Data transmission method, device and equipment and computer storage medium

Abstract

The invention provides a data transmission method, device and equipment and a computer storage medium, and the method relates to the technical field of information security, and is used for improving the security and adaptability of data transmission in a satellite communication process. The method is applied to a satellite network, after a downloading request of a first terminal node in communication connection with the satellite network for target data is received, corresponding identity verification is carried out on the first terminal node, and when a verification result shows that verification is passed, a corresponding proxy re-encryption key is obtained from a second terminal node uploading the target data, and the proxy re-encryption key is sent to the satellite network. Therefore, after the encrypted target data is converted and encrypted based on the proxy re-encryption key, the obtained re-encryption ciphertext is sent to the first terminal node, so that the first terminal node can decrypt the re-encryption ciphertext according to the first identity verification information of the first terminal node, thereby obtaining the corresponding target data. And the security and adaptability in the data transmission process are improved.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a method, device and equipment for data transmission and a computer storage medium. Background Art

[0002] With the continuous development of science and society, satellite networks have been widely used in global data transmission.

[0003] In a general satellite communication architecture, there is usually a satellite network and multiple terminal nodes connected to the satellite network; the terminal nodes can be divided into a first terminal node for downloading data and a second terminal node for uploading data according to the data transmission direction. As a data transfer station, the satellite network usually only forwards the transmission data, that is, after receiving the uploaded data, the satellite network needs to transmit it from the satellite network to the ground for centralized processing.

[0004] However, this centralized processing method not only lengthens the data processing path, but also increases communication delays and bandwidth consumption. This delay is particularly significant in application scenarios that require real-time response. On the other hand, when processing and storing data on the ground, the data faces a higher risk of leakage.

[0005] Therefore, there is an urgent need for a new data transmission method for satellite communications to improve the security and adaptability of data transmission during satellite communications. Summary of the invention

[0006] The embodiments of the present application provide a method, apparatus, device and computer storage medium for data transmission, which are used to improve the security and adaptability of data transmission in a satellite communication process.

[0007] In a first aspect, an embodiment of the present application provides a method for data transmission, which is applied to a satellite network, wherein the satellite network is communicatively connected to a plurality of terminal nodes, wherein the plurality of terminal nodes include at least one first terminal node that downloads data from the satellite network, and at least one second terminal node that uploads data to the satellite network, including:

[0008] Receiving a download request for target data sent from the first terminal node; wherein the download request carries first identity authentication information of the first terminal node;

[0009] When the first identity authentication information is authenticated and the obtained authentication result indicates that the first terminal node has passed the authentication, the first identity authentication information is sent to the second terminal node, so that the second terminal node generates and returns a corresponding proxy re-encryption key based on the first identity authentication information;

[0010] Based on the proxy re-encryption key, performing conversion encryption processing on the encrypted target data stored in the satellite network and encrypted by the second terminal node to obtain corresponding re-encrypted ciphertext;

[0011] The re-encrypted ciphertext is sent to the first terminal node, so that the first terminal node decrypts the re-encrypted ciphertext based on the first identity authentication information to obtain the target data.

[0012] In a second aspect, an embodiment of the present application provides a method for data transmission, which is applied to a second terminal node, where the second terminal node is at least one terminal node among multiple terminal nodes that uploads data to a satellite network, and the terminal node also includes at least one first terminal node that downloads data from the satellite network, including:

[0013] receiving first identity authentication information of the first terminal node sent by the satellite network; the first identity authentication information is sent to the satellite network when the first terminal node sends a download request for target data, and the first identity authentication information is sent after the satellite network authenticates the first identity authentication information and obtains a result indicating that the verification has passed;

[0014] Based on the first identity verification information, generating a corresponding proxy re-encryption key;

[0015] The proxy re-encryption key is sent to the satellite network so that the satellite network performs conversion encryption processing on the encrypted target data stored in the satellite network and encrypted by the second terminal node based on the proxy re-encryption key, obtains the corresponding re-encrypted ciphertext, and sends the re-encrypted ciphertext to the first terminal node.

[0016] In a third aspect, an embodiment of the present application provides a data transmission device, which is applied to a satellite network, wherein the satellite network is communicatively connected to a plurality of terminal nodes, wherein the plurality of terminal nodes include at least one first terminal node that downloads data from the satellite network, and at least one second terminal node that uploads data to the satellite network, wherein the device includes:

[0017] A first receiving module, configured to receive a download request for target data sent from the first terminal node; wherein the download request carries first identity authentication information of the first terminal node;

[0018] A first sending module is used to send the first identity authentication information to the second terminal node when the identity authentication is performed on the first identity authentication information and the obtained authentication result indicates that the first terminal node has passed the authentication, so that the second terminal node generates and returns a corresponding proxy re-encryption key based on the first identity authentication information;

[0019] A first processing module is configured to perform conversion encryption processing on the encrypted target data encrypted by the second terminal node and stored in the satellite network based on the proxy re-encryption key to obtain corresponding re-encrypted ciphertext;

[0020] The first sending module is further used to send the re-encrypted ciphertext to the first terminal node, so that the first terminal node decrypts the re-encrypted ciphertext based on the first identity authentication information to obtain the target data.

[0021] Optionally, the device further includes a registration module, configured to:

[0022] Receiving a registration request from a target registration node; wherein the target registration node is any one of the satellite nodes to be connected to the satellite network, or the target registration node is any one of the terminal nodes to be connected to the satellite network; the registration request carries a unique identifier corresponding to the target registration node;

[0023] Based on the preset life cycle corresponding to the target registration node, corresponding expiration time information is set for the target registration node; the expiration time information represents: the validity period of the target registration node's access permission to the satellite network;

[0024] Based on the unique identifier and expiration time information, combined with the preset encryption configuration information, the registration authentication information of the target registration node is generated, and the registration authentication information is sent to the target registration node, so that the target registration node stores the registration authentication information and completes the identity registration of the target registration node.

[0025] Optionally, the target registration node is any one of the terminal nodes to be accessed in the satellite network; after generating the registration authentication information of the target registration node, the registration module is further used to:

[0026] Based on the security level information corresponding to the unique identifier and the requested permission information carried by the registration request, in combination with the preset attribute configuration set for the terminal node, a corresponding security attribute set is configured for the target registration node; wherein each security attribute in the security attribute set includes: attribute information corresponding to the target registration node and a security score corresponding to the attribute information; the attribute configuration set includes multiple preset attribute information and security scores corresponding to the preset attribute information;

[0027] Allocating a corresponding attribute key and a corresponding key expiration time to each security attribute in the security attribute set;

[0028] The registration module is used to send the registration authentication information to the target registration node so that the target registration node stores the registration authentication information. When the identity registration of the target registration node is completed, it is specifically used to:

[0029] The registration authentication information, the security attribute set, the attribute key, and the key expiration time are sent to the target registration node, so that the target registration node stores the registration authentication information, the security attribute set, the attribute key, and the key expiration time, and completes the identity registration of the target registration node.

[0030] Optionally, the first receiving module is used to perform identity authentication on the first identity authentication information, and when obtaining a verification result, is specifically used to:

[0031] Acquire the registration authentication information, target data information, and security attribute authentication value included in the first identity authentication information; wherein the security attribute authentication value is obtained by the first terminal node based on the security attribute in a preset security attribute set, the corresponding attribute key, and the key expiration time;

[0032] Based on the time information of receiving the download request and the key expiration time in the security attribute authentication value, perform time verification on the first identity authentication information to obtain a corresponding time verification result;

[0033] When the time verification result indicates that the verification is passed, a matching verification is performed on the target data information based on the registration authentication information and the security attribute authentication value to obtain a corresponding verification result.

[0034] Optionally, the first receiving module is used to perform matching verification on the target data information based on the registration authentication information and the security attribute authentication value, and when obtaining a corresponding verification result, is specifically used to:

[0035] Based on preset information of each registered terminal in a preset registered terminal set, verify the registration authentication information of the first terminal node, and obtain a legal verification result corresponding to the first terminal node;

[0036] When the legal verification result indicates that the first terminal node is a registered terminal, a corresponding verification result is obtained based on the total value corresponding to the security scores of each security attribute in the security attribute authentication value, and the download permission conditions of the target data corresponding to the target data information; wherein, when the total value satisfies the download permission conditions, the verification result indicates that the verification is passed.

[0037] Optionally, the first sending module is used to send the first identity authentication information to the second terminal node, so that the second terminal node generates and returns a corresponding proxy re-encryption key based on the first identity authentication information, specifically for:

[0038] By covering the target satellite node of the second terminal node, the first identity authentication information, the satellite registration authentication information of the target satellite node and the data information of the target data are sent to the second terminal node, so that the second terminal node authenticates the satellite registration authentication information of the target satellite node, and when the authentication result indicates that the verification is passed, the proxy re-encryption key is generated and returned based on the first identity authentication information.

[0039] Optionally, before receiving the download request for target data sent from the first terminal node, the first receiving module is further configured to:

[0040] An upload request from the second terminal node is received by covering the target satellite node of the second terminal node; wherein the upload request carries the second identity authentication information of the second terminal node, the encrypted target data encrypted based on the encryption key of the second terminal node, and the corresponding download permission conditions when downloading the target data;

[0041] When identity authentication is performed on the second identity authentication information and the obtained authentication result indicates that the second terminal node has passed the authentication, the encrypted target data is stored.

