Real-time authentication message design and terminal authentication method of satellite navigation system

Abstract

The invention relates to a real-time authentication message design and terminal authentication method of a satellite navigation system. According to the method, a real-time authentication data packet structure is set, the data packet is composed of slow authentication data and fast authentication data, the slow authentication executes first key authentication, and the fast authentication realizes telegraph text authentication. The message digest of the message information is additionally broadcasted in each authentication period, the message belongs to the fast authentication period where the key is broadcasted in a delayed mode, real-time message authentication is achieved at the cost of message overhead, and the requirement of a navigation user for real-time authentication under the scenes of an unmanned aerial vehicle, an unmanned vehicle and the like is met.

Description

Technical Field

[0001] The present invention relates to the technical field of satellite navigation signal authentication, and in particular to a real-time authentication telegram design and a terminal authentication method for a satellite navigation system. Background Art

[0002] Since the civil satellite navigation signal system is open, it is easy for the cheater to carry out generative cheating, which greatly threatens the security of civil navigation signals and thus affects the credibility of navigation positioning results. In order to improve the security of signals, experts and scholars are committed to studying signal authentication technology, which broadcasts unpredictable authentication information on signal features. The receiver extracts the authentication information and determines the source of the signal based on the existence and validity of the authentication information. Since this technology is system-oriented, it generates authentication information based on cryptographic algorithms and makes certain modifications to the original signal system, so its implementation cost is relatively high. Carrying authentication information in the message is the authentication method with the lowest overhead and backward compatibility among all authentication methods. Therefore, this method was first applied to the E1 signal of the Galileo navigation system to provide Open Service Navigation Message Authentication (OSNMA). This scheme adopts the Timed Efficient Stream Loss-tolerant Authentication (TESLA) protocol. By broadcasting the ciphertext first and then delaying the broadcast of the symmetric key, the symmetric encryption algorithm shows the effect of public key encryption, thereby solving the problem of symmetric key distribution in one-way broadcast scenarios such as satellite navigation, while avoiding the use of public key encryption algorithms with high computational complexity. However, this protocol also brings some problems. The delayed broadcast of the symmetric key causes the verification of the ciphertext to be carried out with a lag, which cannot meet the user's demand for real-time authentication in some application scenarios, such as drones, unmanned vehicles, financial transactions and other application scenarios.

[0003] At present, the academic community is more concerned about how to design an authentication signal model to improve the authentication efficiency and security of the authentication method while reducing the implementation overhead, and pays less attention to the real-time performance of the authentication. In engineering, more attention is paid to the robustness and feasibility of the authentication method, and insufficient attention is paid to real-time authentication. Therefore, this application provides a solution. Summary of the invention

[0004] In view of the above technical problems and background, it is necessary to provide a real-time authentication message design and terminal authentication method for a satellite navigation system that can realize real-time authentication and solve the authentication lag problem in navigation message authentication technology.

