Authentication method and device of space-ground integrated network, electronic equipment and storage medium

Abstract

The invention discloses an authentication method and device of a space-ground integrated network, electronic equipment and a storage medium, which are used for solving the problem that a centralized authentication mechanism cannot guarantee the security of the space-ground integrated network, and comprises the following steps: receiving an access request of a user terminal sent by a satellite node and identification information of the satellite node, the access request carries identification information of a user, encrypted user session key negotiation parameter information and an access request verification value; obtaining an access request verification parameter of the user from the alliance chain; decrypting the encrypted user session key negotiation parameter information to obtain decrypted user session key negotiation parameter information, and performing identity authentication on the user according to the decrypted user session key negotiation parameter information, the access request verification parameter and the access request verification value; acquiring an authentication parameter of the satellite node from the alliance chain; and determining a target authentication check value of the satellite node according to the authentication parameter of the satellite node, and performing identity authentication on the satellite node according to the target authentication check value.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to an authentication method, device, electronic device and storage medium for a ground-ground integrated network. Background Art

[0002] The space-ground network is also called the space-ground integrated communication network. It is a multi-level, highly integrated global network communication system that makes comprehensive use of resources on the ground, in the air, near the ground and in deep space. The space-ground network integrates various communication carriers and platforms such as ground user terminals, ground stations (GS), base stations, aerial equipment, satellite systems, etc. using ground links, satellite-to-ground links and inter-satellite links to form a heterogeneous network with full coverage, efficient communication, seamless connection and dynamic resource management.

[0003] With the continuous advancement and in-depth development of global informatization, especially with the rapid development of space-based network technologies such as satellite launch, communication and computing, the space-ground integrated network has become an important communication platform connecting ground, air, low-Earth orbit and deep space resources. The space-ground integrated network can provide seamless coverage of communication services on a global scale, and is particularly suitable for communication needs in remote areas, oceans and disaster emergency scenarios that lack reliable ground communication resources. However, with the continuous expansion of the communication range of the space-ground integrated network, the large-scale access of heterogeneous entities and the surge in wireless open links have led to a great threat to the security of the space-ground integrated network, especially the security of node trust, identity authentication and secure data transmission.

[0004] The traditional ground-to-earth network authentication mechanism often relies on the centralized authentication mechanism of the Network Control Center (NCC). The NCC not only undertakes the management tasks of all ground stations and satellite nodes, but also needs to be responsible for the registration, supervision, accountability and identity authentication of global users. The centralized authentication mechanism makes the NCC an easy target for attack. Once the NCC is breached, the security of the entire ground-to-earth network and the trust issues between nodes will be seriously threatened. In addition, the centralized authentication mechanism that relies on the network control center is also difficult to adapt to the increasingly widespread development trend of the ground-to-earth network, and it is difficult to meet the dynamic network topology requirements of the ground-to-earth network. Therefore, it is urgent to propose an authentication mechanism for the ground-to-earth network to solve the shortcomings of centralized authentication. Summary of the invention

[0005] In order to solve the problem that the centralized authentication mechanism cannot ensure the security of the ground-ground integrated network, the embodiments of the present application provide an authentication method, device, electronic device and storage medium for the ground-ground integrated network.

[0006] In a first aspect, an embodiment of the present application provides an authentication method for a ground-to-earth network implemented by a ground station side, comprising:

[0007] Receiving an access request of a user terminal and identification information of the satellite node sent by a satellite node, wherein the access request carries the identification information of the user, encrypted user session key negotiation parameter information and an access request verification value;

[0008] Acquire the user's access request verification parameter from the alliance chain according to the user's identification information, where the user's access request verification parameter is uploaded to the alliance chain by the ground station after completing the registration of the user;

[0009] decrypting the encrypted user session key negotiation parameter information to obtain decrypted user session key negotiation parameter information, and authenticating the user according to the decrypted user session key negotiation parameter information, the access request verification parameter and the access request verification value;

[0010] Acquire authentication parameters of the satellite node from the alliance chain according to the identification information of the satellite node, where the authentication parameters of the satellite node are uploaded to the alliance chain after the network control center completes registration of the satellite node;

[0011] A target authentication check value of the satellite node is determined according to the authentication parameters of the satellite node, and identity authentication is performed on the satellite node according to the target authentication check value.

[0012] In a second aspect, an embodiment of the present application provides an authentication device for a ground-to-earth network implemented on a ground station side, including:

[0013] A first receiving module, configured to receive an access request of a user terminal sent by a satellite node and identification information of the satellite node, wherein the access request carries the identification information of the user, encrypted user session key negotiation parameter information and an access request verification value;

[0014] A first acquisition module is used to acquire the access request verification parameter of the user from the alliance chain according to the identification information of the user, where the access request verification parameter of the user is uploaded to the alliance chain after the ground station completes the registration of the user;

[0015] a first authentication module, configured to decrypt the encrypted user session key negotiation parameter information to obtain decrypted user session key negotiation parameter information, and perform identity authentication on the user according to the decrypted user session key negotiation parameter information, the access request verification parameter and the access request verification value;

[0016] A second acquisition module is used to acquire the authentication parameters of the satellite node from the alliance chain according to the identification information of the satellite node, and the authentication parameters of the satellite node are uploaded to the alliance chain after the network control center completes the registration of the satellite node;

[0017] The second authentication module is used to determine a target authentication verification value of the satellite node according to the authentication parameters of the satellite node, and perform identity authentication on the satellite node according to the target authentication verification value.

[0018] In a third aspect, an embodiment of the present application provides an authentication method for a space-ground integrated network implemented by a satellite node side, including:

[0019] Receiving an access request sent by a user terminal, wherein the access request carries user identification information, encrypted user session key negotiation parameter information, and an access request verification value;

[0020] Sending the access request and the identification information of the satellite node to the ground station, so that the ground station obtains the access request verification parameter of the user from the alliance chain according to the identification information of the user, decrypts the encrypted user session key negotiation parameter information to obtain the decrypted user session key negotiation parameter information, and authenticates the user according to the decrypted user session key negotiation parameter information, the access request verification parameter and the access request verification value, wherein the access request verification parameter of the user is uploaded to the alliance chain by the ground station after completing the registration of the user;

[0021] Receiving an authorization challenge message sent by the ground station, the authorization challenge message is used to verify the legitimacy of the user terminal, the authorization challenge message is determined by the ground station after determining that the user identity authentication is passed, according to the access request verification parameter and the authentication parameter of the satellite node obtained from the alliance chain according to the identification information of the satellite node, and the authentication parameter of the satellite node is uploaded to the alliance chain after the network control center completes the registration of the satellite node;

[0022] authenticating the legitimacy of the user terminal according to the satellite domain key information and the authorization challenge message;

[0023] Receive a ground station session key negotiation message sent by the ground station, and authenticate the ground station based on the authentication parameters of the satellite node and the ground station session key negotiation message, wherein the ground station session key negotiation message is determined by the ground station based on the authentication parameters of the satellite node obtained from the alliance chain.

[0024] In a fourth aspect, an embodiment of the present application provides an authentication device for a space-ground integrated network implemented on a satellite node side, including:

[0025] A first receiving module, configured to receive an access request sent by a user terminal, wherein the access request carries user identification information, encrypted user session key negotiation parameter information, and an access request verification value;

[0026] A first sending module is used to send the access request and the identification information of the satellite node to the ground station, so that the ground station obtains the access request verification parameter of the user from the alliance chain according to the identification information of the user, decrypts the encrypted user session key negotiation parameter information to obtain the decrypted user session key negotiation parameter information, and authenticates the user according to the decrypted user session key negotiation parameter information, the access request verification parameter and the access request verification value, wherein the access request verification parameter of the user is uploaded to the alliance chain by the ground station after completing the registration of the user;

[0027] A second receiving module is used to receive an authorization challenge message sent by the ground station, where the authorization challenge message is used to verify the legitimacy of the user terminal. The authorization challenge message is determined by the ground station after determining that the user identity authentication is passed, based on the access request verification parameter and the authentication parameter of the satellite node obtained from the alliance chain based on the identification information of the satellite node. The authentication parameter of the satellite node is uploaded to the alliance chain after the network control center completes the registration of the satellite node;

[0028] A first authentication module, configured to authenticate the legitimacy of the user terminal according to the satellite domain key information and the authorization challenge message;

[0029] The second authentication module is used to receive a ground station session key negotiation message sent by the ground station, and to authenticate the ground station based on the authentication parameters of the satellite node and the ground station session key negotiation message. The ground station session key negotiation message is determined by the ground station based on the authentication parameters of the satellite node obtained from the alliance chain.

[0030] In a fifth aspect, an embodiment of the present application provides an authentication method for a ground-ground integrated network implemented by a network control center, including:

[0031] Receiving a ground station registration request sent by a ground station, wherein the ground station registration request carries identification information of the ground station;

[0032] Randomly select prime numbers that are mutually prime from a finite field of large prime numbers corresponding to users of the ground station to obtain a set of prime numbers corresponding to the users;

[0033] Determine ground station user domain key reconstruction parameter information according to each prime number in the prime number set corresponding to the user;

[0034] Obtain the ground station domain key generation parameter information from the alliance chain;

[0035] Randomly select prime numbers that are mutually prime from a finite field of large prime numbers corresponding to the ground station to obtain a prime number set corresponding to the ground station, and randomly select a first target prime number from the prime number set corresponding to the ground station;

[0036] The first target prime number, the ground station user domain key reconstruction parameter information and the ground station domain key generation parameter information are sent to the ground station, so that the ground station determines the target ground station domain key confirmation value according to the ground station domain key generation parameter information and the first target prime number, and verifies the ground station domain key information according to the target ground domain key confirmation value and the ground station domain key confirmation value in the ground station domain key generation parameter information, and after the verification is passed, determines the ground station user domain key generation parameter information according to the ground station user domain key reconstruction parameter information, and uploads the ground station user domain key generation parameter information to the alliance chain, and the ground station domain key information is pre-allocated to the ground station by the network control center.

[0037] In a sixth aspect, an embodiment of the present application provides an authentication device for a ground-to-sky network implemented by a network control center, including:

[0038] A first receiving module is used to receive a ground station registration request sent by a ground station, wherein the ground station registration request carries identification information of the ground station;

[0039] A first selection module is used to randomly select prime numbers that are mutually prime from a finite field of large prime numbers corresponding to users of the ground station to obtain a prime number set corresponding to the users;

[0040] A first determination module is used to determine ground station user domain key reconstruction parameter information according to each prime number in the prime number set corresponding to the user;

[0041] The first acquisition module is used to obtain ground station domain key generation parameter information from the alliance chain;

[0042] A second selection module is used to randomly select prime numbers that are mutually prime from a finite field of large prime numbers corresponding to the ground station to obtain a prime number set corresponding to the ground station, and randomly select a first target prime number from the prime number set corresponding to the ground station;

[0043] The first sending module is used to send the first target prime number, the ground station user domain key reconstruction parameter information and the ground station domain key generation parameter information to the ground station, so that the ground station determines the target ground station domain key confirmation value according to the ground station domain key generation parameter information and the first target prime number, and verifies the ground station domain key information according to the target ground domain key confirmation value and the ground station domain key confirmation value in the ground station domain key generation parameter information, and after the verification is passed, determines the ground station user domain key generation parameter information according to the ground station user domain key reconstruction parameter information, and uploads the ground station user domain key generation parameter information to the alliance chain, and the ground station domain key information is pre-allocated to the ground station by the network control center.

[0044] In the seventh aspect, an embodiment of the present application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the authentication method for the space-ground integrated network described in the present application is implemented.

[0045] In an eighth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps in the authentication method for the space-ground integrated network described in the present application.

[0046] The beneficial effects of this application are as follows:

[0047] The authentication method, device, electronic device and storage medium of the integrated network of the earth and sky provided in the embodiment of the present application, the satellite node receives the access request sent by the user terminal, the access request carries the user's identification information, the encrypted user session key negotiation parameter information and the access request verification value, the satellite node sends the access request and the identification information of the satellite node to the ground station, the ground station obtains the user's access request verification parameter from the alliance chain according to the user's identification information, the user's access request verification parameter is uploaded to the alliance chain after the ground station completes the registration of the user, the ground station decrypts the encrypted user session key negotiation parameter information to obtain the decrypted user session key negotiation parameter information, and authenticates the user according to the decrypted user session key negotiation parameter information, the access request verification parameter and the access request verification value. The ground station obtains the authentication parameter of the satellite node from the alliance chain according to the identification information of the satellite node, the authentication parameter of the satellite node is uploaded to the alliance chain after the network control center completes the registration of the satellite node, the ground station determines the target authentication verification value of the satellite node according to the authentication parameter of the satellite node, and authenticates the satellite node according to the target authentication verification value. The ground station determines the ground station session key negotiation message according to the authentication parameters of the satellite node, sends the ground station session key negotiation message to the satellite node, and the satellite node authenticates the ground station based on the authentication parameters of the satellite node and the ground station session key negotiation message. After determining that the user authentication is passed, the ground station determines the authorization challenge message according to the access request verification parameters and the authentication parameters of the satellite node. The authorization challenge message is used to verify the legitimacy of the user terminal. The ground station sends the authorization challenge message to the satellite node, and the satellite node authenticates the legitimacy of the user terminal according to the satellite domain key information and the authorization challenge message. Compared with the prior art, the authentication method of the integrated network of the earth and the sky provided in the embodiment of the present application, when the user terminal accesses the ground station through the satellite node, completes the three-party authentication between the user terminal, the satellite node and the ground station based on the decentralized characteristics of the alliance chain. This distributed authentication method does not need to authenticate the user terminal, the satellite node and the ground station through the network control center. The network control center is only responsible for registering the ground station and the satellite node, and the ground station is responsible for registering users in the local domain, thereby avoiding dependence on the network control center, effectively reducing the authentication load of the network control center, and improving the security of the integrated network of the earth and the sky. In addition, after completing the registration of the satellite node, the network control center uploads the authentication parameters of the satellite node to the alliance chain for storage. After completing the registration of the user, the ground station stores the user's access request verification parameters in the alliance chain for storage. The alliance chain provides a distributed authentication foundation for the space-ground integrated network with its decentralized, tamper-proof and traceable characteristics. It is only open to pre-authorized entities or nodes in the system, ensuring the security and controllability of the confidential data, registration data and access data of the space-ground integrated network, and further improving the security of the space-ground integrated network.

[0048] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0050] Figure 1 A schematic diagram of an application scenario of the authentication method for the integrated space-ground network provided in an embodiment of the present application;

[0051] Figure 2 A schematic diagram of a process for a network control center to register a ground station according to an embodiment of the present application;

[0052] Figure 3 A schematic diagram of the verification process of the network control center for the ground station registration request provided in the embodiment of the present application;

[0053] Figure 4 A schematic diagram of a process for a network control center to register a satellite node according to an embodiment of the present application;

[0054] Figure 5 A schematic diagram of a process for a ground station to register a user in a local domain provided in an embodiment of the present application;

[0055] Figure 6 A schematic diagram of a process for verifying a user registration request by a user terminal provided in an embodiment of the present application;

[0056] Figure 7 A schematic diagram of a user login verification process provided in an embodiment of the present application;

[0057] Figure 8 A schematic diagram of a flow chart of an authentication method for a ground-to-sky network provided in an embodiment of the present application;

[0058] Fig. 9 A schematic diagram of a process for ground station authentication of a user provided in an embodiment of the present application;

[0059] Fig.10 A schematic diagram of a process for a ground station to generate an authorization challenge message provided in an embodiment of the present application;

[0060] Fig.11 A schematic diagram of a process for a satellite node to authenticate the legitimacy of a user terminal provided in an embodiment of the present application;

[0061] Fig.12 A schematic diagram of a process for a ground station to authenticate a satellite node according to an embodiment of the present application;

[0062] Fig.13 A schematic diagram of a process for a ground station to determine a ground station session key negotiation message provided by an embodiment of the present application;

[0063] Fig.14 A schematic diagram of a process for a satellite node to authenticate a ground station according to an embodiment of the present application;

[0064] Fig.15 A schematic diagram of a specific implementation process for a satellite node to authenticate the legitimacy of a user terminal according to a user session key parameter verification value and a ground station session key negotiation message provided in an embodiment of the present application;

[0065] Fig.16 A schematic diagram of a process for a user terminal to verify the accuracy of a session key negotiated with a ground station provided in an embodiment of the present application;

[0066] Fig.17 A schematic diagram of a ground station domain key update process provided in an embodiment of the present application;

[0067] Fig.18 A schematic diagram of a satellite domain key update process provided in an embodiment of the present application;

[0068] Fig.19 A flowchart of an authentication method for a ground-to-earth network implemented on a ground station side according to an embodiment of the present application;

[0069] Fig. 20 A schematic diagram of the structure of an authentication device for a ground-to-earth network implemented on the ground station side according to an embodiment of the present application;

[0070] Fig.21 A schematic diagram of a flow chart of an authentication method for a space-ground integrated network implemented on a satellite node side according to an embodiment of the present application;

[0071] Fig. 22 A schematic diagram of the structure of an authentication device for a space-ground integrated network implemented on a satellite node side according to an embodiment of the present application;

[0072] Fig.23 A flowchart of an authentication method for a ground-to-sky network implemented by a network control center in an embodiment of the present application;

[0073] Fig.24 A schematic diagram of the structure of an authentication device for a ground-to-sky network implemented at a network control center side according to an embodiment of the present application;

[0074] Fig.25A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0075] With the continuous advancement and in-depth development of global informatization, especially with the rapid development of space-based network technologies such as satellite launch, communication and computing, the space-ground integrated network has become an important communication platform connecting ground, air, low-Earth orbit and deep space resources. The space-ground integrated network can provide seamless coverage of communication services on a global scale, and is particularly suitable for communication needs in remote areas, oceans and disaster emergency scenarios that lack reliable ground communication resources. However, with the continuous expansion of the communication range of the space-ground integrated network, the large-scale access of heterogeneous entities and the surge in wireless open links have led to a great threat to the security of the space-ground integrated network, especially the security of node trust, identity authentication and secure data transmission.

[0076] Traditional ground-to-earth network authentication mechanisms often rely on the centralized authentication mechanism of the Network Control Center (NCC). The NCC not only undertakes the management tasks of all ground stations and satellite nodes, but also needs to be responsible for the registration, supervision, accountability, and identity authentication of global users. The centralized authentication mechanism makes the NCC an easy target for attack. Once the NCC is breached, the security of the entire ground-to-earth network and the trust issues between nodes will be seriously threatened. In addition, the centralized authentication mechanism that relies on the NCC is also difficult to adapt to the increasingly widespread development trend of the ground-to-earth network, and it is difficult to meet the dynamic network topology requirements of the ground-to-earth network and the cross-domain communication requirements of users.

[0077] Based on this, the embodiments of the present application provide an authentication method, device, electronic device and storage medium for a space-ground integrated network, and propose a distributed identity authentication mechanism based on blockchain to solve the problem that the centralized authentication mechanism cannot ensure the security of the space-ground integrated network and meet the authentication needs of cross-domain roaming users.

[0078] The preferred embodiments of the present application are described below in conjunction with the drawings in the specification. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present application, and are not used to limit the present application. In addition, the embodiments and features in the embodiments of the present application may be combined with each other if there is no conflict.

[0079] In this article, it is necessary to understand that the technical terms involved in this application are:

[0080] 1. Network Control Center: It is a trusted entity of the space-ground network system. As the core operation, management and control center of the space-ground network system, it is responsible for the coordination, monitoring, control and infrastructure deployment of the entire network. In this application, NCC is responsible for generating system public parameters and secret parameters in the initialization phase. In the registration phase, NCC provides registration services to satellite nodes and ground stations, and deploys satellite nodes and ground stations to the space-ground network.

[0081] 2. Ground station: It is a distributed ground communication facility in the integrated space-ground network, which can directly connect to orbiting satellites and conduct two-way communication. As a trusted entity in the domain, the ground station is responsible for providing registration services to users in the domain during the registration phase and providing subscription services to user terminals after access.

[0082] 3. Satellite: As a key component of air and space communications in the integrated earth-ground network, satellites can be divided into low-Earth orbit satellites, medium-Earth orbit satellites and high-Earth orbit satellites according to their orbital altitudes. Satellites serve as relay nodes for remote users to access ground stations and can receive and forward ground signals.

[0083] 4. User: is the terminal user in the integrated space-ground network, which can be an individual user, enterprise or organization. When users in remote areas with insufficient ground communication resources need to obtain communication, data, broadband and other services, they need to access the ground station through satellite nodes. Since users are mobile and the integrated space-ground network is divided into multiple domains, after registering in the local domain, users may roam across domains to other regions and request foreign-region subscription services from foreign ground stations through satellite nodes.

[0084] 5. Alliance blockchain: Also known as alliance chain, it is a relatively closed blockchain architecture jointly managed by multiple organizations. It is a blockchain mechanism between public and private chains, and can achieve cross-institutional cooperation and data integrity and confidentiality requirements under a certain degree of decentralization. Since the participants in the alliance chain are pre-authorized organizational members and are not open to the public, it can help protect the confidentiality of data, and the number of participating nodes is small, so transactions can be confirmed and processed faster. In this application, the participants of the alliance include NCC, ground stations in various regions, satellite nodes and user terminals.

[0085] 6. Three-party authentication: Since there are a large number of heterogeneous or untrusted nodes in the integrated space-ground network, in this application, when the user terminal accesses the ground station through the satellite node, mutual identity authentication of the user terminal, satellite node and ground station is implemented, that is, three-party authentication.

[0086] 7. Cross-domain authentication: In this application, the space-ground network is divided into different domains, and users register in the ground station of the domain they are in. When a mobile user roams across domains to a foreign region and requests a subscription service from a foreign ground station through a satellite node, in order to ensure that the resources of the foreign ground station are not abused by unauthorized users and to enable users to obtain trusted services, it is necessary to implement a three-party two-by-two authentication of the foreign ground station, satellite, and cross-domain user terminal, i.e., cross-domain authentication.

[0087] 8. Chinese Remainder Theorem (CRT): It is used to solve the difficult problem of a certain type of congruence equations. CRT can be used to determine the number that can satisfy multiple given congruence conditions. Assume n 1 , n 2 ,…,n k are mutually prime positive integers (that is, any n i and n j The greatest common divisor of is 1, for all i≠j), and a 1 , a 2 , …, a k is any integer. Then for the congruence equations:

[0088] x≡a 1 (mod n 1 )

[0089] x≡a 2 (mod n 2 )

[0090]

[0091] x≡a k (mod n k )

[0092] There exists a unique integer solution x that satisfies the above congruence conditions.

[0093] First reference Figure 1, which is a schematic diagram of an application scenario of the authentication method of the integrated network of the earth and sky provided in an embodiment of the present application. The integrated network system of the earth and sky may include: an alliance chain 101, a network control center 102, a ground station 103, a satellite node 104 and a user terminal 105. The satellite nodes 104 are connected to each other through inter-satellite links, and the satellite nodes 104 and the ground station 103 are connected through satellite-to-ground links. The participants of the alliance chain include the network control center 102, each ground station 103 and each satellite node 104. The network control center 102, the ground station 103 and the satellite node 104 are respectively connected to the alliance chain 101. The network control center 102 divides different regions according to the spatial geographical location. A ground station 103 is set in each region. A ground station 103 provides registration services to users in the local region. The user terminal 105 bound to the user can access the local ground station 103. Other regions are called foreign regions. When data is transmitted between the user terminal 105 and the ground station 103, it needs to be forwarded through the satellite node 104. The network control center 102 is used to register the ground station 103 and the satellite node 104, and after successful registration, upload the ground station registration information and the satellite node registration information to the alliance chain 101 for storage.

[0094] Based on the above application scenarios, the following will refer to the attached Figures 2 to 18 The exemplary embodiments of the present application are described in more detail. It should be noted that the above application scenarios are only shown to facilitate understanding of the spirit and principle of the present application, and the implementation of the present application is not limited in any way. On the contrary, the implementation of the present application can be applied to any applicable scenario.

[0095] In the authentication method of the space-ground network provided in the embodiment of the present application, the trusted node network control center in the space-ground network system is responsible for selecting a secure hash algorithm, a secure biometric fuzzy extraction function, and a secure physical unclonable function (PUF), and selecting large prime numbers based on the Chinese remainder theorem, secret value distribution and domain key generation for ground stations in each domain, secret value distribution and domain key generation for satellite nodes, and smart contract deployment of the alliance chain, and uploading the system public parameters (pubparams) and domain key generation parameter information to the alliance chain for storage.

[0096] Before authenticating the Sky-Earth Network, you must first go through the initialization and registration process. The initialization process is as follows:

[0097] Step 1: The network control center selects a large prime number p corresponding to the ground station based on the Chinese remainder theorem gs The large prime number p corresponding to the satellite node sat , p gsAs a large prime number for all ground stations in the space-ground network system, p sat As large prime numbers for all satellite nodes in the space-ground network system, both can be 1024-bit binary numbers, and p gs With p sat are different prime numbers.

[0098] Step 2: The network control center faces the ground station in the integrated space-ground network system and obtains the large prime number p corresponding to the ground station. gs Finite field of Randomly select n 1 There are two mutually prime prime numbers x gs，i (i=1~n 1 ), and get the prime number set corresponding to the ground station: Among them, n 1 The maximum number of pre-divided domains (or deployed ground stations) in the space-ground network.

[0099] Then, the network control center calculates the modulus of the prime number corresponding to the ground station Auxiliary module xm gs，i ×ym gs，i ≡1 mod x gs，i ,ym gs，i Represents the modular inverse element (ie: xm gs，i The inverse of the secret share coefficient var gs，i =xm gs，i ×ym gs，i , and the secret reconstruction value Among them, the secret reconstruction value μ gs Used to reconstruct the domain key of the ground station.

[0100] Step 3: The network control center faces the satellite nodes in the space-ground integrated network system and obtains the large prime number p corresponding to the satellite nodes. sat Finite field of Randomly select n 2 There are two mutually prime prime numbers x sat，i (i=1~n 2 ), get the prime number set corresponding to the satellite node: Among them, n 2 It is the maximum number of pre-deployed satellite nodes in the integrated space-ground network system.

