Satellite base station cross-layer lightweight authentication method based on identification

Abstract

The invention relates to the technical field of satellite communication, in particular to an identification-based satellite base station cross-layer lightweight authentication method, which comprises the following steps that: a satellite base station and a user terminal respectively register and acquire authentication information; the user terminal initiates a first authentication request, the satellite base station and the user terminal perform first identity authentication on each other based on the authentication information, and if the authentication is passed, a session key is calculated to complete first bidirectional authentication and key negotiation; and the user terminal initiates a re-authentication request, and the satellite base station and the user terminal perform re-identity authentication by extracting and identifying radio frequency fingerprints to complete re-bidirectional authentication and key negotiation. According to the invention, identity recognition and secure access of the satellite communication equipment can be ensured, and the security of a satellite communication network environment is guaranteed.

Description

Technical Field

[0001] The present invention relates to the field of satellite communication technology, and in particular to an identification-based satellite base station cross-layer lightweight authentication method. Background Art

[0002] Satellite communication, as an important part of the modern communication field, refers to the use of artificial satellites as relay stations to forward radio waves, thereby achieving communication between two or more earth stations. Satellite communication links are highly exposed in free space and are vulnerable to malicious attacks from illegal users. Therefore, it is crucial to ensure the security of satellite communication networks. Satellite communication equipment authentication technology includes encryption algorithm-based authentication technology and physical layer-based authentication technology. Encryption technology is divided into symmetric encryption technology and asymmetric encryption technology. Symmetric encryption technology has the problem of difficult key management and distribution. In symmetric encryption, the same key is used for encryption and decryption. The secure distribution and management of keys is crucial to ensure the security and confidentiality of data. When symmetric encryption schemes are actually used, they are prone to denial of service attacks and key analysis attacks.

[0003] Asymmetric encryption technology can be divided into technology based on public key encryption infrastructure and technology based on identity cryptography. In technology based on public key encryption infrastructure, in order to ensure the security of the public key, the sender needs to apply for a certificate from the certificate authority and send its own certificate during authentication. After receiving the authentication message, the receiver needs to query the certificate authority for the legitimacy of the certificate, which makes the authentication process more complicated. At the same time, a large number of certificates are also difficult to manage and maintain. Technology based on identity cryptography unifies the user's public key and real identity, avoiding third-party participation in the authentication process, and overcomes the shortcomings of technology based on public key encryption infrastructure in the identity authentication process. However, technology based on identity cryptography requires multiple bilinear pairing operations and multiple rounds of communication interactions at each authentication terminal during the authentication process, which will cause the identity authentication and key negotiation links to take a long time.

[0004] The device identity authentication method based on radio frequency fingerprint is to extract the radio frequency fingerprint of the device to be authenticated, and combine it with the radio frequency fingerprint of the legal device in the radio frequency fingerprint library to realize the identity authentication of the device. Each wireless communication device will cause differences in its internal hardware under the interference of external factors such as process, material, and environment, so each wireless communication device has a unique radio frequency fingerprint. The features extracted by radio frequency fingerprint mainly include instantaneous frequency, amplitude, phase, carrier frequency deviation, code rate deviation, box dimension, information dimension, dual spectrum features, high-order spectrum features, etc. Commonly used radio frequency fingerprint feature extraction methods mainly include time-frequency analysis, wavelet transform, etc. Satellite communication signals are usually nonlinear and non-stationary. The traditional time-frequency analysis method is not ideal for extracting and identifying radio frequency fingerprint features for signals that are greatly affected by environmental factors such as noise. Therefore, the present invention proposes a cross-layer lightweight authentication method for satellite base stations based on identification. Summary of the invention

[0005] The purpose of the present invention is to provide a satellite base station cross-layer lightweight authentication method based on identification to address the identity deception problem in existing satellite communication links, thereby ensuring the identity recognition and secure access of satellite communication equipment, thereby ensuring the security of the satellite communication network environment.

[0006] To achieve the above object, the present invention provides the following solutions:

[0007] A satellite base station cross-layer lightweight authentication method based on identification, comprising:

[0008] The satellite base station and the user terminal register and obtain authentication information respectively;

[0009] The user terminal initiates an initial authentication request, and the satellite base station and the user terminal respectively perform initial identity authentication on each other based on the authentication information. If the authentication is successful, a session key is calculated to complete the initial two-way authentication and key negotiation;

[0010] The user terminal initiates a re-authentication request, and the satellite base station and the user terminal perform re-identification by extracting and identifying radio frequency fingerprints, thereby completing re-bidirectional authentication and key negotiation.