[0005] A real-time authentication message design and terminal authentication method for a satellite navigation system, the method comprising: A real-time authentication data packet structure is set; the real-time authentication data packet is composed of a slow authentication data packet and a fast authentication data packet; the slow authentication data packet performs the first key authentication, and the fast authentication data packet implements the telegram authentication; the fast authentication data packet is composed of the message digest and digital signature fragment of the telegram information of the key, telegram, delayed broadcast key period, and message authentication code; the digital signature fragments in multiple fast authentication data packets are combined into a complete digital signature as full authentication data, which is used to verify the validity of the generated root key and establish a trust basis; A key chain including multiple keys is obtained by using a generated root key and calculating through a one-way function. Since different keys obey the mathematical relationship of a one-way function, the validity of the generated root key only needs to be verified once, and the validity of other keys can be verified through a one-way function. The message digest is generated through a one-way function using the telegram information of the period in which the delayed broadcast key is located, and is broadcast in advance together with the telegram information and message authentication code to which the key is applied. The message authentication code is calculated using the key pair data consisting of the telegram and the message digest. The digital signature of the generated root key is calculated. The received signal is obtained by using the RF front end; after analog-to-digital conversion of the received signal, the relevant steps are executed and the obtained telegram symbols are decoded, and the telegram data is stored until the key information and digital signature of a slow authentication cycle are collected; The public key is used to operate the digital signature to obtain the message digest of the key information, and the received key information is used to generate the message digest using a one-way function. The two are compared. If they are equal, the key is valid and the verified key is saved; if they are not equal, the key is invalid and the authentication fails. When the digital signature verification is passed or the receiver is in the hot start state, the authenticated key information is saved, and the receiver continues to complete the fast authentication and verify the validity of the message; the arrangement order of the information in the fast authentication cycle data packet is key, message, message digest and message authentication code, and the one-to-one mapping relationship between the message digest and the information is used. A fast authentication verifies the information of two fast authentication cycles at the same time, and realizes real-time message authentication. The real-time authentication message design and terminal authentication method of the above-mentioned satellite navigation system, this application constructs a hierarchical real-time authentication data packet structure to enable the terminal to realize the authentication function in stages, and the slow authentication cycle data packet generates the validity of the root key through digital signature protection. As the first authentication of the receiver, the slow authentication is used to establish the trust basis for the terminal message authentication; wherein the nested multiple fast authentication cycle data packets are arranged in the order of key, message, message digest, message authentication code and other information, and the one-to-one mapping relationship between the message digest and the information is used to realize the function of verifying the information of two fast authentication cycles at the same time in one fast authentication, and build an efficient architecture for real-time authentication. Among them, the authentication information is generated by a cryptographic algorithm, and the security of the cryptographic algorithm in mathematical theory is used to ensure the security of the authentication information. It can be seen that the authentication information generation system is rigorous. The root key is generated by using a one-way function to generate a key chain, so that the receiver only needs to perform a slow cycle authentication to verify the validity of the key. When verifying the key later, it only needs to calculate the verified key through the key chain. The validity of the current key can be verified by comparing the calculated key with the verified key, thereby shortening the key verification time. The message digest of the telegram information of the authentication cycle where the delayed broadcast key is located is generated through a one-way function, and the message authentication code is obtained by encrypting the combined data of the telegram and the message digest with the key, so that the receiving terminal can verify the telegrams of two fast authentication cycles at a time. The one-way nature of the one-way function protects the telegrams of the period where the delayed key is located from being leaked. The telegrams of the period where the delayed broadcast key is located can be compared with the verified valid message digest through a one-way function to verify the validity of the information, thereby achieving real-time authentication at the cost of a small telegram overhead. BRIEF DESCRIPTION OF THE DRAWINGS

[0006] Figure 1 A TESLA protocol data packet structure in one embodiment; Figure 2 A real-time authentication data packet structure in one embodiment; Figure 3 A schematic diagram of key chain generation and use in one embodiment; Figure 4 It is a block diagram of a slow authentication terminal receiving method for satellite navigation real-time electronic message authentication in another embodiment; Figure 5 A block diagram of a fast authentication terminal receiving method for implementing electronic message authentication in a satellite navigation system in one embodiment; Figure 6A diagram showing a B-CNAV2 frame structure in one embodiment; Figure 7 FIG. 5 is a diagram showing the format of a B-CNAV2 information type 50 in one embodiment; Figure 8 FIG. 5 is a diagram showing the format of B-CNAV2 information type 51 in one embodiment; Fig. 9 FIG. 1 is a diagram of the B2a message authentication cycle and information broadcasting sequence in an embodiment. DETAILED DESCRIPTION