[0101] Then, the network control center calculates the modulus of the prime number corresponding to the satellite node Auxiliary module xm sat，i ×ym sat，i ≡1mod x sat，i (ymsat，i For xm sat，i The inverse of the secret share coefficient var sat，i =xm sat，i ×ym sat，i , secret reconstruction value Secret reconstruction value μ sat Used to reconstruct the domain key of the satellite node.

[0102] Step 4: The network control center selects the secure biometric fuzzy extraction function Gen and the biometric key reconstruction function Rep, the physical unclonable function PUF, and the hash function h (i.e., the preset hash algorithm). The biometric fuzzy extraction function Gen is used to generate a biometric key and a public auxiliary string based on the biometric, and the biometric key reconstruction function Rep is used to reconstruct the original biometric key based on the re-extracted biometric key and the public auxiliary string. The preset hash algorithm can use any hash algorithm, such as any one of the MD5 algorithm, SHA-1 algorithm, SHA-256 algorithm, CRC algorithm, etc. The embodiment of the present application does not limit this, and it is sufficient to ensure that the hash algorithms used in the registration process and the authentication process are consistent.

[0103] Step 5: The network control center obtains the finite field of large prime numbers corresponding to the ground station A prime number is randomly selected as the ground station domain key information. The ground station domain key update value is calculated by the ground station domain key update function: γ gs =kd gs ·μ gs , calculate the ground station domain key confirmation value according to the preset hash algorithm: cv gs =h(ID ncc , γ gs , kd gs , E.T. gs , PT gs ), where ID ncc The identification information of the network control center, ET gs kd is the current ground station domain key information gs The expiration timestamp, PT gs kd is the current ground station domain key information gs The release timestamp of .

[0104] Step 6: The network control center obtains the finite field of large prime numbers corresponding to the satellite nodes A prime number is randomly selected as the satellite domain key information. The satellite domain key update value is calculated by the satellite domain key update function: γ sat =kd sat ·μsat , calculate the domain key confirmation value cv according to the preset hash algorithm sat =h(ID ncc , γ sat , kd sat , E.T. sat , PT sat ), where ET sat is the current satellite domain key information kd sat Expiration timestamp, PT sat is the current satellite domain key information kd sat The release timestamp of .

[0105] Step 7: The network control center securely stores the ground station domain key reconstruction parameter information: the prime number set xs corresponding to the ground station gs , the modulus of the prime number corresponding to the ground station θ gs , the secret reconstruction value μ corresponding to the ground station gs :{xs gs ,θ gs , μ gs}, and store satellite domain key reconstruction parameter information: the prime number set xs corresponding to the satellite node sat , the modulus of the prime number corresponding to the satellite node θ sat , the secret reconstruction value μ corresponding to the satellite node sat :{xs sat ,θ sat , μ sat}, and the public parameters pubparams = {p gs , p sat , Gen, Rep, PUF, h}, ground station domain key generation parameter information {ID ncc , γ gs , cv gs , E.T. gs , PT gs}, and satellite domain key generation parameter information {ID ncc , γ sat , cv sat , E.T. sat , PT sat}Upload to the alliance chain for storage. Among them, the ground station domain key reconstruction parameter information is used to reconstruct the ground station domain key information, and the satellite domain key reconstruction parameter information is used to reconstruct the satellite domain key information.

[0106] The network control center provides registration services for ground stations and satellite nodes in the integrated space-ground network system, so that ground stations become legal service nodes in the integrated space-ground network system, and satellite nodes become legal relay nodes in the integrated space-ground network system. Each domain ground station provides registration services to users in its domain, so that it can provide ground subscription services to legal users in the integrated space-ground network system in local and foreign regions. The registration mechanism includes ground station registration mechanism, satellite node registration mechanism and user distributed registration mechanism.

[0107] like Figure 2 As shown, it is a schematic diagram of the process of the network control center registering the ground station, which may include the following steps:

[0108] S21. The ground station sends a ground station registration request to the network control center.

[0109] In specific implementation, the network control center controls any ground station GS k For example, the ground station GS k Send a ground station registration request to the network control center, where the ground station registration request carries the ground station GS k Identification information ID gs，k .

[0110] S22. The network control center randomly selects prime numbers that are mutually prime in pairs from the finite field of large prime numbers corresponding to the users of the ground station to obtain a set of prime numbers corresponding to the users of the ground station, and determines the ground station user domain key reconstruction parameter information based on each prime number in the set of prime numbers corresponding to the users of the ground station.

[0111] In the specific implementation, the network control center selects the large prime number p corresponding to the user of the ground station based on the Chinese remainder theorem. gs，k , p gs，k As a ground station GS k A large prime number of users, and p gs，k With p gs 、p sat The network control center faces the ground station GS k Users from the ground station GS k The large prime number p corresponding to the user gs，k Finite field of Randomly select n k +1 pairwise prime numbers Get Ground Station GS k The set of prime numbers corresponding to the user: Among them, n k The network control center in the space-ground network system allows the ground station GS k The maximum number of registered users in the domain.

[0112] Then, the network control center calculates the ground station GS k The modulus of the prime number corresponding to the user Auxiliary module (in, is the modular inverse element, that is: for The inverse of ), secret share coefficient Secret reconstruction value Secret reconstruction value μ gs，k Used to reconstruct the user domain key of the ground station. The modulus of the prime number corresponding to the user of the ground station The secret reconstruction value μ corresponding to the user of the ground station gs，k Used as the ground station user domain key to reconstruct parameter information.

[0113] S23. The network control center obtains the ground station domain key generation parameter information from the alliance chain.

[0114] In the specific implementation, the network control center obtains the ground station domain key generation parameter information {ID ncc , γ gs , cv gs , E.T. gs , PT gs}.

[0115] S24. The network control center randomly selects a first target prime number from the prime number set corresponding to the ground station.

[0116] In the specific implementation, the network control center obtains the prime number set corresponding to the ground station obtained in the initialization phase. Randomly select a prime number x from gs，k As the first target prime number, x gs，k ∈xs gs .

[0117] S25. The network control center sends the first target prime number, ground station user domain key reconstruction parameter information, and ground station domain key generation parameter information to the ground station.

[0118] In specific implementation, the network control center will set the first target prime number x gs，k , Ground station user domain key reconstruction parameter information and ground station domain key generation parameter information {ID ncc , γ gs , cv gs , E.T. gs , PT gs}Sent to ground station GSk .

[0119] S26. The ground station determines the target ground station domain key confirmation value according to the ground station domain key generation parameter information and the first target prime number, and verifies the ground station domain key information according to the target ground domain key confirmation value and the ground station domain key confirmation value in the ground station domain key generation parameter information.

[0120] In specific implementation, the ground station GS k Obtain the public parameters uploaded by the network control center during the initialization phase from the alliance chain pubparams = {p gs , p sat ,Gen,Rep,PUF,h}.

[0121] Ground Station GS k Receive the first target prime number x sent by the network control center gs，k , Ground station user domain key reconstruction parameter information and ground station domain key generation parameter information {ID ncc , γ gs , cv gs , E.T. gs , PT gs}, first check the ground station domain key information kd gs The expiration timestamp is ET gs and the release timestamp PT gs The validity of the time is determined to be no earlier than the release timestamp PT. gs and no later than the expiration timestamp ET gs , then determine ET gs and PT gs efficient.

[0122] If ET is determined gs and PT gs If it is valid, the ground station domain key update value γ in the ground station domain key generation parameter information is further used. gs and the first target prime number x gs，k Calculate the target ground station domain key kd′ gs :kd′ gs =γ gs mod x gs，k , update the value γ according to the ground station domain key gs and the target ground station domain key kd′ gs Calculate the target ground station domain key confirmation value cv′ based on the preset hash algorithm gs :cv′ gs =h(ID ncc , γ gs , kd′ gs , E.T. gs, PT gs ). The preset hash algorithm is the hash function h in the public parameter. Then, the target ground domain key confirmation value cv′ is verified. gs Is it equal to the ground station domain key confirmation value cv in the ground station domain key generation parameter information? gs , to the ground station domain key information kd gs Verify that if cv′ gs =cv gs , then determine the ground station domain key information kd gs Valid, verified, ground station GS k Storage ground station domain key parameters {kd gs , E.T. gs , PT gs}, the ground station domain key parameters include: ground station domain key information kd gs , ground station domain key information kd gs The expiration timestamp is ET gs , ground station domain key information kd gs The release time stamp is PT gs If cv′ gs ≠cv gs , the verification fails and the registration process is terminated.

[0123] S27. After the verification is passed, the ground station determines the ground station user domain key generation parameter information according to the ground station user domain key reconstruction parameter information.

[0124] In specific implementation, the ground station GS k After verification, the ground station GS k The finite field of large prime numbers corresponding to the user A prime number is randomly selected as the local domain ground station user domain key information kd gs，k , The secret reconstruction value μ corresponding to the user of the ground station in the ground station user domain key reconstruction parameter information gs，k And ground station user domain key information kd gs，k Calculate the ground station user domain key update value γ gs，k , specifically, And update the value γ according to the calculated ground station user domain key gs，k And ground station user domain key information kd gs，k , calculate the ground station user domain key confirmation value cv based on the preset hash algorithm gs，k , specifically, cv gs，k =h(ID ncc , γ gs，k , kd gs，k , E.T. gs，k , PTgs，k ), where ET gs，k kd is the user domain key information of the current ground station gs，k The expiration timestamp, PT gs，k kd is the user domain key information of the current ground station gs，k The release timestamp of .

[0125] Furthermore, the ground station GS k Ground Station GS k Identification information ID gs，k , ground station user domain key update value γ gs，k , ground station user domain key confirmation value cv gs，k , ground station user domain key information kd gs，k The expiration timestamp is ET gs，k , ground station user domain key information kd gs，k The release time stamp is PT gs，k Used as parameter information for ground station user domain key generation.

[0126] S28. The ground station uploads the ground station user domain key generation parameter information to the alliance chain.

[0127] In specific implementation, the ground station GS k Through the smart contract, the ground station user domain key generation parameter information {ID gs，k , γ gs，k , cv gs，k , E.T. gs，k , PT gs，k}Upload to the alliance chain for storage.

[0128] S29. The network control center obtains the ground station user domain key generation parameter information from the alliance chain.

[0129] In specific implementation, the network control center will k Identification information ID gs，k Get the corresponding ground station user domain key generation parameter information from the alliance chain {ID gs，k , γ gs，k , cv gs，k , E.T. gs，k , PT gs，k}.

[0130] S210. The network control center determines the user domain key information of the first target ground station according to the user domain key generation parameter information of the ground station, verifies the ground station registration request according to the user domain key information of the first target ground station and the user domain key generation parameter information of the ground station, and registers the ground station after the verification is passed.

[0131] In the specific implementation, the network control center obtains the ground station user domain key generation parameter information {ID gs，k , γ gs，k , cv gs，k , E.T. gs，k , PT gs，k}, from the ground station GS k The set of prime numbers corresponding to the user Choose any prime number, such as According to the selected prime number and the ground station user domain key update value γ in the ground station user domain key generation parameter information gs，k Calculate the first target ground station user domain key information kd′ gs，k , specifically,

[0132] In implementation, the following Figure 3 The process shown implements the verification of the ground station registration request by the network control center, including the following steps:

[0133] S2101. The network control center determines a target ground station user domain key confirmation value based on the ground station user domain key generation parameter information and the first target ground station user domain key information.

[0134] In specific implementation, the network control center generates the ground station user domain key update value γ in the parameter information according to the ground station user domain key. gs，k and the first target ground station user domain key information kd′ gs，k , calculate the target ground station user domain key confirmation value cv′ based on the preset hash algorithm gs，k , can be recorded as the user domain key confirmation value of the first target ground station. Specifically, cv′ gs，k =h(ID ncc , γ gs，k , kd′ gs，k , E.T. gs，k , PT gs，k ).

[0135] S2102. The network control center verifies the ground station registration request according to the target ground station user domain key confirmation value and the ground station user domain key confirmation value in the ground station user domain key generation parameter information to obtain a verification result.

[0136] In specific implementation, if the network control center determines the target ground station user domain key confirmation value cv′ gs，k Equal to the ground station user domain key confirmation value cv in the ground station user domain key generation parameter information gs，k , then the verification is confirmed to be successful, for the ground station GS k Register. If the target ground station user domain key confirmation value cv′ is determinedgs，k Not equal to the ground station user domain key confirmation value cv in the ground station user domain key generation parameter information gs，k , then the verification is determined to have failed, and the ground station GS k Register and send the ground station's registration failure message {ID gs，k , invalid (invalid)} uploaded to the alliance chain.

[0137] S211. The network control center uploads the registration information of the ground station to the alliance chain.

[0138] In specific implementation, the network control center will k After successful registration, according to the ground station domain key information kd gs and the preset hash algorithm to determine the ground station authentication credential idv gs，k (Also called Ground Station GS k Registration successful verification identification), specifically, idv gs，k =h(ID ncc , ID gs，k , kd gs , E.T. gs，k , PT gs，k ). The network control center sends the ground station GS k Registration information {ID ncc , ID gs，k , idv gs，k , E.T. gs，k , PT gs，k}Upload to the alliance chain for storage, ground station GS k The registration information includes: the identification information ID of the network control center ncc , Ground Station GS k Identification information ID gs，k 、Ground station authentication certificate idv gs，k , ground station user domain key information kd gs，k The expiration timestamp is ET gs，k , ground station user domain key information kd gs，k The release time stamp is PT gs，k .

[0139] S212, the network control center will ground station GS k Deployed within the ground area divided by the integrated space-ground network system.

[0140] like Figure 4 As shown, it is a schematic diagram of the process of the network control center registering the satellite node, which may include the following steps:

[0141] S31. The satellite node sends a satellite registration request to the network control center.

[0142] In specific implementation, the network control center controls any satellite node L j The following is an example of registration. Satellite node L j Send a satellite registration request to the network control center, where the satellite registration request carries the satellite node L j Identification information ID sat，j .

[0143] S32. The network control center randomly selects a second target prime number from the prime number set corresponding to the satellite node.

[0144] In specific implementation, the network control center uses the satellite node L j Identification information ID sat，j Query satellite node L from the alliance chain j Registration information of satellite node L j If it is not registered, the prime number set corresponding to the satellite node Randomly select a prime number x from sat，j As the second target prime number, x sat，j ∈xs sat The set of prime numbers corresponding to the satellite nodes is the large prime number p corresponding to the satellite nodes in the initialization phase of the network control center. sat Finite field of It is obtained by randomly selecting prime numbers that are mutually prime.

[0145] S33. The network control center randomly generates a set of PUF challenge values ​​for the satellite node according to the second target prime number and the physical unclonable function PUF.

[0146] In specific implementation, the network control center can set n j A random challenge signal is generated, and each random challenge signal is respectively matched with the second target prime number x. sat，j As the input of the physical unclonable function (PUF), the satellite node L j The corresponding PUF challenge value c j，i (i=1~n j ), get satellite node L j Corresponding PUF challenge value set Among them, n j The physical unclonable function is used in this application to calculate the PUF challenge value set and PUF response value set of the satellite node in order to ensure the security of the satellite node and prevent the satellite node that is difficult to manage in the air from being controlled by the security threat object or tampering with the satellite node.

[0147] S34. The network control center obtains satellite domain key generation parameter information from the alliance chain.

[0148] In specific implementation, the network control center uses the identification information ID of the network control center ncc Get satellite domain key generation parameter information from the alliance chain {ID ncc , γ sat , cv sat , E.T. sat , PT sat}.

[0149] S35. The network control center sends the second target prime number, satellite domain key generation parameter information, and the PUF challenge value set of the satellite node to the satellite node.

[0150] In the specific implementation, the network control center will set the second target prime number x sat，j and satellite domain key generation parameter information {ID ncc , γ sat , cv sat , E.T. sat , PT sat} as satellite node L j The registration response message of the satellite node L j Registration response message {ID ncc , γ sat , cv sat , x sat，j , E.T. sat , PT sat} and satellite node L j PUF challenge value set Send to satellite node L j .

[0151] S36. The satellite node determines a target satellite domain key confirmation value according to the satellite domain key generation parameter information and the second target prime number, and verifies the satellite domain key information according to the target satellite domain key confirmation value and the satellite domain key confirmation value in the satellite domain key generation parameter information.

[0152] In specific implementation, the satellite node L j Obtain the public parameters uploaded by the network control center during the initialization phase from the alliance chain pubparams = {p gs , p sat ,Gen,Rep,PUF,h}.

[0153] Satellite Node L j Receive the second target prime number x sent by the network control center sat，j , Satellite domain key generation parameter information {ID ncc , γ sat , cv sat , E.T. sat , PT sat} and satellite node L j PUF challenge value set After that, first check the satellite domain key information kd sat The expiration timestamp is ET sat and satellite domain key information kd sat The release time stamp is PT sat The validity of the time is determined to be no earlier than the release timestamp PT. sat and no later than the expiration timestamp ET sat , then determine ET sat and PT sat efficient.

[0154] If ET is determined sat and PT sat If it is valid, the satellite domain key update value γ in the satellite domain key generation parameter information is further generated according to the satellite domain key sat and the second target prime number x sat，j Calculate the target satellite domain key kd′ sat :kd′ sat =γ sat mod x sat，j , update the value γ according to the satellite domain key sat and the target satellite domain key kd′ sat Calculate the target satellite domain key confirmation value cv′ based on the preset hash algorithm sat :cv′ sat =h(ID ncc , γ sat , kd′ sat , E.T. sat , PT sat ), where the hash algorithm is the hash function h in the public parameter. Then, verify the target satellite domain key confirmation value cv′ sat Is it equal to the satellite domain key confirmation value cv in the satellite domain key generation parameter information? sat , to the satellite domain key information kd sat Verify the satellite domain key information kd sat It is pre-allocated to the satellite node by the network control center during the initialization phase. If cv′ sat =cv sat , then determine the satellite domain key information kd sat Valid, verified, satellite node L j Storage satellite domain key parameters {kd sat , E.T. sat , PT sat}, satellite domain key parameters include: satellite domain key information kd sat , satellite domain key information kd sat The expiration timestamp is ETsat , satellite domain key information kd sat The release time stamp is PT sat If cv′ sat ≠cv sat , the verification fails and the registration process is terminated.

[0155] S37. After verification, the satellite node determines a PUF response value set of the satellite node corresponding to the PUF challenge value set of the satellite node.

[0156] In specific implementation, the satellite node L j After verification, the satellite node L is determined based on the physical unclonable function PUF in the public parameters. j PUF challenge value set pufs sat，j The corresponding satellite node L j PUF response value set pufr sat，j : Among them, PUF (c j，1 ) is the PUF challenge value c j，1 The corresponding PUF response value, PUF(c j，2 ) is the PUF challenge value c j，2 ) corresponding to the PUF response value, and so on, PUF challenge value The corresponding PUF response value.

[0157] S38. The satellite node sends the PUF response value set of the satellite node to the network control center.

[0158] In specific implementation, the satellite node L j The satellite node L j PUF response value set Return to the Network Control Center.

[0159] S39. The network control center registers the satellite node.

[0160] In specific implementation, the network control center receives the satellite node L j The set of PUF response values ​​sent After that, for the satellite node L j to register.

[0161] S310. The network control center determines the satellite authentication credential based on the satellite domain key information and the preset hash algorithm.

[0162] In specific implementation, the network control center controls the satellite node L j After successful registration, based on the satellite domain key information kd sat and preset hash algorithm to determine the satellite authentication credential ccsat，j , specifically, cc sat，j =h(ID ncc , ID sat，j , kd sat , E.T. sat , PT sat ).

[0163] S311. The network control center uploads the registration information of the satellite node to the alliance chain.

[0164] In specific implementation, the network control center will satellite node L j Registration information {ID ncc , ID sat，j ,cc sat，j ,pufs sat，j , pufr sat，j , E.T. sat , PT sat}Upload to the alliance chain for storage, satellite node L j The registration information includes: the identification information ID of the network control center ncc , Satellite Node L j Identification information ID sat，j , Satellite certification certificate cc sat，j , Satellite Node L j The PUF challenge value set pufs sent sat，j , Satellite Node L j The PUF response value set sent is pufr sat，j , satellite domain key information kd sat The expiration timestamp is ET sat and satellite domain key information kd sat The release time stamp is PT sat .

[0165] S312. The network control center deploys satellite nodes to the space segment of the integrated space-ground network system.

[0166] In specific implementation, the network control center will satellite node L j Deployed to the space segment of the integrated space-ground network system.

[0167] The preset hash algorithms used in the embodiments of the present application are all hash functions h in the public parameters, which will not be described in detail hereinafter.

[0168] like Figure 5 As shown, it is a schematic diagram of the process of the ground station registering users in the local domain, which may include the following steps:

[0169] S41. The user terminal determines a user characteristic hash value according to user characteristic information input by the user and a preset hash algorithm.

[0170] In a specific implementation, the user terminal receives user characteristic information input by the user, wherein the user characteristic information includes: user identification information, password information and biometric information. The password information may be a string of characters or a password set by the user. i The biometric information may be biometric information such as fingerprint or iris features of the user, which is not limited in the embodiment of the present application.

[0171] The user terminal determines the biometric key based on the biometric fuzzy probability function and the biometric information input by the user, and determines the user feature hash value based on the user's identification information, password information, biometric key and a preset hash algorithm.

[0172] Specifically, any ground station GS k For any user U in the local domain i The following is an example of registration. i Input user characteristic information in the user terminal, the user characteristic information includes: user U i Identification information ID i , password information PW i and biometrics i The user terminal obtains the public parameters pubparams uploaded by the network control center during the initialization phase from the alliance chain. gs , p sat , Gen, Rep, PUF, h} and store it locally, according to the biometric fuzzy probability function Gen and biometric BIO in the public parameters i Determine the biometric key σ i :σ i =Gen(BIO i ) and the public helper string v i , and according to user U i Identification information ID i , password information PW i , biometric key σ i Calculate the user feature hash value RPW with the hash function h in the public parameter i , specifically, RPW i =h(ID i , PW i , σ i ).

[0173] S42. The user terminal sends a user registration request to the satellite node. The user registration request includes the user's identification information and the user feature hash value.

[0174] In specific implementation, the user terminal sends a user registration request {ID i , RPW i}, the user registration request includes user U i Identification information ID i and user feature hash value RPW i .

[0175] S43. The satellite node forwards the user registration request to the ground station.

[0176] In specific implementation, the satellite node forwards the user registration request to the ground station GS k .

[0177] S44. The ground station randomly selects a prime number from the prime number set corresponding to the user as the secret value.

[0178] In this step, the ground station GS k Reconstruct parameter information from ground station user domain keys The set of prime numbers corresponding to the users of the ground stations in Randomly select a prime number x from user，i As a secret value,

[0179] S45. The ground station randomly generates a PUF challenge value set of the user terminal according to the secret value and the physical unclonable function PUF.

[0180] In specific implementation, the ground station GS k Can be set to n i random challenge signals, and each random challenge signal and secret value x are user，i As the input of the physical unclonable function PUF, the PUF challenge value c corresponding to the user terminal is obtained user，i (i=1~n i ), and obtain the PUF challenge value set corresponding to the user terminal Among them, n i The physical unclonable function is used in this application to calculate the PUF challenge value set and PUF response value set of the user terminal in order to ensure the security of the user terminal and prevent the user terminal that is difficult to manage from being cloned or tampered with by the security threat object.

[0181] S46. The ground station determines the user authentication credential information according to the ground station domain key information and the preset hash algorithm, and determines the user authentication credential verification value information according to the user authentication credential information and the preset hash algorithm.

[0182] In specific implementation, the ground station GS k According to the ground station domain key information kd gsCalculate user authentication credential information cc with budget hash algorithm user，i :cc user，i =h(ID ncc , ID gs，k , kd gs , E.T. gs，k , PT gs，k ), based on the user authentication credential information cc user，i Calculate the user authentication credential verification value information ccd with the preset hash algorithm user，i :ccd user，i =h(ID ncc , ID gs，k , ID i , kd gs ,cc user，i , E.T. gs，k , PT gs，k , E.T. gs , PT gs ).

[0183] S47. The ground station obtains the ground station user domain key generation parameter information from the alliance chain.

[0184] In specific implementation, the ground station GS k According to the ground station GS k The identification information of the ground station user domain key generation parameter information {ID gs，k , γ gs，k , cv gs，k , E.T. gs，k , PT gs，k}.

[0185] S48. The ground station sends a registration response message to the satellite node. The registration response message includes ground station user domain key generation parameter information, secret value, user terminal PUF challenge value set and user authentication credential verification value information.

[0186] In specific implementation, the ground station GS k Send a registration response message {ID gs，k , γ gs，k , cv gs，k , x user，i ,ccd user，i ,pufs user，i , E.T. gs，k , PT gs，k ,}, the registration response message includes: ground station user domain key generation parameter information {ID gs，k , γ gs，k , cv gs，k , E.T. gs，k , PT gs，k}、Secret value xuser，i , the PUF challenge value set pufs of the user terminal user，i , user authentication credential verification value information ccd user，i .

[0187] S49. The satellite node forwards the registration response message to the user terminal.

[0188] In specific implementation, the satellite node will respond to the user's registration response message {ID gs，k , γ gs，k , cv gs，k , x user，i ,ccd user，i ,pufs user，i , E.T. gs，k , PT gs，k ,} forwarded to the user terminal.

[0189] S410. The user terminal determines the user domain key information of the second target ground station according to the secret value and the ground station user domain key generation parameter information.

[0190] In specific implementation, the user terminal receives the registration response message {ID gs，k , γ gs，k , cv gs，k , x user，i ,ccd user，i ,pufs user，i , E.T. gs，k , PT gs，k ,}, according to the secret value x user，i and the ground station user domain key update value γ in the ground station user domain key generation parameter information gs，k Calculate the second target ground station user domain key information kd″ gs，k :kd″ gs，k =γ gs，k mod x user，i .

[0191] S411. The user terminal verifies the user registration request according to the second target ground station user domain key information and the ground station user domain key generation parameter information, and determines the PUF response value set of the user terminal corresponding to the PUF challenge value set of the user terminal after the verification is passed.

