Communication data processing method and apparatus, and electronic device

Abstract

The invention provides a communication data processing method and device and electronic equipment. The communication data processing method comprises the following steps: acquiring a shared key corresponding to a target communication link; wherein the target communication link is a communication link previously established with a second electronic device, and the shared key corresponding to the target communication link is a shared key obtained by performing key negotiation with the second electronic device through the target communication link; processing communication data in the current communication link by using a shared key corresponding to the target communication link; wherein the current communication link is a communication link currently established between the electronic equipment and the second electronic equipment. According to the communication data processing method provided by the invention, the processing efficiency of the communication data can be effectively improved, so that the communication efficiency between the electronic equipment is improved.

Description

Technical Field

[0001] The present disclosure relates to the field of communication technology, and in particular to a method and device for processing communication data, and an electronic device. Background Art

[0002] Space communication links include satellite-to-ground transmission and inter-satellite transmission links. For example, satellite tracking and control links are satellite-to-ground transmission, while 3GPP communication links involve satellite-to-ground transmission and inter-satellite transmission. In order to ensure the confidentiality, integrity, and availability of communication data, encryption of communication links is usually a requirement that must be met.

[0003] Satellite measurement and control is an important function to maintain the stable operation of the constellation. Its measurement and control data is transmitted end-to-end between the ground communication system and the satellite communication system. It must be encrypted through the satellite-to-ground transmission channel to resist eavesdropping, replay, injection of pseudo remote control or pseudo telemetry data and other security risks. Space communication links are a common scenario for communication satellites. Satellite-to-ground communication transmission includes but is not limited to communication between space base stations or CU (Centralized Unit) and ground core networks, between space base stations and ground-based base stations, between space distributed units DU (Distributed Unit) and ground CUs, and between satellite core networks and ground core networks; inter-satellite communication transmission includes but is not limited to communication between space base stations and space base stations, between space DUs and space CUs, and between space base stations or CUs and satellite core networks. The above are all communication backhaul interfaces or mid-transmission interfaces defined in the 3GPP specifications, and such interfaces should be encrypted.

[0004] With the rapid development of LEO (Low Earth orbit) satellite Internet, the security of satellite networks has become increasingly important. Satellite networks have the characteristics of fast dynamic topology changes and easy loss of satellite-to-ground transmission. When there is a need for encryption in satellite-to-ground and inter-satellite communications, it is usually necessary to perform encryption and decryption operations through a preset shared key. With the development of low-orbit satellite constellations, the growth rate of the number of satellites is much higher than that of traditional GEO (Geostationary Earth Orbit) or MEO (Medium Earth Orbit) constellations. Giant constellations will face problems such as the pre-setting, updating, and management of a large number of keys. The negotiation system based on non-shared keys faces many technical difficulties in space links, including the inability to maintain a secure tunnel for a long time when the network topology changes dynamically; the key negotiation during the establishment of the communication link has a great impact on the delay of the communication; due to the frequent message exchanges during key negotiation, it is easy to cause key negotiation to fail when affected by environmental factors such as rainfall attenuation, which in turn has a great impact on the quality of communication. Summary of the invention

[0005] The technical problem to be solved by the present disclosure is to overcome the above-mentioned defects in the prior art and to provide a method and device for processing communication data and an electronic device.

[0006] The present invention solves the above technical problems through the following technical solutions:

[0007] A first aspect of the present disclosure provides a method for processing communication data, which is applied to a first electronic device, and the processing method includes the following steps: obtaining a shared key corresponding to a target communication link; wherein the target communication link is a communication link previously established with a second electronic device, and the shared key corresponding to the target communication link is a shared key obtained by performing key negotiation with the second electronic device through the target communication link; and processing communication data in a current communication link using the shared key corresponding to the target communication link; wherein the current communication link is a communication link currently established with the second electronic device.

[0008] Optionally, the shared key corresponding to the target communication link is a shared key obtained by performing a most recent key negotiation with the second electronic device.

[0009] Optionally, the step of processing the communication data in the current communication link by using the shared key corresponding to the target communication link specifically includes:

[0010] In response to not obtaining a shared key corresponding to the current communication link, the communication data in the current communication link is processed using a shared key corresponding to the target communication link; wherein the shared key corresponding to the current communication link is a shared key obtained by performing key negotiation with the second electronic device through the current communication link.

[0011] Optionally, the processing method further includes: storing the shared key corresponding to the target communication link in a key cache list, and updating the state of the shared key corresponding to the target communication link to activated;

[0012] The step of processing the communication data in the current communication link by using the shared key corresponding to the target communication link specifically includes:

[0013] Acquire a shared key in an activated state from the key cache list;

[0014] The communication data in the current communication link is processed using the acquired shared key.