[0042] In a fourth aspect, an embodiment of the present application provides a data transmission device, which is applied to a second terminal node, where the second terminal node is at least one terminal node among multiple terminal nodes that uploads data to a satellite network, and the terminal node also includes at least one first terminal node that downloads data from the satellite network, and the device includes:

[0043] a second receiving module, configured to receive first identity authentication information of the first terminal node sent by the satellite network; the first identity authentication information is sent to the satellite network when the first terminal node sends a download request for target data, and the first identity authentication information is sent after the satellite network authenticates the first identity authentication information and obtains a result indicating that the verification has passed;

[0044] A second processing module, configured to generate a corresponding proxy re-encryption key based on the first identity authentication information;

[0045] The second sending module is used to send the proxy re-encryption key to the satellite network, so that the satellite network converts and encrypts the encrypted target data stored in the satellite network and encrypted by the second terminal node based on the proxy re-encryption key, obtains the corresponding re-encrypted ciphertext, and sends the re-encrypted ciphertext to the first terminal node.

[0046] Optionally, when the second receiving module is used to receive the first identity authentication information of the first terminal node sent by the satellite network, it is specifically used to:

[0047] Receiving the first identity authentication information, satellite registration authentication information of the target satellite node, and data information of the target data sent from a target satellite node covering the second terminal node in the satellite network;

[0048] Based on the preset legal identity information, the satellite registration authentication information is authenticated to obtain a verification result indicating that the satellite registration authentication information has passed the verification; the legal identity information is: the legal identity information carried in the feedback information received when the second terminal node uploads the target data to the target satellite node.

[0049] In a fifth aspect, an embodiment of the present application provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the at least one processor executes the instructions stored in the memory, so that the at least one processor executes the method described in the first aspect or any optional implementation of the first aspect.

[0050] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium, which is used to store instructions. When the instructions are executed, the method in the first aspect or any optional implementation of the first aspect is implemented.

[0051] In a seventh aspect, an embodiment of the present application provides a computer program product comprising instructions, wherein the computer program product stores instructions that, when executed on a computer, enable the computer to execute the method described in the first aspect or any optional implementation of the first aspect.

[0052] The beneficial effects of this application are as follows:

[0053] In this scheme, after receiving the download request from the first terminal node, the satellite network can use the first identity authentication information carried in the download request to authenticate the first terminal node. After confirming that the authentication is successful, the first identity authentication information is sent to the second terminal node. The second terminal node can use the first identity authentication information in combination with its own encryption key to generate a corresponding proxy re-encryption key. The satellite network uses the proxy re-encryption key to convert the encrypted target data and obtain the corresponding re-encrypted ciphertext. In this way, the first terminal node can decrypt and obtain the target data based on the content of its own first identity authentication information.

[0054] In this process, the target data is transmitted and stored in an encrypted form during the transmission process, and plain text data will not appear in any process, so that the security of the target data transmission process can be ensured. At the same time, this scheme adopts proxy re-encryption technology to authorize a specific first terminal node to access the encrypted data. During the whole process, the satellite network cannot decrypt or access the data content, ensuring data privacy and the uploading user's complete control over the data, thereby enhancing the data privacy protection capability and ensuring that even if the data is stored in the cloud, it will not be accessed by the cloud service provider. At the same time, this technology supports a flexible data sharing mode, so that the second terminal node can authorize a specific first terminal node according to demand to ensure the confidentiality and security of the data. This mechanism not only improves the security of the data, but also enhances the flexibility of data sharing. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0056] Figure 1 A schematic diagram of possible application scenarios provided for embodiments of the present application;

[0057] Figure 2 A flowchart of a data transmission method provided in an embodiment of the present application;

[0058] Figure 3 A flowchart of a method for identity registration provided in an embodiment of the present application;

[0059] Figure 4 A schematic diagram of a target registration node provided in an embodiment of the present application;

[0060] Figure 5 A flow chart of an interactive method for identity registration provided in an embodiment of the present application;

[0061] Figure 6 A flowchart of an identity authentication method provided in an embodiment of the present application;

[0062] Figure 7 A flowchart of a matching verification method provided in an embodiment of the present application;

[0063] Figure 8 A schematic diagram of communication between a satellite network and a second terminal node provided in an embodiment of the present application;

[0064] Fig. 9 A flowchart of another data transmission method provided in an embodiment of the present application;

[0065] Fig.10 A schematic diagram of the structure of a data transmission device is provided for an embodiment of the present application;

[0066] Fig.11 A schematic diagram of the structure of a data transmission device is provided for an embodiment of the present application;

[0067] Fig.12 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0068] In order to make the purpose, technical scheme and advantages of the present application clearer, the technical scheme in the embodiment of the present application will be clearly and completely described below in conjunction with the drawings in the embodiment of the present application. Obviously, the described embodiment is only a part of the embodiment of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application. In the absence of conflict, the embodiments in the present application and the features in the embodiments can be arbitrarily combined with each other. In addition, although the logical order is shown in the flow chart, in some cases, the steps shown or described can be performed in an order different from that here.

[0069] The terms "first" and "second" in the specification and claims of the present application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the term "comprising" and any of their variations are intended to cover non-exclusive protection. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes other steps or units inherent to these processes, methods, products or devices. "Multiple" in the present application can mean at least two, for example, two, three or more, and the embodiments of the present application are not limited.

[0070] In the technical solution of this application, the acquisition, transmission, storage, and use of data are in compliance with the requirements of relevant national laws and regulations.

[0071] With the continuous development of science and society, satellite networks have been widely used in global data transmission. Traditional satellite communication architecture usually uses satellite networks as transit stations and provides data services by combining ground data centers with satellite networks. In this architecture, data uploaded to the satellite network usually needs to be transmitted from the satellite network to the ground for centralized processing.

[0072] However, this centralized processing method not only lengthens the data processing path, but also increases communication delays and bandwidth consumption. This delay is particularly significant in application scenarios that require real-time response. On the other hand, when processing and storing data on the ground, the data faces a higher risk of leakage.

[0073] In view of this, an embodiment of the present application provides a method for data transmission, which is applied to a satellite network and a terminal node connected to the satellite network for communication, and the corresponding data transmission method is completed by the interaction between the two. Specifically, when the first terminal node sends a download request for target data to the satellite network, the satellite network will authenticate the first terminal node through the first identity authentication information of the first terminal node carried in the download request to obtain a corresponding verification result. When the verification result indicates that the first terminal node has passed the verification, the satellite network verifies the legitimacy of the identity of the first terminal node, and then it can send the first identity authentication information to the second terminal node that uploaded the target data.

[0074] After receiving the first identity authentication information, the second terminal node can generate a corresponding proxy re-encryption key for the target data according to the first identity authentication information, and use the key to re-encrypt the encrypted target data.

[0075] After the second terminal node returns the proxy re-encryption key to the satellite network, the satellite network performs conversion encryption processing on the encrypted target data encrypted by the second terminal node and stored in the satellite network based on the proxy re-encryption key, thereby obtaining the corresponding re-encrypted ciphertext.

[0076] After the satellite network sends the re-encrypted ciphertext to the first terminal node, the first terminal node can decrypt the re-encrypted ciphertext according to its own first identity authentication information, thereby obtaining the corresponding target data.

[0077] After completing the introduction of the main inventive ideas of the embodiments of the present application, the specific implementation of the data transmission method proposed in the embodiments of the present application will be introduced below through some specific embodiments and drawings.

[0078] The following briefly introduces the application scenarios to which the technical solutions of the embodiments of the present application can be applied. It should be noted that the application scenarios introduced below are only used to illustrate the embodiments of the present application and are not limited. In the specific implementation process, the technical solutions provided by the embodiments of the present application can be flexibly applied according to actual needs.

[0079] See also Figure 1 , is a schematic diagram of a possible application scenario provided by an embodiment of the present application, in which a terminal node 101 and a satellite network 102 may be included.

[0080] The terminal node 101 can be a mobile phone (such as a satellite phone), a tablet computer (PAD), a personal computer (PC), a wearable device, a vehicle-mounted terminal and other devices in the ground equipment, or it can be a server node on the ground, such as an independent physical server, or a server cluster or distributed system composed of multiple physical servers. It can also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms.

[0081] The satellite network 102 may be a satellite cloud system consisting of a satellite constellation, which may be composed of multiple satellites, and these satellites may be located in different orbits, such as low earth orbit, medium earth orbit, and geostationary orbit. The satellite constellation is responsible for receiving and forwarding signals to achieve global coverage.

[0082] It should be noted that Figure 1 The figure is only an example. In fact, the number and communication mode of the terminal nodes and satellite constellations in the satellite network are not limited and are not specifically limited in the embodiments of the present application.

[0083] The following describes the data transmission method provided by the exemplary embodiment of the present application in combination with the application scenario described above and with reference to the accompanying drawings. It should be noted that the above application scenario is only shown to facilitate understanding of the spirit and principles of the present application, and the implementation of the present application is not limited in this respect.

[0084] See also Figure 2 , is a flow chart of a data transmission method provided in an embodiment of the present application. In order to facilitate the subsequent introduction of the method, the communication architecture applied to the data transmission method is first introduced.

[0085] The data transmission method provided in the present application is applied to a satellite network, which is communicatively connected to a plurality of terminal nodes, and these communication nodes include: at least one first terminal node (also referred to as a downloading user) for downloading data from the satellite network, and at least one second terminal node (also referred to as an uploading user) for uploading data to the satellite network.

[0086] For the data transmission method implemented by the satellite network, such as Figure 2 As shown, the specific implementation steps are as follows:

[0087] Step S201: receiving a download request for target data sent from a first terminal node; wherein the download request carries first identity authentication information of the first terminal node.