[0192] When implementing it specifically, you can follow the following steps: Figure 6 The process shown implements the verification of the user registration request by the user terminal, including the following steps:

[0193] S4111. The user terminal determines a target ground station user domain key confirmation value based on the ground station user domain key generation parameter information and the second target ground station user domain key information.

[0194] In specific implementation, the user terminal updates the ground station user domain key value γ in the ground station user domain key generation parameter. gs，k and the second target ground station user domain key information kd″ gs，k , calculate the target ground station domain key confirmation value cv″ based on the preset hash algorithm gs，k , which can be recorded as the second target ground station domain key confirmation value. Specifically, cv″ gs，k =h(ID ncc , γ gs，k , kd′ gs，k , E.T. gs，k , PT gs，k ).

[0195] S4112. The user terminal verifies the user registration request according to the target ground station user domain key confirmation value and the ground station user domain key confirmation value in the ground station user domain key generation parameter information to obtain a verification result.

[0196] In specific implementation, if the user terminal determines the target ground station user domain key confirmation value cv″ gs，k Equal to the ground station user domain key confirmation value cv in the ground station user domain key generation parameters gs，k , then the verification is confirmed to be successful, and the user terminal confirms that the ground station GS k The user domain key information and user registration process are correct. If the target ground station user domain key confirmation value cv″ is determined gs，k Not equal to the ground station user domain key confirmation value cv in the ground station user domain key generation parameters gs，k , then it is determined that the verification has failed.

[0197] S412: The user terminal sends the PUF response value set of the user terminal to the satellite node.

[0198] In specific implementation, if the verification is passed, the user terminal determines the PUF challenge value set pufs of the user terminal according to the physical unclonable function PUF user，i The corresponding PUF response value set pufr of the user terminal user，i : Among them, PUF (c user，1 ) is the PUF challenge value c user，1 The corresponding PUF response value, PUF(c user，2 ) is the PUF challenge value c user，2 The corresponding PUF response value, and so on, PUF challenge value The corresponding PUF response value.

[0199] Then, the user terminal calculates the hash value RPW based on the user feature. i and the secret value xuser，i Determine the perturbation secret value DX i : Perturbation Secret Value DX i Used to restore the secret value x user，i . According to the second target ground station user domain key information kd″ gs，k , user feature hash value RPW i , secret value x user，i and the preset hash algorithm to determine the disturbance domain key DKD i : DKD i Used to restore the ground station user domain key information. Verify the value information ccd according to the user authentication credentials user，i , user feature hash value RPW i , secret value x user，i , the second target ground station user domain key information kd″ gs，k , and the preset hash algorithm determines the disturbance authentication credential derived value DCCD i : Disturbance Authentication Credential Derived Value DCCD i Used to restore user authentication credential verification value information ccd user，i According to the perturbation secret value DX i , Disturbance Domain Key DKD i , Disturbance Authentication Credential Derived Value DCCD i , secret value x user，i , the second target ground station user domain key information kd″ gs，k , user authentication credential verification value information ccd user，i , the PUF challenge value set pufs of the user terminal user，i , and the preset hash algorithm determines the user login verification value ver i :ver i =h(DX i , DKD i , DCCD i , x user，i , kd′ gs，k ,ccd user，i ,pufs user，i , E.T. gs，k , PT gs，k ), user login verification value ver i Used to verify the user's login to the user terminal. Perturbation secret value DX i , Disturbance Domain Key DKD i , Disturbance Authentication Credential Derived Value DCCD i 、User login verification value ver i , public auxiliary string v i , as user Ui The registration parameters are used for the subsequent verification process of the user logging into the user terminal.

[0200] The user terminal sends the user U i The registration parameters {DX i , DKD i , DCCD i ,ver i , v i , E.T. gs，k , PT gs，k} and the PUF response value set pufr of the user terminal user，i Sent to satellite nodes.

[0201] S413: The satellite node forwards the PUF response value set of the user terminal to the ground station.

[0202] In specific implementation, the satellite node will i The registration parameters {DX i , DKD i , DCCD i ,ver i , E.T. gs，k , PT gs，k} and the PUF response value set pufr of the user terminal user，i Forward to ground station GS k .

[0203] S414: The ground station receives the PUF response value set of the user terminal and registers the user.

[0204] In specific implementation, the ground station GS k Received from user U i The registration parameters {DX i , DKD i , DCCD i ,ver i , v i , E.T. gs，k , PT gs，k} and the PUF response value set pufr of the user terminal user，i After that, for user U i Register. And according to the ground station's identification information ID gs，k , User identification information ID i , ground station user domain key information kd gs，k , and the preset hash algorithm determines the user's cross-domain intermediate verification value rac i :rac i =h(ID gs，k , ID i , kd gs，k), user cross-domain intermediate verification value rac i Used for the access request verification process when users cross-domain to access ground stations in other regions.

[0205] S415. The ground station uploads the user's registration information to the alliance chain.

[0206] In specific implementation, the ground station GS k User U i Registration information {ID ncc , ID gs，k , ID i ,ccd user，i ,rac i , E.T. gs，k , PT gs，k ,pufs user，i , pufr user，i}Upload to the alliance chain for storage, user U i The registration information includes: the identification information ID of the network control center ncc , ground station identification information ID gs，k , User identification information ID i , user authentication credential verification value information ccd user，i , the PUF challenge value set pufs of the user terminal user，i , the PUF response value set pufr of the user terminal user，i}, ground station user domain key information kd gs，k The expiration timestamp is ET gs，k , ground station user domain key information kd gs，k The release time stamp is PT gs，k , and can also include the user's cross-domain intermediate verification value rac i .

[0207] At this point, the ground station GS k For User U i The registration process is complete.

[0208] When user U i In the integrated space-ground network system, satellite nodes are connected to the ground station GS k Before obtaining the subscription service, you need to log in to the user terminal first, and then i Login verification is performed to confirm that the user of the user terminal is a legitimate user i and the authentication parameters stored in the user's terminal device are the same as those at the time of registration, complete and have not been tampered with.

[0209] like Figure 7 As shown, it is a schematic diagram of the user login verification process provided by an embodiment of the present application, which may include the following steps:

[0210] S51. The user terminal receives target user characteristic information input by the user.

[0211] In specific implementation, user U i Enter the target user's characteristic information in the user terminal, including: i Target identification information ID i ', target password information PW i ′ and target biometrics BIO i ′.

[0212] S52: The user terminal determines a target user feature hash value according to the target user feature information and a preset hash algorithm.

[0213] In the specific implementation, the user terminal reconstructs the biometric feature Rep and the target biometric feature BIO according to the public parameters. i ′Determine the target biometric key, according to the user U i Target identification information ID i ', target password information PW i ′、Target biometrics BIO i ’ and the preset hash algorithm to determine the target user feature hash value.

[0214] Specifically, the user terminal locally stores the user U i The registration parameters {DX i , DKD i , DCCD i ,ver i , v i , E.T. gs，k , PT gs，k}, the user terminal reconstructs the biometric feature Rep and the target biometric feature BIO according to the public parameters stored locally i ′ and public auxiliary string v i Calculate the target biometric key σ i ′:σ i ′=Rep(BIO i ′,v i ), and according to user U i Target identification information ID i ', target password information PW i ′, target biometric key σ i ' and the preset hash algorithm in the public parameters to calculate the target user feature hash value RPW i ′, specifically, RPW i ′=h(ID i ′, PW i ′,σ i ′).

[0215] S53: The user terminal determines the target user authentication credential verification value information according to the user's registration parameters, the target user characteristic hash value, and a preset hash algorithm.

[0216] In specific implementation, the user terminal i The perturbed secret value DX in the registration parameter i and target user feature hash value RPW i 'Determine the target secret value x' user，i : According to user U i The perturbation domain key DKD in the registration parameters i , target user feature hash value RPW i ′, target secret value x′ user，i and a preset hash algorithm to determine the user key information kd″′ of the third target ground station gs，k : According to user U i The perturbation authentication credential derived value DCCD in the registration parameters i , target user feature hash value RPW i ′, target secret value x′ user，i , the third target ground station user key information kd″′ gs，k , and a preset hash algorithm to determine the target user authentication credential verification value information ccd′ user，i , specifically,

[0217] S54. The user terminal determines the target user login verification value according to the user's registration parameters, the target user authentication credential verification value information, and a preset hash algorithm.

[0218] In specific implementation, the user terminal i The perturbed secret value DX in the registration parameter i , Disturbance Domain Key DKD i , Disturbance Authentication Credential Derived Value DCCD i , and the target secret value x′ user，i , the third target ground station user key information kd″′ gs，k , target user authentication credential verification value information ccd′ user，i , the PUF challenge value set pufs of the user terminal user，i , and the preset hash algorithm determines the target user login verification value ver i ', the target user login verification value ver is calculated by the following formula i ′:

[0219] ver i′=h(DX i , DKD i , DCCD i , x′ user，i，k d″′ gs，k , ccd′ user，i ,pufs user，i , E.T. gs，k , PT gs，k ).

[0220] S55. The user terminal performs login verification on the user according to the target user login verification value and the user login verification value in the user's registration parameters.

[0221] In specific implementation, if the user terminal determines the target user login verification value ver i ′ and user U i The user login verification value in the registration parameter ver i If they are equal, then user U is determined i The login verification is passed. If the target user login verification value is ver i ′ and user U i The user login verification value in the registration parameter ver i If they are not equal, then determine user U i The login verification of the user fails. When the user's login verification passes, the user terminal allows the user to i Execute the subsequent ground station local domain access authorization mechanism, ground station local domain disconnection access mechanism, cross-domain roaming access authorization mechanism, cross-domain roaming disconnection access mechanism, roaming settlement verification mechanism, user domain key information update mechanism, otherwise terminate the user U i operation.

[0222] like Figure 8 As shown, it is a flow chart of the authentication method of the integrated earth-ground network provided in the embodiment of the present application, which is an authorization authentication process for a user terminal to access a local domain ground station, and may specifically include the following steps:

[0223] S61. The user terminal sends an access request to the satellite node. The access request carries user identification information, encrypted user session key negotiation parameter information, and an access request verification value.

[0224] Among them, the user session key negotiation parameter information is a prime number randomly selected by the user terminal from the finite field of large prime numbers corresponding to the user; the encrypted user session key negotiation parameter information is determined by the user terminal based on the user session key negotiation parameter information, the identification information of the ground station, the identification information of the user, the first ground station user domain key information and the preset hash algorithm, and the first ground station user domain key information is generated by the user terminal according to the ground station user domain key generation parameter information obtained from the alliance chain. The user session key negotiation parameter information is used to negotiate the session key between the user and the ground station with the ground station, and is used with the access request verification value for the ground station to perform access authentication on the user terminal.

[0225] In specific implementation, any ground station GS k , Ground Station GS k Any user in the local domain i , and any satellite node L connected to the user terminal j Take this as an example to illustrate.

[0226] User terminal according to the ground station GS k The identification information of the ground station user domain key generation parameter information {ID gs，k , γ gs，k , cv gs，k , E.T. gs，k , PT gs，k}, and according to the user's identification information ID user，i Get user U from the alliance chain i The access request verification parameter of user U i Registration information {ID ncc , ID gs，k , ID user，i ,ccd user，i ,rac i , E.T. gs，k , PT gs，k ,pufs user，i , pufr user，i}, user U i The registration information includes the network control center's identification information ID ncc , Ground Station GS k Identification information ID gs，k 、User U i Identification information ID user，i , user authentication credential verification value information ccd user，i , user authentication credential verification value information ccd user，i It is a ground station GS k When registering, based on the user authentication credential information cc user，i Determined, user authentication credential information ccuser，i The network control center is based on the ground station GS k Assigned ground station domain key information kd gs The access request verification parameters also include the user cross-domain intermediate verification value rac i , the PUF challenge value set pufs of the user terminal user，i , the PUF response value set pufr of the user terminal user，i , and the current ground station user domain key information kd gs，k The expiration timestamp is ET gs，k、 Current ground station user domain key information kd gs，k The release time stamp is PT gs，k User U i The user terminal receives the large prime number P corresponding to the user of the local ground station gs，k Finite field of Randomly select a prime number k from i As user session key negotiation and trader parameter information, the user session key negotiation and trader parameter information is used to negotiate and trade the user session key with the ground station. The user terminal generates the first ground station user domain key information kd′ according to the ground station user domain key generation parameter information. gs，k , and then, the user terminal is based on the ground station's identification information ID gs，k , User identification information ID user，i , the first ground station user domain key information kd′ gs，k The user session key negotiation parameter information k is processed by the preset hash algorithm i Encrypt to obtain the encrypted user session key negotiation parameter information Enc_K i , Enc_K i It can also be called the user session key negotiation perturbation parameter.

[0227] Specifically, the user terminal receives data from the ground station GS k The set of prime numbers corresponding to the user Choose any prime number According to the selected prime number and the ground station user domain key update value Y in the ground station user domain key generation parameter information gs，k Calculate the first ground station user domain key information kd′ gs，k Specifically, the first ground station user domain key information

[0228] The user terminal generates the first ground station user domain key information kd′ gs，k After that, the encrypted user session key negotiation parameter information Enc_K can be calculated by the following formula: i :

[0229]

[0230] Furthermore, the user terminal obtains the user U from the alliance chain i The identification information of the network control center in the registration information, D ncc , ground station identification information ID gs，k 、User U i Identification information ID user，i , user authentication credential verification value information ccd user，i , the generated first ground station user domain key information kd′ gs，k , selected user session key negotiation parameter information k i And a preset hash algorithm is used to determine the access request verification value.

[0231] During implementation, the access request verification value ac can be calculated by the following formula: i :

[0232] ac i =h(ID ncc , ID gs，k , ID user，i , kd gs，k ,ccd user，i， k i , t 1 )

[0233] Among them, t 1 To determine the access request verification value ac i The timestamp of the

[0234] Then, the user terminal sends a signal to the satellite node L in the area covered by the current signal through the satellite-to-ground link. j Send an access request, which includes: the ground station's identification information ID gs，k , User identification information ID user，i , Encrypted user session key negotiation parameter information Enc_K i , access request verification value ac i , and also includes a timestamp t that determines the access request verification value 1 :{ID gs，k , ID user，i , Enc_K i , ac i , t 1}.

[0235] S62. The satellite node sends the access request of the user terminal and identification information of the satellite node to the ground station.

[0236] In specific implementation, the satellite node L jReceive the access request {ID gs，k , ID user，i , Enc_K i , ac i , t 1}, in the access request {ID gs，k , ID user，i , Enc_K i , ac i , t 1 Add satellite node L in j Identification information ID sat，j , get the user local access relay message {ID gs，k , ID sat，j , ID user，i , Enc_K i , ac i , t 1}, satellite node L j Relay message {ID gs k, ID sat，j , ID user，i , Enc-K i , ac i , t 1}Sent to the local ground station GS k .

[0237] S63. The ground station obtains the user's access request verification parameters from the alliance chain according to the user's identification information, and obtains the satellite node's authentication parameters from the alliance chain according to the satellite node's identification information.

[0238] Among them, the user's access request verification parameters are uploaded to the alliance chain after the ground station completes the user's registration, and the satellite node's authentication parameters are uploaded to the alliance chain after the network control center completes the satellite node registration. The user's access request verification parameters are used by the ground station to perform access authentication on the user terminal.

[0239] In specific implementation, the ground station GS k Receives an access request containing a user terminal and a satellite node L j The user local access relay message {ID gs，k , ID sat，j , ID user，i , Enc_K i , ac i , t 1}, first check the timestamp t 1 The validity of the 1 If the time difference between them is less than the preset duration, the timestamp t is determined. 1In accordance with the effectiveness requirements, the preset duration can be set according to needs, and the embodiments of the present application do not limit this.

[0240] Furthermore, the ground station GS k Based on the user's ID user，i Get user U from the alliance chain i The access request verification parameter of user U i Registration information {ID ncc , ID gs，k , ID user，i ,ccd user，i ,rac i , E.T. gs，k , PT gs，k ,pufs user，i , pufr user，i}, the access request verification parameters include: the identification information ID of the network control center ncc , Ground Station GS k Identification information ID gs，k 、User U i Identification information ID user，i , user authentication credential verification value information ccd user，i , user authentication credential verification value information ccd user，i It is a ground station GS k When registering a user, based on the user authentication credential information cc user，i Determined, user authentication credential informationcc user，i The network control center is based on the ground station GS k Assigned ground station domain key information kd gs The access request verification parameters also include the user cross-domain intermediate verification value rac i , the PUF challenge value set pufs of the user terminal user，i , the PUF response value set pufr of the user terminal user，i , and the current ground station user domain key information kd gs，k The expiration timestamp is ET gs，k , Current ground station user domain key information kd gs，k The release time stamp is PT gs，k .

[0241] Ground Station GS k According to the satellite node L j Identification information ID sat，j Get satellite node L from the alliance chain j The authentication parameters of the satellite node L j Registration information {ID ncc , ID sat，j,cc sat，j ,pufs sat，j , pufr sat，j , E.T. sat , PT sat}, satellite node L j The authentication parameters are completed by the network control center to the satellite node L j After registration, upload to the alliance chain, satellite node L j The authentication parameters include the network control center's identification information ID ncc , Satellite Node L j Identification information ID sat，j , Satellite certification certificate cc sat，j , Satellite Node L j PUF challenge value set pufs sat，j , Satellite Node L j PUF response value set pufr sat，j , and the current satellite domain key information kd sat The expiration timestamp is ET sat , current satellite domain key information kd sat The release time stamp is PT sat . Satellite certification certificate cc sat，j The network control center is responsible for the satellite node L j When registering, use the satellite domain key information kd sat It is determined by the preset hash algorithm and will not be elaborated here.

[0242] S64. The ground station decrypts the encrypted user session key negotiation parameter information to obtain the decrypted user session key negotiation parameter information, and authenticates the user according to the decrypted user session key negotiation parameter information, the access request verification parameter and the access request verification value.

[0243] In specific implementation, the ground station GS k According to the ground station GS k Identification information ID gs，k 、User U i Identification information ID user，i , ground station user domain key information kd gs，k , the timestamp t of the access request verification value 1 , and the user session key negotiation parameter information Ennc_K encrypted by the preset hash algorithm i Decrypt and obtain the decrypted user session key negotiation parameter information k i (It can be recorded as the first user session key negotiation parameter information).

[0244] Specifically, the ground station GS kThe encrypted user session key negotiation parameter information Ennc_K can be obtained by the following formula: i Decrypt and obtain the decrypted user session key negotiation parameter information k′ i :

[0245]

[0246] Furthermore, according to Fig. 9 The process shown implements the ground station's authentication of the user, which may include the following steps:

[0247] S641. The ground station determines the target access request verification value based on the identification information of the network control center, the identification information of the ground station, the identification information of the user, the user authentication credential verification value information, the ground station user domain key information, the decrypted user session key negotiation parameter information and the preset hash algorithm.

[0248] In specific implementation, the ground station GS k According to the identification information ID of the user network control center ncc , ground station identification information ID gs，k , User identification information ID user，i , user authentication credential verification value information ccd user，i , ground station user domain key information kd gs，k , decrypted user session key negotiation parameter information k′ i , the timestamp t of the access request verification value 1 And a preset hash algorithm is used to determine the target access request verification value.

[0249] Specifically, the ground station GS k The target access request verification value ac′ can be calculated by the following formula i :

[0250] ac′ i =h(ID ncc , ID gs，k , ID user，i， kd gs，k ,ccd user，i , k′ i , t 1 ).

[0251] S642: If it is determined that the target access request verification value is equal to the access request verification value, it is determined that the user is a legitimate user of the ground station.

[0252] In specific implementation, if the target access request verification value ac′ i Equal to the access request verification value ac i , Ground Station GS k Then we can determine user Ui Is its legitimate user.

[0253] S643: If it is determined that the target access request verification value is not equal to the access request verification value, it is determined that the user is not a legitimate user of the ground station.

[0254] In specific implementation, if the target access request verification value ac′ i Not equal to the access request verification value ac i , Ground Station GS k Then we can determine user U i Not its legitimate user, ground station GS k Reject User U i The user terminal accesses and terminates the authentication, and returns an authentication failure message to the user terminal.

[0255] If the ground station GS k After the user identity authentication is passed, further verification of user U is required i The security of user terminals can be improved to prevent user terminals from being cloned or tampered with.

[0256] S65. After determining that the user identity authentication is successful, the ground station generates an authorization challenge message according to the access request verification parameters and the authentication parameters of the satellite node obtained from the alliance chain.

[0257] The authorization challenge message is used to verify the legitimacy of the user terminal.

[0258] In specific implementation, the ground station GS k You can follow Fig.10 The process shown generates an authorization challenge message, including the following steps:

[0259] S651. Randomly select a prime number from the finite field of large prime numbers corresponding to the user of the ground station as a temporary random challenge value.

[0260] In specific implementation, the ground station GS k From the ground station GS k The finite field p of large prime numbers corresponding to the user gs，k Finite field of Randomly select a prime number as a temporary random challenge value trc sat i.

[0261] S652: Randomly select a PUF challenge value of a satellite node from the PUF challenge value set of the satellite nodes, and randomly select a PUF challenge value of a user terminal from the PUF challenge value set of the user terminals.

[0262] In specific implementation, the ground station GS k From satellite node L j PUF challenge value set Randomly select a satellite node L j The PUF challenge value c sat，j , and the PUF challenge value set from the user terminal A PUF challenge value c of a user terminal is randomly selected user，i .

[0263] S653. Determine the access authorization challenge response value according to the temporary random challenge value, the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the PUF challenge value of the satellite node, the PUF challenge value of the user terminal, the satellite authentication credential and the preset hash algorithm.

[0264] In specific implementation, the ground station GS k According to the temporary random challenge value trc sat，j , ground station identification information ID gs，k , Satellite Node L j Identification information ID sat，j , User identification information ID user，i , Satellite Node L j The PUF challenge value c sat，j , PUF challenge value c of the user terminal user，i , Satellite certification certificate cc sat，j And the preset hash algorithm to determine the access authorization challenge response value av 1 .

[0265] Specifically, the access authorization challenge response value av can be calculated by the following formula: 1 :

[0266]

[0267] Among them, t 2 To calculate the access authorization challenge response value av 1 The current timestamp.

[0268] S654: Determine an access authorization verification value according to the satellite authentication credential, the PUF challenge value of the satellite node, the PUF challenge value of the user terminal, the temporary random challenge value, and a preset hash algorithm.

[0269] In specific implementation, the ground station GS k According to the satellite certification certificate cc sat，j , Satellite Node L j The PUF challenge value c sat，j , PUF challenge value c of the user terminal user，i , temporary random challenge value trc sat，j And preset hash algorithm to determine the access authorization verification value av 2 .

[0270] Specifically, the access authorization verification value av can be calculated by the following formula: 2 :

[0271] av 2 =h(cC sat，j , C sat，j , C user，i , trc sat，j , t 2 )

[0272] Among them, t 2 To calculate the access authorization verification value av 2 The current timestamp of .

[0273] S655: Use the PUF challenge value of the satellite node, the PUF challenge value of the user terminal, the access authorization challenge response value and the access authorization verification value as an authorization challenge message.

[0274] When implemented, the ground station GS k The satellite node L j The PUF challenge value c sat，j , PUF challenge value c of the user terminal user，i , access authorization challenge response value av 1 And access authorization verification value av 2 As an authorization challenge message, the authorization challenge message may also include t 2 , that is, the authorization challenge message includes: sat，j , C user，i ,av 1 ,av 2 , t 2}.

[0275] S66. The ground station sends an authorization challenge message to the satellite node.

[0276] Specific implementation, ground station GS k The authorization challenge message {c sat，j , c user，i ,av 1 ,av 2 , t 2}Sent to satellite node L j .

[0277] S67. The satellite node authenticates the legitimacy of the user terminal according to the satellite domain key information and the authorization challenge message.

[0278] In specific implementation, the satellite node can be as follows Fig.11 The process shown here authenticates the legitimacy of the user terminal and includes the following steps:

[0279] S671. The satellite node determines the target satellite authentication credential based on the satellite domain key information and a preset hash algorithm.

[0280] In specific implementation, the satellite node L j Received from ground station GS k The authorization challenge message sent sat，j , c user，i ,av 1 ,av 2 , t 2}, first check the timestamp t 2 The validity of the timestamp t 2 If the time difference between the current time and the current time is within the valid time range, the timestamp t is determined. 2 Valid, the valid time range can be set by yourself, such as 1 second, or other values, which is not limited in this embodiment of the present application.

[0281] If the timestamp t 2 Valid, satellite node L j According to the identification information ID of the network control center ncc , Satellite Node L j Identification information ID sat，j , satellite domain key information kd sat , satellite domain key kd sat The expiration timestamp is ET sat , satellite domain key information kd sat The release time stamp is PT sat And the preset hash algorithm to determine the target satellite authentication certificate cc′ sat，j .

[0282] Specifically, the target satellite authentication certificate cc′ can be calculated by the following formula sat，j :

[0283] cc′ sat，j =h(ID ncc , ID sat，j , kd sat , E.T. sat , PT sat ).

[0284] Among them, the satellite domain key information kd sat It is pre-allocated to the satellite node by the network control center during the initialization phase.

[0285] S672. The satellite node determines the target temporary random challenge value based on the access authorization challenge response value, the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the target satellite authentication credential, the PUF challenge value of the satellite node, the PUF challenge value of the user terminal, and the preset hash algorithm.

[0286] In specific implementation, the satellite node L j According to the access authorization challenge response value av 1 , Ground Station GS k Identification information ID gs，k , Satellite Node L j Identification information ID sat，j 、User U i Identification information ID user，i , target satellite authentication certificate cc sat，j , Satellite Node L j The PUF challenge value c sat，j , PUF challenge value c of the user terminal user，i , timestamp t 2 And the preset hash algorithm to determine the target temporary random challenge value trc sat，j .

[0287] Specifically, the target temporary random challenge value trc′ can be calculated by the following formula: sat，j :

[0288]

[0289] S673. The satellite node determines the target access authorization verification value based on the target satellite authentication credential, the PUF challenge value of the satellite node, the PUF challenge value of the user terminal, the target temporary random challenge value and the preset hash algorithm.