[0015] Optionally, the processing method also includes: in response to the target communication link being disconnected and obtaining a shared key corresponding to the current communication link, updating the status of the shared key corresponding to the target communication link to expired, and updating the status of the shared key corresponding to the current communication link to activated; wherein, the shared key corresponding to the current communication link is a shared key obtained by performing key negotiation with the second electronic device through the current communication link.

[0016] Optionally, the processing method also includes: in response to the target communication link being disconnected and the shared key corresponding to the current communication link not being obtained, maintaining the state of the shared key corresponding to the target communication link as activated; wherein the shared key corresponding to the current communication link is a shared key obtained by performing key negotiation with the second electronic device through the current communication link.

[0017] Optionally, the target communication link is a communication link established for the first time with the second electronic device, and before the step of obtaining a shared key corresponding to the target communication link, the method further includes:

[0018] authenticating the second electronic device based on the digital certificate obtained from the second electronic device;

[0019] In response to passing the identity authentication, key negotiation is performed with the second electronic device via the target communication link.

[0020] Optionally, the first electronic device is an electronic device in a terrestrial communication system, and the second electronic device is an electronic device in a satellite communication system.

[0021] Optionally, the first electronic device and the second electronic device are electronic devices in different satellite communication systems.

[0022] A second aspect of the present disclosure provides a communication data processing device, applied to a first electronic device, the processing device comprising:

[0023] An acquisition module, configured to acquire a shared key corresponding to a target communication link; wherein the target communication link is a communication link previously established with a second electronic device, and the shared key corresponding to the target communication link is a shared key obtained by performing key negotiation with the second electronic device through the target communication link;

[0024] A processing module is used to process the communication data in the current communication link using the shared key corresponding to the target communication link; wherein the current communication link is the communication link currently established with the second electronic device.

[0025] Optionally, the shared key corresponding to the target communication link is a shared key obtained by performing a most recent key negotiation with the second electronic device.

[0026] Optionally, the processing module is specifically used to process the communication data in the current communication link using the shared key corresponding to the target communication link in response to not obtaining the shared key corresponding to the current communication link; wherein the shared key corresponding to the current communication link is the shared key obtained by performing key negotiation with the second electronic device through the current communication link.

[0027] Optionally, the processing device further includes a storage module, which is used to store the shared key corresponding to the target communication link in a key cache list, and update the state of the shared key corresponding to the target communication link to activated. The processing module is specifically used to obtain the shared key in the activated state from the key cache list; and use the obtained shared key to process the communication data in the current communication link.

[0028] Optionally, the processing device also includes an update module, which is used to update the status of the shared key corresponding to the target communication link to expired and the status of the shared key corresponding to the current communication link to activated in response to the target communication link being disconnected and obtaining the shared key corresponding to the current communication link; wherein the shared key corresponding to the current communication link is a shared key obtained by performing key negotiation with the second electronic device through the current communication link.

[0029] Optionally, the processing device also includes a maintaining module for maintaining the state of the shared key corresponding to the target communication link as activated in response to the target communication link being disconnected and the shared key corresponding to the current communication link not being obtained; wherein the shared key corresponding to the current communication link is a shared key obtained by performing key negotiation with the second electronic device through the current communication link.

[0030] Optionally, the target communication link is a communication link established for the first time with the second electronic device, and the processing device also includes an authentication module for authenticating the second electronic device based on a digital certificate obtained from the second electronic device; and a negotiation module for performing key negotiation with the second electronic device through the target communication link in response to passing the identity authentication.

[0031] Optionally, the first electronic device is an electronic device in a terrestrial communication system, and the second electronic device is an electronic device in a satellite communication system.

[0032] Optionally, the first electronic device and the second electronic device are electronic devices in different satellite communication systems.

[0033] A third aspect of the present disclosure provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of the processing method described in the first aspect.

[0034] A fourth aspect of the present disclosure provides a computer-readable storage medium having a computer program stored thereon, which implements the steps of the processing method described in the first aspect when the computer program is executed by a processor.

[0035] A fifth aspect of the present disclosure provides a computer program product, comprising a computer program, which implements the steps of the processing method described in the first aspect when executed by a processor.

[0036] Based on the common sense in the art, the above optional conditions can be arbitrarily combined to obtain the preferred embodiments of the present disclosure.

[0037] The positive and progressive effect of the present disclosure is that after establishing a communication link between the current and second electronic devices, the first electronic device directly uses the shared key obtained by negotiating the key with the second electronic device through the previously established communication link to process the communication data in the current communication link, without waiting for the key negotiation with the second electronic device through the current communication link to use the obtained shared key to process the communication data. Compared with the preset shared key system, there is no need to preset a large number of keys. Compared with the negotiation system based on non-shared keys, it can not only avoid the computational overhead and communication delay caused by key negotiation when establishing a communication link, but also even if the negotiation fails due to environmental factors, it will not affect the current communication, and can effectively improve the processing efficiency of communication data, thereby improving the communication efficiency between electronic devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 A schematic diagram of a preset shared key system.

