Authentication method and system based on space networking and terminal equipment

Abstract

The invention discloses an authentication method and system based on space networking and terminal equipment. The method comprises the following steps: acquiring an identity identifier from satellite equipment, acquiring biological characteristic information of a legal user side, generating a legal key according to the biological characteristic information and the identity identifier, and sending the legal key to the satellite equipment to complete registration; acquiring a legal key sent by the satellite equipment and first authentication information of a to-be-authenticated user side, and comparing the legal key with the first authentication information to obtain an identity authentication result; if the identity authentication is successful, acquiring second authentication information, sending the second authentication information to the satellite equipment for timestamp authentication, and receiving a preliminary authentication result from the satellite equipment; and if the preliminary authentication result is that authentication succeeds, behavior feature data and spatial feature data of the to-be-authenticated user side are obtained and input into the satellite equipment for continuous authentication until the access is ended. According to the authentication method provided by the invention, the security among equipment of the space networking system is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of distributed device security authentication, and in particular to an authentication method, system, terminal device and computer-readable storage medium based on spatial networking. Background Art

[0002] Distributed devices refer to devices or systems that distribute data storage, data analysis, computing and other functions on a cluster consisting of multiple hosts. This distributed architecture allows data and programs to be distributed to multiple servers or computing nodes, connected and communicated through the network, thereby achieving resource sharing and parallel processing of tasks.

[0003] Space networking technology mainly involves the establishment of networks in space, including local area networks between satellites tens of meters apart to deep space networks covering the entire solar system. This technology can establish a classic network with stable relationships in structure, or it can establish a self-organizing network that can be established at any time.

[0004] In current technologies, distributed devices are widely used in spatial networking application scenarios. However, security authentication and resource integration between devices still face many challenges, and the security and management efficiency of distributed systems are not high.

[0005] Therefore, the prior art still needs to be improved and developed. Summary of the invention

[0006] The main purpose of the present invention is to provide an authentication method, system, terminal device and computer-readable storage medium based on space networking, aiming to solve the problems in the prior art that the security authentication link between devices in the space networking system is weak, the security is not high, and efficient services cannot be provided.

[0007] To achieve the above object, a first embodiment of the present invention provides an authentication method based on space networking, and the authentication method based on space networking includes the following steps:

[0008] When a legitimate user terminal issues a registration request, an identity identifier from a satellite device is obtained, and biometric information of the legitimate user terminal is obtained, a legitimate key is generated according to the biometric information and the identity identifier, and the legitimate key is sent to the satellite device to complete the registration;

[0009] When the user terminal to be authenticated issues an authentication request, the legal key and the first authentication information of the user terminal to be authenticated are obtained, and the first authentication information is compared with the legal key to obtain an identity authentication result;

[0010] If the identity authentication result is that the identity authentication is successful, obtaining second authentication information, sending the second authentication information to the satellite device for timestamp authentication, and accepting the preliminary authentication result from the satellite device;

[0011] If the preliminary authentication result is that the timestamp authentication is successful, the behavior feature data and the spatial feature data of the user terminal to be authenticated are continuously acquired, and the behavior feature data and the spatial feature data are input into the satellite device for continuous authentication until the access ends.

[0012] Optionally, the authentication method based on space networking, wherein the obtaining of a legal identity identifier from a satellite device, obtaining biometric information of the legal user terminal, and generating a legal key according to the biometric information and the legal identity identifier, specifically includes:

[0013] Acquire an identity identifier from a satellite device, wherein the identity identifier is sent to the satellite device by a ground network control center and is used to uniquely identify the device or user terminal;

[0014] Collecting facial feature information of the legitimate user terminal and generating a high entropy password, and concatenating the identity identifier, the facial feature information and the high entropy password to obtain a concatenation result;

[0015] The splicing result is encrypted using a security protocol based on a hash function to obtain a legal key for the splicing result.

[0016] Optionally, the authentication method based on space networking, wherein the obtaining of the legal key and the first authentication information of the user terminal to be authenticated, and comparing the first authentication information with the legal key to obtain the identity authentication result, specifically includes:

[0017] Obtaining the identity identifier to be authenticated, the password to be authenticated, and the facial feature information to be authenticated of the user terminal to be authenticated, and converting the identity identifier to be authenticated, the password to be authenticated, and the facial feature information to be authenticated into a biometric key using a key reconstruction algorithm;

[0018] Obtain the legal key sent by the satellite device, compare the biometric key with the legal key, if the biometric key is different from the legal key, the identity authentication result is an identity authentication failure, if the biometric key is the same as the legal key, the identity authentication result is an identity authentication success, and generate a current timestamp.

[0019] Optionally, the authentication method based on space networking, wherein the acquiring the second authentication information and sending the second authentication information to the satellite device for timestamp authentication specifically includes:

[0020] Acquire the geographical location data of the user terminal to be authenticated through GPS or a sensor, parse and extract the geographical location data, and obtain the current location information of the user terminal to be authenticated;

[0021] The current location information and the current timestamp are sent as second authentication information to the satellite device for timestamp authentication.