[0290] In specific implementation, the satellite node L j According to the target satellite authentication certificate cc′ sat，j , Satellite Node L j The PUF challenge value c sat，j , PUF challenge value c of the user terminal user，i , target temporary random challenge value trc′ sat j, timestamp t 2 And preset hash algorithm to determine the target access authorization verification value av′ 2 .

[0291] Specifically, the target access authorization verification value av′ can be calculated by the following formula: 2 :

[0292] av′ 2 =h(cc′ sat，j , c sat，j , c user，i , trc′ sat，j , t 2 ).

[0293] S674: If the satellite node determines that the target access authorization verification value is equal to the access authorization verification value, the corresponding PUF response value of the satellite node is determined according to the PUF challenge value of the satellite node.

[0294] In specific implementation, the satellite node L j If the target access authorization verification value av′ is determined 2 With ground station GS k The authorization challenge message sent sat，j , c user，i ,av 1 ,av 2 , t 2}Access authorization verification value av 2 Equal, satellite node L j Confirm ground station GS k User U has been initially verified i The identity of user U is legal and needs further verification. i Whether the user terminal has been stolen, misappropriated or copied.

[0295] Satellite Node L j According to the satellite node L j The PUF challenge value c sat，j Determine the PUF response value r of the corresponding satellite node sat，j :r sat，j =PUF(C sat，j ).

[0296] S675. The satellite node determines the authentication verification value of the satellite node based on the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the target satellite authentication credential, the PUF response value of the satellite node, the target temporary random challenge value and the preset hash algorithm.

[0297] In specific implementation, the satellite node L j According to the ground station's identification information ID gs，k , Satellite Node L j Identification information ID sat，j 、User U i Identification information ID user，i , target satellite authentication certificate cc′ sat，j , Satellite Node L j The PUF response value r sat，j , target temporary random challenge value trc′ sat，j And the preset hash algorithm to determine the satellite node L j The authentication verification value av 3 .

[0298] Specifically, the satellite node L can be calculated by the following formula jThe authentication verification value av 3 :

[0299] av 3 =h(ID gs，k , ID sat，j , ID user，i , cc′ sat，j , r sat，j , trc′ sat，j , t 3 )

[0300] Among them, t 3 To calculate the satellite node L j The authentication verification value av 3 The current timestamp of satellite node L j The authentication verification value av 3 For subsequent ground station GS k For satellite node L j Perform identity authentication.

[0301] S676. The satellite node sends the authentication verification value of the satellite node to the ground station.

[0302] In specific implementation, the satellite node L j The satellite node L j The authentication verification value av 3 and timestamp t 3 :{av 3 , t 3} (i.e. satellite node verification message) is sent to the ground station GS k .

[0303] S677. The ground station determines a target authentication verification value of the satellite node according to the authentication parameters of the satellite node, and performs identity authentication on the satellite node according to the target authentication verification value of the satellite node and the authentication verification value of the satellite node.

[0304] In specific implementation, the ground station can Fig.12 The process shown here authenticates the satellite node and includes the following steps:

[0305] S71. The ground station receives the authentication verification value of the satellite node sent by the satellite node.

[0306] In specific implementation, the ground station GS k Receiving satellite node L j Satellite node L j The authentication verification value av 3 and timestamp t 3 :{av 3 , t 3}.

[0307] S72. The ground station queries the PUF response value of the satellite node corresponding to the PUF challenge value of the satellite node from the alliance chain according to the identification information of the satellite node and the PUF challenge value of the satellite node.

[0308] In specific implementation, the ground station GS k According to the satellite node L j Identification information ID sat，j and satellite node L j The PUF challenge value c sat，j Satellite node L stored in the alliance chain j Query the satellite node L in the PUF response value set j The PUF challenge value c sat，j The corresponding satellite node L j The PUF response value r sat，j .

[0309] S73. The ground station determines the target authentication verification value of the satellite node based on the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the satellite authentication credential, the PUF response value of the satellite node, the temporary random challenge value and the preset hash algorithm.

[0310] In specific implementation, the ground station GS k According to the ground station's identification information ID gs，k , Satellite Node L j Identification information ID sat，j 、User U i Identification information ID user，i , Satellite certification certificate cc sat，j , PUF challenge value c queried from the alliance chain sat，j The corresponding satellite node L j The PUF response value r sat，j , temporary random challenge value trc sat，j , timestamp t 3 And the preset hash algorithm to determine the satellite node L j The target authentication check value av′ 3 .

[0311] Specifically, the satellite node L can be calculated by the following formula j The target authentication check value av′ 3 :

[0312] av′ 3 =h(ID gs，k , ID sat，j , ID user，i , C.C. sat，j , r sat，j , trc sat，j , t 3).

[0313] S74. If the ground station determines that the target authentication check value of the satellite node is equal to the authentication check value of the satellite node, it determines that the satellite node identity authentication is successful.

[0314] In specific implementation, if the satellite node L j The target authentication check value av′ 3 With satellite node L j Satellite node L j The authentication verification value av 3 Equal, ground station GS k Then confirm that satellite node L j The identity of the satellite node L is legitimate and the forward session content has not been tampered with. j The identity authentication is passed.

[0315] S75. If the ground station determines that the target authentication check value of the satellite node is not equal to the authentication check value of the satellite node, it determines that the satellite node identity authentication has failed.

[0316] In specific implementation, if the satellite node L j The target authentication check value av′ 3 With satellite node L j Satellite node L j The authentication verification value av 3 Not equal, ground station GS k Then determine the satellite node L j The identity authentication of satellite node L fails. j The identity of the satellite node is illegal and the authentication of the satellite node is terminated.

[0317] S678. After the satellite node identity is authenticated, the ground station determines the ground station session key negotiation message according to the PUF challenge value of the user terminal, the PUF response value of the user terminal corresponding to the PUF challenge value of the user terminal, the temporary random challenge value and the satellite authentication credential.

[0318] Among them, the session key negotiation message is used by the ground station and the user to negotiate the ground station session key, and the ground station session key is used to encrypt data when transmitting data between the ground station and the user in the subsequent transmission.

[0319] In specific implementation, the ground station can be as follows: Fig.13 The process shown determines the ground station session key negotiation message, including the following steps:

[0320] S81. The ground station queries the alliance chain for a PUF response value of the user terminal corresponding to the PUF challenge value of the user terminal according to the user identification information and the PUF challenge value of the user terminal.

[0321] In specific implementation, the ground station GS k According to user U i Identification information ID user，i and the PUF challenge value c of the user terminal user，i Query the PUF challenge value c of the user terminal from the PUF response value set of the user terminal stored in the alliance chain user，i The corresponding PUF response value r of the user terminal user，i .

[0322] S82. Randomly select a prime number from a finite field of large prime numbers corresponding to users of the ground station as a ground station session key negotiation parameter.

[0323] In specific implementation, the ground station GS k The large prime number p corresponding to the user of the ground station gs，k Finite field of A prime number is randomly selected as the ground station session key negotiation parameter k gs，k ,

[0324] S83. Determine an intermediate verification value of the ground station for the user terminal according to the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the PUF challenge value of the user terminal, the PUF response value of the user terminal and a preset hash algorithm.

[0325] In specific implementation, the ground station GS k According to the ground station GS k Identification information ID gs，k , Satellite Node L j Identification information ID sat，j 、User U i Identification information ID user，i , PUF challenge value c of the user terminal user，i , the PUF response value r of the user terminal user，i , user session key negotiation parameter information k i And the preset hash algorithm determines the intermediate verification value mav of the ground station for the user terminal i .

[0326] Specifically, the intermediate verification value mav of the ground station for the user terminal can be calculated by the following formula: i :

[0327] mav i =h(ID gs，k , ID sat，j , ID user，i , c user，i , r user，i， k i ).

[0328] S84. Determine a disturbance value of the intermediate verification value of the ground station for the user terminal according to the intermediate verification value of the ground station for the user terminal, the satellite authentication credential, the PUF response value of the satellite node, the temporary random challenge value, and the preset hash algorithm.

[0329] In specific implementation, the ground station GS k According to the intermediate verification value mav of the ground station for the user terminal i , Satellite certification certificate cc sat，j , Satellite Node L j The PUF response value r sat，j , temporary random challenge value trc sat，j And the preset hash algorithm determines the disturbance value DMAV of the intermediate verification value of the ground station for the user terminal i .

[0330] Specifically, the disturbance value dmav of the intermediate verification value of the ground station for the user terminal can be calculated according to the following formula: i :

[0331]

[0332] Among them, t 4 To calculate the disturbance value dmav of the intermediate verification value of the ground station for the user terminal i The current timestamp of .

[0333] S85. Determine the session key negotiation disturbance parameter according to the ground station session key negotiation parameter, the ground station identification information, the satellite node identification information, the user identification information, the user session key negotiation parameter information, the PUF response value of the user terminal and the preset hash function.

[0334] In specific implementation, the ground station GS k Negotiate parameter k based on the ground station session key gs，k、 Ground Station GS k Identification information ID gs，k , Satellite Node L j Identification information ID sat，j 、User U i Identification information ID user，i , user session key negotiation parameter information k i , the PUF response value r of the user terminal user，i And the preset hash function determines the session key negotiation disturbance parameter Enc_K gs，k .

[0335] Specifically, the session key negotiation disturbance parameter Enc_K can be calculated by the following formula: gs，k :

[0336]

[0337] S86. Determine the session key between the user and the ground station based on the ground station identification information, the satellite node identification information, the user identification information, the user session key negotiation parameter information, the ground station session key negotiation parameter, the PUF response value of the user terminal and the preset hash algorithm.

[0338] In specific implementation, the ground station GS k According to the ground station GS k Identification information ID gs，k , Satellite Node L j Identification information ID sat，j 、User U i Identification information ID user，i , user session key negotiation parameter information k i , ground station session key negotiation parameter k gs，k , the PUF response value r of the user terminal user，i And preset hash algorithm to determine the session key between the user and the ground station Among them, the user session key negotiation parameter k i Negotiate the session key parameter k with the ground station gs，k Used to negotiate session keys between the user and the ground station.

[0339] Specifically, the session key between the user and the ground station can be calculated by the following formula:

[0340]

[0341] S87. Determine a session key negotiation parameter confirmation value according to the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the session key between the user and the ground station, the PUF response value of the user terminal, and a preset hash algorithm.

[0342] In specific implementation, the ground station GS k According to the ground station GS k Identification information ID gs，k , Satellite Node L j Identification information ID sat，j 、User U i Identification information ID user，i , the session key between the user and the ground station PUF response value r of the user terminal user，i And preset hash algorithm to determine the session key negotiation parameter confirmation value av 4 .

[0343] Specifically, the session key negotiation parameter confirmation value av can be calculated by the following formula: 4 :

[0344]

[0345] S88. Determine the verification value of the session key negotiation disturbance parameter and the intermediate verification value of the ground station for the user terminal based on the intermediate verification value of the ground station for the user terminal, the temporary random challenge value, the satellite authentication credential, the response value of the PUF of the satellite node, the session key negotiation disturbance parameter, the session key negotiation parameter confirmation value and the preset hash algorithm.

[0346] In specific implementation, the ground station GS k According to the intermediate verification value mav of the ground station for the user terminal i , temporary random challenge value trc sat，j , Satellite certification certificate cc sat，j , Satellite Node L j The PUF response value r sat，j , Session key negotiation disturbance parameter Enc-K gs，k , Session key negotiation parameter confirmation value av 4 and a preset hash algorithm to determine the verification value av of the session key negotiation disturbance parameter and the intermediate verification value of the ground station for the user terminal 5 .

[0347] Specifically, the verification value av of the session key negotiation disturbance parameter and the intermediate verification value of the ground station for the user terminal can be calculated by the following formula: 5 :

[0348] av 5 =h(mav i , trc sat，j , C.C. sat，j , r sat，j , Enc_K gs，k ,av 4 , t 4 ).

[0349] S89. Use the disturbance value of the intermediate verification value of the ground station for the user terminal, the session key negotiation disturbance parameter, the session key negotiation parameter confirmation value, and the verification value of the session key negotiation disturbance parameter and the intermediate verification value of the ground station for the user terminal as the ground station session key negotiation message.

[0350] In specific implementation, the ground station GS k The disturbance value dmav of the intermediate verification value of the ground station for the user terminal i , Session key negotiation disturbance parameter Enc-K gs，k , Session key negotiation parameter confirmation value av4 , the session key negotiation disturbance parameter and the check value av of the intermediate verification value of the ground station for the user terminal 5 , and timestamp t 4 As the ground station session key negotiation message: {dmav i , Enc-K gs，k ,av 4 ,av 5 , t 4}.

[0351] The parameters in the above-mentioned ground station session key negotiation message are used by the satellite node to authenticate the legitimacy of the ground station.

[0352] S679. The ground station sends a ground station session key negotiation message to the satellite node.

[0353] In specific implementation, the ground station GS k The ground station session key negotiation message {dmav i , Enc-K gs，k ,av 4 ,av 5 , t 4}Sent to satellite node L j .

[0354] S6710. The satellite node sends the PUF challenge value of the user terminal to the user terminal.

[0355] In specific implementation, the satellite node L j The satellite node L j The authentication verification value av 3 and timestamp t 3 :{av 3 , t 3}Sent to ground station GS k At the same time, the PUF challenge value c of the user terminal is also user，i Sent to the user terminal.

[0356] S6711. The user terminal determines a user session key parameter verification value based on the PUF challenge value of the user terminal and the user session key negotiation parameter information.

[0357] In specific implementation, the user terminal can determine the user session key parameter verification value in the following manner:

[0358] The user terminal determines the corresponding PUF response value of the user terminal according to the PUF challenge value of the user terminal, and determines the intermediate verification value of the user terminal according to the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the PUF challenge value of the user terminal, the PUF response value of the user terminal, the user session key negotiation parameter information and the preset hash algorithm, and determines the user session key parameter verification value according to the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the PUF challenge value of the user terminal, the intermediate verification value of the user terminal and the preset hash algorithm.

[0359] Specifically, the user terminal receives the satellite node L j The PUF challenge value c sent by the user terminal user，i Then, according to the PUF challenge value c of the user terminal user，i Calculate the PUF response value r of the corresponding user terminal user，i Specifically, the PUF response value r of the user terminal user，i =PUF(C user，i ).

[0360] Then, the user terminal receives the signal from the ground station GS. k Identification information ID gs，k , Satellite Node L j Identification information ID sat，j 、User U i Identification information ID user，i , PUF challenge value c of the user terminal user，i , the PUF response value r of the user terminal user，i , user session key negotiation parameter information k i And the preset hash algorithm to determine the intermediate verification value mav of the user terminal i Specifically, the intermediate verification value mav of the user terminal can be calculated by the following formula: i :

[0361] mav i =h(ID gs，k , ID sat，j , ID user，i , c user，i , r user，i，ki ).

[0362] Furthermore, the user terminal ground station GS k Identification information ID gs，k , Satellite Node L j Identification information ID sat，j 、User U i Identification information ID user，i , PUF challenge value c of the user terminal user，i, the intermediate verification value mav of the user terminal i And preset hash algorithm to determine the user session key parameter verification value av 6 Specifically, the user session key parameter verification value au can be calculated by the following formula: 6 :

[0363] av 6 =h(ID gs，k , ID sat，j , ID userv，i , c user，i , mav i , t 5 )

[0364] Among them, t 5 Calculate the user session key parameter verification value av 6 The current timestamp of .

[0365] S6712. The user terminal sends the user session key parameter verification value to the satellite node.

[0366] In specific implementation, the user terminal verifies the user session key parameter av 6 and timestamp t 5 :{av 6 , t 5} is sent to satellite node L as user PUF verification message j , user session key parameter verification value av 6 Used to verify the legitimacy of the user terminal.

[0367] S6713. The satellite node authenticates the ground station based on the ground station session key negotiation message.

[0368] In specific implementation, after receiving the ground station session key negotiation message sent by the ground station, the satellite node can follow the following steps: Fig.14 The process shown here authenticates the ground station and includes the following steps:

[0369] S91. The satellite node determines the target intermediate verification value of the ground station for the user terminal based on the disturbance value of the intermediate verification value of the ground station for the user terminal, the target satellite authentication credential, the PUF response value of the satellite node, the target temporary random challenge value and the preset hash algorithm.

[0370] In specific implementation, the satellite node L j Received from ground station GS k The ground station session key negotiation message {dmav i , Enc_K gs，k ,av 4 ,av 5 , t4}, first check the timestamp t 4 The validity of the time stamp t can be checked 2 The implementation process of the effectiveness is not described here.

[0371] If the timestamp t 4 Valid, satellite node L j According to the disturbance value DMAV of the intermediate verification value of the ground station for the user terminal i , target satellite authentication certificate cc′ sat，j , Satellite Node L j The PUF response value r sat，j , target temporary random challenge value trc′ sat，j And the preset hash algorithm determines the target intermediate verification value maav of the ground station for the user terminal i .

[0372] Specifically, the target intermediate verification value maav′ of the ground station for the user terminal can be calculated by the following formula: i :

[0373]

[0374] S92. Determine the target check value of the session key negotiation disturbance parameter and the intermediate verification value of the ground station for the user terminal based on the target intermediate verification value of the ground station for the user terminal, the target temporary random challenge value, the target satellite authentication credential, the PUF response value of the satellite node, the session key negotiation disturbance parameter, the session key negotiation parameter confirmation value and the preset hash function.

[0375] In specific implementation, the satellite node L j According to the target intermediate verification value mav′ of the ground station for the user terminal i , target temporary random challenge value trc′ sat，j , target satellite authentication certificate cc′ sat，j , Satellite Node L j The PUF response value r sat，j , Session key negotiation disturbance parameter Enc_K gs，k , Session key negotiation parameter confirmation value aav 4 And a preset hash function is used to determine the target verification value aav′ of the session key negotiation disturbance parameter and the intermediate verification value of the ground station for the user terminal 5 .

[0376] Specifically, the target verification value av′ of the session key negotiation disturbance parameter and the intermediate verification value of the ground station for the user terminal can be calculated by the following formula: 5 :

[0377] av′5 =h(mav′ i , trc′ sat，j , cc′ sat，j , r sat，j , Enc_K gs，k ,av 4 , t 4 ).

[0378] S93. If the target verification value of the session key negotiation perturbation parameter and the intermediate verification value of the ground station for the user terminal is equal to the verification value of the session key negotiation perturbation parameter and the intermediate verification value of the ground station for the user terminal, it is determined that the ground station identity authentication is successful.

[0379] In specific implementation, if the session key negotiation disturbance parameter is equal to the target verification value av′ of the intermediate verification value of the ground station for the user terminal 5 , negotiate the disturbance parameter with the session key and the check value av of the intermediate verification value of the ground station for the user terminal 5 Equal, satellite node L j Then confirm that the local ground station GS k The identity is legal, for the ground station GS k The identity authentication is passed.

[0380] S94. If the target verification value of the session key negotiation perturbation parameter and the intermediate verification value of the ground station for the user terminal is not equal to the verification value of the session key negotiation perturbation parameter and the intermediate verification value of the ground station for the user terminal, it is determined that the ground station identity authentication has failed.

[0381] In specific implementation, if the session key negotiation disturbance parameter is equal to the target verification value av′ of the intermediate verification value of the ground station for the user terminal 5 , negotiate the disturbance parameter with the session key and the check value av of the intermediate verification value of the ground station for the user terminal 5 Not equal, satellite node L j Then determine the ground station GS k The identity authentication fails and the authentication is terminated.

[0382] S6714. The satellite node authenticates the legitimacy of the user terminal based on the user session key parameter verification value and the ground station session key negotiation message.

[0383] In specific implementation, the satellite node can be as follows Fig.15 The process shown here authenticates the legitimacy of the user terminal and includes the following steps:

[0384] S101. The satellite node determines a target user session key parameter verification value according to the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the PUF challenge value of the user terminal, the target intermediate verification value of the ground station for the user terminal, and a preset hash algorithm.

[0385] In specific implementation, the satellite node L j Receive the user PUF verification message {av 6 , t 5}, first check the timestamp t 5 The validity of the timestamp t 5 Valid, satellite node L j According to the ground station GS k Identification information ID gs，k , Satellite Node L j Identification information ID sat，j , User U i Identification information ID user，i , PUF challenge value c of the user terminal user，i , the target intermediate verification value mav′ of the ground station for the user terminal i The target user session key parameter verification value aav′ is determined by the preset hash algorithm 6 .

[0386] Specifically, the target user session key parameter verification value aav′ can be calculated by the following formula: 6 :

[0387] av′ 6 =h(ID gs，k , ID sat，j , ID user，i , c user，i , mav′ i , t 5 ).

[0388] S102: If it is determined that the target user session key parameter verification value is equal to the user session key parameter verification value sent by the user terminal, it is determined that the legitimacy authentication of the user terminal is passed.

[0389] In specific implementation, if the target user session key parameter verification value av′ 6 Verify the user session key parameter av sent by the user terminal 6 Equal, satellite node L j It is determined that the legitimacy authentication of the user terminal has passed.

[0390] S103: If it is determined that the target user session key parameter verification value is not equal to the user session key parameter verification value sent by the user terminal, it is determined that the legitimacy authentication of the user terminal has failed.

[0391] In specific implementation, if the target user session key parameter verification value av′ 6 Verify the user session key parameter av sent by the user terminal 6 Not equal, satellite node L j It is determined that the legitimacy authentication of the user terminal has failed, and the authentication is terminated.

[0392] S68. After determining that the legitimacy authentication of the user terminal has passed, the satellite node sends a session key verification message to the user terminal.

[0393] In specific implementation, the satellite node L j After confirming that the legitimacy of the user terminal has been authenticated, the disturbance parameter Enc_K is negotiated based on the session key. gs，k , Session key negotiation parameter confirmation value av 4 , the target intermediate verification value mav′ of the ground station for the user terminal i , and a preset hash algorithm to determine the session key negotiation parameter verification value av 7 .

[0394] Specifically, the session key negotiation parameter verification value av can be calculated by the following formula: 7 :

[0395] av 7 =h(Enc_K gs，k ,av 4 , mav′ i , t 6 )

[0396] Among them, t 6 To calculate the session key negotiation parameter verification value av 7 The current timestamp of .

[0397] Satellite Node L j The disturbance value dmav of the intermediate verification value of the ground station for the user terminal i , Session key negotiation disturbance parameter Enc_K gs，k And the session key negotiation parameter verification value av 7 , timestamp t 4 ,t 6 As the satellite session key negotiation message {dmav i , Enc_K gs，k ,av 7 , t 4 , t 6The parameters in the satellite session key negotiation message are used by the user terminal to authenticate the legitimacy of the ground station and the satellite node.

[0398] S69. The user terminal performs identity authentication on the ground station and the satellite node based on the satellite session key negotiation message.

[0399] In specific implementation, the user terminal receives the satellite node L j The satellite session key negotiation message {dmav i , Enc_K gs，k ,av 7 , t 4 , t 6}, first check the timestamp t 4 and t 6 The effectiveness of 4 and t 6 If it is valid, the user terminal will send the following information to the ground station GS: k and satellite node L j Certification of the legality of:

[0400] The user terminal negotiates the disturbance parameter Enc_K based on the session key gs，k , Session key negotiation parameter confirmation value av 4 , the intermediate verification value mav of the ground station for the user terminal i , and a preset hash algorithm is used to determine the first target session key negotiation parameter verification value av′ 7 , if the first target session key negotiation parameter verification value av′ is determined 7 Negotiate the parameter verification value av with the session key 7 If they are equal, the user terminal determines the local ground station GS k and satellite node L j Legal, confirmed for ground station GS k The identity authentication of the satellite node L j If the identity authentication of the first target session key negotiation parameter verification value av′ is determined 7 Negotiate the parameter verification value av with the session key 7 If they are not equal, the user terminal determines that k and satellite node L j Authentication failed.

[0401] Specifically, the first target session key negotiation parameter verification value av′ can be calculated by the following formula: 7 :

[0402] av′ 7 =h(Enc_K gs，k ,av 4, mav i , t 6 ).

[0403] In one implementation, after the user terminal passes the legitimacy authentication of the ground station and the satellite node, it may further verify whether the session key jointly negotiated with the ground station is correct.

[0404] Specifically, after the user terminal determines that the identity authentication of the ground station and the satellite node is passed, the user terminal can Fig.16 The process shown verifies the accuracy of the session key negotiated with the ground station and includes the following processes:

[0405] S111. The user terminal determines the ground station target session key negotiation parameters according to the session key negotiation disturbance parameters, the ground station identification information, the satellite node identification information, the user identification information, the user session key negotiation parameter information, the PUF response value of the user terminal, and the preset hash algorithm.

[0406] In specific implementation, the user terminal negotiates the disturbance parameter Enc-K according to the session key gs，k , Ground Station GS k Identification information ID gs，k , Satellite Node L j Identification information ID sat，j 、User U i Identification information ID user，i , user session key negotiation parameter information k i , the PUF response value r of the user terminal user，i , and a preset hash algorithm to determine the ground station target session key negotiation parameter k′ gs，k .

[0407] Specifically, the ground station target session key negotiation parameter k′ can be calculated by the following formula: gs，k :

[0408]

[0409] S112. Determine the target session key between the user and the ground station based on the ground station's identification information, the satellite node's identification information, the user's identification information, the user's session key negotiation parameter information, the ground station's target session key negotiation parameter, the user terminal's PUF response value, and a preset hash algorithm.

[0410] In specific implementation, users can use the ground station GS k Identification information ID gs，k , Satellite Node L j Identification information ID sat，j 、User U i Identification information ID user，i, user session key negotiation parameter information k i , ground station target session key negotiation parameter k′ gs，k , the PUF response value r of the user terminal user，i , and the preset hash algorithm determines the target session key between the user and the ground station

[0411] Specifically, the target session key between the user and the ground station can be calculated by the following formula:

[0412]

[0413] S113. Determine a target session key negotiation parameter confirmation value according to the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the target session key between the user and the ground station, the PUF response value of the user terminal, and a preset hash algorithm.

[0414] In specific implementation, the user terminal uses the ground station GS k Identification information ID gs，k , Satellite Node L j Identification information ID sat，j 、User U i Identification information ID user，i , target session key between user and ground station PUF response value r of the user terminal user，i , and a preset hash algorithm to determine the target session key negotiation parameter confirmation value av′ 4 .