[0039] Figure 2 A schematic diagram of a negotiation system based on a non-shared key.

[0040] Figure 3 A flowchart of a method for processing communication data provided in Embodiment 1 of the present disclosure.

[0041] Figure 4 A flowchart of another method for processing communication data provided in Embodiment 1 of the present disclosure.

[0042] Figure 5 A schematic diagram including inter-satellite communication and satellite-to-ground communication is provided for Embodiment 1 of the present disclosure.

[0043] Figure 6 A schematic diagram of a key cache list provided for Embodiment 1 of the present disclosure.

[0044] Figure 7 A schematic diagram of satellite-to-ground communication provided in Example 1 of the present disclosure.

[0045] Figure 8 Another schematic diagram including inter-satellite communication and satellite-to-ground communication is provided for Embodiment 1 of the present disclosure.

[0046] Fig. 9 This is a structural block diagram of a communication data processing device provided in Example 1 of the present disclosure.

[0047] Fig.10 A schematic diagram of the structure of an electronic device provided in Embodiment 2 of the present disclosure. DETAILED DESCRIPTION

[0048] The following is a description of exemplary embodiments of the present disclosure in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present disclosure. Similarly, for the sake of clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

[0049] It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product, or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products, or devices.

[0050] Figure 1 A schematic diagram for illustrating a preset shared key system. Figure 1As shown in the figure, by presetting the shared key in the ground communication system and the shared key before the satellite is launched, the satellite and ground communication systems use the same key for symmetric encryption and decryption operations. In order to ensure that the communication content has a certain degree of backward security (that is, a cryptographic system will not affect the security of future communication content when the key is leaked or the password is cracked), the session key should have validity period management and should be refreshed or rotated when the key expires. If a rotation mechanism is used, a certain number of session keys should be preset to ensure that the number of keys is sufficient. Figure 1 As shown, key-1 is used to represent multiple keys preset in the ground communication system and one of the satellite communication systems, key-2 is used to represent multiple keys preset in the ground communication system and another satellite communication system, and key-3 is used to represent multiple keys preset in the two satellite communication systems. If a refresh mechanism is adopted, the communicating parties should use a key derivation function (KDF) to synchronously derive the shared key for the next session based on the same master key, the same salt, the same number of iterations, and the same one-way function. This mechanism consumes a lot of computing power in the ground communication system and has great restrictions on throughput and the maximum number of connections. With the increase in the size of the constellation, the challenges faced by the above-mentioned preset shared key system will gradually become apparent. A large number of keys will bring problems of difficulty in management and maintenance in both the ground communication system and the satellite communication system. A large number of communication links will also put great pressure on the KDF operation, thus forming a bottleneck. In addition, since the shared key needs to be preset out of band, on the one hand, the security protection of the key needs to be strengthened in the ground communication system, and on the other hand, the preset before the satellite launch must also be well managed and kept safe. Once the key is leaked, it will pose a serious threat to the keys of on-orbit satellites. Even if an on-orbit key update mechanism can be adopted, the key used to encrypt the update instructions is still not safe.

[0051] Figure 2 A schematic diagram for illustrating a negotiation system based on a non-shared key. Figure 2As shown in the figure, the negotiation system based on non-shared keys needs to cooperate with the Public Key Infrastructure (PKI). The PKI system issues digital certificates for the ground communication system and the satellite communication system. Before the satellite is launched, the digital certificate for the first use can be issued out-of-band. After the satellite is launched, if the digital certificate needs to be updated, the new digital certificate can be added and replaced through the satellite-to-ground transmission link (in actual applications, it can generally be distributed through the satellite control center). After the successful update, the key negotiation process of the communication link is carried out through the new certificate. Due to the rapid dynamic changes in the topology of the low-orbit satellite network and the large number of communication links, the establishment and removal of the communication link is carried out almost every moment, whether it is satellite-to-ground transmission or inter-satellite transmission. At this time, it has a greater impact on application scenarios with high throughput requirements (such as 3GPP NG-u interface and F1-u interface). According to the requirements of 3GPP, IKEv2 authentication and IPsec ESP encryption protection should be supported for the mid-transmission interface (F1) and the backhaul interface (such as NG / Xn, etc.). In order not to affect the communication efficiency, the IPsec tunnel should be established in advance and the tunnel should be kept available. The ESP encryption key should be renegotiated only once every few hours (through the parameter configuration of the IPsec peer, generally configured to a value between 1 hour and 24 hours). When the communication payload enters the IPsec tunnel, ESP encapsulation is directly performed. However, since the topology of the satellite communication link is constantly changing, the traditional IPsec protocol cannot maintain a secure tunnel. The resulting problem is that IKEv2 key exchange and negotiation are required every time the satellite-to-ground or intersatellite link is established. When a negotiation system based on non-shared keys is adopted, no matter what specific key negotiation system is used for the satellite-to-ground or intersatellite link, the same problem will be faced, that is, key negotiation needs to be performed when the link is established. In giant constellations, key renegotiation will become extremely frequent. The computational overhead of the negotiation system based on non-shared keys is much greater than that of shared keys, usually hundreds or even thousands of times. The impact of key negotiation on communication delay when the communication link is accessed is huge. In addition, due to the long space link and many influencing factors, such as the influence of weather conditions such as rainfall on the satellite-to-ground link and bit flipping caused by cosmic rays, the negotiation system based on non-shared keys requires multiple message interactions (including key exchange and identity authentication). When any message fails to be transmitted due to environmental factors, it will cause key negotiation failure. The retransmission mechanism can ensure the robustness of the key negotiation process to a certain extent, but it will also further aggravate the communication delay problem.