[0088] When the first terminal node hopes to obtain some specific data (i.e., target data) stored in it from the satellite network, it first needs to send a corresponding download request for the target data to the satellite network, and the download request needs to carry the first identity authentication information of the first terminal node so that the satellite network can authenticate the first terminal node.

[0089] The premise of identity authentication is that the first terminal node is already a registered legal user of the satellite network. For the satellite network, the list set of registered legal users can be a list set directly set in the satellite network, or can be obtained by different registration nodes through legal registration in the satellite network.

[0090] In a possible implementation, before the satellite network receives the download request for the target data sent from the first terminal node, the satellite network may complete the acquisition of the list set of legally registered users in the following manner.

[0091] See also Figure 3 , is a flow chart of an identity registration method provided in an embodiment of the present application, the execution subject of the method is a satellite network, such as Figure 3 As shown, the specific implementation steps are as follows:

[0092] Step S301: receiving a registration request from a target registration node.

[0093] like Figure 4 As shown, for a satellite network, the nodes in which legal identity registration is expected to be performed include not only the terminal nodes that are connected to it for communication, but also the different satellite nodes that constitute the satellite network. Therefore, the target registration node is any one of the satellite nodes to be connected to the satellite network, or the target registration node is any one of the terminal nodes to be connected to the satellite network; at the same time, the registration request carries the unique identifier corresponding to the target registration node.

[0094] Step S302: Based on the preset life cycle corresponding to the target registration node, corresponding expiration time information is set for the target registration node, where the expiration time information represents: the validity period of the target registration node's access permission to the satellite network.

[0095] For the target registration node, a corresponding preset life cycle is set. The specific value of the preset life cycle can be set in different ways based on different types of nodes.

[0096] For example, when the target registration node is a satellite node, the value of the preset life cycle can be set according to the expected life cycle and validity of the satellite corresponding to the satellite node. When the target registration node is a terminal node, the value of the preset life cycle can be set according to the expected life cycle and validity of the terminal node. Furthermore, for the terminal node, a fixed time limit can be set as the data basis for setting the preset life cycle to ensure that the terminal node needs to be re-registered after a certain period of time, so as to avoid long-term validity after one registration, which may cause errors in identity authentication.

[0097] After the expiration time information is set, the satellite network can adjust the validity period of the target registration node's access permission to the satellite network according to the expiration time information.

[0098] Step S303: Based on the unique identifier, expiration time information, and preset encryption configuration information, generate registration authentication information of the target registration node, and send the registration authentication information to the target registration node so that the target registration node stores the registration authentication information and completes the identity registration of the target registration node.

[0099] After the satellite network obtains the corresponding unique identifier and expiration time information, the satellite network can process the information accordingly. Specifically, the satellite network can generate corresponding registration authentication information based on the preset encryption configuration information; wherein the encryption configuration information may include: a preset hash function, an encryption key of the satellite network, and the like.

[0100] In this way, the satellite network can use the hash function to perform corresponding hash processing on the unique identification and expiration time information, and then combine the encryption key of the satellite network to generate the corresponding registration authentication information.

[0101] For example, it is assumed that the satellite node satellite L j Initiate a registration request to the satellite network. Then, the direct interaction between the satellite network and the satellite node is the following process:

[0102] First, satellite L jSend a registration request to the satellite network {ID j}, where ID j Satellite L j A unique identifier for

[0103] Secondly, the satellite network has a great impact on the satellite L j The satellite network is set according to the satellite L j The estimated service life and effectiveness of the satellite L j The expiration time information of the registration authentication information ET j ;

[0104] Next, set the satellite L j In this process, the satellite network can generate registration authentication information in the following ways:

[0105] The first step is to generate the first authentication intermediate key: the satellite network is based on the preset hash function H and satellite L j Unique ID j , Expiration time information ET j and satellite network key calculation satellite L j The first authentication intermediate key ss j,1 =H(ID j ,ET j )+sk ncc ;

[0106] The second step is to generate the second authentication intermediate key: the satellite network calculates the satellite L j The second authentication intermediate key

[0107] The third step is to generate registration authentication information: the satellite network calculates the satellite L j Registration authentication information sk j =ss j,2 P1, where P1 is a generator of the elliptic curve G1. The elliptic curve G1 is a preset elliptic curve used by the satellite network to generate keys using elliptic curve cryptography (ECC).

[0108] Finally, the satellite network can send the registration authentication information to the satellite L j .

[0109] The above is the method used by satellite nodes to register their identities in the satellite network.

[0110] It can be seen from the above content that the satellite network needs to allocate corresponding keys to the target registration nodes that need to be registered, and use its own keys to generate registration authentication information. Therefore, in a possible implementation, a corresponding network control center can be set up in the satellite network to configure the security parameters involved in the satellite network, including the elliptic curves, addition and multiplication groups, and hash settings required for key generation.

[0111] Exemplarily, the satellite network may be initialized and configured for the following types of parameters respectively:

[0112] Elliptic curve parameter configuration: The satellite network selects a secure elliptic curve E p :y 2 =x 3 +ax+b, where p is a large prime number, 4a 3 +27b 2 mod p≠0, F p is the base domain of the elliptic curve, {a,b}∈F p ;

[0113] Addition and multiplication cycle group configuration: The satellite network selects N-order addition cycle group G1, N-order addition cycle group G2, and N-order multiplication cycle group G T And from G1×G2 to G T The bilinear map e of

[0114] Generator configuration: The satellite network determines the generator P1 of the N-order additive cyclic group G1 and the generator P2 of the N-order additive cyclic group G2;

[0115] Master key generation: The satellite network randomly selects the master private key sk ncc ∈F p , and calculate the master public key PK ncc =sk ncc ·P2.

[0116] The above takes satellite nodes as an example to introduce the registration methods that can be adopted by satellite nodes and terminal nodes when performing identity registration in the satellite network. In a possible implementation, for terminal nodes, the satellite network can also adopt the following methods to improve the diversity and security of terminal nodes when performing identity registration.

[0117] Specifically, after the satellite network generates registration authentication information for the target registration node, when the target registration node is any one of the terminal nodes to be accessed in the satellite network, the satellite network may further perform the following operations:

[0118] The satellite network configures a corresponding security attribute set for the target registration node based on the security level information corresponding to the unique identifier and the requested permission information carried in the registration request, combined with a preset attribute configuration set for the terminal node; wherein each security attribute in the security attribute set includes: attribute information corresponding to the target registration node and a security score corresponding to the attribute information, and the attribute configuration set includes multiple preset attribute information and security scores corresponding to the preset attribute information.

[0119] Then, a corresponding attribute key and a corresponding key expiration time of each attribute key are assigned to each security attribute in the security attribute set.

[0120] Regarding the above-mentioned satellite network operation, the first thing that needs to be introduced is the attribute configuration set preset in the satellite network. In the satellite network, for different attributes in the terminal node, a corresponding security score can be pre-configured for each attribute information.

[0121] Property information Safety Score Property Key <![CDATA[Attribute 1a1]]> <![CDATA[Score of Attribute 1 f(a1)]]> <![CDATA[(p1,s1)]]> <![CDATA[Attribute 2a2]]> <![CDATA[Attribute 2 score f(a2)]]> <![CDATA[(p2,s2)]]> <![CDATA[Attribute 3a3]]> <![CDATA[Score of Attribute 3, f(a3)]]> <![CDATA[(p3,s3)]]> <![CDATA[Attribute 4a4]]> <![CDATA[Attribute 4 score f(a4)]]> <![CDATA[(p4,s4)]]> <![CDATA[Attribute 5a5]]> <![CDATA[Attribute 5 score f(a5)]]> <![CDATA[(p5,s5)]]> … … …

[0122] Table 1

[0123] As shown in Table 1, the satellite network can store different attribute information A={a1, a2,…, a m}, where a represents information such as attributes and roles. Then, a security score is assigned to each attribute information, that is, f(a), where the security score is defined according to the importance of the attribute information and the security requirement level. l , randomly select attribute information a l Private Keys l ∈F p , and calculate the security attribute a l Public key p l =s l ·P1. These attribute keys will be used for attribute-based access control mechanisms to enhance the security of satellite network data processing and sharing. It should be noted that the form of Table 1 above is only an example of an attribute configuration set. In practical applications, the representation and storage format of the attribute configuration set can be in a variety of different ways, and this application does not limit this.

[0124] As mentioned above, the attribute configuration set shown in Table 1 is pre-set in the satellite network. Therefore, after the satellite network receives the registration request from the terminal node, in addition to generating the corresponding registration authentication information for it, it can also combine the attribute configuration set, based on the security level information corresponding to the unique identifier of the terminal node, and the permission information to be requested carried in the registration request, to configure the corresponding security attribute set for the terminal node; wherein the permission information to be requested is the information of the permissions that the terminal node expects to obtain in the satellite network during this identity registration process, including permissions to upload data, download data of different security levels, and so on.

[0125] For example, assuming that the terminal node is the target registration node, it can be recorded as user U i , so that for the user U i A registration request such as Figure 5 As shown, the steps of direct interaction between the satellite network and it can be:

[0126] Step S501: User U i Send a registration request to the satellite network {ID i}, in addition to the corresponding unique identifier, the registration request also carries the permission information to be requested sar i ; Accordingly, the satellite network receives the registration request.

[0127] Step S502: The satellite network is based on user U i The preset life cycle is for the user U i Set the corresponding expiration time information. The expiration time information can be expressed in the form of an expiration timestamp ET. i format implementation.

[0128] Step S503: The satellite network uses the hash function H and the user U i Identifier ID i , Expiration timestamp ET i and the private key in the satellite network's master key to calculate user U i The first authentication intermediate key ss i,1 =H(ID i ,ET i )+sk ncc .