[0022] In addition, to achieve the above-mentioned purpose, the present invention further provides an authentication system based on space networking, wherein the authentication system based on space networking includes:

[0023] The device registration module is used to obtain an identity identifier from a satellite device and biometric information of the legitimate user terminal after a legitimate user terminal sends a registration request, generate a legitimate key according to the biometric information and the identity identifier, and send the legitimate key to the satellite device to complete the registration;

[0024] A first authentication module, configured to obtain the legal key and first authentication information of the user terminal to be authenticated after the user terminal to be authenticated sends an authentication request, compare the first authentication information with the legal key, and obtain an identity authentication result;

[0025] A second authentication module, configured to obtain second authentication information if the identity authentication result is successful, send the second authentication information to the satellite device for timestamp authentication, and accept a preliminary authentication result from the satellite device;

[0026] The continuous authentication module is used to continuously obtain the behavior feature data and the spatial feature data of the user terminal to be authenticated if the preliminary authentication result is a successful timestamp authentication, and input the behavior feature data and the spatial feature data into the satellite device for continuous authentication until the access is completed.

[0027] In addition, to achieve the above-mentioned purpose, the present invention also provides a terminal device, wherein the terminal device includes: a memory, a processor, and an authentication program based on space networking stored in the memory and executable on the processor, and when the authentication program based on space networking is executed by the processor, the steps of the authentication method based on space networking in the first embodiment described above are implemented.

[0028] To achieve the above object, a second embodiment of the present invention provides an authentication method based on space networking, and the authentication method based on space networking includes the following steps:

[0029] After obtaining the registration request sent by the user terminal, sending the registration request to the ground network control center, receiving the identity identifier sent by the ground network control center, sending the identity identifier to the user terminal, and receiving the legal key from the user terminal;

[0030] After receiving the authentication request sent by the user terminal to be authenticated, sending the legal key to the user terminal to be authenticated;

[0031] If second authentication information sent by the user terminal to be authenticated is received, timestamp authentication is performed according to the second authentication information, wherein the second authentication information includes current location information and current timestamp of the user terminal to be authenticated;

[0032] When the timestamp authentication succeeds, the historical location information previously sent by the user terminal to be authenticated is obtained, and spatial location authentication is performed according to the current location information and the historical location information. If the spatial location authentication succeeds, the preliminary authentication succeeds, and the result of the preliminary authentication success is sent to the user terminal to be authenticated;

[0033] Continuously receive the behavior feature data and space feature data sent by the user terminal to be authenticated, send the behavior feature data and the space feature data to the ground network control center for matching, and receive the matching result from the ground network control center. If the matching result passes, continue to maintain the authentication status.

[0034] Optionally, the authentication method based on space networking, wherein after obtaining the registration request sent by the user terminal, sending the registration request to the ground network control center, further comprises:

[0035] A satellite identifier and a satellite key sent by a ground network control center are obtained, wherein the satellite identifier and the satellite key are used to ensure data security between the satellite device and the ground network control center.

[0036] Optionally, in the authentication method based on space networking, the ground network control center is preset with a model for training and predicting user behavior feature data and space feature data;

[0037] The ground network control center and the satellite equipment perform data transmission via a secure channel.

[0038] In addition, to achieve the above-mentioned purpose, the present invention further provides an authentication system based on space networking, wherein the authentication system based on space networking includes:

[0039] The identification forwarding module is used to, after obtaining the registration request sent by the user terminal, send the registration request to the ground network control center, receive the identity identifier sent by the ground network control center, send the identity identifier to the user terminal, and receive the legal key from the user terminal;

[0040] A legal key sending module, used for sending the legal key to the user terminal to be authenticated after receiving an authentication request sent by the user terminal to be authenticated;

[0041] A timestamp authentication module, configured to perform timestamp authentication according to the second authentication information if second authentication information sent by the user terminal to be authenticated is received, wherein the second authentication information includes current location information and current timestamp of the user terminal to be authenticated;

[0042] The spatial location authentication module is used to obtain the historical location information sent by the user terminal to be authenticated last time after the timestamp authentication is successful, and perform spatial location authentication based on the current location information and the historical location information. If the spatial location authentication is successful, the preliminary authentication is successful, and the result of the preliminary authentication success is sent to the user terminal to be authenticated;

[0043] The continuous authentication module is used to continuously receive the behavioral feature data and spatial feature data sent by the user terminal to be authenticated, send the behavioral feature data and the spatial feature data to the ground network control center for matching, and receive the matching result from the ground network control center. If the matching result passes, the authentication status is maintained.

[0044] In addition, to achieve the above-mentioned purpose, the present invention also provides a satellite device, wherein the satellite device includes: a memory, a processor, and a space networking-based authentication program stored in the memory and executable on the processor, wherein the space networking-based authentication program, when executed by the processor, implements the steps of the space networking-based authentication method in the second embodiment described above.

[0045] In addition, to achieve the above-mentioned purpose, the present invention also provides a computer-readable storage medium, wherein the computer-readable storage medium stores an authentication program based on space networking, and when the authentication program based on space networking is executed by a processor, the steps of the authentication method based on space networking as described above are implemented.