[0415] Specifically, the target session key negotiation parameter confirmation value av′ can be calculated by the following formula: 4 :

[0416]

[0417] s114. Determine a second target session key negotiation parameter verification value according to the session key negotiation disturbance parameter, the target session key negotiation parameter confirmation value, the intermediate verification value of the ground station for the user terminal, and a preset hash algorithm.

[0418] In specific implementation, the user terminal negotiates the disturbance parameter Enc_K according to the session key gs，k , target session key negotiation parameter confirmation value av′ 4 、The intermediate verification value mqv of the ground station for the user terminal i , and a preset hash algorithm to determine a second target session key negotiation parameter verification value av″ 7 .

[0419] Specifically, the second target session key negotiation parameter verification value av″ can be calculated by the following formula: 7 :

[0420] av″ 7 =h(Enc_K gs，k ,av′ 4 , mav i , t 6 ).

[0421] s115. If it is determined that the second target session key negotiation parameter verification value is equal to the session key negotiation parameter verification value, it is determined that the target session key between the user negotiated with the ground station and the ground station is correct.

[0422] In a specific implementation, if the second target session key negotiation parameter verification value av″ 7 Negotiate the parameter verification value av with the session key 7 If they are equal, the user terminal determines that it is connected to the ground station GS k Negotiated target session key between user and ground station correct.

[0423] S116: If it is determined that the second target session key negotiation parameter verification value is not equal to the session key negotiation parameter verification value, then determine to communicate with the ground station GS k The negotiated target session key between the user and the ground station is incorrect.

[0424] In a specific implementation, if the second target session key negotiation parameter verification value av″ 7 Negotiate the parameter verification value av with the session key 7 If they are not equal, the user terminal determines that k Negotiated target session key between user and ground station Incorrect.

[0425] S610. After determining that the legitimacy authentication of the user terminal has passed, the satellite node sends user identity authentication confirmation information to the ground station.

[0426] Among them, the user identity authentication confirmation information is used by the ground station to authenticate the legitimacy of the user terminal.

[0427] In specific implementation, the satellite node L j After determining that the legitimacy of the user terminal has been authenticated, the session key negotiation parameter verification value av is determined. 7 At the same time, according to the ground station GS k Identification information ID gs，k , Satellite Node L j Identification information ID sat，j 、User U iIdentification information ID user，i , PUF challenge value c of the user terminal user，i , the target intermediate verification value mav′ of the ground station for the user terminal i , and the preset hash algorithm determines the user identity authentication confirmation value av 8 .

[0428] Specifically, the user identity authentication confirmation value can be calculated by the following formula:

[0429] aav 8 =h(ID gs，k , ID sat，j , ID user，i , C user，i , mav′ i , t 6 )

[0430] Among them, t 6 To calculate the session key negotiation parameter verification value av 7 Confirm the user identity authentication value av 8 The current timestamp of .

[0431] Satellite Node L j The user identity authentication confirmation value av 8 and timestamp t 6 As user identity authentication confirmation information 8 , t 6}Sent to ground station GS k .

[0432] S611. The ground station performs legitimacy authentication on the user terminal based on the user identity authentication confirmation information.

[0433] In specific implementation, the ground station GS k Received from satellite node L j User identity authentication confirmation information sent 8 , t 6}, first check the timestamp t 6 The validity of the timestamp t 6 Valid, Ground Station GS k According to the ground station GS k Identification information ID gs，k , Satellite Node L j Identification information ID sat，j 、User U i Identification information ID user，i , PUF challenge value c of the user terminal user，i , the intermediate verification value maav of the ground station for the user terminal i, and a preset hash algorithm to determine the user identity authentication target confirmation value av′ 8 .

[0434] Specifically, the user identity authentication target confirmation value av′ can be calculated by the following formula: 8 :

[0435] av′ 8 =h(ID gs，k , ID sat，j , ID user，i , c user，i , mav i , t 6 ).

[0436] If the user identity authentication target confirmation value av′ is determined 8 Confirm the user identity authentication value av 8 Equal, ground station GS k Then it is determined that the legitimacy authentication of the user terminal has passed. If the user identity authentication target confirmation value av′ is determined 8 Confirm the user identity authentication value av 8 Not equal, ground station GS k It is determined that the legitimacy authentication of the user terminal has failed.

[0437] Ground Station GS k After the legitimacy of the user terminal is authenticated, the user U i The local domain access parameter {ID user，i , ID gs，k , ID sat，j , Enc_K i , ac i , t 1}Upload to the alliance chain for storage, so that the user U i To perform tracing, billing and other operations, user U i The local domain access parameters of the user terminal include: i Identification information ID user，i , Encrypted user session key negotiation parameter information Enc_K i , access request verification value ac i and determine the access request verification value ac i The timestamp of the

[0438] In one implementation, the present application also provides a domain key update mechanism. The domain key update mechanism can ensure that the domain key in the ground-ground network can be updated regularly. The domain key update mechanism may involve the ground station domain key kd gs , satellite domain key kd sat , each domain user domain key kdgs，k , where the ground station domain key and satellite domain key are updated by the network control center, and the user domain keys of each domain are updated by the ground stations of each domain. The following takes the network control center updating the ground station domain key and satellite domain key as an example for explanation.

[0439] like Fig.17 As shown, it is a schematic diagram of the ground station domain key update process, which may include the following steps:

[0440] S121. When the network control center determines that the ground station domain key update condition is met, the network control center randomly selects a prime number from a finite field of large prime numbers corresponding to the ground station as the updated first ground station domain key information.

[0441] In specific implementation, the network control center can pre-set the ground station domain key update conditions, such as: updating the ground station domain key according to a preset time period, and the preset time period can be set by itself, such as one week, half a month, or other durations, which are not limited in the embodiment of the present application. The ground station domain key can also be updated when a new ground station is added to the integrated space-ground network.

[0442] When a new time period arrives or a certain number of ground stations are added to the Tiandiyihua network, the network control center obtains the large prime number p corresponding to the ground station. gs Finite field of A prime number is randomly selected as the updated first ground station domain key information

[0443] S122: The network control center determines a ground station domain key update value according to the first ground station domain key information and the ground station domain key update function. In specific implementation, the ground station domain key update value may be calculated by the following ground station domain key update function:

[0444]

[0445] Among them, μ gs It is the secret reconstruction value corresponding to the ground station, used to reconstruct the ground station domain key.

[0446] S123. The network control center determines the ground station domain key update confirmation value according to the ground station domain key information, the first ground station domain key information, the ground station domain key update value, and a preset hash algorithm.

[0447] In specific implementation, the ground station domain key update confirmation value can be calculated by the following formula

[0448]

[0449] Among them, ID ncc It is the identification information of the network control center;

[0450] Update the value of the ground station domain key;

[0451] kd gs It is the domain key information of the current ground station;

[0452] The first ground station domain key information;

[0453] The expiration timestamp of the currently updated ground station domain key;

[0454] The update timestamp of the current ground station domain key.

[0455] S124. The network control center uploads the ground station domain key update value and the ground station domain key update confirmation value as a ground station domain key update generation message to the alliance chain.

[0456] In the specific implementation, the network control center will ncc , Ground station domain key update value Ground station domain key update confirmation value Expiration timestamp of the currently updated ground station domain key And the update timestamp of the current ground station domain key Generates a message as a ground station domain key update Generate a message to update the ground station domain key Upload to the alliance chain for storage. Among them, the ground station domain key update generation message is used to generate new ground station domain key information.

[0457] S125. The ground station obtains a ground station domain key update generation message from the alliance chain.

[0458] In specific implementation, the ground station GS k According to the identification information ID of the network control center ncc Get the ground station domain key update generation message from the alliance chain

[0459] S126. The ground station determines the second ground station domain key information according to the ground station domain key update value.

[0460] In specific implementation, the ground station GS k Verify the expiration timestamp of the currently updated ground station domain key And the update timestamp of the current ground station domain key The effectiveness of and If valid, the second ground station domain key information is calculated by the following formula

[0461]

[0462] in, Update the value of the ground station domain key;

[0463] x gs，k is the set of prime numbers corresponding to the ground station Any prime number in x gs，k ∈xs gs .

[0464] S127. The ground station determines the target ground station domain key update confirmation value according to the ground station domain key information, the second ground station domain key information, the ground station domain key update value, and a preset hash algorithm.

[0465] In specific implementation, the ground station GS k The target ground station domain key update confirmation value can be calculated by the following formula

[0466]

[0467] Among them, ID ncc It is the identification information of the network control center;

[0468] Update the value of the ground station domain key;

[0469] kd gs It is the domain key information of the current ground station;

[0470] The domain key information of the second ground station;

[0471] The expiration timestamp of the currently updated ground station domain key;

[0472] The update timestamp of the current ground station domain key.

[0473] S128. If the ground station determines that the target ground station domain key update confirmation value is equal to the ground station domain key update confirmation value, the ground station domain key information is updated to the second ground station domain key information.

[0474] In specific implementation, the ground station GS k Verify the target ground station domain key update confirmation value Confirm the value of the ground station domain key update Are they equal? ​​If Then the current ground station domain key information kd gs Updated to the second ground station domain key information

[0475] like Fig.18 As shown, it is a schematic diagram of the satellite domain key update process, which may include the following steps:

[0476] S131. When the network control center determines that the satellite domain key update condition is met, the network control center randomly selects a prime number from a finite field of large prime numbers corresponding to the satellite node as updated first satellite domain key information.

[0477] In specific implementation, the network control center can pre-set the satellite domain key update conditions, such as: updating the satellite domain key according to a preset time period, and the preset time period can be set by itself, such as one week, half a month, or other durations, which are not limited in the embodiment of the present application. The satellite domain key can also be updated when a new satellite node is added to the integrated space-ground network.

[0478] When a new time period arrives or a certain number of satellite nodes are added to the integrated space-ground network, the network control center calculates the value of the large prime number p corresponding to the satellite node. sat Finite field of A prime number is randomly selected as the updated first satellite station domain key information

[0479] S132: The network control center determines a satellite domain key update value according to the first satellite domain key information and a satellite domain key update function.

[0480] In specific implementation, the ground station domain key update value can be calculated by the following satellite domain key update function

[0481]

[0482] Among them, μ sat It is the secret reconstruction value corresponding to the satellite node, used to reconstruct the satellite domain key.

[0483] S133: The network control center determines a satellite domain key update confirmation value according to the satellite domain key information, the first satellite domain key information, the satellite domain key update value, and a preset hash algorithm.

[0484] In specific implementation, the satellite domain key update confirmation value can be calculated by the following formula

[0485]

[0486] Among them, ID ncc It is the identification information of the network control center;

[0487] Update the value for the satellite domain key;

[0488] kd sat is the current satellite domain key information;

[0489] is the first satellite domain key information;

[0490] The expiration timestamp of the currently updated satellite domain key;

[0491] The update timestamp of the current satellite domain key.

[0492] S134. The network control center uploads the satellite domain key update value and the satellite domain key update confirmation value as a satellite domain key update generation message to the alliance chain.

[0493] In the specific implementation, the network control center will ncc , Satellite domain key update value Satellite domain key update confirmation value The expiration timestamp of the currently updated satellite domain key and the update timestamp of the current satellite domain key Generates a message as a satellite domain key update Generate a satellite domain key update message Upload to the alliance chain for storage. Among them, the satellite domain key update generation message is used to generate new satellite domain key information.

[0494] S135. The satellite node obtains the satellite domain key update generation message from the alliance chain.

[0495] In specific implementation, the satellite node L j According to the identification information ID of the network control center ncc Get satellite domain key update generation message from the alliance chain

[0496] S136. The satellite node determines second satellite domain key information according to the satellite domain key update value.

[0497] In specific implementation, the satellite node L j Verify the expiration timestamp of the currently updated satellite domain key and the update timestamp of the current satellite domain key The effectiveness of and If valid, the second ground station domain key information is calculated by the following formula

[0498]

[0499] in, Update the value for the satellite domain key;

[0500] x sat，j is the prime number set corresponding to the satellite node Any prime number in x sat，j ∈xs sat .

[0501] S137. The satellite node determines a target satellite domain key update confirmation value according to the satellite domain key information, the second satellite domain key information, the satellite domain key update value, and a preset hash algorithm.

[0502] In specific implementation, the satellite node L j The target satellite domain key update confirmation value can be calculated by the following formula

[0503]

[0504] Among them, ID ncc It is the identification information of the network control center;

[0505] Update the value for the satellite domain key;

[0506] kd sat is the current satellite domain key information;

[0507] is the second satellite domain key information;

[0508] The expiration timestamp of the currently updated satellite domain key;

[0509] The update timestamp of the current satellite domain key.

[0510] S138. If the satellite node determines that the target satellite domain key update confirmation value is equal to the satellite domain key update confirmation value, the satellite domain key information is updated to the second satellite domain key information.

[0511] In specific implementation, the satellite node L j Verify the target satellite domain key update confirmation value Key update confirmation value with satellite domain Are they equal? ​​If Satellite Node L jIt confirms that the network control center has updated the satellite domain key and sets the current satellite domain key information kd sat Update to the second satellite domain key information

[0512] In the embodiments of the present application, the secret partitioning and reconstruction mechanism based on the Chinese remainder theorem enables the domain key to be updated based on pre-selected pairwise prime secret values ​​when a new satellite node, ground station or user is added to the system, without the need to completely replace the key base of the entire system, which can greatly reduce the system update overhead when a new node is added.

[0513] This application implements the proposed cross-domain tripartite authentication mechanism for the local and external domains of the integrated earth-sky network that combines the decentralized characteristics of the alliance chain and the Chinese remainder theorem secret sharing mechanism. The blockchain technology is used to ensure the immutability and traceability of node registration information, authentication messages, domain key release and update messages. At the same time, the dynamic update and reconstruction of the domain key is realized based on the Chinese remainder theorem, and it can adapt to the dynamic addition and revocation of satellite nodes, ground stations and users in each domain of the integrated earth-sky network. The distributed identity authentication and key negotiation mechanism solves the problem of high load and high security risk of the central authentication of a single node in the traditional network control center. The distributed identity authentication mechanism is realized by dividing the domain, and the integrated earth-sky network is divided into multiple domains. Each domain corresponds to a management node, where the management node for satellite nodes and ground stations in each domain is the network control center, and the management node for users in each domain is the ground station in each domain. When a user accesses, the traditional way of relying on a single network control center for verification is changed to authentication by ground stations in each domain, which reduces the performance and risk level of a single node and satisfies the mutual authentication between users, satellite nodes and ground stations in each domain. In addition, the shared key negotiation method based on random numbers can also reduce the computational overhead of traditional public key-based key negotiation.

[0514] Based on the same inventive concept, an embodiment of the present application also provides an authentication method for a space-ground integrated network implemented on a ground station side. Since the principle of solving the problem by the authentication method for a space-ground integrated network implemented on the ground station side is similar to that of the authentication method for a space-ground integrated network, the implementation of the authentication method for a space-ground integrated network implemented on the ground station side can refer to the implementation of the authentication method for a space-ground integrated network, and the repeated parts will not be repeated.

[0515] like Fig.19 As shown, it is a flow chart of the authentication method of the ground-to-earth network implemented by the ground station side provided in an embodiment of the present application, which may include the following steps:

[0516] S141. The ground station receives an access request from a user terminal and identification information of the satellite node sent by a satellite node. The access request carries the identification information of the user, encrypted user session key negotiation parameter information, and an access request verification value.

[0517] S142. Obtain the user's access request verification parameters from the alliance chain according to the user's identification information.

[0518] Among them, the user's access request verification parameters are uploaded to the alliance chain after the ground station completes the registration of the user.

[0519] S143. Decrypt the encrypted user session key negotiation parameter information to obtain decrypted user session key negotiation parameter information, and authenticate the user according to the decrypted user session key negotiation parameter information, the access request verification parameter and the access request verification value.

[0520] S144. Obtain authentication parameters of the satellite node from the alliance chain according to the identification information of the satellite node.

[0521] Among them, the authentication parameters of the satellite node are uploaded to the alliance chain after the network control center completes the registration of the satellite node.

[0522] S145. Determine a target authentication check value of the satellite node according to the authentication parameters of the satellite node, and perform identity authentication on the satellite node according to the target authentication check value.

[0523] In one embodiment, the access request verification parameter includes identification information of the network control center, identification information of the ground station, identification information of the user, and user authentication credential verification value information, wherein the user authentication credential verification value information is determined according to the user authentication credential information, and the user authentication credential information is determined according to the ground station domain key information;

[0524] Performing identity authentication on the user according to the decrypted user session key negotiation parameter information, the access request verification parameter, and the access request verification value specifically includes:

[0525] Determine a target access request verification value according to the identification information of the network control center, the identification information of the ground station, the identification information of the user, the user authentication credential verification value information, the ground station user domain key information, the decrypted user session key negotiation parameter information and a preset hash algorithm;

[0526] If it is determined that the target access request verification value is equal to the access request verification value, it is determined that the user is a legitimate user of the ground station;

[0527] If it is determined that the target access request verification value is not equal to the access request verification value, it is determined that the user is not a legitimate user of the ground station.

[0528] In one embodiment, the user session key negotiation parameter information is a prime number randomly selected by the user terminal from a finite field of large prime numbers corresponding to the user; the encrypted user session key negotiation parameter information is determined by the user terminal based on the user session key negotiation parameter information, the identification information of the ground station, the identification information of the user, the first ground station user domain key information and the preset hash algorithm, and the first ground station user domain key information is generated by the user terminal according to the ground station user domain key generation parameter information obtained from the alliance chain.

[0529] In one embodiment, the access request verification parameters also include a physical unclonable function PUF challenge value set of a user terminal and a PUF response value set of the user terminal, the authentication parameters of the satellite node include a satellite authentication credential, a PUF challenge value set of the satellite node, and a PUF response value set of the satellite node, and the satellite authentication credential is determined according to the satellite domain key information and the preset hash algorithm when the network control center registers the satellite node;

[0530] When it is determined that the user authentication is successful, the method further includes:

[0531] generating an authorization challenge message according to the access request verification parameter and the authentication parameter of the satellite node, wherein the authorization challenge message is used to verify the legitimacy of the user terminal;

[0532] The authorization challenge message is sent to the satellite node, so that the satellite node determines the target satellite authentication credential according to the satellite domain key information and the preset hash algorithm, determines the target temporary random challenge value according to the access authorization challenge response value, the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the target satellite authentication credential, the PUF challenge value of the satellite node, the PUF challenge value of the user terminal and the preset hash algorithm, and based on the target satellite authentication credential, the PUF challenge value of the satellite node, the PUF challenge value of the user terminal, the target temporary random challenge value, and the preset hash algorithm Method, determine the target access authorization verification value, if it is determined that the target access authorization verification value is equal to the access authorization verification value, the satellite node determines the corresponding PUF response value of the satellite node according to the PUF challenge value of the satellite node, and determines the authentication verification value of the satellite node according to the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the target satellite authentication credential, the PUF response value of the satellite node, the target temporary random challenge value, and the preset hash algorithm, and sends the authentication verification value of the satellite node to the ground station, and sends the PUF challenge value of the user terminal to the user terminal.

[0533] In one implementation, generating an authorization challenge message according to the access request verification parameter and the authentication parameter of the satellite node specifically includes:

[0534] Randomly select a prime number from the finite field of large prime numbers corresponding to the users of the ground station as a temporary random challenge value;

[0535] Randomly select a PUF challenge value of a satellite node from the set of PUF challenge values ​​of the satellite nodes, and randomly select a PUF challenge value of a user terminal from the set of PUF challenge values ​​of the user terminals;

[0536] Determine an access authorization challenge response value according to the temporary random challenge value, the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the PUF challenge value of the satellite node, the PUF challenge value of the user terminal, the satellite authentication credential, and the preset hash algorithm;

[0537] Determine an access authorization verification value according to the satellite authentication credential, the PUF challenge value of the satellite node, the PUF challenge value of the user terminal, the temporary random challenge value and the preset hash algorithm;

[0538] The PUF challenge value of the satellite node, the PUF challenge value of the user terminal, the access authorization challenge response value and the access authorization verification value are used as an authorization challenge message.

[0539] In one implementation, determining a target authentication check value of the satellite node according to the authentication parameter of the satellite node, and performing identity authentication on the satellite node according to the target authentication check value specifically includes:

[0540] Receiving an authentication check value of the satellite node sent by the satellite node;

[0541] Querying the PUF response value of the satellite node corresponding to the PUF challenge value of the satellite node from the alliance chain according to the identification information of the satellite node and the PUF challenge value of the satellite node;

[0542] Determine a target authentication check value of the satellite node according to the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the satellite authentication credential, the PUF response value of the satellite node, the temporary random challenge value and the preset hash algorithm;

[0543] If it is determined that the target authentication check value of the satellite node is equal to the authentication check value of the satellite node, it is determined that the identity authentication of the satellite node is passed;

[0544] If it is determined that the target authentication check value of the satellite node is not equal to the authentication check value of the satellite node, it is determined that the identity authentication of the satellite node has failed.

[0545] In one implementation, after the satellite node identity is authenticated, the method further includes:

[0546] Determine a ground station session key negotiation message according to the PUF challenge value of the user terminal, the PUF response value of the user terminal corresponding to the PUF challenge value of the user terminal, the temporary random challenge value, and the satellite authentication credential, wherein the session key negotiation message is used to negotiate a ground station session key with the user;

[0547] The ground station session key negotiation message is sent to the satellite node, so that the satellite node performs identity authentication on the ground station based on the authentication parameters of the satellite node and the ground station session key negotiation message.

[0548] In one implementation, determining a ground station session key negotiation message according to the PUF challenge value of the user terminal, the PUF response value of the user terminal corresponding to the PUF challenge value of the user terminal, the temporary random challenge value, and the satellite authentication credential specifically includes:

[0549] According to the user identification information and the PUF challenge value of the user terminal, query the PUF response value of the user terminal corresponding to the PUF challenge value of the user terminal from the alliance chain;

[0550] Randomly select a prime number from a finite field of large prime numbers corresponding to users of the ground station as a ground station session key negotiation parameter;

[0551] Determine, according to the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the PUF challenge value of the user terminal, the PUF response value of the user terminal, and a preset hash algorithm, an intermediate verification value of the ground station for the user terminal;

[0552] Determine a disturbance value of the intermediate verification value of the ground station for the user terminal according to the intermediate verification value of the ground station for the user terminal, the satellite authentication credential, the PUF response value of the satellite node, the temporary random challenge value and the preset hash algorithm;

[0553] Determine a session key negotiation perturbation parameter according to the ground station session key negotiation parameter, the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the user session key negotiation parameter information, the PUF response value of the user terminal, and the preset hash function;

[0554] Determine a session key between the user and the ground station according to the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the user session key negotiation parameter information, the ground station session key negotiation parameter, the PUF response value of the user terminal, and the preset hash algorithm;

[0555] Determine a session key negotiation parameter confirmation value according to the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the session key between the user and the ground station, the PUF response value of the user terminal, and the preset hash algorithm;

[0556] Determine, according to the intermediate verification value of the ground station for the user terminal, the temporary random challenge value, the satellite authentication credential, the response value of the PUF of the satellite node, the session key negotiation disturbance parameter, the session key negotiation parameter confirmation value, and the preset hash algorithm, a check value of the session key negotiation disturbance parameter and the intermediate verification value of the ground station for the user terminal;

[0557] The perturbation value of the intermediate verification value of the ground station for the user terminal, the session key negotiation perturbation parameter, the session key negotiation parameter confirmation value, and the verification value of the session key negotiation perturbation parameter and the intermediate verification value of the ground station for the user terminal are sent to the satellite node as a ground station session key negotiation message.

[0558] In one embodiment, before the ground station receives the access request of the user terminal forwarded by the satellite node, the method further includes:

[0559] Sending a ground station registration request to the network control center, wherein the ground station registration request carries identification information of the ground station;

[0560] Receive the target prime number, ground station user domain key reconstruction parameter information and ground station domain key generation parameter information sent by the network control center, the target prime number is a prime number randomly selected from the prime number set corresponding to the ground station obtained by randomly selecting two mutually prime prime numbers from the finite field of large prime numbers corresponding to the ground station by the network control center, the ground station user domain key reconstruction parameter information is determined by the network control center according to each prime number in the prime number set corresponding to the user of the ground station, the prime number set corresponding to the user of the ground station is obtained by randomly selecting two mutually prime prime numbers from the finite field of large prime numbers corresponding to the user of the ground station by the network control center, and the ground station domain key generation parameter information is obtained by the network control center from the alliance chain;

[0561] Determine a target ground station domain key confirmation value according to the ground station domain key generation parameter information and the target prime number, and verify the ground station domain key information according to the target ground domain key confirmation value and the ground station domain key confirmation value in the ground station domain key generation parameter information;

[0562] After the verification is passed, the ground station user domain key generation parameter information is determined according to the ground station user domain key reconstruction parameter information, and the ground station user domain key generation parameter information is uploaded to the alliance chain, so that the network control center obtains the ground station user domain key generation parameter information from the alliance chain, determines the first target ground station user domain key information according to the ground station user domain key generation parameter information, verifies the ground station registration request according to the first target ground station user domain key information and the ground station user domain key generation parameter information, and registers the ground station after the verification is passed, and uploads the registration information of the ground station to the alliance chain, the registration information of the ground station includes a ground station authentication credential, the ground station authentication credential is determined according to the ground station domain key information and a preset hash algorithm, and the ground station domain key information is determined according to the ground station domain key generation parameter information and the target prime number.