[0129] Step S504: The satellite network calculates the user U i The second authentication intermediate key

[0130] Step S505: The satellite network receives the i The security level information and permission information to be requested are for user U i Assign security attribute set {a i,1,a i,2 ,…,a i,n}. The security attribute set is based on the user U i After obtaining the relevant information of the corresponding terminal node, the corresponding attribute information and security score are selected from the attribute configuration set.

[0131] Step S506: For each security attribute l, the satellite network calculates the i The attribute key ask corresponding to the security attribute combined with the identity i,l =H(ID i ,a i,l ,ET i,l )s i,l +sk ncc , where s i,l is the security attribute a l The security attribute private key of ET i,l Satellite network for user U i Each security attribute a in the security attribute set i,l The key expiration time assigned to the security attribute.

[0132] In this way, after the satellite network completes the generation of the corresponding registration authentication information, security attribute set, corresponding attribute key, and key expiration time for the terminal node (i.e., the target registration node), the information can be fed back to the target registration node so that the target registration node stores the information and completes the identity registration of the target registration node, illustratively, as follows:

[0133] Step S507: The satellite network sends user U i Registration authentication informationsk i , security attribute set {a i,1 ,a i,2 ,…,a i,n}, and its corresponding attribute key, and the key expiration time corresponding to the attribute key, that is, {(a i,l ,f(a i,l )):(p i,l ,ask i,l ,ET i,l )} Safely sent to user U i ; Correspondingly, user U i Securely store the received user registration authentication information sk i And the set {(a i,l ,f(a i,l )):(p i,l ,ask i,l ,ET i,l )}.

[0134] In this way, through the above method, the satellite network can complete the registration request sent by the satellite node or terminal node, and feedback the registration-related information for these nodes, including registration authentication information, as well as possible security attribute sets, attribute keys, key expiration time and other information. In this method, the satellite network provides identity authentication and fine-grained access control of data for each satellite node and terminal node. Compared with the fixed and centralized node registration and authentication mechanism in the traditional satellite network, this method improves the adaptability and security of the system in complex application scenarios through a multi-attribute authentication mechanism and a flexible key distribution method. This mechanism not only ensures the uniqueness of each node identity, but also provides dynamic authentication and permission control based on multiple attributes, so that the satellite network can flexibly manage the permissions of different nodes according to actual needs, and enhance the security and flexibility of data transmission.

[0135] The above describes the way in which different nodes register their identities in the satellite network before the satellite network receives a download request.

[0136] After clarifying the method for obtaining basic information for identity authentication by the satellite network, the following will introduce a process in which the satellite network performs identity authentication on the first identity authentication information of the first terminal node and obtains a corresponding authentication result.

[0137] In a possible implementation, the satellite network can directly verify the identity information of the first terminal node according to the registration authentication information included in the first identity authentication information sent by the first terminal node, so as to determine whether the first terminal node is a legitimate terminal node that has completed identity registration in the satellite network. If so, a verification result indicating that the verification has been passed can be obtained, and if not, a verification result indicating that the verification has not been passed can be obtained.

[0138] This method can quickly authenticate the first terminal node, thereby improving the efficiency of the data transmission process.

[0139] In another possible implementation, the satellite network may also perform corresponding identity authentication on the first identity authentication information in the following manner.

[0140] See also Figure 6 , which is a flow chart of an identity authentication method provided in an embodiment of the present application, such as Figure 6 As shown, the specific implementation steps of this method are as follows:

[0141] Step S601: Acquire the registration authentication information, target data information, and security attribute authentication value included in the first identity authentication information.

[0142] The security attribute authentication value is obtained by the first terminal node based on the security attribute in a preset security attribute set, the corresponding attribute key and the key expiration time.

[0143] When the first terminal node sends a download request for target data to the satellite network, the first identity authentication information carried in the download request may include the above-mentioned registration authentication information, target data information, security attribute authentication value, etc. Among them, the registration authentication information is used to represent the identity information of the first terminal node, the target data information is used to represent the relevant information of the target data requested for download (such as data identification, etc.), and the security attribute authentication value is used to represent the security level of the first terminal node, data download authority, etc.

[0144] Exemplarily, the generation of the security attribute authentication value is performed by the first terminal node before sending the download request. At this time, in order to meet the data access control requirements, the first terminal node needs to calculate the security attribute authentication value and send it to the satellite network. Specifically, the first terminal node can select one or more security attributes from the security attribute set obtained during identity registration according to the actual request requirements of the target data to be downloaded, as well as their corresponding security scores, attribute keys, and key expiration times, and generate corresponding security attribute authentication values. For example, the first terminal node is the download user U k For example, the downloading user U k From the attribute key set of the security attribute set {(a i,l ,f(a i,l )):(p i,l ,ask i,l ,ET i,l )} select security attributes {a k,1 ,a k,2 ,a k,3} and its corresponding attribute key {(p k,1 ,ask k,1 ,ET k,1 ),(p k,2 ,ask k,2 ,ET k,2 ),(p k,3 ,ask k,3 ,ET k,3 )} as an example.

[0145] The downloading user U corresponding to the first terminal node k You need to calculate the verification hash value sacv first k =H(ID k ,a k,1 ,a k,2 ,a k,3 ,p k,1 ,p k,2 ,p k,3 ,ET k,1 ,ET k,2 ,ETk,3 ,h k-j ,S k-j ,IDdata,t2), and then calculate the security attribute authentication value saav based on the verification hash value k =sacv k ·(ask k,1 +ask k,2 +ask k,3 +tsk k )+sk ncc .

[0146] In this way, after obtaining the corresponding security attribute authentication value, the first terminal node can add it to the first identity authentication information and then send it to the satellite network.

[0147] After receiving the download request carrying the first identity authentication information, the satellite network can authenticate the first terminal node according to the content of the first identity authentication information, that is:

[0148] Step S602: Based on the time information of receiving the download request and the key expiration time in the security attribute authentication value, time verification is performed on the first identity authentication information to obtain a corresponding time verification result.

[0149] When the satellite network authenticates the first terminal node, the first thing that needs to be verified is whether the registration authentication information, attribute key and other information of the first terminal node are still valid. Specifically, the time information of receiving the download request is compared with the expiration time information and the key expiration time to determine whether the time information of receiving the download request is still within the time range represented by the expiration time information and the key expiration time.

[0150] Optionally, when other satellite networks interact with different nodes, the satellite network or other different nodes can perform time verification on the effectiveness of the time of each interactive operation. For example, when the terminal node sends data or requests to download data, the satellite network can first perform time verification on the information related to the expiration time in the terminal node. For another example, when the satellite network sends an instruction to generate a proxy re-encryption key to the terminal node, the terminal node can also perform time verification on the expiration time information of the satellite node that sends the instruction.

[0151] In this way, when each node performs interactive operations, it can first verify the time of the relevant information of the expiration time, and only after the verification is confirmed to be passed, it can continue with other verification operations or other processing operations, etc. In this way, it is first ensured that each node is within the validity period before continuing with subsequent operations, which further improves the security of the data transmission process.

[0152] Step S603: When the time verification result indicates that the verification is passed, a matching verification is performed on the target data information based on the registration authentication information and the security attribute authentication value to obtain a corresponding verification result.

[0153] In this manner, the download request sent by the first terminal node is verified by double verification, and the time verification and matching verification are combined to improve the security of the download request verification process.

[0154] In a possible implementation, when matching and verifying the target data information, the satellite network may complete the verification in the following manner.

[0155] See also Figure 7 , is a flow chart of a matching verification method provided in an embodiment of the present application, such as Figure 7 As shown, the specific implementation steps of this method are as follows:

[0156] Step S701: based on preset information of each registered terminal in a preset registered terminal set, verify the registration authentication information of the first terminal node, and obtain a legal verification result corresponding to the first terminal node.

[0157] When the satellite network determines that all relevant information about the expiration time included in the first identity authentication information is within the validity period, it can continue to match and verify the registration authentication information and security attribute authentication value included in the first identity authentication information.

[0158] Specifically, the satellite network first needs to verify the registration authentication information corresponding to the first terminal node based on the preset information of each registered terminal in the preset registered terminal set, and obtain the corresponding legal verification result.

[0159] Among them, the registered terminal set preset in the satellite network can be directly configured in the satellite network, or it can be composed of preset information retained when different satellite nodes and terminal nodes register in the satellite network as described above. This application does not impose any restrictions on this.

[0160] When performing verification, the satellite network can compare the registration authentication information sent by the received first terminal node with the preset information in the satellite network to see if they are the same. If they are the same, it can be indicated that the first terminal node is a legitimate user registered in the satellite network. Therefore, the legal verification result can indicate that the first terminal node is a registered terminal.

[0161] Step S702: When the legal verification result indicates that the first terminal node is a registered terminal, based on the total value corresponding to each security score in the security attribute authentication value and the download permission condition of the target data corresponding to the target data information, the corresponding verification result is obtained. When the total value meets the download permission condition, the verification result indicates that the verification is passed.

[0162] For the target data, when uploading, it can also correspond to the corresponding download permission conditions, which are used to limit the permissions that the terminal nodes that can download need to have.

[0163] Therefore, when the satellite network performs verification processing on the first identity authentication information, it is also necessary to determine whether the first terminal node requesting to download the target data meets the download authority conditions corresponding to the target data.

[0164] Specifically, the satellite network can obtain the total value of the security scores corresponding to each security attribute contained in the security attribute authentication value to determine whether the download permission conditions of the corresponding target data are met; it can also determine the corresponding verification result based on whether the types of each security attribute contained in the security attribute authentication value meet the download permission conditions of the target data.