[0052] Different from the above-mentioned preset shared key system and the negotiation system based on non-shared key, in the method for processing communication data provided by the embodiment of the present disclosure, after establishing a communication link between the current and second electronic devices, the first electronic device directly uses the shared key obtained by negotiating the key with the second electronic device through the previously established communication link to process the communication data in the current communication link, without waiting for the key negotiation with the second electronic device through the current communication link to use the obtained shared key to process the communication data. Compared with the preset shared key system, there is no need to preset a large number of keys, and compared with the negotiation system based on non-shared keys, it can not only avoid the computing overhead and communication delay caused by key negotiation when establishing a communication link, but also even if the negotiation fails due to environmental factors, it will not affect the current communication, and can effectively improve the processing efficiency of communication data, thereby improving the communication efficiency between electronic devices.

[0053] In one case, the communication involved in the embodiment of the present disclosure is satellite-to-ground communication, specifically, the first electronic device is an electronic device in a ground communication system, and the second electronic device is an electronic device in a satellite communication system. In another case, the communication involved in the embodiment of the present disclosure is inter-satellite communication, specifically, the first electronic device and the second electronic device are electronic devices in different satellite communication systems. It should be noted that the communication link that has been established between the first electronic device and the second electronic device will be disconnected as the satellite topology changes, and a new communication link needs to be established again.

[0054] Example 1

[0055] Figure 3 A flow chart of a method for processing communication data provided in this embodiment is provided. The method for processing communication data can be executed by a communication data processing device. The communication data processing device can be implemented by software and / or hardware. The communication data processing device can be part or all of an electronic device. The following describes the method for processing communication data provided in this embodiment with a first electronic device as the execution subject.

[0056] like Figure 3 As shown, the communication data processing method provided in this embodiment may include the following steps S11-S12:

[0057] Step S11, obtaining a shared key corresponding to a target communication link, wherein the target communication link is a communication link previously established with a second electronic device, and the shared key corresponding to the target communication link is a shared key obtained by performing key negotiation with the second electronic device through the target communication link.

[0058] In a specific implementation, the target communication link may be any communication link previously established with the second electronic device, such as a communication link established for the first time, or a communication link established previously, etc. The key negotiation may adopt a negotiation algorithm such as DH (Diffie-Hellman), ECDH (Elliptic Curve Diffie-Hellman), etc. After the key negotiation, both the first electronic device and the second electronic device can obtain a shared key.

[0059] Step S12: Process the communication data in the current communication link using the shared key corresponding to the target communication link, wherein the current communication link is the communication link currently established with the second electronic device.

[0060] In a specific example, the communication data in the current communication link is the communication data sent by the second electronic device to the first electronic device, and accordingly, the above processing may be a decryption operation processing. In another specific example, the communication data in the current communication link is the communication data sent by the first electronic device to the second electronic device, and accordingly, the above processing may include an encryption operation processing, and may also include transmitting the communication data after the encryption operation processing.

[0061] In an optional implementation, the shared key corresponding to the target communication link is the shared key obtained by the most recent key negotiation with the second electronic device. In this implementation, the communication data in the current communication link is processed using the shared key obtained by the most recent key negotiation. In a specific example, before the current communication link is established, the three communication links established between the first electronic device and the second electronic device are Link1 to Link3, respectively, wherein the shared key obtained by the key negotiation with the second electronic device through Link1 is Key1, the shared key obtained by the key negotiation with the second electronic device through Link2 is Key2, and the key negotiation with the second electronic device through Link3 fails, and the corresponding shared key is not obtained. At this time, the corresponding target communication link should be Link2, and the shared key corresponding to the target communication link should be Key2, and Key2 is used to process the communication data in the current communication link.

[0062] In an optional implementation of the above-mentioned step S12, in response to not obtaining a shared key corresponding to the current communication link, the communication data in the current communication link is processed using a shared key corresponding to the target communication link; wherein the shared key corresponding to the current communication link is a shared key obtained by performing key negotiation with the second electronic device through the current communication link.