[0011] Optionally, the satellite base station and the user terminal respectively registering and obtaining authentication information includes:

[0012] The satellite ground network system adopts the SM9 identification cryptographic algorithm to assign IDs to the satellite base station and user terminal respectively, generate an authentication key pair, and obtain the authentication information by combining the authentication key pair and corresponding summary information, wherein the authentication key pair is calculated using the SM3 cryptographic hash algorithm.

[0013] Optionally, the authentication key pair of the satellite base station is:

[0014] Pr S = ;

[0015] q S =Hash ;

[0016] The authentication key pair of the user terminal is:

[0017] Pr U = ;

[0018] q U = Hash ;

[0019] Among them, (Pr S ,q S ) is the authentication key pair of the satellite base station, (Pr U ,q U ) is the authentication key pair of the user terminal, s is the encryption master private key of the satellite ground network system, P is the generator of the additive cyclic group, ID S The ID assigned by the satellite ground network system to the satellite base station. U The ID assigned to the user terminal by the satellite ground network system.

[0020] Optionally, the authentication information of the satellite base station includes N, ê, G, G1, s, P, P0, ID S , Pr S The authentication information of the user terminal includes N, ê, G, G1, P, P0, ID S , ID U , Pr U ,q S , where N is the prime order of the additive cyclic group and the multiplicative cyclic group, ê is a bilinear pairing, G is the additive cyclic group, G1 is the multiplicative cyclic group, s is the encryption master private key of the satellite ground network system, P is the generator of the additive cyclic group, P0 is the encryption master public key of the satellite ground network system, ID S ID assigned by the satellite ground network system to the satellite base station, Pr S The private key of the satellite base station authentication key pair, ID U ID assigned by the satellite ground network system to the user terminal, Pr U is the private key of the authentication key pair of the user terminal, q S It is the public key of the satellite base station's authentication key pair.

[0021] Optionally, the user terminal initiates an initial authentication request, the satellite base station and the user terminal respectively perform initial identity authentication on each other based on the authentication information, and if the authentication is successful, a session key is calculated, and completing the initial two-way authentication and key negotiation includes:

[0022] When the user terminal initiates the first authentication request, the user terminal generates a prime random number n U , and calculate the information (ψ U , σ U ), combined with the ID information, is sent to the satellite base station, where ψ U is a prime random number n U The random parameter value of the user terminal obtained by adding the cyclic group G, σ U is a prime random number n U and private key Pr U The obtained random key value of the user terminal;

[0023] After receiving the information, the satellite base station generates a prime random number n S , and calculate the information (ψ S , σ S ) is sent to the user terminal, where ψ S is a prime random number n S The satellite base station random parameter value obtained by adding the cyclic group G, σ S is a prime random number n S and private key Pr S The obtained satellite base station random key value;

[0024] The satellite base station according to the information (ψ U , σ U ) Verify whether the bilinear pairing meets the conditions. If the verification is qualified, calculate the session key SK S ;

[0025] The user terminal according to the information (ψ S , σ S ) Verify whether the bilinear pairing meets the conditions. If the verification is qualified, calculate the session key SK U .

[0026] Optionally, the information (ψ U , σ U ):

[0027] ψ U = n U ·P;

[0028] σ U = n U ·Pr U ;

[0029] The satellite base station according to the information (ψ U , σ U ) Verify that the bilinear pairing meets the conditions:

[0030] ê(σ U , P0+q U ·P) = ê(ψ U , P0);

[0031] Calculate the session key SK S :

[0032] SK S = Hash(ID S ‖ID U ‖ψ U ‖ψ S ‖X);

[0033] Among them, P is the generator of the additive cyclic group, Pr U The private key of the user terminal's authentication key pair, ê is a bilinear pairing, P0 is the encryption master public key of the satellite ground network system, q U is the public key of the authentication key pair of the user terminal, ID S The ID assigned by the satellite ground network system to the satellite base station. U is the ID assigned by the satellite ground network system to the user terminal, and X is a random number combined with a prime number n U and a prime random number n S and the random parameter value obtained by the additive cyclic group G, where X = n S ·ψ U .