[0046] In the present invention, an identity identifier from a satellite device is obtained, biometric information of a legitimate user terminal is obtained, a legitimate key is generated according to the biometric information and the identity identifier, and the legitimate key is sent to the satellite device to complete registration; the legitimate key sent by the satellite device and the first authentication information of the user terminal to be authenticated are obtained, the two are compared, and an identity authentication result is obtained; if the identity authentication is successful, the second authentication information is obtained, the second authentication information is sent to the satellite device for timestamp authentication, and the preliminary authentication result from the satellite device is accepted; if the preliminary authentication result is successful authentication, the behavior feature data and space feature data of the user terminal to be authenticated are obtained, and the data are input into the satellite device for continuous authentication until the access ends. The authentication method provided by the present invention improves the security between devices in a space networking system. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 It is a flow chart of a first preferred embodiment of the authentication method based on space networking of the present invention;

[0048] Figure 2 It is a structural diagram of a first preferred embodiment of an authentication system based on space networking of the present invention;

[0049] Figure 3 A schematic diagram of the operating environment of a preferred embodiment of the terminal device of the present invention;

[0050] Figure 4 It is a flow chart of a second preferred embodiment of the authentication method based on space networking of the present invention;

[0051] Figure 5 It is a structural diagram of a second preferred embodiment of the authentication system based on space networking of the present invention;

[0052] Figure 6 The figure is a schematic diagram of the operating environment of a preferred embodiment of the satellite device of the present invention. DETAILED DESCRIPTION

[0053] The present application provides an authentication method and related equipment based on space networking. In order to make the purpose, technical solution and effect of the present application clearer and more specific, the present application is further described in detail with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described here are only used to explain the present application and are not used to limit the present application.

[0054] It will be understood by those skilled in the art that, unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as those generally understood by those skilled in the art to which this application belongs. It should also be understood that terms such as those defined in general dictionaries should be understood to have meanings consistent with those in the context of the prior art, and will not be interpreted with idealized or overly formal meanings unless specifically defined as here.

[0055] In addition, if there are descriptions involving "first", "second", etc. in the embodiments of the present invention, the descriptions of "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or suggesting their relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the ability of ordinary technicians in the field to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such a combination of technical solutions does not exist and is not within the scope of protection required by the present invention.

[0056] For the terminal device, the authentication method based on space networking described in the first preferred embodiment of the present invention is as follows: Figure 1 As shown, the authentication method based on space networking includes the following steps:

[0057] Step S101: After a legitimate user terminal issues a registration request, an identity identifier is obtained from a satellite device, and biometric information of the legitimate user terminal is obtained, a legitimate key is generated according to the biometric information and the identity identifier, and the legitimate key is sent to the satellite device to complete the registration.

[0058] Specifically, after a legitimate user terminal issues a registration request, an identity identifier is obtained from a satellite device. The identity identifier is sent to the satellite device by a ground network control center and is used to uniquely identify the device or the user terminal.

[0059] It can be understood that there is a communication and authentication relationship between the user equipment and the satellite equipment. The user equipment communicates and authenticates with the ground network control center through the satellite equipment. The satellite equipment is responsible for forwarding the authentication request of the user equipment and performing preliminary identity authentication. Among them, the identity identifier is used to uniquely identify each device or user. It is used to match the identity and verify the legitimacy in the subsequent authentication process.

[0060] Furthermore, facial feature information of the legitimate user terminal is collected, and a high entropy password is generated, and the identity identifier, the facial feature information and the high entropy password are spliced ​​to obtain a splicing result.

[0061] In this embodiment, the facial feature information, i.e., biometric information, of the legal user terminal is collected by a sensor or a camera, and a high entropy password is generated. The high entropy password is a password generated by random arrangement, which is intended to avoid the use of common phrases and predictable substitutions, thereby improving the complexity and security of the password. This password should be a random arrangement that can interweave uppercase and lowercase letters, numbers, and symbols, avoid the use of common phrases and predictable substitutions, and with its true complexity, it is impossible for attackers to find its obvious pattern, and it is impossible to perform logical sorting or guessing. Finally, the identity identifier, the facial feature information, and the high entropy password are spliced ​​to obtain a splicing result.

[0062] Furthermore, the splicing result is encrypted using a security protocol based on a hash function to obtain a legal key for the splicing result.

[0063] A hash function refers to a function that maps the key value of an element in a hash table to the storage location of the element (the relative position of a general linear table record in a structure is random, that is, there is no definite relationship between the record and the key word, so a series of comparisons with the key word are required when searching for a record in the structure). The user device of the present invention uses a hash function during the registration process to ensure the integrity of data transmission and prevent tampering. The hash function can generate a unique hash value from the splicing result of the identity identifier, the facial feature information and the high entropy password, which is used to verify the authenticity of the data.

[0064] Furthermore, the legal key is sent to the satellite device for storage to complete the registration, wherein the legal key is used to encrypt and decrypt messages in the subsequent communication authentication process to ensure the confidentiality and integrity of the data.