[0165] The above introduces the relevant steps that the satellite network needs to perform before and after receiving the download request from the first terminal node. In order to facilitate understanding of the specific implementation of the above solution, the process will be introduced below through an example.

[0166] For example, assuming that the first terminal node is a downloading user U k , while in the satellite network, the receiving download user U k The node that requested the download is the satellite node L j , then the above interaction process between the two parties is as follows:

[0167] The first part, for downloading user U k For example, you need to perform the following operations:

[0168] First, due to the download user U k It is expected to make a download request for the target data, so the download user U k You can randomly select a temporary private key tsk after identity registration in the satellite network k ∈F p , and calculate the temporary public key

[0169] Second, download user U k Calculate the identity authentication and data request authentication code h k-j =H(ID k ,tpk k ,IDdata,ET k ,t2), identity authentication and data request signature value S k-j =(tsk k -h k-j )·sk k, where IDdata is the downloading user U k The identifier of the requested data, t2 is the current time when this information is generated, and this information is used as the registration authentication information and target data information in the above content.

[0170] Next, download user U k In order to meet the data access control requirements, the security attribute authentication value needs to be calculated and sent to the satellite node L j The specific calculation method of the security attribute authentication value can refer to the above description, and this application will not elaborate on it here.

[0171] Finally, download user U k The information packet {ID k ,h k-j ,S k-j ,a k,1 ,a k,2 ,a k,3 ,p k,1 ,p k,2 ,p k,3 ,saav k ,ET k,1 ,ET k,2 ,ET k,3 ,ET k ,IDdata,t2} is sent to the satellite node L as the first identity authentication information carried in the download request j ; Among them, the first identity authentication information includes registration authentication information, target data information and security attribute authentication value.

[0172] Part II: Access Points in Satellite Networks, Satellite Nodes L j After receiving the above download user U k After sending a download request carrying the first identity verification information, you need to perform the following operations:

[0173] First, perform time verification. Specifically, the satellite node L j Receive download user U k The first identity verification information (when represented by an identifier:

[0174] {ID k ,h k-j ,S k-j ,sacv k ,a k,1 ,a k,2 ,a k,3 ,p k,1 ,p k,2 ,p k,3 ,saav k,ET k,1 ,ET k,2 ,ET k,3 ,ET k ,IDdata,t2}),

[0175] Need to filter out ET k,1 ,ET k,2 ,ET k,3 ,ET k ,t2 is used to verify the validity and freshness of the first identity authentication information.

[0176] Secondly, the first terminal node is matched and verified. Specifically, the satellite node L j Calculating the verification factor Identity and data verification parameters P k-j =H(ID k ,ET k )·P2+PK ncc , identity and data intermediate verification parameter u k-j =e(S k-j ,P k-j ), identity and data final verification parameter w k-j =u k-j ·T k-j , and finally verify the identity and data authentication code h k-j Parameters and H(ID k ,w k-j ,IDdata,ET k ,t2) are equal. If they are equal, then w k-j =tpk k , then the satellite node L j Can confirm downloading user U k the legitimacy of.

[0177] Then, the security attributes and access rights are verified, and the satellite node L j First, verify whether the identity, data request, and security attribute or its total score in the security attribute authentication value can meet the data access control requirements, and then calculate SACv ′ k =H(ID k ,a k,1 ,a k,2 ,a k,3 ,p k,1 ,p k,2 ,p k,3 ,ET k,1 ,ET k,2 ,ET k,3 ,h k-j ,S k-j ,IDdata,t2).

[0178] And verify saav k Is P1 (i.e., equation 1 below) equal to equation 2? Where, equation 1 and equation 2 are:

[0179] saav k ·P1=sacv k ·(H(ID k ,a i,1 ,ET k,1 )·p k,1 +PK ncc )+sacv k ·(H(ID k ,a i,2 ,ET k,2 )·p k,2 +PK ncc )+sacv k ·(H(ID k ,a i,3 ,,ET k,3 )·p k,3 +PK ncc )+sacv k ·tpk k +PK ncc (Equation 1)

[0180] sacv k ·(H(ID k ,a i,1 ,ET k,1 )·p k,1 +H(ID k ,a i,2 ,,ET k,2 )·p k,2 +H(ID k ,a i,3 ,ET k,3 )·p k,3 )+sacv k ·(3PK ncc +tpk k )+PK ncc (Equation 2)

[0181] If the equation holds true, then the download user U is determined k The security attribute of is legitimate, that is, the satellite network should allow the download of user U k Get the data data identified as IDdata.

[0182] In the above, various implementation methods that can be performed for the process in which the first terminal node sends a download request to the satellite network and the satellite network verifies the download request are introduced. The subsequent operations of the satellite network will be further introduced below.

[0183] Step S202: When identity authentication is performed on the first identity authentication information and the obtained authentication result indicates that the first terminal node has passed the authentication, the first identity authentication information is sent to the second terminal node so that the second terminal node generates and returns a corresponding proxy re-encryption key based on the first identity authentication information.

[0184] After the satellite network authenticates the first terminal node and confirms the legitimacy of the first terminal node and can download the target data, it needs to perform corresponding processing on the target data.

[0185] Specifically, the satellite network can use proxy re-encryption processing on the target data to ensure secure sharing and flexible access to data in the satellite network. In this way, after the download request is verified, the satellite network can send the first identity authentication information corresponding to the first terminal node to the second terminal node that uploads the target data, so that the second terminal node uses the first identity authentication information to generate a corresponding proxy re-encryption key. The role of the proxy re-encryption key is to allow the satellite network to convert the encryption key corresponding to the target data into a form that can be decrypted by the first terminal node.

[0186] In a possible implementation manner, when the satellite network sends the first identity authentication information to the second terminal node, the method may be as follows:

[0187] like Figure 8 As shown, the satellite network sends the first identity authentication information to the second terminal node through a target satellite node in its own network, wherein the target satellite node is: a satellite node covering the second terminal node.

[0188] At this time, while sending the first identity authentication information to the second terminal node, it is also necessary to send to the second terminal node the satellite registration authentication information stored when the target satellite node performs identity registration in the satellite network and the data information of the target data.

[0189] In this way, after receiving the content, the second terminal node can perform identity authentication based on the satellite registration authentication information of the target satellite node, and when the obtained identity authentication result indicates that the authentication is passed, it generates and returns the corresponding proxy re-encryption key based on the first identity authentication information.

[0190] For example, assuming that the target satellite node is satellite node L j , the first terminal node requesting to download data is the downloading user U k, the second terminal node that uploaded the target data is the uploading user U i , then the process of obtaining the proxy re-encryption key can be described as follows:

[0191] First, the satellite node L j Randomly select a new temporary private key tsk for identity and parameter verification j ∈F p , and calculate the temporary public key for identity and parameter verification

[0192] Secondly, the satellite node L j Calculate the identity and data authentication code h j-i =H(ID j ,tpk j ,tpk k ,ET j ,t3), identity and data signature value S j-i =(tsk j -h j-i )·sk k , where t3 is the current timestamp.

[0193] Next, the satellite node L j Upload user U i Send {ID j ,h j-i ,S j-i ,tpk k ,ET j ,t3}.

[0194] On the other hand, uploading user U i Received from satellite node L j {ID j ,h j-i ,S j-i ,tpk k ,ET j ,t3}, first verify the timestamps t3, ET j freshness and effectiveness.

[0195] Then, upload user U i Calculating the verification factor Identity and data verification parameters P j-i =H(ID j ,ET j )·P2+PK ncc , identity and data intermediate verification parameter u j-i =e(S j-i ,P j-i ), identity and temporary public key final verification parameter w j-i =uj-i ·T j-i , and finally verify the identity and temporary public key authentication code h j-i Parameters and H(ID j ,w j-i ,tpk k ,ET j ,t3) are equal.

[0196] If they are equal, then w j-i =tpk j , then upload user U i Able to confirm satellite node L j The legitimacy of the satellite node L j Sent {ID j ,h j-i ,S j-i ,tpk k ,ET j ,t3} is complete and valid.

[0197] So, upload user U i Calculate the re-encryption key for the Edata encryption key Computing and Satellite Nodes L j Session key Encrypted proxy re-encryption key Erk = Sys_enc(rk,key i-j ), identity and related parameter authentication code h i-j,1 =H(ID i ,tpk i ,Erk,ET i ,t4), identity and data signature value S i-j,1 =(tsk i -h i-j,1 )·sk i , where t4 is the current timestamp.

[0198] Finally, upload user U i The proxy re-encryption key and authentication credential {ID i ,Erk,h i-j,1 ,S i-j,1 ,ET i ,t4} sent to the satellite node L of the satellite network j .

[0199] In this method, a dynamic trust verification mechanism is proposed, which combines multi-level verification methods such as identity verification, timestamp verification, and data integrity verification to ensure the security of data during upload, storage, download, and access. In this way, the mechanism can manage and verify the security of data interaction between multiple users and multiple nodes in real time, and through dynamic trust management, this method effectively prevents unauthorized access and data tampering, and enhances the overall security and reliability of the data transmission process; especially in complex scenarios of multi-user and multi-node collaboration, the mechanism provides stronger real-time and adaptability, and improves the security of data interaction.

[0200] After receiving the proxy re-encryption key returned by the second terminal node, the satellite network can continue to perform the following operations:

[0201] Step S203: Based on the proxy re-encryption key, the encrypted target data stored in the satellite network and encrypted by the second terminal node is converted and encrypted to obtain the corresponding re-encrypted ciphertext.