[0034] Optionally, the information (ψ S , σ S ):

[0035] ψ S = n S ·P;

[0036] σ S = n S ·Pr S ;

[0037] The user terminal according to the information (ψ S , σ S ) Verify that the bilinear pairing meets the conditions:

[0038] ê(σ S , P0+q S ·P) = ê(ψS , P0);

[0039] Calculate the session key SK U :

[0040] SK U = Hash(ID S ‖ID U ‖ψ U ‖ψ S ‖X);

[0041] Among them, P is the generator of the additive cyclic group, Pr S is the private key of the satellite base station authentication key pair, ê is a bilinear pairing, P0 is the encryption master public key of the satellite ground network system, q S The public key of the satellite base station authentication key pair, ID S The ID assigned by the satellite ground network system to the satellite base station. U is the ID assigned by the satellite ground network system to the user terminal, and X is a random number combined with a prime number n U and a prime random number n S and the random parameter value obtained by the additive cyclic group G, where X = n U ·ψ S .

[0042] Optionally, the user terminal initiates a re-authentication request, the satellite base station and the user terminal perform re-authentication by extracting and identifying a radio frequency fingerprint, and completing re-bidirectional authentication and key negotiation includes:

[0043] When the user terminal initiates a re-authentication request, the user terminal sends the information (ψ U , σ U ) combined with ID information and sent to the satellite base station;

[0044] After receiving the information, the satellite base station checks the storage list. If the first authentication has been completed, the signal sent by the user terminal is subjected to feature extraction and recognition of the radio frequency fingerprint. If the recognition result is a legitimate device, the user terminal is authenticated and the session key SK is used. S , and simultaneously sends information to the user terminal (ψ S , σ S );

[0045] After receiving the information, the user terminal checks the storage list. If the first authentication has been completed, the signal sent by the satellite base station is subjected to feature extraction and recognition of the radio frequency fingerprint. If the recognition result is a legitimate device, the satellite base station is authenticated and the session key SK is used. U .

[0046] Optionally, feature extraction and identification of radio frequency fingerprint of the signal are performed by using bispectral analysis combined with convolutional autoencoder.

[0047] The beneficial effects of the present invention are:

[0048] The present invention uses the SM9 identification cryptographic algorithm in the registration stage and the first authentication stage, avoiding the use and management of digital certificates. No third party participation is required in the first authentication stage, reducing the authentication delay; and uses a device identity authentication method based on radio frequency fingerprint in the re-authentication stage to reduce repeated calculations and improve communication security. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0050] Figure 1 The present invention is a flowchart of a satellite base station cross-layer lightweight authentication method based on identification according to an embodiment of the present invention. DETAILED DESCRIPTION

[0051] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0052] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0053] This embodiment provides a satellite base station cross-layer lightweight authentication method based on identification, such as Figure 1 As shown, including:

[0054] The satellite base station and the user terminal register and obtain authentication information respectively;

[0055] The user terminal initiates an initial authentication request, and the satellite base station and the user terminal respectively perform initial identity authentication on each other based on the authentication information. If the authentication is successful, a session key is calculated to complete the initial two-way authentication and key negotiation;

[0056] The user terminal initiates a re-authentication request, and the satellite base station and the user terminal perform re-identification by extracting and identifying radio frequency fingerprints, thereby completing re-bidirectional authentication and key negotiation.

[0057] Specifically, this embodiment uses the SM9 identification cryptographic algorithm in the registration stage and the first authentication stage, avoiding the use and management of digital certificates. No third party participation is required in the first authentication stage, reducing the authentication delay; in the re-authentication stage, a device identity authentication method based on radio frequency fingerprint is used to reduce repeated calculations and improve communication security.

[0058] Furthermore, the satellite base station and the user terminal respectively register and obtain authentication information including:

[0059] The satellite ground network system adopts the SM9 identification cryptographic algorithm to assign IDs to the satellite base station and user terminal respectively, generate an authentication key pair, and obtain the authentication information by combining the authentication key pair and corresponding summary information, wherein the authentication key pair is calculated using the SM3 cryptographic hash algorithm.