[0063] It should be noted that after the first electronic device and the second electronic device establish a communication link, they usually negotiate a key through the established communication link. If a shared key corresponding to the current communication link is not obtained, it means that the first electronic device and the second electronic device have not negotiated a shared key through the current communication link.

[0064] In an optional implementation, the processing method further includes storing the shared key corresponding to the target communication link in a key cache list, and updating the state of the shared key corresponding to the target communication link to activated. In this implementation, step S12 specifically includes: obtaining the shared key in the activated state from the key cache list, and processing the communication data in the current communication link using the obtained shared key.

[0065] In a specific implementation, the shared key obtained by the key negotiation between the first electronic device and the second electronic device can be stored in a key cache list, and even if the corresponding communication link is disconnected, the shared password obtained by the key negotiation can be obtained from the key cache list. The key cache list may include an identifier of the shared key and the state of the shared key, wherein the identifier of the shared key is used to uniquely represent the identity information of the shared key, for example, the identifier of the shared key is 11, which is used to represent that it is a shared key corresponding to the communication link 11; the identifier of the shared key is 12, which is used to represent that it is a shared key corresponding to the communication link 12.

[0066] In an optional implementation, the processing method further includes: in response to the target communication link not being disconnected and obtaining a shared key corresponding to the current communication link, updating the state of the shared key corresponding to the current communication link to pending activation.

[0067] In another optional implementation, the processing method further includes: in response to the target communication link being disconnected and obtaining a shared key corresponding to the current communication link, updating the state of the shared key corresponding to the target communication link to expired, and updating the state of the shared key corresponding to the current communication link to activated. In this implementation, when the previously established target communication link is disconnected and the shared key is obtained through key negotiation through the current communication link, the shared key corresponding to the target communication link is set to an expired state, and the currently negotiated shared key is set to an activated state, so that the currently negotiated shared key can be used to process the communication data in the communication link to be established next time, thereby improving the efficiency of subsequent communications.

[0068] In a specific implementation, after the current communication link is disconnected, as the communication link is re-established between the first electronic device and the second electronic device, the shared key in the key cache list that is in an activated state, i.e., the shared key corresponding to the current communication link, can be used to process the communication data in the re-established communication link, so as to effectively improve the processing efficiency of the communication data.

[0069] In order to reduce the space occupied by the key cache list in the first electronic device, the first electronic device may overwrite the expired shared key in the key cache list with the shared key obtained by performing key negotiation with the second electronic device through the re-established communication link.

[0070] In another optional embodiment, the processing method further includes: in response to the target communication link being disconnected and the shared key corresponding to the current communication link not being obtained, maintaining the state of the shared key corresponding to the target communication link as activated. In this embodiment, when the previously established target communication link is disconnected and the currently negotiated shared key is not obtained, the state of the shared key corresponding to the target communication link is maintained as activated, so that the previously negotiated shared key can be used to process the communication data in the communication link to be established next time, thereby improving the efficiency of subsequent communications.

[0071] In a specific implementation, after the current communication link is disconnected, as the communication link is re-established between the first electronic device and the second electronic device, the shared key in the key cache list that is in an activated state, i.e., the shared key corresponding to the target communication link, can be used to process the communication data in the re-established communication link, so as to effectively improve the processing efficiency of the communication data.

[0072] It should be noted that the shared keys in the key cache column that are activated are unique.

[0073] In order to further reduce the space occupied by the key cache list in the first electronic device, only the shared key corresponding to the target communication link can be stored in the key cache list, and the shared key corresponding to the target communication link can be used to process the communication data in the current communication link and the communication link established later.

[0074] In an optional implementation, the target communication link is a communication link established for the first time with the second electronic device, and before the above step S11, the step further includes: authenticating the second electronic device based on the digital certificate obtained from the second electronic device; and in response to passing the identity authentication, performing key negotiation with the second electronic device through the target communication link. In this implementation, the first electronic device and the second electronic device perform the first key negotiation only after the identity authentication of the second electronic device is passed.

[0075] In a specific implementation, the first electronic device first generates a public-private key pair, which includes a public key and a private key, and then generates a certificate signing request (CSR), and applies for a digital certificate by sending the certificate signing request to the PKI system. The same is true for the second electronic device. After the first electronic device and the second electronic device obtain digital certificates from the PKI system respectively, they send the obtained digital certificates to each other respectively. The first electronic device authenticates the second electronic device based on the digital certificate sent by the second electronic device. Similarly, the second electronic device authenticates the first electronic device based on the digital certificate sent by the first electronic device. Among them, in the process of key negotiation between the first electronic device and the second electronic device, the above-mentioned public key and private key are also needed. Specifically, the above-mentioned public key is used for encryption and the above-mentioned private key is used for decryption.