[0563] In one embodiment, the method further comprises:

[0564] receiving a user registration request sent by the user terminal and forwarded by the satellite node, wherein the user registration request carries the identification information of the user and a user feature hash value, wherein the user feature hash value is determined by the user terminal according to the identification information of the user, password information, the biometric key and the preset hash algorithm input by the user after the biometric key is determined according to the biometric fuzzy probability function and the biometric information input by the user;

[0565] Randomly select a prime number from the prime number set corresponding to the user as a secret value;

[0566] Randomly generate a PUF challenge value set of the user terminal according to the secret value and the physical unclonable function PUF;

[0567] Determine user authentication credential information according to the ground station domain key information and the preset hash algorithm, and determine user authentication credential verification value information according to the user authentication credential information and the preset hash algorithm;

[0568] Acquire the ground station user domain key generation parameter information from the alliance chain, and send a registration response message to the satellite node, wherein the registration response message includes the ground station user domain key generation parameter information, the secret value, the PUF challenge value set of the user terminal and the user authentication credential verification value information, and the satellite node forwards the registration response message to the user terminal, so that the user terminal determines the second target ground station user domain key information according to the secret value and the ground station user domain key generation parameter information, verifies the user registration request according to the second target ground station user domain key information and the ground station user domain key generation parameter information, and determines the PUF response value set of the user terminal corresponding to the PUF challenge value set of the user terminal after the verification is passed;

[0569] receiving a PUF response value set of the user terminal sent by the user terminal and forwarded by the satellite node, and registering the user;

[0570] The user's registration information is uploaded to the alliance chain, and the user's registration information includes the identification information of the network control center, the identification information of the ground station, the identification information of the user, the user authentication credential verification value information, the PUF challenge value set of the user terminal, and the PUF response value set of the user terminal.

[0571] Based on the same inventive concept, an embodiment of the present application also provides an authentication device for a space-ground integrated network implemented on a ground station side. Since the principle of solving the problem by the authentication device for a space-ground integrated network implemented on the ground station side is similar to the authentication method for a space-ground integrated network, the implementation of the authentication device for a space-ground integrated network implemented on the ground station side can refer to the implementation of the authentication method for a space-ground integrated network, and the repeated parts will not be repeated.

[0572] like Fig. 20 As shown, it is a schematic diagram of the structure of the authentication device of the ground-ground integrated network implemented on the ground station side provided by the embodiment of the present application, which may include:

[0573] The first receiving module 151 is used to receive an access request of a user terminal sent by a satellite node and identification information of the satellite node, wherein the access request carries the identification information of the user, encrypted user session key negotiation parameter information and an access request verification value;

[0574] A first acquisition module 152 is used to acquire the access request verification parameter of the user from the alliance chain according to the identification information of the user, where the access request verification parameter of the user is uploaded to the alliance chain after the ground station completes the registration of the user;

[0575] A first authentication module 153 is used to decrypt the encrypted user session key negotiation parameter information to obtain decrypted user session key negotiation parameter information, and perform identity authentication on the user according to the decrypted user session key negotiation parameter information, the access request verification parameter and the access request verification value;

[0576] The second acquisition module 154 is used to acquire the authentication parameters of the satellite node from the alliance chain according to the identification information of the satellite node, and the authentication parameters of the satellite node are uploaded to the alliance chain after the network control center completes the registration of the satellite node;

[0577] The second authentication module 155 is used to determine a target authentication verification value of the satellite node according to the authentication parameters of the satellite node, and perform identity authentication on the satellite node according to the target authentication verification value.

[0578] In one embodiment, the access request verification parameter includes identification information of the network control center, identification information of the ground station, identification information of the user, and user authentication credential verification value information, wherein the user authentication credential verification value information is determined according to the user authentication credential information, and the user authentication credential information is determined according to the ground station domain key information;

[0579] The first authentication module 153 is specifically used to determine the target access request verification value based on the identification information of the network control center, the identification information of the ground station, the identification information of the user, the user authentication credential verification value information, the ground station user domain key information, the decrypted user session key negotiation parameter information and a preset hash algorithm; if it is determined that the target access request verification value is equal to the access request verification value, it is determined that the user is a legitimate user of the ground station; if it is determined that the target access request verification value is not equal to the access request verification value, it is determined that the user is not a legitimate user of the ground station.

[0580] In one embodiment, the user session key negotiation parameter information is a prime number randomly selected by the user terminal from a finite field of large prime numbers corresponding to the user; the encrypted user session key negotiation parameter information is determined by the user terminal based on the user session key negotiation parameter information, the identification information of the ground station, the identification information of the user, the first ground station user domain key information and the preset hash algorithm, and the first ground station user domain key information is generated by the user terminal according to the ground station user domain key generation parameter information obtained from the alliance chain.

[0581] In one embodiment, the access request verification parameters also include a physical unclonable function PUF challenge value set of a user terminal and a PUF response value set of the user terminal, the authentication parameters of the satellite node include a satellite authentication credential, a PUF challenge value set of the satellite node, and a PUF response value set of the satellite node, and the satellite authentication credential is determined according to the satellite domain key information and the preset hash algorithm when the network control center registers the satellite node;

[0582] The device further comprises:

[0583] A first generating module, configured to generate an authorization challenge message according to the access request verification parameter and the authentication parameter of the satellite node when it is determined that the user authentication is passed, wherein the authorization challenge message is used to verify the legitimacy of the user terminal;

[0584] The first sending module is configured to send the authorization challenge message to the satellite node, so that the satellite node determines the target satellite authentication credential according to the satellite domain key information and the preset hash algorithm, determines the target temporary random challenge value according to the access authorization challenge response value, the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the target satellite authentication credential, the PUF challenge value of the satellite node, the PUF challenge value of the user terminal and the preset hash algorithm, and determines the target temporary random challenge value based on the target satellite authentication credential, the PUF challenge value of the satellite node, the PUF challenge value of the user terminal, the target temporary random challenge value, and the preset A hash algorithm is set to determine the target access authorization verification value. If it is determined that the target access authorization verification value is equal to the access authorization verification value, the satellite node determines the corresponding PUF response value of the satellite node according to the PUF challenge value of the satellite node, and determines the authentication verification value of the satellite node according to the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the target satellite authentication credential, the PUF response value of the satellite node, the target temporary random challenge value, and the preset hash algorithm, and sends the authentication verification value of the satellite node to the ground station, and sends the PUF challenge value of the user terminal to the user terminal.

[0585] In one embodiment, the first generation module is specifically used to randomly select a prime number from a finite field of large prime numbers corresponding to users of the ground station as a temporary random challenge value; randomly select a PUF challenge value of a satellite node from the PUF challenge value set of the satellite node, and randomly select a PUF challenge value of a user terminal from the PUF challenge value set of the user terminal; determine an access authorization challenge response value based on the temporary random challenge value, the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the PUF challenge value of the satellite node, the PUF challenge value of the user terminal, the satellite authentication credential, and the preset hash algorithm; determine an access authorization verification value based on the satellite authentication credential, the PUF challenge value of the satellite node, the PUF challenge value of the user terminal, the temporary random challenge value, and the preset hash algorithm; use the PUF challenge value of the satellite node, the PUF challenge value of the user terminal, the access authorization challenge response value, and the access authorization verification value as an authorization challenge message.

[0586] In one embodiment, the second authentication module 155 is specifically used to receive the authentication verification value of the satellite node sent by the satellite node; query the PUF response value of the satellite node corresponding to the PUF challenge value of the satellite node from the alliance chain according to the identification information of the satellite node and the PUF challenge value of the satellite node; determine the target authentication verification value of the satellite node according to the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the satellite authentication credential, the PUF response value of the satellite node, the temporary random challenge value and the preset hash algorithm; if it is determined that the target authentication verification value of the satellite node is equal to the authentication verification value of the satellite node, it is determined that the identity authentication of the satellite node is passed; if it is determined that the target authentication verification value of the satellite node is not equal to the authentication verification value of the satellite node, it is determined that the identity authentication of the satellite node has failed.

[0587] In one embodiment, the device further comprises:

[0588] The first determination module is used to determine a ground station session key negotiation message according to the PUF challenge value of the user terminal, the PUF response value of the user terminal corresponding to the PUF challenge value of the user terminal, the temporary random challenge value, and the satellite authentication credential after the satellite node identity authentication is passed, wherein the session key negotiation message is used to negotiate a ground station session key with the user; and send the ground station session key negotiation message to the satellite node so that the satellite node authenticates the ground station based on the authentication parameters of the satellite node and the ground station session key negotiation message.

[0589] In one embodiment, the first determination module is specifically used to query the PUF response value of the user terminal corresponding to the PUF challenge value of the user terminal from the alliance chain according to the user's identification information and the PUF challenge value of the user terminal; randomly select a prime number from the finite field of large prime numbers corresponding to the user of the ground station as the ground station session key negotiation parameter; determine the intermediate verification value of the ground station for the user terminal according to the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the PUF challenge value of the user terminal, the PUF response value of the user terminal and the preset hash algorithm. value; according to the intermediate verification value of the ground station for the user terminal, the satellite authentication credential, the PUF response value of the satellite node, the temporary random challenge value and the preset hash algorithm, determine the disturbance value of the intermediate verification value of the ground station for the user terminal; according to the ground station session key negotiation parameters, the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the user session key negotiation parameter information, the PUF response value of the user terminal and the preset hash function, determine the session key negotiation disturbance parameter; according to the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the user session key negotiation parameter information, the PUF response value of the user terminal and the preset hash function, determine the session key negotiation disturbance parameter; according to the identification information of the ground station, the identification information of the satellite node The session key between the user and the ground station is determined according to the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the user session key negotiation parameter information, the ground station session key negotiation parameter, the PUF response value of the user terminal and the preset hash algorithm; the session key negotiation parameter confirmation value is determined according to the intermediate verification value of the ground station for the user terminal, the temporary random challenge value, The satellite authentication credential, the response value of the PUF of the satellite node, the session key negotiation perturbation parameter, the session key negotiation parameter confirmation value and the preset hash algorithm are used to determine the verification value of the session key negotiation perturbation parameter and the intermediate verification value of the ground station for the user terminal; the perturbation value of the intermediate verification value of the ground station for the user terminal, the session key negotiation perturbation parameter, the session key negotiation parameter confirmation value, and the verification value of the session key negotiation perturbation parameter and the intermediate verification value of the ground station for the user terminal are sent to the satellite node as a ground station session key negotiation message.

[0590] In one embodiment, the device further comprises:

[0591] A second sending module is used to send a ground station registration request to the network control center before the ground station receives the access request of the user terminal forwarded by the satellite node, wherein the ground station registration request carries the identification information of the ground station;

[0592] A second receiving module is configured to receive a target prime number, ground station user domain key reconstruction parameter information and ground station domain key generation parameter information sent by the network control center, wherein the target prime number is a prime number randomly selected from a set of prime numbers corresponding to the ground station obtained by randomly selecting two mutually prime prime numbers from a finite field of large prime numbers corresponding to the ground station by the network control center, the ground station user domain key reconstruction parameter information is determined by the network control center according to each prime number in the set of prime numbers corresponding to the users of the ground station, the set of prime numbers corresponding to the users of the ground station is obtained by randomly selecting two mutually prime prime numbers from a finite field of large prime numbers corresponding to the users of the ground station by the network control center, and the ground station domain key generation parameter information is obtained by the network control center from the alliance chain;

[0593] A verification module, used to determine a target ground station domain key confirmation value according to the ground station domain key generation parameter information and the target prime number, and verify the ground station domain key information according to the target ground domain key confirmation value and the ground station domain key confirmation value in the ground station domain key generation parameter information;

[0594] The first upload module is used to determine the ground station user domain key generation parameter information according to the ground station user domain key reconstruction parameter information after the verification is passed, and upload the ground station user domain key generation parameter information to the alliance chain, so that the network control center obtains the ground station user domain key generation parameter information from the alliance chain, determines the first target ground station user domain key information according to the ground station user domain key generation parameter information, verifies the ground station registration request according to the first target ground station user domain key information and the ground station user domain key generation parameter information, registers the ground station after the verification is passed, and uploads the registration information of the ground station to the alliance chain, the registration information of the ground station includes a ground station authentication credential, the ground station authentication credential is determined according to the ground station domain key information and a preset hash algorithm, and the ground station domain key information is determined according to the ground station domain key generation parameter information and the target prime number.

[0595] In one embodiment, the device further comprises:

[0596] A third receiving module is configured to receive a user registration request sent by the user terminal and forwarded by the satellite node, wherein the user registration request carries the identification information of the user and a user feature hash value, and the user feature hash value is determined by the user terminal according to the identification information of the user, the password information, the biometric key and the preset hash algorithm input by the user after the biometric key is determined according to the biometric fuzzy probability function and the biometric information input by the user;

[0597] A selection module, used to randomly select a prime number from the prime number set corresponding to the user as a secret value;

[0598] A second generating module is used to randomly generate a PUF challenge value set of the user terminal according to the secret value and the physical unclonable function PUF;

[0599] The second determination module is used to determine the user authentication credential information according to the ground station domain key information and the preset hash algorithm, and determine the user authentication credential verification value information according to the user authentication credential information and the preset hash algorithm;

[0600] A third sending module is used to obtain the ground station user domain key generation parameter information from the alliance chain, and send a registration response message to the satellite node, wherein the registration response message includes the ground station user domain key generation parameter information, the secret value, the PUF challenge value set of the user terminal and the user authentication credential verification value information, and the satellite node forwards the registration response message to the user terminal, so that the user terminal determines the second target ground station user domain key information according to the secret value and the ground station user domain key generation parameter information, verifies the user registration request according to the second target ground station user domain key information and the ground station user domain key generation parameter information, and determines the PUF response value set of the user terminal corresponding to the PUF challenge value set of the user terminal after the verification is passed;

[0601] A registration module, configured to receive a PUF response value set of the user terminal sent by the user terminal and forwarded by the satellite node, and register the user;

[0602] The second uploading module is used to upload the user's registration information to the alliance chain, and the user's registration information includes the identification information of the network control center, the identification information of the ground station, the identification information of the user, the user authentication credential verification value information, the PUF challenge value set of the user terminal and the PUF response value set of the user terminal.

[0603] Based on the same inventive concept, an embodiment of the present application also provides an authentication method for a space-ground integrated network implemented on a satellite node side. Since the principle of solving the problem by the authentication method for a space-ground integrated network implemented on the satellite node side is similar to that of the authentication method for a space-ground integrated network, the implementation of the authentication method for a space-ground integrated network implemented on the satellite node side can refer to the implementation of the authentication method for a space-ground integrated network, and the repeated parts will not be repeated.

[0604] like Fig.21As shown, it is a flow chart of the authentication method of the space-ground integrated network implemented by the satellite node side provided in the embodiment of the present application, which may include the following steps:

[0605] S161. The satellite node receives an access request sent by a user terminal. The access request carries user identification information, encrypted user session key negotiation parameter information, and an access request verification value.

[0606] S162. Send the access request and the identification information of the satellite node to the ground station, so that the ground station obtains the user's access request verification parameters from the alliance chain according to the user's identification information, decrypts the encrypted user session key negotiation parameter information to obtain the decrypted user session key negotiation parameter information, and authenticates the user according to the decrypted user session key negotiation parameter information, the access request verification parameters and the access request verification value.

[0607] Among them, the user's access request verification parameters are uploaded to the alliance chain after the ground station completes the registration of the user.

[0608] S163. Receive an authorization challenge message sent by the ground station, where the authorization challenge message is used to verify the legitimacy of the user terminal.

[0609] Among them, the authorization challenge message is determined by the ground station after determining that the user identity authentication is passed, based on the access request verification parameters and the authentication parameters of the satellite node obtained from the alliance chain according to the identification information of the satellite node; the authentication parameters of the satellite node are uploaded to the alliance chain after the network control center completes the registration of the satellite node.

[0610] S164: Authenticate the legitimacy of the user terminal according to the satellite domain key information and the authorization challenge message.

[0611] S165. Receive a ground station session key negotiation message sent by the ground station, and perform identity authentication on the ground station based on the authentication parameters of the satellite node and the ground station session key negotiation message.

[0612] The ground station session key negotiation message is determined by the ground station according to the authentication parameters of the satellite node obtained from the alliance chain.

[0613] In one embodiment, the authentication parameters of the satellite node include a satellite authentication credential, a set of physical unclonable function PUF challenge values ​​of the satellite node, and a set of PUF response values ​​of the satellite node. The satellite authentication credential is determined according to satellite domain key information and a preset hash algorithm when the network control center registers the satellite node; the authorization challenge message includes a PUF challenge value of the satellite node, a PUF challenge value of the user terminal, an access authorization challenge response value, and an access authorization verification value; the PUF challenge value of the satellite node is randomly selected by the ground station from the PUF challenge value set of the satellite node, the PUF challenge value of the user terminal is randomly selected by the ground station from the PUF challenge value set of the user terminal, and the access authorization challenge response value is determined by the ground station according to a temporary random challenge value, identification information of the ground station, identification information of the satellite node, identification information of the user, PUF challenge value of the satellite node, PUF challenge value of the user terminal, satellite authentication credential, and the preset hash algorithm, and the temporary random challenge value is a prime number randomly selected by the ground station from a finite field of large prime numbers corresponding to the user of the ground station.

[0614] In one implementation, authenticating the legitimacy of the user terminal according to the satellite domain key information and the authorization challenge message specifically includes:

[0615] Determine the target satellite authentication credential according to the satellite domain key information and the preset hash algorithm;

[0616] Determine a target temporary random challenge value according to the access authorization challenge response value, the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the target satellite authentication credential, the PUF challenge value of the satellite node, the PUF challenge value of the user terminal, and the preset hash algorithm;

[0617] Determine a target access authorization verification value based on the target satellite authentication credential, the PUF challenge value of the satellite node, the PUF challenge value of the user terminal, the target temporary random challenge value, and the preset hash algorithm;

[0618] If it is determined that the target access authorization verification value is equal to the access authorization verification value, determining a corresponding PUF response value of the satellite node according to the PUF challenge value of the satellite node;

[0619] Determine the authentication check value of the satellite node according to the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the target satellite authentication credential, the PUF response value of the satellite node, the target temporary random challenge value and the preset hash algorithm; and

[0620] Sending the authentication check value of the satellite node to the ground station, so that the ground station performs identity authentication on the satellite node based on the authentication check value of the satellite node;

[0621] Sending the PUF challenge value of the user terminal to the user terminal, so that the user terminal determines the corresponding PUF response value of the user terminal according to the PUF challenge value of the user terminal, and determining the intermediate verification value of the user terminal according to the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the PUF challenge value of the user terminal, the PUF response value of the user terminal, the user session key negotiation parameter information and the preset hash algorithm, and determining the user session key parameter verification value according to the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the PUF challenge value of the user terminal, the intermediate verification value of the user terminal and the preset hash algorithm;

[0622] Receiving the user session key parameter verification value sent by the user terminal;

[0623] receiving a ground station session key negotiation message sent by the ground station;

[0624] Authenticating the ground station according to the ground station session key negotiation message; and

[0625] The legitimacy of the user terminal is authenticated according to the user session key parameter verification value and the ground station session key negotiation message.

[0626] In one embodiment, the ground station session key negotiation message includes a perturbation value of the ground station for the intermediate verification value of the user terminal, the session key negotiation perturbation parameter, the session key negotiation parameter confirmation value, and a check value of the session key negotiation perturbation parameter and the intermediate verification value of the ground station for the user terminal;

[0627] Performing identity authentication on the ground station according to the ground station session key negotiation message specifically includes:

[0628] Determine a target intermediate verification value of the ground station for the user terminal according to a disturbance value of the intermediate verification value of the ground station for the user terminal, the target satellite authentication credential, a PUF response value of the satellite node, the target temporary random challenge value, and the preset hash algorithm;

[0629] Determine, according to the target intermediate verification value of the ground station for the user terminal, the target temporary random challenge value, the target satellite authentication credential, the PUF response value of the satellite node, the session key negotiation perturbation parameter, the session key negotiation parameter confirmation value, and the preset hash function, a target check value of the session key negotiation perturbation parameter and the intermediate verification value of the ground station for the user terminal;

[0630] If the target verification value of the session key negotiation perturbation parameter and the intermediate verification value of the ground station for the user terminal is determined to be equal to the verification value of the session key negotiation perturbation parameter and the intermediate verification value of the ground station for the user terminal, it is determined that the ground station identity authentication is passed.

[0631] In one implementation, authenticating the legitimacy of the user terminal according to the user session key parameter verification value and the ground station session key negotiation message specifically includes:

[0632] Determine a target user session key parameter verification value according to the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the PUF challenge value of the user terminal, the target intermediate verification value of the ground station for the user terminal, and the preset hash algorithm;

[0633] If it is determined that the target user session key parameter verification value is equal to the user session key parameter verification value sent by the user terminal, it is determined that the legitimacy authentication of the user terminal is passed;

[0634] If it is determined that the target user session key parameter verification value is not equal to the user session key parameter verification value sent by the user terminal, it is determined that the legitimacy authentication of the user terminal has failed.

[0635] In one implementation, after determining that the legitimacy authentication of the user terminal is passed, the method further includes:

[0636] Determining a session key negotiation parameter verification value according to the session key negotiation disturbance parameter, the session key negotiation parameter confirmation value, a target intermediate verification value of the ground station for the user terminal, and the preset hash algorithm;

[0637] The perturbation value of the intermediate verification value of the ground station for the user terminal, the session key negotiation perturbation parameter, and the session key negotiation parameter verification value are sent to the user terminal as a satellite session key negotiation message, so that the user terminal determines a first target session key negotiation parameter verification value according to the session key negotiation perturbation parameter, the session key negotiation parameter confirmation value, the intermediate verification value of the ground station for the user terminal, and the preset hash algorithm. If it is determined that the first target session key negotiation parameter verification value is equal to the session key negotiation parameter verification value, the user terminal determines that the identity authentication of the ground station and the identity authentication of the satellite node are passed, and determines the ground station target session key negotiation parameter according to the session key negotiation perturbation parameter, the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the user session key negotiation parameter information, the PUF response value of the user terminal, and the preset hash algorithm. , the identification information of the satellite node, the identification information of the user, the user session key negotiation parameter information, the ground station target session key negotiation parameter, the PUF response value of the user terminal, and the preset hash algorithm to determine the target session key between the user and the ground station, and determine a target session key negotiation parameter confirmation value according to the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the target session key between the user and the ground station, the PUF response value of the user terminal, and the preset hash algorithm, and determine a second target session key negotiation parameter verification value according to the session key negotiation perturbation parameter, the target session key negotiation parameter confirmation value, the intermediate verification value of the ground station for the user terminal, and the preset hash algorithm; if it is determined that the second target session key negotiation parameter verification value is equal to the session key negotiation parameter verification value, then the user terminal determines that the target session key between the user and the ground station negotiated with the ground station is correct;

[0638] Determine a user identity authentication confirmation value according to the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the PUF challenge value of the user terminal, the target intermediate verification value of the ground station for the user terminal, and the preset hash algorithm;

[0639] The user identity authentication confirmation value is sent to the ground station, so that the ground station determines the user identity authentication target confirmation value according to the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the PUF challenge value of the user terminal, the intermediate verification value of the ground station for the user terminal, and the preset hash algorithm. If it is determined that the user identity authentication target confirmation value is equal to the user identity authentication confirmation value, the ground station determines that the legitimacy authentication of the user terminal has passed.

[0640] Based on the same inventive concept, an embodiment of the present application also provides an authentication device for a space-ground integrated network implemented on a satellite node side. Since the principle of solving the problem by the authentication device for a space-ground integrated network implemented on the satellite node side is similar to the authentication method for a space-ground integrated network, the implementation of the authentication device for a space-ground integrated network implemented on the satellite node side can refer to the implementation of the authentication method for a space-ground integrated network, and the repeated parts will not be repeated.

[0641] like Fig. 22 As shown, it is a structural diagram of an authentication device for a space-ground integrated network implemented on a satellite node side provided in an embodiment of the present application, which may include:

[0642] The first receiving module 171 is used to receive an access request sent by a user terminal, wherein the access request carries user identification information, encrypted user session key negotiation parameter information and an access request verification value;

[0643] A first sending module 172 is used to send the access request and the identification information of the satellite node to the ground station, so that the ground station obtains the access request verification parameter of the user from the alliance chain according to the identification information of the user, decrypts the encrypted user session key negotiation parameter information to obtain the decrypted user session key negotiation parameter information, and authenticates the user according to the decrypted user session key negotiation parameter information, the access request verification parameter and the access request verification value, wherein the access request verification parameter of the user is uploaded to the alliance chain by the ground station after completing the registration of the user;

[0644] The second receiving module 173 is used to receive an authorization challenge message sent by the ground station, where the authorization challenge message is used to verify the legitimacy of the user terminal. The authorization challenge message is determined by the ground station after determining that the user identity authentication is passed, based on the access request verification parameter and the authentication parameter of the satellite node obtained from the alliance chain based on the identification information of the satellite node. The authentication parameter of the satellite node is uploaded to the alliance chain after the network control center completes the registration of the satellite node;

[0645] A first authentication module 174, configured to authenticate the legitimacy of the user terminal according to the satellite domain key information and the authorization challenge message;

[0646] The second authentication module 175 is used to receive a ground station session key negotiation message sent by the ground station, and to authenticate the ground station based on the authentication parameters of the satellite node and the ground station session key negotiation message. The ground station session key negotiation message is determined by the ground station based on the authentication parameters of the satellite node obtained from the alliance chain.

[0647] In one embodiment, the authentication parameters of the satellite node include a satellite authentication credential, a set of physical unclonable function PUF challenge values ​​of the satellite node, and a set of PUF response values ​​of the satellite node. The satellite authentication credential is determined according to satellite domain key information and a preset hash algorithm when the network control center registers the satellite node; the authorization challenge message includes a PUF challenge value of the satellite node, a PUF challenge value of the user terminal, an access authorization challenge response value, and an access authorization verification value; the PUF challenge value of the satellite node is randomly selected by the ground station from the PUF challenge value set of the satellite node, the PUF challenge value of the user terminal is randomly selected by the ground station from the PUF challenge value set of the user terminal, and the access authorization challenge response value is determined by the ground station according to a temporary random challenge value, identification information of the ground station, identification information of the satellite node, identification information of the user, PUF challenge value of the satellite node, PUF challenge value of the user terminal, satellite authentication credential, and the preset hash algorithm, and the temporary random challenge value is a prime number randomly selected by the ground station from a finite field of large prime numbers corresponding to the user of the ground station.