[0060] Furthermore, the authentication key pair of the satellite base station is:

[0061] Pr S = ;

[0062] q S =Hash ;

[0063] The authentication key pair of the user terminal is:

[0064] Pr U = ;

[0065] q U = Hash ;

[0066] Among them, (Pr S ,q S ) is the authentication key pair of the satellite base station, (Pr U ,q U ) is the authentication key pair of the user terminal, s is the encryption master private key of the satellite ground network system, P is the generator of the additive cyclic group, ID S The ID assigned by the satellite ground network system to the satellite base station. U The ID assigned to the user terminal by the satellite ground network system.

[0067] Furthermore, the authentication information of the satellite base station includes N, ê, G, G1, s, P, P0, ID S , Pr SThe authentication information of the user terminal includes N, ê, G, G1, P, P0, ID S , ID U , Pr U ,q S , where N is the prime order of the additive cyclic group and the multiplicative cyclic group, ê is a bilinear pairing, G is the additive cyclic group, G1 is the multiplicative cyclic group, s is the encryption master private key of the satellite ground network system, P is the generator of the additive cyclic group, P0 is the encryption master public key of the satellite ground network system, ID S ID assigned by the satellite ground network system to the satellite base station, Pr S The private key of the satellite base station authentication key pair, ID U ID assigned by the satellite ground network system to the user terminal, Pr U is the private key of the authentication key pair of the user terminal, q S It is the public key of the satellite base station's authentication key pair.

[0068] Further, the user terminal initiates an initial authentication request, the satellite base station and the user terminal respectively perform initial identity authentication on each other based on the authentication information, and if the authentication is successful, a session key is calculated, and the initial two-way authentication and key negotiation are completed, including:

[0069] When the user terminal initiates the first authentication request, the user terminal generates a prime random number n U , and calculate the information (ψ U , σ U ), combined with the ID information, is sent to the satellite base station, where ψ U is a prime random number n U The random parameter value of the user terminal obtained by adding the cyclic group G, σ U is a prime random number n U and private key Pr U The obtained random key value of the user terminal;

[0070] After receiving the information, the satellite base station generates a prime random number n S , and calculate the information (ψ S , σ S ) is sent to the user terminal, where ψ S is a prime random number n S The satellite base station random parameter value obtained by adding the cyclic group G, σ S is a prime random number n S and private key Pr S The obtained satellite base station random key value;

[0071] The satellite base station according to the information (ψ U , σ U) Verify whether the bilinear pairing meets the conditions. If the verification is qualified, calculate the session key SK S ;

[0072] The user terminal according to the information (ψ S , σ S ) Verify whether the bilinear pairing meets the conditions. If the verification is qualified, calculate the session key SK U .

[0073] Further, the information (ψ U , σ U ):

[0074] ψ U = n U ·P;

[0075] σ U = n U ·Pr U ;

[0076] The satellite base station according to the information (ψ U , σ U ) Verify that the bilinear pairing meets the conditions:

[0077] ê(σ U , P0+q U ·P) = ê(ψ U , P0);

[0078] Calculate the session key SK S :

[0079] SK S = Hash(ID S ‖ID U ‖ψ U ‖ψ S ‖X);

[0080] Among them, P is the generator of the additive cyclic group, Pr U The private key of the user terminal's authentication key pair, ê is a bilinear pairing, P0 is the encryption master public key of the satellite ground network system, q U is the public key of the authentication key pair of the user terminal, ID S The ID assigned by the satellite ground network system to the satellite base station. U is the ID assigned by the satellite ground network system to the user terminal, and X is a random number combined with a prime number n U and a prime random number n S and the random parameter value obtained by the additive cyclic group G, where X = n S ·ψ U .

[0081] Further, the information (ψ S , σ S ):

[0082] ψ S = n S ·P;

[0083] σ S = n S ·Pr S ;

[0084] The user terminal according to the information (ψ S , σ S ) Verify that the bilinear pairing meets the conditions:

[0085] ê(σ S , P0+q S ·P) = ê(ψ S , P0);

[0086] Calculate the session key SK U :

[0087] SK U = Hash(ID S ‖ID U ‖ψ U ‖ψ S ‖X);

[0088] Among them, P is the generator of the additive cyclic group, Pr S is the private key of the satellite base station authentication key pair, ê is a bilinear pairing, P0 is the encryption master public key of the satellite ground network system, q S is the public key of the satellite base station authentication key pair, ID S The ID assigned by the satellite ground network system to the satellite base station. U is the ID assigned by the satellite ground network system to the user terminal, and X is a random number combined with a prime number n U and a prime random number n S and the random parameter value obtained by the additive cyclic group G, where X = n U ·ψ S .