[0202] After the satellite network obtains the proxy re-encryption key of the second terminal node, it can determine that the second terminal node has allowed the first terminal node's download request for the target data. Therefore, at this time, the satellite network needs to perform proxy re-encryption processing on the encrypted target data it stores, and then send the obtained ciphertext to the first terminal node. This method is designed to ensure the secure transmission of sensitive data in the satellite network and its secure and controllable access to the first terminal node. Through proxy re-encryption processing, the second terminal node securely converts the encryption key into a form that can be decrypted by the first terminal node, ensuring that the satellite network itself cannot access the data content, thereby protecting data privacy.

[0203] For example, assuming that the second terminal node is the uploading user U i , then, the satellite network receives the upload user U i The proxy re-encryption key and verification credential message {ID i ,Erk,h i-j,1 ,S i-j,1 ,ET i ,t4}, first verify the timestamp ET i ,t4 effectiveness and freshness.

[0204] After verification, the satellite network calculates the verification factor Identity and data verification parameters P i-j,1 =H(ID i ,ET i )·P2+PK ncc , identity and data intermediate verification parameter u i-j,1 =e(S i-j,1 ,P i-j,1), identity and data final verification parameter w i-j,1 =u i-j,1 ·T i-j,1 , and finally verify the identity and data authentication code h i-j,1 Parameters and H(ID i ,w i-j,1 ,Erk,ET i ,t4) are equal. If they are equal, then w i-j,1 =tpk i , then the satellite network can confirm the upload user U i The legitimacy of the proxy re-encryption key and verification credential {ID i ,Erk,h i-j,1 ,S i-j,1 ,ET i ,t4} completeness.

[0205] Then, the satellite network calculates and uploads user U i Session key Extract the proxy re-encryption key rk = Sys_dnc (Erk, key i-j ), then the satellite network calculates That is, the Edata encryption key ciphertext after proxy re-encryption is (R i ′ ,Edek i ).

[0206] After the satellite network obtains the corresponding re-encrypted ciphertext, it can continue to perform the following operations:

[0207] Step S204: Send the re-encrypted ciphertext to the first terminal node, so that the first terminal node decrypts the re-encrypted ciphertext through the first identity authentication information to obtain the target data.

[0208] After the satellite network sends the re-encrypted ciphertext to the first terminal node, the first terminal node can use the information in its own first identity authentication information to decrypt the re-encrypted ciphertext to obtain the target data.

[0209] In this way, the satellite network can complete the data transmission operation for the target data, and during the operation, after receiving the download request from the first terminal node, the satellite network can use the first identity authentication information carried in the download request to authenticate the first terminal node. After confirming that the verification is successful, the first identity authentication information is sent to the second terminal node. The second terminal node can use the first identity authentication information in combination with its own encryption key to generate a corresponding proxy re-encryption key. The satellite network uses the proxy re-encryption key to convert the encrypted target data and obtain the corresponding re-encrypted ciphertext. In this way, the first terminal node can decrypt and obtain the target data based on the content of its own first identity authentication information.

[0210] In this process, the target data is transmitted and stored in an encrypted form during the transmission process, and plain text data will not appear in any process, so that the security of the target data transmission process can be ensured. At the same time, this scheme adopts proxy re-encryption technology to authorize a specific first terminal node to access the encrypted data. During the whole process, the satellite network cannot decrypt or access the data content, ensuring data privacy and the uploading user's complete control over the data, thereby enhancing the data privacy protection capability and ensuring that even if the data is stored in the cloud, it will not be accessed by the cloud service provider. At the same time, this technology supports a flexible data sharing mode, so that the second terminal node can authorize a specific first terminal node according to demand to ensure the confidentiality and security of the data. This mechanism not only improves the security of the data, but also enhances the flexibility of data sharing.

[0211] In a possible implementation manner, when the satellite network receives the target data from the first terminal node and stores the target data, the satellite network may adopt the following method:

[0212] First, the satellite network receives an upload request from the second terminal node through a target satellite node covering the second terminal node; wherein the upload request carries second identity authentication information of the second terminal node, encrypted target data encrypted based on an encryption key of the second terminal node, and corresponding download permission conditions when downloading the target data.

[0213] Next, when identity authentication is performed on the second identity authentication information and the obtained authentication result indicates that the second terminal node has passed the authentication, the encrypted target data is stored.

[0214] Specifically, in this method, the second terminal node can first generate a key for encrypting data and a temporary public key, and use this temporary public key to encrypt the encryption key to ensure the security of the key during transmission. Then, the second terminal node uses the encryption key to encrypt the data to be uploaded, and uploads the encrypted data together with the key encrypted by the temporary public key to the satellite network. During the upload process, the second terminal node can also set specific access rights as download permission conditions, define a set of security attributes or security score thresholds, and only the first terminal node that meets these conditions can decrypt and access the data. After receiving the data, the satellite network will perform a verification operation to confirm the validity and legitimacy of the uploaded data and the second terminal node, and store the data according to the set download permission conditions. This approach not only strengthens the security of the data, but also provides flexible access control, ensuring that only authorized first terminal nodes can access sensitive information.

[0215] For example, assuming that the second terminal node is the uploading user U i , user U i The data to be uploaded is data, satellite node L j is the target satellite node in the satellite network. In this way, the interaction mode of this method can be carried out in the following ways:

[0216] First, upload user U i Randomly select data encryption key dek i ∈F p , randomly select a temporary private key tsk for the encryption key i ∈F p , and calculate the temporary public key for the encryption key

[0217] Secondly, user U i Through the symmetric confidentiality mechanism and encryption key dek i Encrypt data, that is, encrypt data Edata = Sys_enc(data,H(data,dek i ),dek i ), where Sys_enc is a symmetric encryption algorithm, H(data, dek i ) is a parameter for the receiver to perform integrity verification.

[0218] Next, user U i Randomly select random factor r i , calculate the random factor public key Encrypted encryption key

[0219] Then, upload user U i Calculate the identity and data authentication code hi-j =H(ID i ,tpk i ,Edata,Edek i ,R i ,ET i ,am i ,t1), identity and data signature value S i-j =(tsk i -h i-j )·sk i , where am i The security attribute or security score threshold required to access data data. When the requirement is a security attribute, the download permission condition am i =ras i ={a1,a2,…}, when the requirement is the security score threshold, the download permission condition am i =ras i =sc i , a1 and a2 are user attributes, sc i is the score, and t1 is the current timestamp.

[0220] Finally, upload user U i The encrypted data authentication package {ID i ,Edata,Edek i ,R i ,ET i ,h i-j ,S i-j ,am i ,t1} is sent to the satellite access point L of the satellite cloud system j .

[0221] On the other hand, the satellite network receives the upload user U i After sending the encrypted data authentication package, you can perform the following operations:

[0222] First, the satellite node L j First verify the timestamps t1, ET i Freshness and validity, calculate the verification factor Identity and data verification parameters P i-j =H(ID i ,ET i )·P2+PK ncc , identity and data intermediate verification parameter u i-j =e(S i-j ,P i-j ), identity and data final verification parameter w i-j =u i-j ·T i-j .

[0223] Secondly, the satellite node L j Verify identity and data authentication code i-j Parameters and H(ID i ,w i-j ,Edata,Edek i ,R i ,ET i ,am i ,t1) are equal. If they are equal, then w i-j =tpk i , then the satellite node L j Able to confirm uploading user U i The legitimacy of the upload user U i Fully encrypted data authentication packet sent {ID i ,Edata,Edek i ,R i ,ET i ,h i-j ,S i-j ,am i ,t1} is complete, legal and valid.

[0224] Finally, the satellite node L j The validity of the data source has been verified, and the encrypted data Edata and the encryption key ciphertext Edek i , temporary public key tpk for encryption key i , random factor public key R i 、Download permission conditionsam i Stored on satellite network.

[0225] The above are various possible implementation methods performed by the satellite network when the data transmission method provided by the present application is applied in the satellite network.

[0226] Based on the same inventive concept, an embodiment of the present application also provides a method for data transmission, which is applied to a second terminal node that is communicatively connected to a satellite network.

[0227] See also Fig. 9 , which is a flowchart of another method for data transmission provided in an embodiment of the present application, such as Fig. 9 As shown, the specific implementation steps of this method are as follows:

[0228] Step S901: Receive first identity authentication information of a first terminal node sent by a satellite network; the first identity authentication information is sent to the satellite network when the first terminal node sends a download request for target data, and the first identity authentication information is sent after the satellite network authenticates the first identity authentication information and obtains a result indicating that the verification has passed.

[0229] Step S902: Generate a corresponding proxy re-encryption key based on the first identity authentication information.

[0230] Step S903: Send the proxy re-encryption key to the satellite network, so that the satellite network converts and encrypts the encrypted target data encrypted by the second terminal node and stored in the satellite network based on the proxy re-encryption key, obtains the corresponding re-encrypted ciphertext, and sends the re-encrypted ciphertext to the first terminal node.

[0231] Among them, the possible implementation methods of the second terminal node specifically performing the above steps can be found in the foregoing content, and this application will not elaborate on them here.

[0232] In a possible implementation, when the second terminal node receives the first identity authentication information from the first terminal node of the satellite network, the following operations may be performed:

[0233] First, receiving first identity authentication information, satellite registration authentication information of the target satellite node, and data information of the target data sent from a target satellite node covering the second terminal node in the satellite network;

[0234] Then, based on the preset legal identity information, the satellite registration authentication information is authenticated to obtain a verification result indicating that the satellite registration authentication information has passed the verification; wherein the legal identity information is: the legal identity information carried in the feedback information received when the second terminal node uploads the target data to the target satellite node.