[0076] It should be noted that when the digital certificate in the first electronic device or the second electronic device is about to expire, it is necessary to regenerate the public-private key pair and use the certificate management protocol to automatically update the digital certificate. In specific implementations, protocols such as CMP (Certificate Management Protocol) and SCEP (Simple Certificate Enrollment Protocol) can be used to update the digital certificate.

[0077] Based on the above embodiment, this embodiment also provides a specific method for processing communication data, such as Figure 4 As shown, the following steps S21 to S29 are included:

[0078] Step S21: authenticating the second electronic device based on the digital certificate obtained from the second electronic device.

[0079] Step S22: In response to passing the identity authentication, perform key negotiation with the second electronic device through the target communication link, wherein the target communication link is a communication link previously established with the second electronic device, and the shared key corresponding to the target communication link is a shared key obtained by performing key negotiation with the second electronic device through the target communication link.

[0080] Step S23: Acquire a shared key corresponding to the target communication link.

[0081] Step S24: Store the shared key corresponding to the target communication link in a key cache list, and update the state of the shared key corresponding to the target communication link to activated.

[0082] Step S25: Acquire the shared key in the activated state from the key cache list.

[0083] Step S26: Use the acquired shared key to process the communication data in the current communication link, wherein the current communication link is the communication link currently established with the second electronic device.

[0084] Step S27: In response to the target communication link being disconnected, determine whether a shared key corresponding to the current communication link is obtained; if so, execute step S28; if not, execute step S29.

[0085] Step S28: Update the status of the shared key corresponding to the target communication link to expired, and update the status of the shared key corresponding to the current communication link to activated.

[0086] Step S29: Keep the state of the shared key corresponding to the target communication link activated.

[0087] In a specific implementation, the first electronic device and the second electronic device may both include a certificate management unit, an authentication negotiation unit, a key management unit, and a transmission gateway unit. The certificate management unit is used to manage digital certificates issued by the PKI system. Before the satellite is launched, it can be issued and preset in an out-of-band manner. When the satellite is in orbit, the certificate management protocol is used to interact with the PKI system and update the digital certificate. The authentication negotiation unit is used to perform identity authentication and key negotiation. The key management unit is used to maintain a key cache list, and can be combined with a hardware security module HSM (Hardware Security Module), a security chip TPM (Trusted Platform Module), etc. to strengthen the security protection of the above-mentioned private key and shared key. The transmission gateway unit is used for secure transmission, and the communication data is processed and transmitted using the shared key successfully negotiated by the authentication negotiation unit. The PKI system is used to issue digital certificates for each communication unit, such as the first electronic device and the second electronic device, and provides an out-of-band manual and automatic certificate issuance function based on the certificate management protocol.

[0088] Figure 5 A schematic diagram for illustrating a method including inter-satellite communication and satellite-to-ground communication. Figure 5As shown, electronic device A and electronic device B are located in different satellite communication systems, and electronic device C is located in a ground communication system. Electronic devices A, B and C all include a certificate management unit, an authentication negotiation unit, a key management unit and a transmission gateway unit. Electronic devices A, B and C are all used to obtain digital certificates from the PKI system. Among them, after the identity authentication between electronic device A and electronic device C is passed, key negotiation is performed, and ciphertext transmission is performed based on the shared key obtained by key negotiation. The communication between the two is satellite-to-ground communication. After the identity authentication between electronic device A and electronic device B is passed, key negotiation is performed, and ciphertext transmission is performed based on the shared key obtained by key negotiation. The communication between the two is inter-satellite communication.

[0089] Figure 6 A schematic diagram for illustrating a key cache list. Figure 5 In the example shown, electronic device A communicates with electronic device B and electronic device C respectively, and the key cache list maintained by the key management unit in electronic device A is as follows: Figure 6 As shown, it includes the shared key and its status corresponding to the communication link established with electronic device B, and the shared key and its status corresponding to the communication link established with electronic device C.

[0090] Figure 7 A schematic diagram for illustrating satellite-to-ground communication. Figure 7 As shown, the ground communication system communicates with M satellite communication systems respectively, and the electronic equipment in each satellite communication system only needs to maintain N shared keys and a pair of public-private keys generated for identity authentication and key negotiation. The electronic equipment in the ground communication system needs to maintain N*M shared keys. Usually, a giant constellation can reach more than 10,000 satellites. Taking N=5 and M=10,000 as an example, a total of 50,000 shared keys and a pair of public-private keys generated for identity authentication and key negotiation need to be maintained. In a system based on preset shared keys, for each satellite that communicates with the ground communication system, the ground communication system needs to preset far more than N keys to communicate with it. Therefore, compared with the system based on preset shared keys, in the solution provided by the embodiment of the present disclosure, the number of shared keys stored by the ground communication system is greatly reduced.