[0089] Specifically, this embodiment proposes a satellite base station lightweight authentication method based on identification. The two parties to authentication use the SM9 identification cryptographic algorithm to avoid the use and management of digital certificates. The two parties to authentication complete the allocation of identity information and keys during the registration phase. No third party participation is required during the access authentication phase, thereby reducing authentication delay.

[0090] Further, the user terminal initiates a re-authentication request, and the satellite base station and the user terminal perform re-authentication by extracting and identifying a radio frequency fingerprint, and completing re-bidirectional authentication and key negotiation includes:

[0091] When the user terminal initiates a re-authentication request, the user terminal sends the information (ψ U , σ U ) combined with ID information and sent to the satellite base station;

[0092] After receiving the information, the satellite base station checks the storage list. If the first authentication has been completed, the signal sent by the user terminal is subjected to feature extraction and recognition of the radio frequency fingerprint. If the recognition result is a legitimate device, the user terminal is authenticated and the session key SK is used. S , and simultaneously sends information to the user terminal (ψ S , σ S );

[0093] After receiving the information, the user terminal checks the storage list. If the first authentication has been completed, the signal sent by the satellite base station is subjected to feature extraction and recognition of the radio frequency fingerprint. If the recognition result is a legitimate device, the satellite base station is authenticated and the session key SK is used. U .

[0094] Furthermore, the feature extraction and identification of the radio frequency fingerprint of the signal is completed by using bispectral analysis combined with convolutional autoencoder.

[0095] Specifically, this embodiment proposes to use a physical layer security authentication method in the re-authentication phase, that is, a device identity authentication method based on radio frequency fingerprint, which improves security. At the same time, it reduces repeated calculations, and confirms that the legitimate device uses the parameters of the first authentication, which reduces the calculation complexity.

[0096] The following is a detailed description of the three phases of a satellite base station cross-layer lightweight authentication method based on identification proposed in this embodiment, which are a registration phase, an initial authentication phase, and a re-authentication phase, as follows:

[0097] (1) Registration stage:

[0098] This stage involves user terminals, satellite base stations, satellite ground network systems, and private key generation centers. User terminals are terminals with specific satellite communication functions, including aircraft, vehicles, ships, and convenient handheld devices. Satellite base stations have limited computing and storage capabilities and are responsible for user access and data transmission. The satellite ground network system is responsible for identity registration and verification of user terminals and satellite base stations. The private key generation center is responsible for generating system parameters and issuing private keys to user terminals and satellite base stations.

[0099] In this phase, the user terminal and satellite base station registration are completed. The user terminal registers its identity with the satellite ground network system in an offline manner, obtains the identity information and the corresponding negotiated key provided by the satellite ground network system, and this information is stored in the authentication card and delivered to the registered user terminal in a secure manner, and the relevant information of the registered user is reserved in the satellite ground network system. The satellite base station also registers its identity with the satellite ground network system in an offline manner, and the identity information and negotiated key information are also stored in the satellite's authentication card, and the satellite's relevant information is reserved in the satellite ground network system.

[0100] Satellite base station registration process:

[0101] 1) The satellite ground network system uses the SM9 identification cryptographic algorithm, selects a 256-bit BN curve and an additive cyclic group G with an order of prime number N and a generator P, and a bilinear pairing ê and a multiplicative cyclic group G1 with an order of prime number N, where ê: G×G→G1, and uses a secure random number generator to generate the encrypted master private key s∈Z of the private key generation center * N and the encrypted master public key P0, where P0=s·P;

[0102] 2) The satellite ground network system assigns an ID to the satellite base station S and generate a pair of authentication key pairs for the satellite base station (Pr S ,q S ), private key Pr S and the public key q S It is calculated by the following formula, where Hash() selects the SM3 cryptographic hash algorithm:

[0103] Pr S = ;

[0104] q S =Hash .

[0105] 3) The satellite ground network system stores the authentication key pair and the corresponding summary information in the authentication card of the satellite base station. The specific information is N, ê, G, G1, s, P, P0, ID S , Pr S .