[0648] In one embodiment, the first authentication module 174 is specifically used to determine the target satellite authentication credential according to the satellite domain key information and the preset hash algorithm; determine the target temporary random challenge value according to the access authorization challenge response value, the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the target satellite authentication credential, the PUF challenge value of the satellite node, the PUF challenge value of the user terminal and the preset hash algorithm; determine the target access authorization verification value based on the target satellite authentication credential, the PUF challenge value of the satellite node, the PUF challenge value of the user terminal, the target temporary random challenge value and the preset hash algorithm; if it is determined that the target access authorization verification value is equal to the access authorization verification value, determine the corresponding PUF response value of the satellite node according to the PUF challenge value of the satellite node; determine the authentication verification value of the satellite node according to the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the target satellite authentication credential, the PUF response value of the satellite node, the target temporary random challenge value and the preset hash algorithm; and send the authentication verification value of the satellite node to the A ground station, so that the ground station performs identity authentication on the satellite node based on the authentication check value of the satellite node; sends the PUF challenge value of the user terminal to the user terminal, so that the user terminal determines the corresponding PUF response value of the user terminal according to the PUF challenge value of the user terminal, and determines the intermediate verification value of the user terminal according to the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the PUF challenge value of the user terminal, the PUF response value of the user terminal, the user session key negotiation parameter information and the preset hash algorithm, and determines the user session key parameter verification value according to the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the PUF challenge value of the user terminal, the intermediate verification value of the user terminal and the preset hash algorithm; receives the user session key parameter verification value sent by the user terminal; receives the ground station session key negotiation message sent by the ground station; performs identity authentication on the ground station according to the ground station session key negotiation message; and authenticates the legitimacy of the user terminal according to the user session key parameter verification value and the ground station session key negotiation message.

[0649] In one embodiment, the ground station session key negotiation message includes a perturbation value of the ground station for the intermediate verification value of the user terminal, the session key negotiation perturbation parameter, the session key negotiation parameter confirmation value, and a check value of the session key negotiation perturbation parameter and the intermediate verification value of the ground station for the user terminal;

[0650] The first authentication module 174 is specifically used to determine the target intermediate verification value of the ground station for the user terminal according to the disturbance value of the intermediate verification value of the ground station for the user terminal, the target satellite authentication credential, the PUF response value of the satellite node, the target temporary random challenge value, and the preset hash algorithm; determine the target verification value of the session key negotiation disturbance parameter and the intermediate verification value of the ground station for the user terminal according to the target intermediate verification value of the ground station for the user terminal, the target temporary random challenge value, the target satellite authentication credential, the PUF response value of the satellite node, the session key negotiation disturbance parameter, the session key negotiation parameter confirmation value and the preset hash function; if the target verification value of the session key negotiation disturbance parameter and the intermediate verification value of the ground station for the user terminal is determined to be equal to the verification value of the session key negotiation disturbance parameter and the intermediate verification value of the ground station for the user terminal, it is determined that the ground station identity authentication is passed.

[0651] In one embodiment, the first authentication module 174 is specifically used to determine a target user session key parameter verification value based on the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the PUF challenge value of the user terminal, the target intermediate verification value of the ground station for the user terminal, and the preset hash algorithm; if it is determined that the target user session key parameter verification value is equal to the user session key parameter verification value sent by the user terminal, it is determined that the legitimacy authentication of the user terminal is passed; if it is determined that the target user session key parameter verification value is not equal to the user session key parameter verification value sent by the user terminal, it is determined that the legitimacy authentication of the user terminal has failed.

[0652] In one embodiment, the device further comprises:

[0653] A first determination module, after determining that the legitimacy authentication of the user terminal is passed, determines a session key negotiation parameter verification value according to the session key negotiation disturbance parameter, the session key negotiation parameter confirmation value, a target intermediate verification value of the ground station for the user terminal, and the preset hash algorithm;

[0654] The second sending module is used to send the disturbance value of the intermediate verification value of the ground station for the user terminal, the session key negotiation disturbance parameter and the session key negotiation parameter verification value as a satellite session key negotiation message to the user terminal, so that the user terminal determines a first target session key negotiation parameter verification value according to the session key negotiation disturbance parameter, the session key negotiation parameter confirmation value, the intermediate verification value of the ground station for the user terminal, and the preset hash algorithm. If it is determined that the first target session key negotiation parameter verification value is equal to the session key negotiation parameter verification value, the user terminal determines that the identity authentication of the ground station and the identity authentication of the satellite node are passed, and determines the ground station target session key negotiation parameter according to the session key negotiation disturbance parameter, the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the user session key negotiation parameter information, the PUF response value of the user terminal, and the preset hash algorithm. The method further comprises: determining a target session key between the user and the ground station according to the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the user session key negotiation parameter information, the ground station target session key negotiation parameter, the PUF response value of the user terminal, and the preset hash algorithm; determining a target session key negotiation parameter confirmation value according to the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the user session key negotiation parameter information, the ground station target session key negotiation parameter, the PUF response value of the user terminal, and the preset hash algorithm; determining a second target session key negotiation parameter verification value according to the session key negotiation perturbation parameter, the target session key negotiation parameter confirmation value, the intermediate verification value of the ground station for the user terminal, and the preset hash algorithm; if it is determined that the second target session key negotiation parameter verification value is equal to the session key negotiation parameter verification value, then the user terminal determines that the target session key between the user and the ground station negotiated with the ground station is correct;

[0655] A second determination module is used to determine a user identity authentication confirmation value according to the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the PUF challenge value of the user terminal, the target intermediate verification value of the ground station for the user terminal, and the preset hash algorithm;

[0656] The third sending module is used to send the user identity authentication confirmation value to the ground station, so that the ground station determines the user identity authentication target confirmation value according to the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the PUF challenge value of the user terminal, the intermediate verification value of the ground station for the user terminal, and the preset hash algorithm. If it is determined that the user identity authentication target confirmation value is equal to the user identity authentication confirmation value, the ground station determines that the legitimacy authentication of the user terminal is passed.

[0657] Based on the same inventive concept, an embodiment of the present application also provides an authentication method for a space-ground integrated network implemented on the network control center side. Since the principle of solving the problem by the authentication method for the space-ground integrated network implemented on the network control center side is similar to that of the authentication method for the space-ground integrated network, the implementation of the authentication method for the space-ground integrated network implemented on the network control center side can refer to the implementation of the authentication method for the space-ground integrated network, and the repeated parts will not be repeated.

[0658] like Fig.23 As shown, it is a flow chart of the authentication method of the integrated space network implemented by the network control center side provided in the embodiment of the present application, which may include the following steps:

[0659] S181. The network control center receives a ground station registration request sent by the ground station. The ground station registration request carries identification information of the ground station.

[0660] S182. Randomly select prime numbers that are mutually prime from a finite field of large prime numbers corresponding to users of the ground station to obtain a set of prime numbers corresponding to the users.

[0661] S183. Determine ground station user domain key reconstruction parameter information according to each prime number in the prime number set corresponding to the user.

[0662] S184. Obtain ground station domain key generation parameter information from the alliance chain.

[0663] S185. Randomly select prime numbers that are mutually prime in pairs from the finite field of large prime numbers corresponding to the ground station to obtain a prime number set corresponding to the ground station, and randomly select a first target prime number from the prime number set corresponding to the ground station.

[0664] S186. Send the first target prime number, ground station user domain key reconstruction parameter information and ground station domain key generation parameter information to the ground station, so that the ground station determines the target ground station domain key confirmation value according to the ground station domain key generation parameter information and the first target prime number, and verifies the ground station domain key information according to the target ground domain key confirmation value and the ground station domain key confirmation value in the ground station domain key generation parameter information, and after the verification is passed, determines the ground station user domain key generation parameter information according to the ground station user domain key reconstruction parameter information, and uploads the ground station user domain key generation parameter information to the alliance chain.

[0665] The ground station domain key information is pre-allocated by the network control center to the ground station.

[0666] In one embodiment, the method further comprises:

[0667] Acquire the ground station user domain key generation parameter information from the alliance chain;

[0668] Determine the target ground station user domain key information according to the ground station user domain key generation parameter information;

[0669] The ground station registration request is verified according to the target ground station user domain key information and the ground station user domain key generation parameter information to obtain a verification result.

[0670] In one implementation, the ground station registration request is verified according to the target ground station user domain key information and the ground station user domain key generation parameter information to obtain a verification result, specifically including:

[0671] Determine a target ground station user domain key confirmation value according to the ground station user domain key generation parameter information and the target ground station user domain key information;

[0672] The ground station registration request is verified according to the target ground station user domain key confirmation value and the ground station user domain key confirmation value in the ground station user domain key generation parameter information to obtain a verification result.

[0673] In one implementation, the registration request of the ground station is verified according to the target ground station user domain key confirmation value and the ground station user domain key confirmation value in the ground station user domain key generation parameter information to obtain a verification result, specifically including:

[0674] If it is determined that the target ground station user domain key confirmation value is equal to the ground station user domain key confirmation value in the ground station user domain key generation parameter information, it is determined that the verification is passed and the ground station is registered;

[0675] If it is determined that the target ground station user domain key confirmation value is not equal to the ground station user domain key confirmation value in the ground station user domain key generation parameter information, it is determined that the verification has failed, and the registration failure message of the ground station is uploaded to the alliance chain.

[0676] In one implementation, after registering the ground station, the method further includes:

[0677] The registration information of the ground station is uploaded to the alliance chain, the registration information of the ground station includes the ground station authentication credential, and the ground station authentication credential is determined based on the ground station domain key information and a preset hash algorithm.

[0678] In one embodiment, the method further comprises:

[0679] Receiving a satellite registration request sent by a satellite node, wherein the satellite registration request carries identification information of the satellite node;

[0680] Randomly select a second target prime number from the set of prime numbers corresponding to the satellite nodes, where the set of prime numbers corresponding to the satellite nodes is obtained by the network control center randomly selecting prime numbers that are mutually prime from a finite field of large prime numbers corresponding to the satellite nodes;

[0681] Randomly generate a PUF challenge value set of the satellite node according to the second target prime number and the physical unclonable function PUF;

[0682] Acquire satellite domain key generation parameter information from the alliance chain;

[0683] sending the second target prime number, the satellite domain key generation parameter information and the PUF challenge value set of the satellite node to the satellite node, so that the satellite node determines a target satellite domain key confirmation value according to the satellite domain key generation parameter information and the second target prime number, verifies the satellite domain key information according to the target satellite domain key confirmation value and the satellite domain key confirmation value in the satellite domain key generation parameter information, and determines a PUF response value set of the satellite node corresponding to the PUF challenge value set of the satellite node after the verification is passed, wherein the satellite domain key information is pre-allocated to the satellite node by the network control center;

[0684] Receive a PUF response value set of the satellite node sent by the satellite node, and register the satellite node.

[0685] In one implementation, after registering the satellite node, the method further includes:

[0686] Determine satellite authentication credentials based on satellite domain key information and a preset hash algorithm;

[0687] The registration information of the satellite node is uploaded to the alliance chain, where the registration information of the satellite node includes the satellite authentication credential, the PUF challenge value set of the satellite node, and the PUF response value set of the satellite node.

[0688] In one embodiment, the method further comprises:

[0689] When it is determined that the ground station domain key update condition is met, randomly selecting a prime number from a finite field of large prime numbers corresponding to the ground station as the updated first ground station domain key information;

[0690] Determine a ground station domain key update value according to the first ground station domain key information and a ground station domain key update function;

[0691] Determine a ground station domain key update confirmation value according to the ground station domain key information, the first ground station domain key information, the ground station domain key update value, and a preset hash algorithm;

[0692] The ground station domain key update value and the ground station domain key update confirmation value are used as a ground station domain key update generation message and uploaded to the alliance chain, so that the ground station determines the second ground station domain key information according to the ground station domain key update value, and determines the target ground station domain key update confirmation value according to the ground station domain key information, the second ground station domain key information, the ground station domain key update value, and the preset hash algorithm; if it is determined that the target ground station domain key update confirmation value is equal to the ground station domain key update confirmation value, the ground station domain key information is updated to the second ground station domain key information.

[0693] In one embodiment, the method further comprises:

[0694] When it is determined that the satellite domain key update condition is met, randomly selecting a prime number from a finite field of large prime numbers corresponding to the satellite node as the updated first satellite domain key information;

[0695] Determine a satellite domain key update value according to the first satellite domain key information and a satellite domain key update function;

[0696] Determine a satellite domain key update confirmation value according to the satellite domain key information, the first satellite domain key information, the satellite domain key update value, and a preset hash algorithm;

[0697] The satellite domain key update value and the satellite domain key update confirmation value are used as a satellite domain key update generation message and uploaded to the alliance chain, so that the satellite node determines the second satellite domain key information according to the satellite domain key update value, and determines the target satellite domain key update confirmation value according to the satellite domain key information, the second satellite domain key information, the satellite domain key update value, and the preset hash algorithm; if it is determined that the target satellite domain key update confirmation value is equal to the satellite domain key update confirmation value, the satellite domain key information is updated to the second satellite domain key information.

[0698] Based on the same inventive concept, an embodiment of the present application also provides an authentication device for a space-ground integrated network implemented on the network control center side. Since the principle of solving the problem by the authentication device for a space-ground integrated network implemented on the network control center side is similar to the authentication method for a space-ground integrated network, the implementation of the authentication device for a space-ground integrated network implemented on the network control center side can refer to the implementation of the authentication method for a space-ground integrated network, and the repeated parts will not be repeated.

[0699] like Fig.24 As shown, it is a schematic diagram of the structure of the authentication device of the integrated network implemented by the network control center side provided in the embodiment of the present application, which may include:

[0700] The first receiving module 191 is used to receive a ground station registration request sent by a ground station, wherein the ground station registration request carries identification information of the ground station;

[0701] A first selection module 192 is used to randomly select prime numbers that are mutually prime from a finite field of large prime numbers corresponding to users of the ground station to obtain a set of prime numbers corresponding to the users;

[0702] A first determination module 193 is used to determine ground station user domain key reconstruction parameter information according to each prime number in the prime number set corresponding to the user;

[0703] The first acquisition module 194 is used to obtain ground station domain key generation parameter information from the alliance chain;

[0704] A second selection module 195 is used to randomly select prime numbers that are mutually prime from a finite field of large prime numbers corresponding to the ground station to obtain a prime number set corresponding to the ground station, and randomly select a first target prime number from the prime number set corresponding to the ground station;

[0705] The first sending module 196 is used to send the first target prime number, the ground station user domain key reconstruction parameter information and the ground station domain key generation parameter information to the ground station, so that the ground station determines the target ground station domain key confirmation value according to the ground station domain key generation parameter information and the first target prime number, and verifies the ground station domain key information according to the target ground domain key confirmation value and the ground station domain key confirmation value in the ground station domain key generation parameter information, and after the verification is passed, determines the ground station user domain key generation parameter information according to the ground station user domain key reconstruction parameter information, and uploads the ground station user domain key generation parameter information to the alliance chain, and the ground station domain key information is pre-allocated to the ground station by the network control center.

[0706] In one embodiment, the device further comprises:

[0707] A second acquisition module is used to obtain the ground station user domain key generation parameter information from the alliance chain;

[0708] A second determination module is used to determine the target ground station user domain key information according to the ground station user domain key generation parameter information;

[0709] The verification module is used to verify the ground station registration request according to the target ground station user domain key information and the ground station user domain key generation parameter information to obtain a verification result.

[0710] In one embodiment, the verification module is specifically used to determine the target ground station user domain key confirmation value based on the ground station user domain key generation parameter information and the target ground station user domain key information; verify the ground station registration request based on the target ground station user domain key confirmation value and the ground station user domain key confirmation value in the ground station user domain key generation parameter information to obtain a verification result.

[0711] In one embodiment, the verification module is specifically used to determine that the verification is successful and register the ground station if it is determined that the user domain key confirmation value of the target ground station is equal to the ground station user domain key confirmation value in the ground station user domain key generation parameter information; if it is determined that the user domain key confirmation value of the target ground station is not equal to the ground station user domain key confirmation value in the ground station user domain key generation parameter information, then determine that the verification has failed and upload the registration failure message of the ground station to the alliance chain.

[0712] In one embodiment, the device further comprises:

[0713] The first uploading module is used to upload the registration information of the ground station to the alliance chain after registering the ground station, the registration information of the ground station includes the ground station authentication credential, and the ground station authentication credential is determined based on the ground station domain key information and a preset hash algorithm.

[0714] In one embodiment, the device further comprises:

[0715] A second receiving module is used to receive a satellite registration request sent by a satellite node, wherein the satellite registration request carries identification information of the satellite node;

[0716] A third selection module is used to randomly select a second target prime number from the prime number set corresponding to the satellite node, where the prime number set corresponding to the satellite node is obtained by the network control center randomly selecting prime numbers that are mutually prime from a finite field of large prime numbers corresponding to the satellite nodes;

[0717] A generating module, configured to randomly generate a PUF challenge value set of a satellite node according to the second target prime number and a physical unclonable function PUF;

[0718] A third acquisition module is used to obtain satellite domain key generation parameter information from the alliance chain;

[0719] a second sending module, configured to send the second target prime number, the satellite domain key generation parameter information, and the PUF challenge value set of the satellite node to the satellite node, so that the satellite node determines a target satellite domain key confirmation value according to the satellite domain key generation parameter information and the second target prime number, verifies the satellite domain key information according to the target satellite domain key confirmation value and the satellite domain key confirmation value in the satellite domain key generation parameter information, and determines a PUF response value set of the satellite node corresponding to the PUF challenge value set of the satellite node after the verification is passed, wherein the satellite domain key information is pre-allocated to the satellite node by the network control center;

[0720] The third receiving module is used to receive the PUF response value set of the satellite node sent by the satellite node, and register the satellite node.

[0721] In one embodiment, the device further comprises:

[0722] A third determination module is used to determine the satellite authentication credential based on the satellite domain key information and a preset hash algorithm after registering the satellite node;

[0723] The second uploading module is used to upload the registration information of the satellite node to the alliance chain, and the registration information of the satellite node includes the satellite authentication credential, the PUF challenge value set of the satellite node and the PUF response value set of the satellite node.

[0724] In one embodiment, the device further comprises:

[0725] A fourth selection module, configured to randomly select a prime number from a finite field of large prime numbers corresponding to the ground station as updated first ground station domain key information when it is determined that the ground station domain key update condition is met;

[0726] a fourth determining module, configured to determine a ground station domain key update value according to the first ground station domain key information and a ground station domain key update function;

[0727] a fifth determination module, configured to determine a ground station domain key update confirmation value according to the ground station domain key information, the first ground station domain key information, the ground station domain key update value, and a preset hash algorithm;

[0728] The third upload module is used to upload the ground station domain key update value and the ground station domain key update confirmation value as a ground station domain key update generation message to the alliance chain, so that the ground station determines the second ground station domain key information according to the ground station domain key update value, and determines the target ground station domain key update confirmation value according to the ground station domain key information, the second ground station domain key information, the ground station domain key update value, and the preset hash algorithm; if it is determined that the target ground station domain key update confirmation value is equal to the ground station domain key update confirmation value, the ground station domain key information is updated to the second ground station domain key information.

[0729] In one embodiment, the device further comprises:

[0730] a fifth selection module, configured to randomly select a prime number from a finite field of large prime numbers corresponding to the satellite node as updated first satellite domain key information when it is determined that the satellite domain key update condition is met;

[0731] a sixth determining module, configured to determine a satellite domain key update value according to the first satellite domain key information and a satellite domain key update function;

[0732] a seventh determination module, configured to determine a satellite domain key update confirmation value according to the satellite domain key information, the first satellite domain key information, the satellite domain key update value, and a preset hash algorithm;

[0733] The fourth upload module is used to upload the satellite domain key update value and the satellite domain key update confirmation value as a satellite domain key update generation message to the alliance chain, so that the satellite node determines the second satellite domain key information according to the satellite domain key update value, and determines the target satellite domain key update confirmation value according to the satellite domain key information, the second satellite domain key information, the satellite domain key update value, and the preset hash algorithm; if it is determined that the target satellite domain key update confirmation value is equal to the satellite domain key update confirmation value, the satellite domain key information is updated to the second satellite domain key information.

[0734] Based on the same technical concept, the present application embodiment also provides an electronic device 200, referring to Fig.25 As shown, the electronic device 200 is used to implement the authentication method of the integrated space network described in the above method embodiment. The electronic device 200 of this embodiment may include: a memory 201, a processor 202, and a computer program stored in the memory and executable on the processor, such as an authentication program of the integrated space network. When the processor executes the computer program, the steps in the above-mentioned authentication method embodiments of the integrated space network are implemented.

[0735] The specific connection medium between the memory 201 and the processor 202 is not limited in the embodiment of the present application. Fig.25 In the embodiment, the memory 201 and the processor 202 are connected via a bus 203. The bus 203 is connected to the processor 202 via a bus 203. Fig.25 The connection between other components is shown by bold lines, which is only for schematic illustration and is not intended to be limiting. The bus 203 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.25 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0736] The memory 201 may be a volatile memory, such as a random-access memory (RAM); the memory 201 may also be a non-volatile memory, such as a read-only memory, a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD), or the memory 201 may be any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 201 may be a combination of the above memories.

[0737] Processor 202 is used to implement the authentication method of the ground-ground integrated network provided in the embodiment of the present application.

[0738] An embodiment of the present application also provides a computer-readable storage medium that stores computer-executable instructions required to execute the above-mentioned processor, which includes a program required to execute the above-mentioned processor.

[0739] In some possible implementations, various aspects of the authentication method for the integrated sky and earth network provided in the present application may also be implemented in the form of a program product, which includes a program code. When the program product is run on an electronic device, the program code is used to enable the electronic device to execute the steps of the authentication method for the integrated sky and earth network described above in this specification according to various exemplary implementations of the present application.

[0740] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, devices, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0741] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (apparatus), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0742] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0743] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0744] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0745] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for authenticating a space-ground integrated network, characterized in that: Applied to a ground station, the method comprises: Receiving an access request of a user terminal and identification information of the satellite node sent by a satellite node, wherein the access request carries the identification information of the user, encrypted user session key negotiation parameter information and an access request verification value; Acquire the user's access request verification parameter from the alliance chain according to the user's identification information, where the user's access request verification parameter is uploaded to the alliance chain by the ground station after completing the registration of the user; decrypting the encrypted user session key negotiation parameter information to obtain decrypted user session key negotiation parameter information, and authenticating the user according to the decrypted user session key negotiation parameter information, the access request verification parameter and the access request verification value; Acquire authentication parameters of the satellite node from the alliance chain according to the identification information of the satellite node, where the authentication parameters of the satellite node are uploaded to the alliance chain after the network control center completes registration of the satellite node; A target authentication check value of the satellite node is determined according to the authentication parameters of the satellite node, and identity authentication is performed on the satellite node according to the target authentication check value.

2. The method according to claim 1, characterized in that The access request verification parameters include identification information of the network control center, identification information of the ground station, identification information of the user and user authentication credential verification value information, wherein the user authentication credential verification value information is determined according to the user authentication credential information, and the user authentication credential information is determined according to the ground station domain key information; Performing identity authentication on the user according to the decrypted user session key negotiation parameter information, the access request verification parameter and the access request verification value specifically includes: Determine a target access request verification value according to the identification information of the network control center, the identification information of the ground station, the identification information of the user, the user authentication credential verification value information, the ground station user domain key information, the decrypted user session key negotiation parameter information and a preset hash algorithm; If it is determined that the target access request verification value is equal to the access request verification value, it is determined that the user is a legitimate user of the ground station; If it is determined that the target access request verification value is not equal to the access request verification value, it is determined that the user is not a legitimate user of the ground station.

3. The method according to claim 2, characterized in that The user session key negotiation parameter information is a prime number randomly selected by the user terminal from a finite field of large prime numbers corresponding to the user; the encrypted user session key negotiation parameter information is determined by the user terminal based on the user session key negotiation parameter information, the identification information of the ground station, the identification information of the user, the first ground station user domain key information and the preset hash algorithm, and the first ground station user domain key information is generated by the user terminal according to the ground station user domain key generation parameter information obtained from the alliance chain.

4. The method according to claim 2, characterized in that The access request verification parameters also include a physical unclonable function PUF challenge value set of the user terminal and a PUF response value set of the user terminal, the authentication parameters of the satellite node include a satellite authentication credential, a PUF challenge value set of the satellite node and a PUF response value set of the satellite node, and the satellite authentication credential is determined according to the satellite domain key information and the preset hash algorithm when the network control center registers the satellite node; When it is determined that the user authentication is successful, the method further includes: generating an authorization challenge message according to the access request verification parameter and the authentication parameter of the satellite node, wherein the authorization challenge message is used to verify the legitimacy of the user terminal; The authorization challenge message is sent to the satellite node, so that the satellite node determines the target satellite authentication credential according to the satellite domain key information and the preset hash algorithm, determines the target temporary random challenge value according to the access authorization challenge response value, the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the target satellite authentication credential, the PUF challenge value of the satellite node, the PUF challenge value of the user terminal and the preset hash algorithm, and based on the target satellite authentication credential, the PUF challenge value of the satellite node, the PUF challenge value of the user terminal, the target temporary random challenge value, and the preset hash algorithm Method, determine the target access authorization verification value, if it is determined that the target access authorization verification value is equal to the access authorization verification value, the satellite node determines the corresponding PUF response value of the satellite node according to the PUF challenge value of the satellite node, and determines the authentication verification value of the satellite node according to the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the target satellite authentication credential, the PUF response value of the satellite node, the target temporary random challenge value, and the preset hash algorithm, and sends the authentication verification value of the satellite node to the ground station, and sends the PUF challenge value of the user terminal to the user terminal.

5. The method according to claim 4, characterized in that Generating an authorization challenge message according to the access request verification parameter and the authentication parameter of the satellite node specifically includes: Randomly select a prime number from the finite field of large prime numbers corresponding to the users of the ground station as a temporary random challenge value; Randomly select a PUF challenge value of a satellite node from the set of PUF challenge values ​​of the satellite nodes, and randomly select a PUF challenge value of a user terminal from the set of PUF challenge values ​​of the user terminals; Determine an access authorization challenge response value according to the temporary random challenge value, the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the PUF challenge value of the satellite node, the PUF challenge value of the user terminal, the satellite authentication credential, and the preset hash algorithm; Determine an access authorization verification value according to the satellite authentication credential, the PUF challenge value of the satellite node, the PUF challenge value of the user terminal, the temporary random challenge value and the preset hash algorithm; The PUF challenge value of the satellite node, the PUF challenge value of the user terminal, the access authorization challenge response value and the access authorization verification value are used as an authorization challenge message.