[0065] Step S102: After the user terminal to be authenticated issues an authentication request, the legal key and first authentication information of the user terminal to be authenticated are obtained, and the first authentication information is compared with the legal key to obtain an identity authentication result.

[0066] It is understandable that during the authentication phase, the user's terminal device needs to perform local identity authentication, and after the local identity authentication is passed, it also needs to perform two-way authentication with the satellite device. The authentication process includes steps such as identity authentication, timestamp generation, and spatial location verification to ensure the legitimacy of the user's identity.

[0067] Specifically, the identity identifier to be authenticated, the password to be authenticated and the facial feature information to be authenticated of the user terminal to be authenticated are obtained, and a key reconstruction algorithm (such as RSA, ECC algorithm) is used to convert the identity identifier to be authenticated, the password to be authenticated and the facial feature information to be authenticated into a biometric key.

[0068] In this embodiment, the user terminal inputs the identity identifier to be authenticated, the password to be authenticated, and the facial feature information to be authenticated, and the user terminal device locally uses a deterministic key reconstruction algorithm (a deterministic key reconstruction algorithm is an algorithm for recovering or reconstructing a key, and its characteristic is that it can deterministically generate the same key output when given specific conditions or inputs. This algorithm has applications in many fields, including but not limited to cryptography, biometric recognition, distributed systems, etc.) to calculate the biometric key, convert the identity identifier to be authenticated, the password to be authenticated, and the facial feature information to be authenticated into a biometric key, and verify the legitimacy of the user identity based on the biometric key.

[0069] Furthermore, a legal key sent by the satellite device is obtained, and the biometric key is compared with the legal key. If the biometric key is different from the legal key, the identity authentication result is an identity authentication failure. If the biometric key is the same as the legal key, the identity authentication result is an identity authentication success, and a current timestamp is generated.

[0070] It can be understood that the legal key sent by the satellite device through the secure channel is obtained, and the biometric key is compared with the legal key. If the biometric key is different from the legal key, it means that the identity of the user terminal to be authenticated is illegal, the identity authentication result is identity authentication failure, and the access of the user terminal to be authenticated is terminated; if the biometric key is the same as the legal key, it means that the identity of the user terminal to be authenticated is legal, the identity authentication result is identity authentication success, and the current timestamp is generated.

[0071] The current timestamp is generated according to the current time and the legal key, and includes time information and encrypted authentication data. Timestamp verification ensures the legitimacy of the identity by checking whether the timestamp is within the allowed time window and whether the encrypted information is correct.

[0072] Step S103: If the identity authentication result is successful, obtain second authentication information, send the second authentication information to the satellite device for timestamp authentication, and accept the preliminary authentication result from the satellite device.

[0073] Specifically, if the identity authentication result is that the identity authentication is successful, the geographical location data of the user terminal to be authenticated is obtained through GPS or a sensor, and the geographical location data is parsed and extracted to obtain the current location information of the user terminal to be authenticated.

[0074] In this embodiment, geographic location data can be obtained through a GPS module or a mobile phone sensor. The geographic location data includes the user's GPS coordinates (longitude and latitude), altitude and movement trajectory. The geographic location data is parsed and extracted in real time to ensure its accuracy and timeliness, and the current location information of the user to be authenticated is obtained.

[0075] Furthermore, the current location information and the current timestamp are sent as second authentication information to the satellite device for timestamp authentication.

[0076] It can be understood that the current location information and the current timestamp are sent to the satellite device as the second authentication information, and the satellite device receives the timestamp and current location information sent by the user device, and verifies the legitimacy of the timestamp according to the timestamp and the current location information. If the timestamp authentication is not legal, the user access is denied; if the timestamp authentication is legal, the identity information in the authentication message is obtained and matched in the local database of the satellite device.

[0077] Furthermore, if the timestamp authentication is legal, the satellite device will also perform spatial position authentication. The satellite device obtains the position of the user device (user terminal to be authenticated) at the end of the last visit, and calculates the displacement difference in combination with the current position, and obtains a preliminary authentication result based on the displacement difference. If the calculated displacement difference exceeds the preset threshold, the user access is denied and the preliminary authentication result is failure. If the calculated displacement difference does not exceed the preset threshold, the user access is allowed and the preliminary authentication result is success, and the preliminary authentication result is sent to the user terminal to be authenticated.

[0078] Step S104: If the preliminary authentication result is that the timestamp authentication is successful, the behavior feature data and the spatial feature data of the user terminal to be authenticated are continuously acquired, and the behavior feature data and the spatial feature data are input into the satellite device for continuous authentication until the access is completed.

[0079] Specifically, if the preliminary authentication result is a successful timestamp authentication, the user terminal to be authenticated continuously obtains the behavior feature data and spatial feature data of the user terminal to be authenticated, and sends the behavior feature data and the spatial feature data to the satellite device through a secure channel for input into the satellite device, and the satellite device initiates a continuous authentication request to the ground network control center, forwards the behavior feature data and the spatial feature data to the ground network control center through a secure channel, and the ground network control center receives the behavior feature data and the spatial feature data, and verifies and matches the data. If the data matches, the user access is authorized; otherwise, the access is terminated and the authentication failure information is returned.