[0106] User terminal registration process:

[0107] 1) The satellite ground network system uses the same encryption algorithm and parameters as the satellite base station registration process;

[0108] 2) Satellite ground network system assigns ID to user terminal U and generate an authentication key pair (Pr U,q U ), private key Pr U and the public key q U It is calculated by the following formula, where Hash() selects the SM3 cryptographic hash algorithm:

[0109] Pr U = ;

[0110] q U = Hash .

[0111] 3) The satellite ground network system stores the authentication key pair and the corresponding summary information in the authentication card of the user terminal. The specific information includes N, ê, G, G1, P, P0, ID S , ID U , Pr U ,q S .

[0112] (2) Initial certification stage:

[0113] When the user terminal initiates access authentication to the satellite base station for the first time, the user terminal and the satellite base station complete two-way authentication and key negotiation through the following steps:

[0114] 1) The user terminal generates a prime random number n U ∈Z * N , ψ is calculated by the following formula U , σ U , and (ID U , ψ U , σ U ) is sent to the satellite base station:

[0115] ψ U = n U ·P;

[0116] σ U = n U ·Pr U .

[0117] 2) The satellite base station receives the information sent by the user terminal (ID U , ψ U , σ U ), by ID U Calculate its public key q U , generate a prime random number n S ∈Z * N , ψ is calculated by the following formula S , σ S , and (ψ S , σS ) is sent to the user terminal:

[0118] ψ S = n S ·P;

[0119] σ S = n S ·Pr S .

[0120] 3) Satellite base station according to (ψ U , σ U ) Verify that the bilinear pairing meets the conditions:

[0121] ê(σ U , P0+q U ·P) = ê(ψ U , P0);

[0122] If the verification is successful, the session key SK is calculated S :

[0123] SK S = Hash(ID S ‖ID U ‖ψ U ‖ψ S ‖X);

[0124] Where X = n S ·ψ U .

[0125] 4) The user terminal receives the information (ψ S , σ S ), verify whether the bilinear pairing meets the conditions:

[0126] ê(σ S , P0+q S ·P) = ê(ψ S , P0);

[0127] If the verification is successful, the session key SK is calculated U :

[0128] SK U = Hash(ID S ‖ID U ‖ψ U ‖ψ S ‖X);

[0129] Where X = n U ·ψ S .

[0130] Provable SK S = SK U , that is, the session keys are equal, then the key negotiation between the user terminal and the satellite base station is successful. Therefore, after the above steps, the user terminal and the satellite base station can complete the two-way authentication and key negotiation for the first access.

[0131] (3) Re-certification stage:

[0132] When the user terminal initiates a re-access authentication request to the satellite base station, the user terminal and the satellite base station complete the two-way authentication through the device identity authentication method based on RF fingerprint. Device identification based on RF fingerprint features can be divided into four steps: signal acquisition, preprocessing, feature extraction and fingerprint recognition:

[0133] 1) Signal acquisition: The transmitter sends the RF signal, and the receiver obtains the baseband signal through down-conversion sampling;

[0134] 2) Preprocessing: Preprocess the signal, including normalization, noise reduction, target signal interception and other operations;

[0135] 3) Feature extraction: Use bispectral analysis to extract signal features. Bispectral analysis has many advantages over time-frequency analysis, mainly: bispectral can simultaneously reflect the amplitude and phase information of the signal; like high-order cumulants, bispectral can theoretically completely suppress the interference of additive Gaussian noise. These advantages can play a better role in the identification of real legitimate signals and deceptive interference signals.

[0136] 4) Fingerprint recognition: Convolutional autoencoders are constructed to identify satellite RF fingerprints. With its flexible feature extraction capabilities, autoencoders are often used in anomaly detection, intrusion detection, text classification, fault analysis and other fields. As a typical unsupervised learning model, the autoencoder network can more comprehensively represent the main and secondary features of the RF signal through feature weighting and fusion, rather than blindly abandoning the secondary features. Convolutional neural networks can extract information from the hidden space of data, so the encoder and decoder networks constructed using convolutional neural networks will be better than traditional autoencoders, so convolutional autoencoders are produced. In the encoding process, the convolutional autoencoder uses a convolutional layer to extract the features of the input sample, and in the decoding process, the convolutional autoencoder uses a deconvolutional layer to try to restore the hidden feature vector to the original input sample. During training, the input signal sample is first normalized, and then the encoder is used to extract features to obtain a low-dimensional feature representation of the signal. Then the decoder reconstructs the low-dimensional feature representation to obtain a reconstructed sample, and the network is trained by reducing the error between the reconstructed sample and the original sample. During detection, the sample set to be detected is input into the trained convolutional autoencoder to obtain the reconstruction error of the sample to be detected, and whether the sample is an abnormal sample is determined based on the size of the reconstruction error.