6. The method according to claim 5, characterized in that Determining a target authentication check value of the satellite node according to the authentication parameter of the satellite node, and performing identity authentication on the satellite node according to the target authentication check value, specifically comprising: Receiving an authentication check value of the satellite node sent by the satellite node; Querying the PUF response value of the satellite node corresponding to the PUF challenge value of the satellite node from the alliance chain according to the identification information of the satellite node and the PUF challenge value of the satellite node; Determine a target authentication check value of the satellite node according to the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the satellite authentication credential, the PUF response value of the satellite node, the temporary random challenge value and the preset hash algorithm; If it is determined that the target authentication check value of the satellite node is equal to the authentication check value of the satellite node, it is determined that the identity authentication of the satellite node is passed; If it is determined that the target authentication check value of the satellite node is not equal to the authentication check value of the satellite node, it is determined that the identity authentication of the satellite node has failed.

7. The method according to claim 6, characterized in that After the satellite node identity is authenticated, the method further includes: Determine a ground station session key negotiation message according to the PUF challenge value of the user terminal, the PUF response value of the user terminal corresponding to the PUF challenge value of the user terminal, the temporary random challenge value, and the satellite authentication credential, wherein the session key negotiation message is used to negotiate a ground station session key with the user; The ground station session key negotiation message is sent to the satellite node, so that the satellite node performs identity authentication on the ground station based on the authentication parameters of the satellite node and the ground station session key negotiation message.

8. The method according to claim 7, characterized in that Determining a ground station session key negotiation message according to the PUF challenge value of the user terminal, the PUF response value of the user terminal corresponding to the PUF challenge value of the user terminal, the temporary random challenge value, and the satellite authentication credential, specifically comprising: According to the user identification information and the PUF challenge value of the user terminal, query the PUF response value of the user terminal corresponding to the PUF challenge value of the user terminal from the alliance chain; Randomly select a prime number from a finite field of large prime numbers corresponding to users of the ground station as a ground station session key negotiation parameter; Determine, according to the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the PUF challenge value of the user terminal, the PUF response value of the user terminal, and a preset hash algorithm, an intermediate verification value of the ground station for the user terminal; Determine a disturbance value of the intermediate verification value of the ground station for the user terminal according to the intermediate verification value of the ground station for the user terminal, the satellite authentication credential, the PUF response value of the satellite node, the temporary random challenge value and the preset hash algorithm; Determine a session key negotiation perturbation parameter according to the ground station session key negotiation parameter, the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the user session key negotiation parameter information, the PUF response value of the user terminal, and the preset hash function; Determine a session key between the user and the ground station according to the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the user session key negotiation parameter information, the ground station session key negotiation parameter, the PUF response value of the user terminal, and the preset hash algorithm; Determine a session key negotiation parameter confirmation value according to the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the session key between the user and the ground station, the PUF response value of the user terminal, and the preset hash algorithm; Determine, according to the intermediate verification value of the ground station for the user terminal, the temporary random challenge value, the satellite authentication credential, the response value of the PUF of the satellite node, the session key negotiation disturbance parameter, the session key negotiation parameter confirmation value, and the preset hash algorithm, a check value of the session key negotiation disturbance parameter and the intermediate verification value of the ground station for the user terminal; The perturbation value of the intermediate verification value of the ground station for the user terminal, the session key negotiation perturbation parameter, the session key negotiation parameter confirmation value, and the verification value of the session key negotiation perturbation parameter and the intermediate verification value of the ground station for the user terminal are sent to the satellite node as a ground station session key negotiation message.

9. The method according to claim 1, characterized in that Before the ground station receives the access request of the user terminal forwarded by the satellite node, it also includes: Sending a ground station registration request to the network control center, wherein the ground station registration request carries identification information of the ground station; Receive the target prime number, ground station user domain key reconstruction parameter information and ground station domain key generation parameter information sent by the network control center, the target prime number is a prime number randomly selected from the prime number set corresponding to the ground station obtained by randomly selecting two mutually prime prime numbers from the finite field of large prime numbers corresponding to the ground station by the network control center, the ground station user domain key reconstruction parameter information is determined by the network control center according to each prime number in the prime number set corresponding to the user of the ground station, the prime number set corresponding to the user of the ground station is obtained by randomly selecting two mutually prime prime numbers from the finite field of large prime numbers corresponding to the user of the ground station by the network control center, and the ground station domain key generation parameter information is obtained by the network control center from the alliance chain; Determine a target ground station domain key confirmation value according to the ground station domain key generation parameter information and the target prime number, and verify the ground station domain key information according to the target ground domain key confirmation value and the ground station domain key confirmation value in the ground station domain key generation parameter information; After the verification is passed, the ground station user domain key generation parameter information is determined according to the ground station user domain key reconstruction parameter information, and the ground station user domain key generation parameter information is uploaded to the alliance chain, so that the network control center obtains the ground station user domain key generation parameter information from the alliance chain, determines the first target ground station user domain key information according to the ground station user domain key generation parameter information, verifies the ground station registration request according to the first target ground station user domain key information and the ground station user domain key generation parameter information, and registers the ground station after the verification is passed, and uploads the registration information of the ground station to the alliance chain, the registration information of the ground station includes a ground station authentication credential, the ground station authentication credential is determined according to the ground station domain key information and a preset hash algorithm, and the ground station domain key information is determined according to the ground station domain key generation parameter information and the target prime number.

10. The method according to claim 9, characterized in that Also includes: receiving a user registration request sent by the user terminal and forwarded by the satellite node, wherein the user registration request carries the identification information of the user and a user feature hash value, wherein the user feature hash value is determined by the user terminal according to the identification information of the user, password information, the biometric key and the preset hash algorithm input by the user after the biometric key is determined according to the biometric fuzzy probability function and the biometric information input by the user; Randomly select a prime number from the prime number set corresponding to the user as a secret value; Randomly generate a PUF challenge value set of the user terminal according to the secret value and the physical unclonable function PUF; Determine user authentication credential information according to the ground station domain key information and the preset hash algorithm, and determine user authentication credential verification value information according to the user authentication credential information and the preset hash algorithm; Acquire the ground station user domain key generation parameter information from the alliance chain, and send a registration response message to the satellite node, wherein the registration response message includes the ground station user domain key generation parameter information, the secret value, the PUF challenge value set of the user terminal and the user authentication credential verification value information, and the satellite node forwards the registration response message to the user terminal, so that the user terminal determines the second target ground station user domain key information according to the secret value and the ground station user domain key generation parameter information, verifies the user registration request according to the second target ground station user domain key information and the ground station user domain key generation parameter information, and determines the PUF response value set of the user terminal corresponding to the PUF challenge value set of the user terminal after the verification is passed; receiving a PUF response value set of the user terminal sent by the user terminal and forwarded by the satellite node, and registering the user; The user's registration information is uploaded to the alliance chain, and the user's registration information includes the identification information of the network control center, the identification information of the ground station, the identification information of the user, the user authentication credential verification value information, the PUF challenge value set of the user terminal, and the PUF response value set of the user terminal.

11. A method for authenticating a space-ground network, characterized in that: Applied to a satellite node, the method comprises: Receiving an access request sent by a user terminal, wherein the access request carries user identification information, encrypted user session key negotiation parameter information, and an access request verification value; Sending the access request and the identification information of the satellite node to the ground station, so that the ground station obtains the access request verification parameter of the user from the alliance chain according to the identification information of the user, decrypts the encrypted user session key negotiation parameter information to obtain the decrypted user session key negotiation parameter information, and authenticates the user according to the decrypted user session key negotiation parameter information, the access request verification parameter and the access request verification value, wherein the access request verification parameter of the user is uploaded to the alliance chain by the ground station after completing the registration of the user; Receiving an authorization challenge message sent by the ground station, the authorization challenge message is used to verify the legitimacy of the user terminal, the authorization challenge message is determined by the ground station after determining that the user identity authentication is passed, according to the access request verification parameter and the authentication parameter of the satellite node obtained from the alliance chain according to the identification information of the satellite node, and the authentication parameter of the satellite node is uploaded to the alliance chain after the network control center completes the registration of the satellite node; authenticating the legitimacy of the user terminal according to the satellite domain key information and the authorization challenge message; Receive a ground station session key negotiation message sent by the ground station, and authenticate the ground station based on the authentication parameters of the satellite node and the ground station session key negotiation message, wherein the ground station session key negotiation message is determined by the ground station based on the authentication parameters of the satellite node obtained from the alliance chain.

12. The method according to claim 11, characterized in that The authentication parameters of the satellite node include a satellite authentication credential, a set of physical unclonable function PUF challenge values ​​of the satellite node, and a set of PUF response values ​​of the satellite node. The satellite authentication credential is determined according to satellite domain key information and a preset hash algorithm when the network control center registers the satellite node; the authorization challenge message includes a PUF challenge value of the satellite node, a PUF challenge value of the user terminal, an access authorization challenge response value, and an access authorization verification value; the PUF challenge value of the satellite node is randomly selected by the ground station from the PUF challenge value set of the satellite node, the PUF challenge value of the user terminal is randomly selected by the ground station from the PUF challenge value set of the user terminal, and the access authorization challenge response value is determined by the ground station according to a temporary random challenge value, the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the PUF challenge value of the satellite node, the PUF challenge value of the user terminal, the satellite authentication credential, and the preset hash algorithm. The temporary random challenge value is a prime number randomly selected by the ground station from a finite field of large prime numbers corresponding to the user of the ground station.

13. The method according to claim 12, characterized in that Authenticating the legitimacy of the user terminal according to the satellite domain key information and the authorization challenge message, specifically including: Determine the target satellite authentication credential according to the satellite domain key information and the preset hash algorithm; Determine a target temporary random challenge value according to the access authorization challenge response value, the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the target satellite authentication credential, the PUF challenge value of the satellite node, the PUF challenge value of the user terminal, and the preset hash algorithm; Determine a target access authorization verification value based on the target satellite authentication credential, the PUF challenge value of the satellite node, the PUF challenge value of the user terminal, the target temporary random challenge value, and the preset hash algorithm; If it is determined that the target access authorization verification value is equal to the access authorization verification value, determining a corresponding PUF response value of the satellite node according to the PUF challenge value of the satellite node; Determine the authentication check value of the satellite node according to the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the target satellite authentication credential, the PUF response value of the satellite node, the target temporary random challenge value and the preset hash algorithm; and Sending the authentication check value of the satellite node to the ground station, so that the ground station performs identity authentication on the satellite node based on the authentication check value of the satellite node; Sending the PUF challenge value of the user terminal to the user terminal, so that the user terminal determines the corresponding PUF response value of the user terminal according to the PUF challenge value of the user terminal, and determining the intermediate verification value of the user terminal according to the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the PUF challenge value of the user terminal, the PUF response value of the user terminal, the user session key negotiation parameter information and the preset hash algorithm, and determining the user session key parameter verification value according to the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the PUF challenge value of the user terminal, the intermediate verification value of the user terminal and the preset hash algorithm; Receiving the user session key parameter verification value sent by the user terminal; receiving a ground station session key negotiation message sent by the ground station; Authenticating the ground station according to the ground station session key negotiation message; and The legitimacy of the user terminal is authenticated according to the user session key parameter verification value and the ground station session key negotiation message.

14. The method according to claim 13, characterized in that The ground station session key negotiation message includes a disturbance value of the ground station for the intermediate verification value of the user terminal, the session key negotiation disturbance parameter, the session key negotiation parameter confirmation value, and a check value of the session key negotiation disturbance parameter and the intermediate verification value of the ground station for the user terminal; Performing identity authentication on the ground station according to the ground station session key negotiation message specifically includes: Determine a target intermediate verification value of the ground station for the user terminal according to a disturbance value of the intermediate verification value of the ground station for the user terminal, the target satellite authentication credential, a PUF response value of the satellite node, the target temporary random challenge value, and the preset hash algorithm; Determine, according to the target intermediate verification value of the ground station for the user terminal, the target temporary random challenge value, the target satellite authentication credential, the PUF response value of the satellite node, the session key negotiation perturbation parameter, the session key negotiation parameter confirmation value, and the preset hash function, a target check value of the session key negotiation perturbation parameter and the intermediate verification value of the ground station for the user terminal; If the target verification value of the session key negotiation perturbation parameter and the intermediate verification value of the ground station for the user terminal is determined to be equal to the verification value of the session key negotiation perturbation parameter and the intermediate verification value of the ground station for the user terminal, it is determined that the ground station identity authentication is passed.

15. The method according to claim 14, characterized in that Authenticating the legitimacy of the user terminal according to the user session key parameter verification value and the ground station session key negotiation message, specifically comprising: Determine a target user session key parameter verification value according to the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the PUF challenge value of the user terminal, the target intermediate verification value of the ground station for the user terminal, and the preset hash algorithm; If it is determined that the target user session key parameter verification value is equal to the user session key parameter verification value sent by the user terminal, it is determined that the legitimacy authentication of the user terminal is passed; If it is determined that the target user session key parameter verification value is not equal to the user session key parameter verification value sent by the user terminal, it is determined that the legitimacy authentication of the user terminal has failed.

16. The method according to claim 15, characterized in that After determining that the legitimacy authentication of the user terminal is passed, the method further includes: Determining a session key negotiation parameter verification value according to the session key negotiation disturbance parameter, the session key negotiation parameter confirmation value, a target intermediate verification value of the ground station for the user terminal, and the preset hash algorithm; The perturbation value of the intermediate verification value of the ground station for the user terminal, the session key negotiation perturbation parameter, and the session key negotiation parameter verification value are sent to the user terminal as a satellite session key negotiation message, so that the user terminal determines a first target session key negotiation parameter verification value according to the session key negotiation perturbation parameter, the session key negotiation parameter confirmation value, the intermediate verification value of the ground station for the user terminal, and the preset hash algorithm. If it is determined that the first target session key negotiation parameter verification value is equal to the session key negotiation parameter verification value, the user terminal determines that the identity authentication of the ground station and the identity authentication of the satellite node are passed, and determines the ground station target session key negotiation parameter according to the session key negotiation perturbation parameter, the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the user session key negotiation parameter information, the PUF response value of the user terminal, and the preset hash algorithm. , the identification information of the satellite node, the identification information of the user, the user session key negotiation parameter information, the ground station target session key negotiation parameter, the PUF response value of the user terminal, and the preset hash algorithm to determine the target session key between the user and the ground station, and determine a target session key negotiation parameter confirmation value according to the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the target session key between the user and the ground station, the PUF response value of the user terminal, and the preset hash algorithm, and determine a second target session key negotiation parameter verification value according to the session key negotiation perturbation parameter, the target session key negotiation parameter confirmation value, the intermediate verification value of the ground station for the user terminal, and the preset hash algorithm; if it is determined that the second target session key negotiation parameter verification value is equal to the session key negotiation parameter verification value, then the user terminal determines that the target session key between the user and the ground station negotiated with the ground station is correct; Determine a user identity authentication confirmation value according to the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the PUF challenge value of the user terminal, the target intermediate verification value of the ground station for the user terminal, and the preset hash algorithm; The user identity authentication confirmation value is sent to the ground station, so that the ground station determines the user identity authentication target confirmation value according to the identification information of the ground station, the identification information of the satellite node, the identification information of the user, the PUF challenge value of the user terminal, the intermediate verification value of the ground station for the user terminal, and the preset hash algorithm. If it is determined that the user identity authentication target confirmation value is equal to the user identity authentication confirmation value, the ground station determines that the legitimacy authentication of the user terminal has passed.

17. An authentication method for a ground-ground integrated network, characterized in that: Applied to a network control center, the method comprises: Receiving a ground station registration request sent by a ground station, wherein the ground station registration request carries identification information of the ground station; Randomly select prime numbers that are mutually prime from a finite field of large prime numbers corresponding to users of the ground station to obtain a set of prime numbers corresponding to the users; Determine ground station user domain key reconstruction parameter information according to each prime number in the prime number set corresponding to the user; Obtain the ground station domain key generation parameter information from the alliance chain; Randomly select prime numbers that are mutually prime from a finite field of large prime numbers corresponding to the ground station to obtain a prime number set corresponding to the ground station, and randomly select a first target prime number from the prime number set corresponding to the ground station; The first target prime number, the ground station user domain key reconstruction parameter information and the ground station domain key generation parameter information are sent to the ground station, so that the ground station determines the target ground station domain key confirmation value according to the ground station domain key generation parameter information and the first target prime number, and verifies the ground station domain key information according to the target ground domain key confirmation value and the ground station domain key confirmation value in the ground station domain key generation parameter information, and after the verification is passed, determines the ground station user domain key generation parameter information according to the ground station user domain key reconstruction parameter information, and uploads the ground station user domain key generation parameter information to the alliance chain, and the ground station domain key information is pre-allocated to the ground station by the network control center.

18. The method according to claim 17, characterized in that Also includes: Acquire the ground station user domain key generation parameter information from the alliance chain; Determine the target ground station user domain key information according to the ground station user domain key generation parameter information; The ground station registration request is verified according to the target ground station user domain key information and the ground station user domain key generation parameter information to obtain a verification result.

19. The method according to claim 18, characterized in that The ground station registration request is verified according to the target ground station user domain key information and the ground station user domain key generation parameter information to obtain a verification result, specifically including: Determine a target ground station user domain key confirmation value according to the ground station user domain key generation parameter information and the target ground station user domain key information; The ground station registration request is verified according to the target ground station user domain key confirmation value and the ground station user domain key confirmation value in the ground station user domain key generation parameter information to obtain a verification result.

20. The method of claim 19, wherein: The registration request of the ground station is verified according to the target ground station user domain key confirmation value and the ground station user domain key confirmation value in the ground station user domain key generation parameter information to obtain a verification result, specifically including: If it is determined that the target ground station user domain key confirmation value is equal to the ground station user domain key confirmation value in the ground station user domain key generation parameter information, it is determined that the verification is passed and the ground station is registered; If it is determined that the target ground station user domain key confirmation value is not equal to the ground station user domain key confirmation value in the ground station user domain key generation parameter information, it is determined that the verification has failed, and the registration failure message of the ground station is uploaded to the alliance chain.

21. The method of claim 20, wherein: After registering the ground station, the method further includes: The registration information of the ground station is uploaded to the alliance chain, the registration information of the ground station includes the ground station authentication credential, and the ground station authentication credential is determined based on the ground station domain key information and a preset hash algorithm.

22. The method of claim 17, wherein: Also includes: Receiving a satellite registration request sent by a satellite node, wherein the satellite registration request carries identification information of the satellite node; Randomly select a second target prime number from the set of prime numbers corresponding to the satellite nodes, where the set of prime numbers corresponding to the satellite nodes is obtained by the network control center randomly selecting prime numbers that are mutually prime from a finite field of large prime numbers corresponding to the satellite nodes; Randomly generate a PUF challenge value set of the satellite node according to the second target prime number and the physical unclonable function PUF; Acquire satellite domain key generation parameter information from the alliance chain; sending the second target prime number, the satellite domain key generation parameter information and the PUF challenge value set of the satellite node to the satellite node, so that the satellite node determines a target satellite domain key confirmation value according to the satellite domain key generation parameter information and the second target prime number, verifies the satellite domain key information according to the target satellite domain key confirmation value and the satellite domain key confirmation value in the satellite domain key generation parameter information, and determines a PUF response value set of the satellite node corresponding to the PUF challenge value set of the satellite node after the verification is passed, wherein the satellite domain key information is pre-allocated to the satellite node by the network control center; Receive a PUF response value set of the satellite node sent by the satellite node, and register the satellite node.

23. The method of claim 22, wherein: After registering the satellite node, the method further includes: Determine satellite authentication credentials based on satellite domain key information and a preset hash algorithm; The registration information of the satellite node is uploaded to the alliance chain, where the registration information of the satellite node includes the satellite authentication credential, the PUF challenge value set of the satellite node, and the PUF response value set of the satellite node.

24. The method of claim 17, wherein: Also includes: When it is determined that the ground station domain key update condition is met, randomly selecting a prime number from a finite field of large prime numbers corresponding to the ground station as the updated first ground station domain key information; Determine a ground station domain key update value according to the first ground station domain key information and a ground station domain key update function; Determine a ground station domain key update confirmation value according to the ground station domain key information, the first ground station domain key information, the ground station domain key update value, and a preset hash algorithm; The ground station domain key update value and the ground station domain key update confirmation value are used as a ground station domain key update generation message and uploaded to the alliance chain, so that the ground station determines the second ground station domain key information according to the ground station domain key update value, and determines the target ground station domain key update confirmation value according to the ground station domain key information, the second ground station domain key information, the ground station domain key update value, and the preset hash algorithm; if it is determined that the target ground station domain key update confirmation value is equal to the ground station domain key update confirmation value, the ground station domain key information is updated to the second ground station domain key information.

25. The method of claim 22, wherein: Also includes: When it is determined that the satellite domain key update condition is met, randomly selecting a prime number from a finite field of large prime numbers corresponding to the satellite node as the updated first satellite domain key information; Determine a satellite domain key update value according to the first satellite domain key information and a satellite domain key update function; Determine a satellite domain key update confirmation value according to the satellite domain key information, the first satellite domain key information, the satellite domain key update value, and a preset hash algorithm; The satellite domain key update value and the satellite domain key update confirmation value are used as a satellite domain key update generation message and uploaded to the alliance chain, so that the satellite node determines the second satellite domain key information according to the satellite domain key update value, and determines the target satellite domain key update confirmation value according to the satellite domain key information, the second satellite domain key information, the satellite domain key update value, and the preset hash algorithm; if it is determined that the target satellite domain key update confirmation value is equal to the satellite domain key update confirmation value, the satellite domain key information is updated to the second satellite domain key information.

26. An authentication device for a ground-ground integrated network, characterized in that: Applied to a ground station, the device comprises: A first receiving module, configured to receive an access request of a user terminal sent by a satellite node and identification information of the satellite node, wherein the access request carries the identification information of the user, encrypted user session key negotiation parameter information and an access request verification value; A first acquisition module is used to acquire the access request verification parameter of the user from the alliance chain according to the identification information of the user, where the access request verification parameter of the user is uploaded to the alliance chain after the ground station completes the registration of the user; a first authentication module, configured to decrypt the encrypted user session key negotiation parameter information to obtain decrypted user session key negotiation parameter information, and perform identity authentication on the user according to the decrypted user session key negotiation parameter information, the access request verification parameter and the access request verification value; A second acquisition module is used to acquire the authentication parameters of the satellite node from the alliance chain according to the identification information of the satellite node, and the authentication parameters of the satellite node are uploaded to the alliance chain after the network control center completes the registration of the satellite node; The second authentication module is used to determine a target authentication verification value of the satellite node according to the authentication parameters of the satellite node, and perform identity authentication on the satellite node according to the target authentication verification value.

27. An authentication device for a ground-ground network, characterized in that: Applied to a satellite node, the device comprises: A first receiving module, configured to receive an access request sent by a user terminal, wherein the access request carries user identification information, encrypted user session key negotiation parameter information, and an access request verification value; A first sending module is used to send the access request and the identification information of the satellite node to the ground station, so that the ground station obtains the access request verification parameter of the user from the alliance chain according to the identification information of the user, decrypts the encrypted user session key negotiation parameter information to obtain the decrypted user session key negotiation parameter information, and authenticates the user according to the decrypted user session key negotiation parameter information, the access request verification parameter and the access request verification value, wherein the access request verification parameter of the user is uploaded to the alliance chain by the ground station after completing the registration of the user; A second receiving module is used to receive an authorization challenge message sent by the ground station, where the authorization challenge message is used to verify the legitimacy of the user terminal. The authorization challenge message is determined by the ground station after determining that the user identity authentication is passed, based on the access request verification parameter and the authentication parameter of the satellite node obtained from the alliance chain based on the identification information of the satellite node. The authentication parameter of the satellite node is uploaded to the alliance chain after the network control center completes the registration of the satellite node; A first authentication module, configured to authenticate the legitimacy of the user terminal according to the satellite domain key information and the authorization challenge message; The second authentication module is used to receive a ground station session key negotiation message sent by the ground station, and to authenticate the ground station based on the authentication parameters of the satellite node and the ground station session key negotiation message. The ground station session key negotiation message is determined by the ground station based on the authentication parameters of the satellite node obtained from the alliance chain.

28. An authentication device for a ground-ground network, characterized in that: Applied to a network control center, the device comprises: A first receiving module is used to receive a ground station registration request sent by a ground station, wherein the ground station registration request carries identification information of the ground station; A first selection module is used to randomly select prime numbers that are mutually prime from a finite field of large prime numbers corresponding to users of the ground station to obtain a prime number set corresponding to the users; A first determination module is used to determine ground station user domain key reconstruction parameter information according to each prime number in the prime number set corresponding to the user; The first acquisition module is used to obtain ground station domain key generation parameter information from the alliance chain; A second selection module is used to randomly select prime numbers that are mutually prime from a finite field of large prime numbers corresponding to the ground station to obtain a prime number set corresponding to the ground station, and randomly select a first target prime number from the prime number set corresponding to the ground station; The first sending module is used to send the first target prime number, the ground station user domain key reconstruction parameter information and the ground station domain key generation parameter information to the ground station, so that the ground station determines the target ground station domain key confirmation value according to the ground station domain key generation parameter information and the first target prime number, and verifies the ground station domain key information according to the target ground domain key confirmation value and the ground station domain key confirmation value in the ground station domain key generation parameter information, and after the verification is passed, determines the ground station user domain key generation parameter information according to the ground station user domain key reconstruction parameter information, and uploads the ground station user domain key generation parameter information to the alliance chain, and the ground station domain key information is pre-allocated to the ground station by the network control center.

29. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the authentication method for the space-ground integrated network as described in any one of claims 1 to 25 is implemented.

30. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the authentication method for the space-ground integrated network as described in any one of claims 1 to 25 are implemented.

Images