[0091] Figure 8 It is used to show another schematic diagram including inter-satellite communication and satellite-to-ground communication. Figure 8In the application scenario shown, since different satellite communication systems, as well as satellite communication systems and ground communication systems, are all communication peers, the satellite communication system must implement a key management unit with the same capabilities as the ground communication system. Furthermore, since the satellite communication system involves a large number of communication network units, if all units in the entire communication network are included in the key cache list, the communication unit key cache list will become very large and difficult to maintain. For each communication unit in the satellite communication system, the key cache list associated with each object can be maintained in combination with the communication objects maintained in the TNL (Transport Network Layer) configuration information in the 3GPP standard, or each key cache list can be included in the TNL management parameters for unified management, without having to maintain the information of all communication network units in the entire communication network.

[0092] This embodiment also provides a communication data processing device, which is applied to a first electronic device, such as Fig. 9 As shown, the communication data processing device 90 includes an acquisition module 91 and a processing module 92. The acquisition module 91 is used to acquire a shared key corresponding to a target communication link; wherein the target communication link is a communication link previously established with a second electronic device, and the shared key corresponding to the target communication link is a shared key obtained by performing key negotiation with the second electronic device through the target communication link. The processing module 92 is used to process the communication data in the current communication link using the shared key corresponding to the target communication link; wherein the current communication link is a communication link currently established with the second electronic device.

[0093] In an optional implementation manner, the shared key corresponding to the target communication link is a shared key obtained by performing a most recent key negotiation with the second electronic device.

[0094] In an optional embodiment, the processing module is specifically used to process the communication data in the current communication link using the shared key corresponding to the target communication link in response to not obtaining the shared key corresponding to the current communication link; wherein the shared key corresponding to the current communication link is a shared key obtained by performing key negotiation with the second electronic device through the current communication link.

[0095] In an optional embodiment, the processing device further includes a storage module, which is used to store the shared key corresponding to the target communication link in a key cache list, and update the state of the shared key corresponding to the target communication link to activated. The processing module is specifically used to obtain the shared key in the activated state from the key cache list; and use the obtained shared key to process the communication data in the current communication link.

[0096] In an optional embodiment, the processing device also includes an update module for updating the status of the shared key corresponding to the target communication link to expired and the status of the shared key corresponding to the current communication link to activated in response to the target communication link being disconnected and obtaining the shared key corresponding to the current communication link; wherein the shared key corresponding to the current communication link is a shared key obtained by performing key negotiation with the second electronic device through the current communication link.

[0097] In an optional embodiment, the processing device also includes a maintaining module for maintaining the state of the shared key corresponding to the target communication link as activated in response to the target communication link being disconnected and the shared key corresponding to the current communication link not being obtained; wherein the shared key corresponding to the current communication link is a shared key obtained by performing key negotiation with the second electronic device through the current communication link.

[0098] In an optional embodiment, the target communication link is a communication link established for the first time with the second electronic device, and the processing device also includes an authentication module for authenticating the second electronic device based on a digital certificate obtained from the second electronic device; and a negotiation module for performing key negotiation with the second electronic device through the target communication link in response to passing the identity authentication.

[0099] It should be noted that the communication data processing device in this embodiment may specifically be a separate chip, a chip module or an electronic device, or may be a chip or a chip module integrated into an electronic device.

[0100] The various modules / units included in the communication data processing device described in this embodiment may be software modules / units or hardware modules / units, or may be partially software modules / units and partially hardware modules / units.

[0101] Example 2

[0102] Fig.10 A schematic diagram of the structure of an electronic device provided in this embodiment. The electronic device includes at least one processor and a memory connected to the at least one processor. The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can perform the steps of the method for processing communication data in Example 1. The electronic device provided in this embodiment can be an electronic device in a satellite communication system or an electronic device in a ground communication system. Fig.10The electronic device 3 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0103] The components of the electronic device 3 may include, but are not limited to: the at least one processor 4 mentioned above, the at least one memory 5 mentioned above, and a bus 6 connecting different system components (including the memory 5 and the processor 4).

[0104] The bus 6 includes a data bus, an address bus and a control bus.

[0105] The memory 5 may include a volatile memory, such as a random access memory (RAM) 51 and / or a cache memory 52 , and may further include a read-only memory (ROM) 53 .

[0106] The memory 5 may also include a program tool 55 having a set (at least one) of program modules 54, such program modules 54 including but not limited to: an operating system, one or more application programs, other program modules and program data, each of which or some combination may include the implementation of a network environment.

[0107] The processor 4 executes various functional applications and data processing, such as the communication data processing method described above, by running the computer programs stored in the memory 5 .

[0108] The electronic device 3 may also communicate with one or more external devices 7 (e.g., keyboards, pointing devices, etc.). Such communication may be performed via an input / output (I / O) interface 8. Furthermore, the electronic device 3 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter 9. Fig.10 As shown, the network adapter 9 communicates with other modules of the electronic device 3 via the bus 6. It should be understood that although Fig.10 Not shown, other hardware and / or software modules may be used in conjunction with the electronic device 3, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID (disk array) systems, tape drives, and data backup storage systems.