[0137] During the re-authentication phase, the user terminal and satellite base station complete the authentication through the following steps:

[0138] 1) User terminal sends information (ID U , ψ U , σ U ) to the satellite base station;

[0139] 2) After receiving the message, the satellite base station checks the storage list. If the first authentication has been completed before, the signal sent by the user terminal is extracted and identified by radio frequency fingerprint. If the identification result is a legitimate device, the identity of the user terminal is authenticated and the session key SK negotiated during the first authentication is used. S , and send information to the user terminal at the same time (ψ S, σ S );

[0140] 3) After receiving the message, the user terminal checks the storage list. If the first authentication has been completed before, the signal sent by the satellite base station is extracted and identified by radio frequency fingerprint. If the identification result is a legitimate device, the identity of the satellite base station is authenticated and the session key SK negotiated during the first authentication is used. U .

[0141] After the above steps, the user terminal and the satellite base station can complete the two-way authentication and key negotiation for re-access.

[0142] The embodiments described above are only descriptions of the preferred embodiments of the present invention and are not intended to limit the scope of the present invention. Without departing from the design spirit of the present invention, various modifications and improvements made to the technical solutions of the present invention by ordinary technicians in this field should all fall within the protection scope determined by the claims of the present invention.

Claims

1. A satellite base station cross-layer lightweight authentication method based on identification, characterized in that: include: The satellite base station and the user terminal register and obtain authentication information respectively; The user terminal initiates an initial authentication request, and the satellite base station and the user terminal respectively perform initial identity authentication on each other based on the authentication information. If the authentication is successful, a session key is calculated to complete the initial two-way authentication and key negotiation; The user terminal initiates a re-authentication request, and the satellite base station and the user terminal perform re-identification by extracting and identifying radio frequency fingerprints, thereby completing re-bidirectional authentication and key negotiation.

2. The identification-based satellite base station cross-layer lightweight authentication method according to claim 1, characterized in that: The satellite base station and the user terminal respectively register and obtain authentication information including: The satellite ground network system adopts the SM9 identification cryptographic algorithm to assign IDs to the satellite base station and user terminal respectively, generate an authentication key pair, and obtain the authentication information by combining the authentication key pair and corresponding summary information, wherein the authentication key pair is calculated using the SM3 cryptographic hash algorithm.

3. The identification-based satellite base station cross-layer lightweight authentication method according to claim 2, characterized in that: The authentication key pair of the satellite base station is: Pr S = ； q S =Hash ; The authentication key pair of the user terminal is: Pr U = ； q U = Hash ; Among them, (Pr S ,q S ) is the satellite base station authentication key pair, (Pr U ,q U ) is the authentication key pair of the user terminal, s is the encryption master private key of the satellite ground network system, P is the generator of the additive cyclic group, ID S The ID assigned by the satellite ground network system to the satellite base station. U The ID assigned to the user terminal by the satellite ground network system.

4. The identification-based satellite base station cross-layer lightweight authentication method according to claim 2, characterized in that: The satellite base station authentication information includes N, ê, G, G1, s, P, P0, ID S , Pr S The authentication information of the user terminal includes N, ê, G, G1, P, P0, ID S , ID U , Pr U ,q S , where N is the prime order of the additive cyclic group and the multiplicative cyclic group, ê is a bilinear pairing, G is the additive cyclic group, G1 is the multiplicative cyclic group, s is the encryption master private key of the satellite ground network system, P is the generator of the additive cyclic group, P0 is the encryption master public key of the satellite ground network system, ID S ID assigned by the satellite ground network system to the satellite base station, Pr S The private key of the satellite base station authentication key pair, ID U ID assigned by the satellite ground network system to the user terminal, Pr U is the private key of the authentication key pair of the user terminal, q S It is the public key of the satellite base station's authentication key pair.