[0235] When the second terminal node uploads relevant content of the target data to the target satellite node, the target satellite node will feedback the legal identity information of the target satellite node to the second terminal node after receiving the relevant content, so as to be used by the second terminal node for subsequent identity authentication.

[0236] In this way, after receiving the first identity authentication information sent by the target satellite node, the second terminal node can first verify the identity of the target satellite node to ensure the security of the information sender.

[0237] Based on the same inventive concept, an embodiment of the present application also provides a device for data transmission.

[0238] See also Fig.10 , is a structural schematic diagram of a data transmission device provided in an embodiment of the present application. The device may be the above-mentioned server or a chip or integrated circuit in the device, etc. The device includes a module / unit / technical means for executing the method executed by the server in the above-mentioned method embodiment.

[0239] Exemplarily, the device 1000 includes:

[0240] The first receiving module 1001 is used to receive a download request for target data sent from the first terminal node; wherein the download request carries the first identity authentication information of the first terminal node;

[0241] The first sending module 1002 is used to send the first identity authentication information to the second terminal node when the identity authentication result obtained indicates that the first terminal node has passed the authentication, so that the second terminal node generates and returns a corresponding proxy re-encryption key based on the first identity authentication information;

[0242] A first processing module 1003 is configured to perform conversion encryption processing on the encrypted target data encrypted by the second terminal node and stored in the satellite network based on the proxy re-encryption key to obtain a corresponding re-encrypted ciphertext;

[0243] The first sending module 1002 is further used to send the re-encrypted ciphertext to the first terminal node, so that the first terminal node decrypts the re-encrypted ciphertext based on the first identity authentication information to obtain the target data.

[0244] Optionally, the device further includes a registration module 1004, which is used to:

[0245] Receiving a registration request from a target registration node; wherein the target registration node is any one of the satellite nodes to be connected to the satellite network, or the target registration node is any one of the terminal nodes to be connected to the satellite network; the registration request carries a unique identifier corresponding to the target registration node;

[0246] Based on the preset life cycle corresponding to the target registration node, corresponding expiration time information is set for the target registration node; the expiration time information represents: the validity period of the target registration node's access permission to the satellite network;

[0247] Based on the unique identifier and expiration time information, combined with the preset encryption configuration information, the registration authentication information of the target registration node is generated, and the registration authentication information is sent to the target registration node, so that the target registration node stores the registration authentication information and completes the identity registration of the target registration node.

[0248] Optionally, the target registration node is any one of the terminal nodes to be accessed in the satellite network; after generating the registration authentication information of the target registration node, the registration module 1004 is further used to:

[0249] Based on the security level information corresponding to the unique identifier and the requested permission information carried by the registration request, in combination with the preset attribute configuration set for the terminal node, a corresponding security attribute set is configured for the target registration node; wherein each security attribute in the security attribute set includes: attribute information corresponding to the target registration node and a security score corresponding to the attribute information; the attribute configuration set includes multiple preset attribute information and security scores corresponding to the preset attribute information;

[0250] Allocating a corresponding attribute key and a corresponding key expiration time to each security attribute in the security attribute set;

[0251] The registration module is used to send the registration authentication information to the target registration node so that the target registration node stores the registration authentication information. When the identity registration of the target registration node is completed, it is specifically used to:

[0252] The registration authentication information, the security attribute set, the attribute key, and the key expiration time are sent to the target registration node, so that the target registration node stores the registration authentication information, the security attribute set, the attribute key, and the key expiration time, and completes the identity registration of the target registration node.

[0253] Optionally, the first receiving module 1001 is used to perform identity authentication on the first identity authentication information, and when obtaining the authentication result, is specifically used to:

[0254] Acquire the registration authentication information, target data information, and security attribute authentication value included in the first identity authentication information; wherein the security attribute authentication value is obtained by the first terminal node based on the security attribute in a preset security attribute set, the corresponding attribute key, and the key expiration time;

[0255] Based on the time information of receiving the download request and the key expiration time in the security attribute authentication value, perform time verification on the first identity authentication information to obtain a corresponding time verification result;

[0256] When the time verification result indicates that the verification is passed, a matching verification is performed on the target data information based on the registration authentication information and the security attribute authentication value to obtain a corresponding verification result.

[0257] Optionally, the first receiving module 1001 is used to perform matching verification on the target data information based on the registration authentication information and the security attribute authentication value, and when obtaining a corresponding verification result, is specifically used to:

[0258] Based on preset information of each registered terminal in a preset registered terminal set, verify the registration authentication information of the first terminal node, and obtain a legal verification result corresponding to the first terminal node;

[0259] When the legal verification result indicates that the first terminal node is a registered terminal, a corresponding verification result is obtained based on the total value corresponding to the security scores of each security attribute in the security attribute authentication value, and the download permission conditions of the target data corresponding to the target data information; wherein, when the total value satisfies the download permission conditions, the verification result indicates that the verification is passed.

[0260] Optionally, the first sending module 1002 is used to send the first identity authentication information to the second terminal node, so that the second terminal node generates and returns a corresponding proxy re-encryption key based on the first identity authentication information, specifically for:

[0261] By covering the target satellite node of the second terminal node, the first identity authentication information, the satellite registration authentication information of the target satellite node and the data information of the target data are sent to the second terminal node, so that the second terminal node authenticates the satellite registration authentication information of the target satellite node, and when the authentication result indicates that the verification is passed, the proxy re-encryption key is generated and returned based on the first identity authentication information.

[0262] Optionally, before receiving the download request for target data sent from the first terminal node, the first receiving module 1002 is further configured to:

[0263] An upload request from the second terminal node is received by covering the target satellite node of the second terminal node; wherein the upload request carries the second identity authentication information of the second terminal node, the encrypted target data encrypted based on the encryption key of the second terminal node, and the corresponding download permission conditions when downloading the target data;

[0264] When identity authentication is performed on the second identity authentication information and the obtained authentication result indicates that the second terminal node has passed the authentication, the encrypted target data is stored.

[0265] Based on the same inventive concept, an embodiment of the present application also provides a device for data transmission.

[0266] See also Fig.11 , is a structural schematic diagram of a data transmission device provided in an embodiment of the present application. The device may be the above-mentioned server or a chip or integrated circuit in the device, etc. The device includes a module / unit / technical means for executing the method executed by the server in the above-mentioned method embodiment.

[0267] Exemplarily, the device 1100 includes:

[0268] The second receiving module 1101 is used to receive first identity authentication information of the first terminal node sent by the satellite network; the first identity authentication information is sent to the satellite network when the first terminal node sends a download request for target data, and the first identity authentication information is sent after the satellite network authenticates the first identity authentication information and obtains a result indicating that the verification has passed;

[0269] A second processing module 1102 is used to generate a corresponding proxy re-encryption key based on the first identity authentication information;

[0270] The second sending module 1103 is used to send the proxy re-encryption key to the satellite network, so that the satellite network converts and encrypts the encrypted target data stored in the satellite network and encrypted by the second terminal node based on the proxy re-encryption key, obtains the corresponding re-encrypted ciphertext, and sends the re-encrypted ciphertext to the first terminal node.

[0271] Optionally, when the second receiving module 1101 is used to receive the first identity authentication information of the first terminal node sent by the satellite network, it is specifically used to:

[0272] Receiving the first identity authentication information, satellite registration authentication information of the target satellite node, and data information of the target data sent from a target satellite node covering the second terminal node in the satellite network;

[0273] Based on the preset legal identity information, the satellite registration authentication information is authenticated to obtain a verification result indicating that the satellite registration authentication information has passed the verification; the legal identity information is: the legal identity information carried in the feedback information received when the second terminal node uploads the target data to the target satellite node.

[0274] It should be noted that, although several modules or submodules of the device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to an embodiment of the present invention, the features and functions of two or more units described above can be embodied in one module. Conversely, the features and functions of one module described above can be further divided into multiple modules to be embodied.

[0275] As a possible product form of the above device, see Fig.12 The embodiment of the present application further provides an electronic device 1200, including:

[0276] At least one processor 1201; and a communication interface 1203 that is communicatively connected to the at least one processor 1201; the at least one processor 1201 executes instructions stored in the memory 1202, so that the electronic device 1200 executes the method steps performed by any device in the above method embodiments through the communication interface 1203.

[0277] Optionally, the memory 1202 is located outside the electronic device 1200 .

[0278] Optionally, the electronic device 1200 includes the memory 1202, the memory 1202 is connected to the at least one processor 1201, and the memory 1202 stores instructions that can be executed by the at least one processor 1201. Fig.12 The dashed lines indicate that the memory 1202 is optional for the electronic device 1200 .

[0279] The processor 1201 and the memory 1202 may be coupled via an interface circuit or may be integrated together, which is not limited here.

[0280] The specific connection medium between the processor 1201, the memory 1202 and the communication interface 1203 is not limited in the embodiment of the present application. Fig.12 The processor 1201, the memory 1202 and the communication interface 1203 are connected via a bus 1204. Fig.12 The connections between the other components are shown in bold lines, which are only for illustration and are not intended to be limiting. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.12 In the example, only one thick line is used to represent the bus, but it does not mean that there is only one bus or one type of bus. It should be understood that the processor mentioned in the embodiment of the present application can be implemented by hardware or by software. When implemented by hardware, the processor can be a logic circuit, an integrated circuit, etc. When implemented by software, the processor can be a general-purpose processor, which is implemented by reading the software code stored in the memory.