[0109] It should be noted that although several units / modules or sub-units / modules of the electronic device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more units / modules described above can be embodied in one unit / module. Conversely, the features and functions of one unit / module described above can be further divided into multiple units / modules to be embodied.

[0110] Example 3

[0111] This embodiment provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the method for processing communication data in Embodiment 1 are implemented.

[0112] The readable storage medium may include, but is not limited to, a portable disk, a hard disk, a random access memory, a read-only memory, an erasable programmable read-only memory, an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0113] In a possible implementation manner, the present disclosure may also be implemented in the form of a computer program product, which includes a computer program, and when the computer program is executed by a processor, the steps of the method for processing communication data in Example 1 are implemented.

[0114] Among them, the computer program for executing the present disclosure can be written in any combination of one or more programming languages, and the computer program can be executed completely on the electronic device, partially on the electronic device, as a separate software package, partially on the electronic device and partially on a remote device, or completely on the remote device.

[0115] Although the specific embodiments of the present disclosure are described above, those skilled in the art should understand that this is only an example, and the protection scope of the present disclosure is defined by the appended claims. Those skilled in the art may make various changes or modifications to these embodiments without departing from the principles and essence of the present disclosure, but these changes and modifications all fall within the protection scope of the present disclosure.

Claims

1. A method for processing communication data, characterized in that: Applied to a first electronic device, the processing method comprises the following steps: Acquire a shared key corresponding to a target communication link; wherein the target communication link is a communication link previously established with a second electronic device, and the shared key corresponding to the target communication link is a shared key obtained by performing key negotiation with the second electronic device through the target communication link; The communication data in the current communication link is processed using the shared key corresponding to the target communication link; wherein the current communication link is the communication link currently established with the second electronic device.

2. The processing method according to claim 1, characterized in that The shared key corresponding to the target communication link is the shared key obtained by the most recent key negotiation with the second electronic device.

3. The processing method according to claim 1, characterized in that: The step of processing the communication data in the current communication link by using the shared key corresponding to the target communication link specifically includes: In response to not obtaining a shared key corresponding to the current communication link, the communication data in the current communication link is processed using a shared key corresponding to the target communication link; wherein the shared key corresponding to the current communication link is a shared key obtained by performing key negotiation with the second electronic device through the current communication link.

4. The processing method according to claim 1, characterized in that: The processing method further includes: storing the shared key corresponding to the target communication link in a key cache list, and updating the state of the shared key corresponding to the target communication link to activated; The step of processing the communication data in the current communication link by using the shared key corresponding to the target communication link specifically includes: Acquire a shared key in an activated state from the key cache list; The communication data in the current communication link is processed using the acquired shared key.

5. The processing method according to claim 4, characterized in that: The processing method also includes: In response to the target communication link being disconnected and obtaining a shared key corresponding to the current communication link, the status of the shared key corresponding to the target communication link is updated to expired, and the status of the shared key corresponding to the current communication link is updated to activated; wherein the shared key corresponding to the current communication link is a shared key obtained by performing key negotiation with the second electronic device through the current communication link.

6. The processing method according to claim 4, characterized in that: The processing method also includes: In response to the target communication link being disconnected and the shared key corresponding to the current communication link not being obtained, the state of the shared key corresponding to the target communication link is maintained as activated; wherein the shared key corresponding to the current communication link is a shared key obtained by performing key negotiation with the second electronic device through the current communication link.

7. The processing method according to claim 1, characterized in that: The target communication link is a communication link established for the first time with the second electronic device, and before the step of obtaining a shared key corresponding to the target communication link, the method further includes: authenticating the second electronic device based on the digital certificate obtained from the second electronic device; In response to passing the identity authentication, key negotiation is performed with the second electronic device via the target communication link.

8. The processing method according to any one of claims 1 to 7, characterized in that: The first electronic device is an electronic device in a terrestrial communication system, and the second electronic device is an electronic device in a satellite communication system; Alternatively, the first electronic device and the second electronic device are electronic devices in different satellite communication systems.

9. A communication data processing device, characterized in that: Applied to a first electronic device, the processing device includes: An acquisition module, configured to acquire a shared key corresponding to a target communication link; wherein the target communication link is a communication link previously established with a second electronic device, and the shared key corresponding to the target communication link is a shared key obtained by performing key negotiation with the second electronic device through the target communication link; A processing module is used to process the communication data in the current communication link using the shared key corresponding to the target communication link; wherein the current communication link is the communication link currently established with the second electronic device.

10. An electronic device comprising a memory, a processor and a computer program stored in the memory, characterized in that: The processor executes the computer program to implement the steps of the processing method according to any one of claims 1 to 8.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the processing method described in any one of claims 1 to 8 are implemented.

12. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the processing method described in any one of claims 1 to 8 are implemented.

Images