method, characterized in that: Applied to core network equipment, including: Sending a first key record to a gateway, wherein the first key record is used to obtain a registration request; sending a second key record to the satellite system, wherein the second key record is used to obtain an authentication request; The first key record includes one or more of the following: The key value of the authentication key; Authentication key identifier; Root key identifier; Key generation parameters; Validity period of authentication key; Message authentication code; The second key record includes one or more of the following: The key value of the root key; Root key identifier; Key generation parameters; Root key validity period; Message authentication code to generate keys.

14. An authentication device, characterized in that: Applied to gateway stations, including: memory, transceiver, processor; A memory for storing a computer program; a transceiver for transmitting and receiving data under the control of the processor; and a processor for reading the computer program in the memory and performing the following operations: Sending a registration request to a satellite system; receiving an authentication request sent by the satellite system, wherein the authentication request is generated by the satellite system according to the registration request; The satellite system is authenticated according to the authentication request.

15. The device according to claim 14, characterized in that The processor is further configured to read the computer program in the memory and perform the following operations: Obtain a first key record from a core network device, wherein the first key record includes one or more of the following: The key value of the authentication key; Authentication key identifier; Root key identifier; Key generation parameters; Validity period of authentication key; Message authentication code.

16. The device according to claim 15, characterized in that The registration request includes a gateway identifier, a gateway authentication key generation parameter, and a one-time value; The gateway authentication key parameters include: a first authentication key identifier, a first root key identifier, a first key generation parameter, a first authentication key validity period, and a first message authentication code, wherein the first authentication key identifier, the first root key identifier, the first key generation parameter, the first authentication key validity period, and the first message authentication code are selected from the first key record.

17. The device according to claim 14, characterized in that The authentication request includes a random number and an authentication token; the processor is further configured to read the computer program in the memory and perform the following operations: verifying the authentication token; If the authentication token is verified, an authentication response is generated according to the random number, and the authentication response is sent to the satellite system.

18. An authentication device, characterized in that: Applied to satellite systems, including: memory, transceiver, processor; A memory for storing a computer program; a transceiver for transmitting and receiving data under the control of the processor; and a processor for reading the computer program in the memory and performing the following operations: Receive registration requests sent by the gateway; Performing authentication according to the registration request, and generating an authentication request according to the authentication result; The authentication request is sent to the gateway.

19. The device according to claim 18, characterized in that The processor is further configured to read the computer program in the memory and perform the following operations: Obtain a second key record from a core network device, wherein the second key record includes one or more of the following: The key value of the root key; Root key identifier; Key generation parameters; Root key validity period; Message authentication code to generate keys.

20. The device according to claim 18 or 19, characterized in that The registration request includes a gateway identifier, a gateway authentication key generation parameter, and a one-time value; The gateway authentication key parameters include: a first authentication key identifier, a first root key identifier, a first key generation parameter, a first authentication key validity period, and a first message authentication code, wherein the first authentication key identifier, the first root key identifier, the first key generation parameter, the first authentication key validity period, and the first message authentication code are selected from the first key record.

21. The device according to claim 20, characterized in that The processor is further configured to read the computer program in the memory and perform the following operations: authenticating a first root key corresponding to the first root key identifier; If the authentication of the first root key is passed, authenticating the first message authentication code; If the first message authentication code is authenticated, generating an authentication key according to the first root key, the first key generation parameter, and a second key generation parameter corresponding to the first root key; generating an authentication vector according to the authentication key, the random number, and the one-time value, wherein the authentication vector includes the random number and an authentication token; The authentication request is obtained according to the authentication vector, wherein the authentication request includes the random number and the authentication token.

22. The device according to claim 21, characterized in that The processor is further configured to read the computer program in the memory and perform the following operations: Verifying whether the first root key is within the root key validity period of the first root key; and / or The first message authentication code is authenticated according to the message authentication code generation key corresponding to the first root key, so as to determine the legitimacy of the first authentication key identifier, the first root key identifier, the first key generation parameter and the validity period of the first authentication key.

23. The device according to claim 21, characterized in that The processor is further configured to read the computer program in the memory and perform the following operations: Acquire first key identification information from a core network device, wherein the first key identification information includes a root key identification that is permitted or prohibited from use; and / or The gateway identification information is obtained from the core network device, wherein the gateway identification information includes an identification of a gateway to which access is prohibited.

24. The device according to claim 23, characterized in that The processor is further configured to read the computer program in the memory and perform the following operations: If it is determined that the gateway identifier is not located in the gateway identifier information, and / or if it is determined that the first root key corresponding to the first root key identifier is a root key identifier allowed for use in the first key identifier information, the first root key corresponding to the first root key identifier is authenticated.

25. The device according to claim 18, characterized in that The processor is further configured to read the computer program in the memory and perform the following operations: Receiving an authentication response sent by the gateway; verifying the authentication response; If the authentication response is verified successfully, a key is generated.

26. An authentication device, characterized in that: Applied to core network equipment, including: memory, transceiver, processor; A memory for storing a computer program; a transceiver for transmitting and receiving data under the control of the processor; and a processor for reading the computer program in the memory and performing the following operations: Sending a first key record to a gateway, wherein the first key record is used to obtain a registration request; sending a second key record to the satellite system, wherein the second key record is used to obtain an authentication request; The first key record includes one or more of the following: The key value of the authentication key; Authentication key identifier; Root key identifier; Key generation parameters; Validity period of authentication key; Message authentication code; The second key record includes one or more of the following: The key value of the root key; Root key identifier; Key generation parameters; Root key validity period; Message authentication code to generate keys.

27. An authentication device, characterized in that: Applied to gateway stations, including: A first sending unit, configured to send a registration request to a satellite system; A first receiving unit, configured to receive an authentication request sent by the satellite system, wherein the authentication request is generated by the satellite system according to the registration request; The first authentication unit is configured to authenticate the satellite system according to the authentication request.

28. An authentication device, characterized in that: Applications in satellite systems, including: A first receiving unit, configured to receive a registration request sent by a gateway; A first authentication unit, configured to perform authentication according to the registration request and generate an authentication request according to the authentication result; The first sending unit is configured to send the authentication request to the gateway.

29. An authentication device, characterized in that: Applied to core network equipment, including: A first sending unit, configured to send a first key record to a gateway, wherein the first key record is used to obtain a registration request; A second sending unit, configured to send a second key record to the satellite system, wherein the second key record is used to obtain an authentication request; The first key record includes one or more of the following: The key value of the authentication key; Authentication key identifier; Root key identifier; Key generation parameters; Validity period of authentication key; Message authentication code; The second key record includes one or more of the following: The key value of the root key; Root key identifier; Key generation parameters; Root key validity period; Message authentication code to generate keys.

30. A processor-readable storage medium, characterized in that: The processor-readable storage medium stores a computer program, and the computer program is used to enable the processor to execute the method according to any one of claims 1 to 13.

Images