[0281] Exemplarily, the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0282] It should be understood that the memory mentioned in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct memory bus random access memory (DirectRambus RAM, DR RAM).

[0283] It should be noted that when the processor is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, the memory (storage module) can be integrated into the processor.

[0284] It should be noted that the memory described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0285] As another possible product form, an embodiment of the present application also provides a computer-readable storage medium, which is used to store instructions. When the instructions are executed, the computer executes the method steps executed by any device in the above method example.

[0286] As another possible product form, an embodiment of the present application also provides a computer program product including instructions, wherein the computer program product stores instructions that, when executed on a computer, enable the computer to execute the method steps executed by any device in the above method embodiment.

[0287] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0288] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0289] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0290] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0291] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for data transmission, characterized in that: Applied to a satellite network, the satellite network is communicatively connected to a plurality of terminal nodes, the plurality of terminal nodes include at least one first terminal node downloading data from the satellite network, and at least one second terminal node uploading data to the satellite network, the method comprising: Receiving a download request for target data sent from the first terminal node; wherein the download request carries first identity authentication information of the first terminal node; When performing identity authentication on the first identity authentication information and the obtained authentication result indicates that the first terminal node has passed the authentication, sending the first identity authentication information to the second terminal node, so that the second terminal node generates and returns a corresponding proxy re-encryption key based on the first identity authentication information; Based on the proxy re-encryption key, performing conversion encryption processing on the encrypted target data stored in the satellite network and encrypted by the second terminal node to obtain corresponding re-encrypted ciphertext; The re-encrypted ciphertext is sent to the first terminal node, so that the first terminal node decrypts the re-encrypted ciphertext based on the first identity authentication information to obtain the target data.

2. The method according to claim 1, characterized in that Before receiving the download request for the target data sent from the first terminal node, the method further includes: Receiving a registration request from a target registration node; wherein the target registration node is any one of the satellite nodes to be connected to the satellite network, or the target registration node is any one of the terminal nodes to be connected to the satellite network; the registration request carries a unique identifier corresponding to the target registration node; Based on the preset life cycle corresponding to the target registration node, corresponding expiration time information is set for the target registration node; the expiration time information represents: the validity period of the target registration node's access permission to the satellite network; Based on the unique identifier and expiration time information, combined with the preset encryption configuration information, the registration authentication information of the target registration node is generated, and the registration authentication information is sent to the target registration node, so that the target registration node stores the registration authentication information and completes the identity registration of the target registration node.

3. The method according to claim 2, characterized in that The target registration node is any one of the terminal nodes to be accessed in the satellite network; after generating the registration authentication information of the target registration node, the method further includes: Based on the security level information corresponding to the unique identifier and the requested permission information carried by the registration request, in combination with the preset attribute configuration set for the terminal node, a corresponding security attribute set is configured for the target registration node; wherein each security attribute in the security attribute set includes: attribute information corresponding to the target registration node and a security score corresponding to the attribute information; the attribute configuration set includes multiple preset attribute information and security scores corresponding to the preset attribute information; Allocating a corresponding attribute key and a corresponding key expiration time to each security attribute in the security attribute set; Then, sending the registration authentication information to the target registration node so that the target registration node stores the registration authentication information and completes the identity registration of the target registration node, includes: The registration authentication information, the security attribute set, the attribute key, and the key expiration time are sent to the target registration node, so that the target registration node stores the registration authentication information, the security attribute set, the attribute key, and the key expiration time, and completes the identity registration of the target registration node.

4. The method according to claim 1, characterized in that Performing identity authentication on the first identity authentication information to obtain a verification result includes: Acquire the registration authentication information, target data information, and security attribute authentication value included in the first identity authentication information; wherein the security attribute authentication value is obtained by the first terminal node based on the security attribute in a preset security attribute set, the corresponding attribute key, and the key expiration time; Based on the time information of receiving the download request and the key expiration time in the security attribute authentication value, perform time verification on the first identity authentication information to obtain a corresponding time verification result; When the time verification result indicates that the verification is passed, a matching verification is performed on the target data information based on the registration authentication information and the security attribute authentication value to obtain a corresponding verification result.

5. The method according to claim 4, characterized in that The matching verification of the target data information based on the registration authentication information and the security attribute authentication value to obtain a corresponding verification result includes: Based on preset information of each registered terminal in a preset registered terminal set, verify the registration authentication information of the first terminal node, and obtain a legal verification result corresponding to the first terminal node; When the legal verification result indicates that the first terminal node is a registered terminal, a corresponding verification result is obtained based on the total value corresponding to the security scores of each security attribute in the security attribute authentication value, and the download permission conditions of the target data corresponding to the target data information; wherein, when the total value satisfies the download permission conditions, the verification result indicates that the verification is passed.

6. The method according to any one of claims 1 to 5, characterized in that: The sending the first identity authentication information to the second terminal node so that the second terminal node generates and returns a corresponding proxy re-encryption key based on the first identity authentication information, includes: By covering the target satellite node of the second terminal node, the first identity authentication information, the satellite registration authentication information of the target satellite node and the data information of the target data are sent to the second terminal node, so that the second terminal node authenticates the satellite registration authentication information of the target satellite node, and when the authentication result indicates that the verification is passed, the proxy re-encryption key is generated and returned based on the first identity authentication information.

7. The method according to claim 1, characterized in that Before receiving the download request for the target data sent from the first terminal node, the method further includes: An upload request from the second terminal node is received by covering the target satellite node of the second terminal node; wherein the upload request carries the second identity authentication information of the second terminal node, the encrypted target data encrypted based on the encryption key of the second terminal node, and the corresponding download permission conditions when downloading the target data; When identity authentication is performed on the second identity authentication information and the obtained authentication result indicates that the second terminal node has passed the authentication, the encrypted target data is stored.

8. A method for data transmission, characterized in that: Applied to a second terminal node, the second terminal node is at least one terminal node among a plurality of terminal nodes that uploads data to a satellite network, and the terminal node further includes at least one first terminal node that downloads data from the satellite network, the method comprising: receiving first identity authentication information of the first terminal node sent by the satellite network; the first identity authentication information is sent to the satellite network when the first terminal node sends a download request for target data, and the first identity authentication information is sent after the satellite network authenticates the first identity authentication information and obtains a result indicating that the verification has passed; Based on the first identity verification information, generating a corresponding proxy re-encryption key; The proxy re-encryption key is sent to the satellite network so that the satellite network performs conversion encryption processing on the encrypted target data stored in the satellite network and encrypted by the second terminal node based on the proxy re-encryption key, obtains the corresponding re-encrypted ciphertext, and sends the re-encrypted ciphertext to the first terminal node.

9. The method according to claim 8, characterized in that The receiving first identity authentication information of the first terminal node sent by the satellite network includes: Receiving the first identity authentication information, satellite registration authentication information of the target satellite node, and data information of the target data sent from a target satellite node covering the second terminal node in the satellite network; Based on the preset legal identity information, the satellite registration authentication information is authenticated to obtain a verification result indicating that the satellite registration authentication information has passed the verification; the legal identity information is: the legal identity information carried in the feedback information received when the second terminal node uploads the target data to the target satellite node.

10. A data transmission device, characterized in that: Applied to a satellite network, the satellite network is communicatively connected to a plurality of terminal nodes, the plurality of terminal nodes include at least one first terminal node that downloads data from the satellite network, and at least one second terminal node that uploads data to the satellite network, the device includes: A first receiving module, configured to receive a download request for target data sent from the first terminal node; wherein the download request carries first identity authentication information of the first terminal node; A first sending module is used to send the first identity authentication information to the second terminal node when the identity authentication is performed on the first identity authentication information and the obtained authentication result indicates that the first terminal node has passed the authentication, so that the second terminal node generates and returns a corresponding proxy re-encryption key based on the first identity authentication information; A first processing module is configured to perform conversion encryption processing on the encrypted target data encrypted by the second terminal node and stored in the satellite network based on the proxy re-encryption key to obtain corresponding re-encrypted ciphertext; The first sending module is further used to send the re-encrypted ciphertext to the first terminal node, so that the first terminal node decrypts the re-encrypted ciphertext based on the first identity authentication information to obtain the target data.

11. A data transmission device, characterized in that: Applied to a second terminal node, the second terminal node is at least one terminal node among multiple terminal nodes that uploads data to a satellite network, and the terminal node also includes at least one first terminal node that downloads data from the satellite network, the device comprising: a second receiving module, configured to receive first identity authentication information of the first terminal node sent by the satellite network; the first identity authentication information is sent to the satellite network when the first terminal node sends a download request for target data, and the first identity authentication information is sent after the satellite network authenticates the first identity authentication information and obtains a result indicating that the verification has passed; A second processing module, configured to generate a corresponding proxy re-encryption key based on the first identity authentication information; The second sending module is used to send the proxy re-encryption key to the satellite network, so that the satellite network converts and encrypts the encrypted target data stored in the satellite network and encrypted by the second terminal node based on the proxy re-encryption key, obtains the corresponding re-encrypted ciphertext, and sends the re-encrypted ciphertext to the first terminal node.

12. An electronic device, characterized in that: include: at least one processor; and a memory communicatively coupled to the at least one processor; The memory stores instructions that can be executed by the at least one processor, and the at least one processor executes the method as described in any one of claims 1-7 and 8-9 by executing the instructions stored in the memory.

13. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store instructions, and when the instructions are executed, the method according to any one of claims 1-7, 8-9 is implemented.

14. A computer program product comprising instructions, characterized in that The computer program product stores instructions, and when the computer program product is run on a computer, the computer is caused to execute the method according to any one of claims 1 to 7 and 8 to 9.

Images