[0080] Furthermore, if Figure 2As shown, based on the above-mentioned authentication method based on space networking, the present invention also provides an authentication system based on space networking, wherein the authentication system based on space networking includes:

[0081] The device registration module 41 is used to obtain an identity identifier from a satellite device and biometric information of the legitimate user terminal after the legitimate user terminal sends a registration request, generate a legitimate key according to the biometric information and the identity identifier, and send the legitimate key to the satellite device to complete the registration;

[0082] The first authentication module 42 is used to obtain the legal key and the first authentication information of the user terminal to be authenticated after the user terminal to be authenticated sends an authentication request, and compare the first authentication information with the legal key to obtain an identity authentication result;

[0083] The second authentication module 43 is used to obtain second authentication information if the identity authentication result is successful, send the second authentication information to the satellite device for timestamp authentication, and accept the preliminary authentication result from the satellite device;

[0084] The continuous authentication module 44 is used to continuously obtain the behavior feature data and the spatial feature data of the user terminal to be authenticated if the preliminary authentication result is a successful timestamp authentication, and input the behavior feature data and the spatial feature data into the satellite device for continuous authentication until the access is completed.

[0085] Furthermore, if Figure 3 As shown, based on the above-mentioned authentication method and system based on space networking, the present invention also provides a terminal device accordingly, and the terminal device includes a processor 10, a memory 20 and a display 30. Figure 3 Only some components of the terminal device are shown, but it should be understood that it is not required to implement all the components shown, and more or fewer components may be implemented instead.

[0086] In some embodiments, the memory 20 may be an internal storage unit of the terminal device, such as a hard disk or memory of the terminal device. In other embodiments, the memory 20 may also be an external storage device of the terminal device, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the terminal device. Further, the memory 20 may also include both an internal storage unit of the terminal device and an external storage device. The memory 20 is used to store application software and various types of data installed on the terminal device, such as the program code of the terminal device. The memory 20 may also be used to temporarily store data that has been output or is to be output. In one embodiment, the memory 20 stores an authentication program 40 based on space networking, and the authentication program 40 based on space networking can be executed by the processor 10, thereby realizing the authentication method based on space networking in the present application.

[0087] In some embodiments, the processor 10 may be a central processing unit (CPU), a microprocessor or other data processing chip, used to run the program code or process data stored in the memory 20, such as executing the authentication method based on space networking.

[0088] In some embodiments, the display 30 may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, an OLED (Organic Light-Emitting Diode) touch device, etc. The display 30 is used to display information on the terminal device and to display a visual user interface. The components 10-30 of the terminal device communicate with each other via a system bus.

[0089] In one embodiment, when the processor 10 executes the spatial networking-based authentication program 40 in the memory 20, the spatial networking-based authentication method described in the first preferred embodiment is implemented.

[0090] For the terminal device, the authentication method based on space networking described in the second preferred embodiment of the present invention is as follows: Figure 4 As shown, the authentication method based on space networking includes the following steps:

[0091] Step S201: after obtaining the registration request sent by the user terminal, send the registration request to the ground network control center, receive the identity identifier sent by the ground network control center, send the identity identifier to the user terminal, and receive the legal key from the user terminal.

[0092] Specifically, the satellite device is used to receive a registration request sent by the user terminal, and forward the registration request to the ground network control center through a secure channel. After receiving the registration request, the ground center generates an identity identifier for the user terminal. The identity identifier is used to uniquely identify each device or user, and it is used to match the identity and verify the legitimacy in the subsequent authentication process. Further, the ground network control center encrypts the identity identifier, and the ground network control center sends the encrypted identity identifier to the satellite device through a secure channel. It can be understood that the satellite device pre-stores a satellite key for decrypting the encrypted identity identifier. After sending the encrypted identity identifier to the satellite device, the satellite device parses the encrypted identity identifier through the satellite key to obtain the identity identifier, and sends the identity identifier to the user terminal. The user terminal forms a legal key based on the identity identifier, receives and stores the legal key, and the legal key is used in the identity authentication process when the user terminal needs to establish communication.

[0093] It can be understood that after obtaining the registration request sent by the user terminal, the registration request is sent to the ground network control center, which also includes:

[0094] A satellite identifier and a satellite key sent by a ground network control center are obtained, wherein the satellite identifier and the satellite key are used to ensure data security between the satellite device and the ground network control center.

[0095] Step S202: after receiving the authentication request sent by the user terminal to be authenticated, the legal key is sent to the user terminal to be authenticated.

[0096] It is understandable that when the user terminal to be authenticated needs to establish a communication connection with the satellite device, identity authentication is required. At this time, the user terminal to be authenticated sends an authentication request to the satellite device. After receiving the authentication request sent by the user terminal to be authenticated, the previously pre-stored legal key is sent to the corresponding user terminal to be authenticated.

[0097] Step S203: If second authentication information sent by the user terminal to be authenticated is received, timestamp authentication is performed according to the second authentication information, wherein the second authentication information includes current location information and current timestamp of the user terminal to be authenticated.