5. The satellite base station cross-layer lightweight authentication method based on identification according to claim 1, characterized in that: The user terminal initiates an initial authentication request, the satellite base station and the user terminal respectively perform initial identity authentication on each other based on the authentication information, and if the authentication is successful, a session key is calculated, and the initial two-way authentication and key negotiation are completed, including: When the user terminal initiates the first authentication request, the user terminal generates a prime random number n U , and calculate the information (ψ U , σ U ), combined with the ID information, is sent to the satellite base station, where ψ U is a prime random number n U The random parameter value of the user terminal obtained by adding the cyclic group G, σ U is a prime random number n U and private key Pr U The obtained random key value of the user terminal; After receiving the information, the satellite base station generates a prime random number n S , and calculate the information (ψ S , σ S ) is sent to the user terminal, where ψ S is a prime random number n S The satellite base station random parameter value obtained by adding the cyclic group G, σ S is a prime random number n S and private key Pr S The obtained satellite base station random key value; The satellite base station according to the information (ψ U , σ U ) Verify whether the bilinear pairing meets the conditions. If the verification is qualified, calculate the session key SK S ; The user terminal according to the information (ψ S , σ S ) Verify whether the bilinear pairing meets the conditions. If the verification is qualified, calculate the session key SK U .

6. The satellite base station cross-layer lightweight authentication method based on identification according to claim 5 is characterized in that: Calculate the information (ψ U , σ U ): ψ U = n U ·P; σ U = n U ·Pr U , The satellite base station according to the information (ψ U , σ U ) Verify that the bilinear pairing meets the conditions: ê(s U ,P0+q U ·P) = ê(ψ U ,P0); Calculate the session key SK S : SK S = Hash(ID S ‖ID U ‖ψ U ‖ψ S ‖X); Among them, P is the generator of the additive cyclic group, Pr U The private key of the user terminal's authentication key pair, ê is a bilinear pairing, P0 is the encryption master public key of the satellite ground network system, q U is the public key of the authentication key pair of the user terminal, ID S The ID assigned by the satellite ground network system to the satellite base station. U is the ID assigned by the satellite ground network system to the user terminal, and X is a random number combined with a prime number n U and a prime random number n S and the random parameter value obtained by the additive cyclic group G, where X = n S ·ψ U .

7. The identification-based satellite base station cross-layer lightweight authentication method according to claim 5, characterized in that: Calculate the information (ψ S , σ S ): ψ S = n S ·P; σ S = n S ·Pr S , The user terminal according to the information (ψ S , σ S ) Verify that the bilinear pairing meets the conditions: ê(s S ,P0+q S ·P) = ê(ψ S , P0); Calculate the session key SK U : SK U = Hash(ID S ‖ID U ‖ψ U ‖ψ S ‖X); Among them, P is the generator of the additive cyclic group, Pr S is the private key of the satellite base station authentication key pair, ê is a bilinear pairing, P0 is the encryption master public key of the satellite ground network system, q S The public key of the satellite base station authentication key pair, ID S The ID assigned by the satellite ground network system to the satellite base station. U is the ID assigned by the satellite ground network system to the user terminal, and X is a random number combined with a prime number n U and a prime random number n S and the random parameter value obtained by the additive cyclic group G, where X = n U ·ψ S .

8. The identification-based satellite base station cross-layer lightweight authentication method according to claim 5, characterized in that: The user terminal initiates a re-authentication request, the satellite base station and the user terminal perform re-authentication by extracting and identifying a radio frequency fingerprint, and completing re-bidirectional authentication and key negotiation, including: When the user terminal initiates a re-authentication request, the user terminal sends the information (ψ U , σ U ) combined with ID information and sent to the satellite base station; After receiving the information, the satellite base station checks the storage list. If the first authentication has been completed, the signal sent by the user terminal is subjected to feature extraction and recognition of the radio frequency fingerprint. If the recognition result is a legitimate device, the user terminal is authenticated and the session key SK is used. S , and simultaneously sends information to the user terminal (ψ S , σ S ); After receiving the information, the user terminal checks the storage list. If the first authentication has been completed, the signal sent by the satellite base station is subjected to feature extraction and recognition of the radio frequency fingerprint. If the recognition result is a legitimate device, the satellite base station is authenticated and the session key SK is used. U .

9. The identification-based satellite base station cross-layer lightweight authentication method according to claim 8, characterized in that: The feature extraction and identification of the radio frequency fingerprint of the signal are completed by using bispectral analysis combined with convolutional autoencoder.

Images