[0098] Specifically, after the legal key is sent to the user terminal to be authenticated, the user terminal to be authenticated will perform identity authentication based on the legal key. When the identity authentication is passed, the user terminal to be authenticated needs to perform a second authentication, namely, timestamp verification. At this time, the satellite device receives the second authentication information sent by the user terminal to be authenticated for timestamp verification, wherein the second authentication information includes the current location information and current timestamp of the user terminal to be authenticated (the timestamp is generated based on the current time and the legal key, and contains time information and encrypted authentication data. Timestamp verification ensures the legitimacy of the identity by checking whether the timestamp is within the allowed time window and whether the encrypted information is correct).

[0099] Step S204: When the timestamp authentication is successful, the historical location information previously sent by the user terminal to be authenticated is obtained, and spatial location authentication is performed based on the current location information and the historical location information. If the spatial location authentication is successful, the preliminary authentication is successful, and the result of the preliminary authentication success is sent to the user terminal to be authenticated.

[0100] In this embodiment, when the timestamp authentication is successful, the satellite device performs spatial position authentication on the user terminal to be authenticated, obtains the historical position information sent by the user terminal to be authenticated the last time (that is, the position when the user device last visited), compares the current position information with the historical position information, calculates the displacement difference between the two, and obtains a preliminary authentication result based on the displacement difference. If the calculated displacement difference exceeds the preset threshold, the user access is denied and the preliminary authentication result is failure. If the calculated displacement difference does not exceed the preset threshold, the user access is allowed and the preliminary authentication result is success, and the preliminary authentication result is sent to the user terminal to be authenticated.

[0101] Step S205, continuously receiving the behavior feature data and the spatial feature data sent by the user terminal to be authenticated, sending the behavior feature data and the spatial feature data to the ground network control center for matching, and receiving the matching result from the ground network control center. If the matching result passes, the authentication status is maintained.

[0102] Specifically, after the spatial location authentication is passed, the preliminary authentication result is sent to the user terminal to be authenticated. At this time, the authentication is initially passed, and the communication connection between the user terminal and the satellite device is established, and the satellite device enters the continuous authentication stage. In the continuous authentication stage, the satellite device continuously receives the behavior feature data and spatial feature data sent by the user terminal to be authenticated, sends the behavior feature data and the spatial feature data to the ground network control center for matching, and receives the matching result from the ground network control center. If the matching result is passed, the authentication state is maintained.

[0103] That is, the continuous authentication phase is initiated by the satellite device, and the user device transmits spatial feature data and behavioral feature data to complete the continuous authentication. The continuous authentication process ensures the legitimacy of the user's identity during the entire access period.

[0104] It is understandable that the ground network control center is preset with a model for training and predicting user behavior feature data and spatial feature data.

[0105] When training the model, historical behavior feature data and historical spatial feature data are first obtained, wherein the historical behavior feature data includes the user's historical activity patterns, traffic types, and behavior habits. These data are collected through sensors (such as accelerometers, gyroscopes) and software applications (such as map services) in the user's device. Furthermore, the historical behavior feature data is processed, including denoising, smoothing, and standardizing the data, and feature values ​​for model training and identity authentication are extracted from the historical behavior feature data. The processed data is used to train the machine learning model and generate spatial feature model parameters. These model parameters are used for subsequent identity authentication and location matching to ensure the accuracy and reliability of the verification process.

[0106] Furthermore, if Figure 5 As shown, based on the above-mentioned authentication method based on space networking, the present invention also provides an authentication system based on space networking, wherein the authentication system based on space networking includes:

[0107] The identification forwarding module 51 is used for, after obtaining the registration request sent by the user terminal, sending the registration request to the ground network control center, receiving the identity identifier sent by the ground network control center, sending the identity identifier to the user terminal, and receiving the legal key from the user terminal;

[0108] A legal key sending module 52 is used to send the legal key to the user terminal to be authenticated after receiving an authentication request sent by the user terminal to be authenticated;

[0109] A timestamp authentication module 53, configured to perform timestamp authentication according to the second authentication information if second authentication information sent by the user terminal to be authenticated is received, wherein the second authentication information includes current location information and current timestamp of the user terminal to be authenticated;

[0110] The spatial location authentication module 54 is used to obtain the historical location information sent by the user terminal to be authenticated last time after the timestamp authentication is successful, and perform spatial location authentication according to the current location information and the historical location information. If the spatial location authentication is successful, the preliminary authentication is successful, and the result of the preliminary authentication success is sent to the user terminal to be authenticated;

[0111] The continuous authentication module 55 is used to continuously receive the behavioral feature data and spatial feature data sent by the user terminal to be authenticated, send the behavioral feature data and the spatial feature data to the ground network control center for matching, and receive the matching result from the ground network control center. If the matching result is passed, the authentication status is maintained.

[0112] Furthermore, if Figure 6 As shown, based on the above-mentioned authentication method and system based on space networking, the present invention also provides a satellite device accordingly, and the satellite device includes a processor 10, a memory 20 and a display 30. Figure 6 Only some of the components of the satellite device are shown, but it should be understood that implementation of all of the components shown is not required, and more or fewer components may be implemented instead.

[0113] In some embodiments, the memory 20 may be an internal storage unit of the terminal device, such as a hard disk or memory of a satellite device. In other embodiments, the memory 20 may also be an external storage device of the satellite device, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the satellite device. Further, the memory 20 may also include both an internal storage unit of the satellite device and an external storage device. The memory 20 is used to store application software and various types of data installed in the satellite device, such as the program code of the satellite device. The memory 20 may also be used to temporarily store data that has been output or is to be output. In one embodiment, the memory 20 stores an authentication program 40 based on space networking, and the authentication program 40 based on space networking can be executed by the processor 10, thereby realizing the authentication method based on space networking in the present application.

[0114] In some embodiments, the processor 10 may be a central processing unit (CPU), a microprocessor or other data processing chip, used to run the program code or process data stored in the memory 20, such as executing the authentication method based on space networking.

[0115] In some embodiments, the display 30 may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, an OLED (Organic Light-Emitting Diode) touch device, etc. The display 30 is used to display information on the terminal device and to display a visual user interface. The components 10-30 of the terminal device communicate with each other via a system bus.

[0116] In one embodiment, when the processor 10 executes the spatial networking-based authentication program 40 in the memory 20, the spatial networking-based authentication method described in the second preferred embodiment is implemented.

[0117] In summary, the present invention provides an authentication method, system and terminal device based on space networking, the method comprising: when a legitimate user terminal issues a registration request, obtaining an identity identifier from a satellite device, obtaining biometric information of the legitimate user terminal, generating a legitimate key according to the biometric information and the identity identifier, and sending the legitimate key to the satellite device to complete the registration; when the user terminal to be authenticated issues an authentication request, obtaining the legitimate key and the first authentication information of the user terminal to be authenticated, comparing the first authentication information with the legitimate key, and obtaining an identity authentication result; if the identity authentication result is that the identity authentication is successful, obtaining the second authentication information, sending the second authentication information to the satellite device for timestamp authentication, and accepting the preliminary authentication result from the satellite device; if the preliminary authentication result is that the timestamp authentication is successful, continuously obtaining the behavior feature data and space feature data of the user terminal to be authenticated, inputting the behavior feature data and space feature data into the satellite device for continuous authentication until the access ends. The present invention proposes a phased authentication method, including an initialization phase, a device registration phase, a main authentication phase and a continuous authentication phase, the present invention not only improves the security of the system, but also enhances the flexibility and reliability of device authentication.

[0118] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, an element defined by the sentence "includes a ..." does not exclude the existence of other identical elements in the process, method, article or terminal device including the element.

[0119] Of course, those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided by the present invention can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0120] It should be understood that the application of the present invention is not limited to the above examples. For ordinary technicians in this field, improvements or changes can be made based on the above description. All these improvements and changes should fall within the scope of protection of the claims attached to the present invention.

Claims

1. An authentication method based on space networking, characterized in that: The authentication method based on space networking includes: When a legitimate user terminal issues a registration request, an identity identifier from a satellite device is obtained, and biometric information of the legitimate user terminal is obtained, a legitimate key is generated according to the biometric information and the identity identifier, and the legitimate key is sent to the satellite device to complete the registration; When the user terminal to be authenticated issues an authentication request, the legal key and the first authentication information of the user terminal to be authenticated are obtained, and the first authentication information is compared with the legal key to obtain an identity authentication result; If the identity authentication result is that the identity authentication is successful, obtaining second authentication information, sending the second authentication information to the satellite device for timestamp authentication, and accepting the preliminary authentication result from the satellite device; If the preliminary authentication result is that the timestamp authentication is successful, the behavior feature data and the spatial feature data of the user terminal to be authenticated are continuously acquired, and the behavior feature data and the spatial feature data are input into the satellite device for continuous authentication until the access ends.

2. The authentication method based on space networking according to claim 1, characterized in that: The step of obtaining a legal identity identifier from a satellite device and obtaining biometric information of a legal user terminal, and generating a legal key according to the biometric information and the legal identity identifier specifically includes: Acquire an identity identifier from a satellite device, wherein the identity identifier is sent to the satellite device by a ground network control center and is used to uniquely identify the device or user terminal; Collecting facial feature information of the legitimate user terminal and generating a high entropy password, and concatenating the identity identifier, the facial feature information and the high entropy password to obtain a concatenation result; The splicing result is encrypted using a security protocol based on a hash function to obtain a legal key for the splicing result.

3. The authentication method based on space networking according to claim 1, characterized in that: The obtaining of the legal key and the first authentication information of the to-be-authenticated user terminal, and comparing the first authentication information with the legal key to obtain an identity authentication result specifically includes: Obtaining the identity identifier to be authenticated, the password to be authenticated, and the facial feature information to be authenticated of the user terminal to be authenticated, and converting the identity identifier to be authenticated, the password to be authenticated, and the facial feature information to be authenticated into a biometric key using a key reconstruction algorithm; Obtain the legal key sent by the satellite device, compare the biometric key with the legal key, if the biometric key is different from the legal key, the identity authentication result is an identity authentication failure, if the biometric key is the same as the legal key, the identity authentication result is an identity authentication success, and generate a current timestamp.

4. The authentication method based on space networking according to claim 3, characterized in that: The obtaining of the second authentication information and sending the second authentication information to the satellite device for timestamp authentication specifically includes: Acquire the geographical location data of the user terminal to be authenticated through GPS or a sensor, parse and extract the geographical location data, and obtain the current location information of the user terminal to be authenticated; The current location information and the current timestamp are sent as second authentication information to the satellite device for timestamp authentication.

5. An authentication system based on space networking, characterized in that: The authentication system based on space networking includes: The device registration module is used to obtain an identity identifier from a satellite device and biometric information of the legitimate user terminal after the legitimate user terminal sends a registration request, generate a legitimate key according to the biometric information and the identity identifier, and send the legitimate key to the satellite device to complete the registration; A first authentication module, configured to obtain the legal key and first authentication information of the user terminal to be authenticated after the user terminal to be authenticated sends an authentication request, compare the first authentication information with the legal key, and obtain an identity authentication result; A second authentication module, configured to obtain second authentication information if the identity authentication result is successful, send the second authentication information to the satellite device for timestamp authentication, and accept a preliminary authentication result from the satellite device; The continuous authentication module is used to continuously obtain the behavior feature data and the spatial feature data of the user terminal to be authenticated if the preliminary authentication result is a successful timestamp authentication, and input the behavior feature data and the spatial feature data into the satellite device for continuous authentication until the access is completed.

6. A terminal device, characterized in that: The terminal device includes: a memory, a processor, and a space networking-based authentication program stored in the memory and executable on the processor. When the space networking-based authentication program is executed by the processor, the steps of the space networking-based authentication method as described in any one of claims 1 to 4 are implemented.

7. An authentication method based on space networking, characterized in that: The authentication method based on space networking includes: After obtaining the registration request sent by the user terminal, sending the registration request to the ground network control center, receiving the identity identifier sent by the ground network control center, sending the identity identifier to the user terminal, and receiving the legal key from the user terminal; After receiving the authentication request sent by the user terminal to be authenticated, sending the legal key to the user terminal to be authenticated; If second authentication information sent by the user terminal to be authenticated is received, timestamp authentication is performed according to the second authentication information, wherein the second authentication information includes current location information and current timestamp of the user terminal to be authenticated; When the timestamp authentication succeeds, the historical location information sent by the user terminal to be authenticated last time is obtained, and the spatial location authentication is performed according to the current location information and the historical location information. If the spatial location authentication succeeds, the preliminary authentication succeeds, and the result of the preliminary authentication success is sent to the user terminal to be authenticated; Continuously receive the behavior feature data and space feature data sent by the user terminal to be authenticated, send the behavior feature data and the space feature data to the ground network control center for matching, and receive the matching result from the ground network control center. If the matching result passes, continue to maintain the authentication status.

8. The authentication method based on space networking according to claim 7, characterized in that: After obtaining the registration request sent by the user terminal, the registration request is sent to the ground network control center, which also includes: A satellite identifier and a satellite key sent by a ground network control center are obtained, wherein the satellite identifier and the satellite key are used to ensure data security between the satellite device and the ground network control center.

9. The authentication method based on space networking according to claim 7, characterized in that: The ground network control center is preset with a model for training and predicting user behavior feature data and spatial feature data; The ground network control center and the satellite equipment perform data transmission via a secure channel.

10. An authentication system based on space networking, characterized in that: The authentication system based on space networking includes: The identification forwarding module is used to, after obtaining the registration request sent by the user terminal, send the registration request to the ground network control center, receive the identity identifier sent by the ground network control center, send the identity identifier to the user terminal, and receive the legal key from the user terminal; A legal key sending module, used for sending the legal key to the user terminal to be authenticated after receiving an authentication request sent by the user terminal to be authenticated; A timestamp authentication module, configured to perform timestamp authentication according to the second authentication information if second authentication information sent by the user terminal to be authenticated is received, wherein the second authentication information includes current location information and current timestamp of the user terminal to be authenticated; The spatial location authentication module is used to obtain the historical location information sent by the user terminal to be authenticated last time after the timestamp authentication is successful, and perform spatial location authentication based on the current location information and the historical location information. If the spatial location authentication is successful, the preliminary authentication is successful, and the result of the preliminary authentication success is sent to the user terminal to be authenticated; The continuous authentication module is used to continuously receive the behavioral feature data and spatial feature data sent by the user terminal to be authenticated, send the behavioral feature data and the spatial feature data to the ground network control center for matching, and receive the matching result from the ground network control center. If the matching result passes, the authentication status is maintained.

11. A satellite device, characterized in that: The satellite device includes: a memory, a processor, and a space networking-based authentication program stored in the memory and executable on the processor. When the space networking-based authentication program is executed by the processor, the steps of the space networking-based authentication method as described in any one of claims 7 to 9 are implemented.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores an authentication program based on space networking, and when the authentication program based on space networking is executed by a processor, the steps of the authentication method based on space networking as described in any one of claims 1-4 or claims 7-9 are implemented.

Images