[0007] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0008] In one embodiment, a real-time authentication message design and terminal authentication method for a satellite navigation system are provided, comprising the following steps: A real-time authentication data packet structure is set; the real-time authentication data packet is composed of a slow authentication data packet and a fast authentication data packet; the slow authentication data packet performs the first key authentication, and the fast authentication data packet implements the telegram authentication; the fast authentication data packet is composed of the message digest and digital signature fragment of the telegram information of the key, telegram, delayed broadcast key period, and message authentication code; the digital signature fragments in multiple fast authentication data packets are combined into a complete digital signature as full authentication data, which is used to verify the validity of the generated root key and establish a trust basis; A key chain including multiple keys is obtained by using a generated root key and calculating through a one-way function. Since different keys obey the mathematical relationship of a one-way function, the validity of the generated root key only needs to be verified once, and the validity of other keys can be verified through a one-way function. The message digest is generated through a one-way function using the telegram information of the period in which the delayed broadcast key is located, and is broadcast in advance together with the telegram information and message authentication code to which the key is applied. The message authentication code is calculated using the key pair data consisting of the telegram and the message digest. The digital signature of the generated root key is calculated. The received signal is obtained by using the RF front end; after analog-to-digital conversion of the received signal, the relevant steps are executed and the obtained telegram symbols are decoded, and the telegram data is stored until the key information and digital signature of a slow authentication cycle are collected; The public key is used to operate the digital signature to obtain the message digest of the key information, and the received key information is used to generate the message digest using a one-way function. The two are compared. If they are equal, the key is valid and the verified key is saved; if they are not equal, the key is invalid and the authentication fails. When the digital signature is verified or the receiver is in the hot start state, the authenticated key information is saved, and the receiver continues to complete the fast authentication to verify the validity of the message; the information in the fast authentication cycle data packet is arranged in the order of key, message, message digest and message authentication code. By using the one-to-one mapping relationship between the message digest and the information, a fast authentication verifies the information of two fast authentication cycles at the same time, realizing real-time message authentication. In a specific embodiment, this application is based on the original TESLA data packet (such as Figure 1 ) is modified and rearranged into slow authentication data packets and fast authentication data packets. The slow authentication cycle uses digital signatures to protect the validity of the key, performs the first key authentication, and realizes the time synchronization of the receiver. The fast authentication cycle uses message authentication code (MAC) to prevent the message from being tampered with and realizes the message authentication. The specific modifications are summarized as follows: 1. The MAC of each authentication cycle protects both the message information of the current cycle and the message information of the cycle in which the delayed broadcast key is located; 2. The slow authentication cycle contains multiple fast authentication cycles, and the digital signature is distributed to each fast authentication cycle data packet for broadcast; 3. This application advances the broadcast position of the key in each authentication cycle, so that the receiver can verify the message digest of each authentication cycle before the message is fully broadcast. Due to the consistency of the message digest and the message information, the validity of the two is also consistent. At the same time, the one-way characteristic of the hash function protects the security of the message information.

[0009] The detailed data packet structure of this application is as follows Figure 2 The digital signature of the slow authentication cycle is generated for the key of the fast authentication cycle within the cycle. A slow authentication cycle includes M Fast authentication cycle data packets, so the digital signature DS is divided into M 1st j The data packet of an authentication cycle consists of four parts: key , Telegram , No. ( j + n ) message digest of the authentication cycle message information , using key right and The message authentication code MAC calculated from the composed data j ,in i Indicates that the key is the first i indivual, n Indicates that the MAC of the current authentication cycle is delayed by n The key broadcast after the authentication cycle K i-n generate.

[0010] Based on the principle of message digest validity, the message digest is generated through a one-way function using the message information of the authentication period, which is equivalent to creating a unique "digital fingerprint" for each message. Since the message digest has a fixed length and can accurately reflect the key characteristics of the message, the message information and the message digest have a one-to-one relationship. When the message digest of a piece of information is verified to be valid data, the corresponding message data is also valid.

[0011] At the same time, based on the TESLA protocol data packet structure, it is optimized and key elements such as message digests are incorporated to build a real-time fast authentication cycle data packet. After receiving the data packet and verifying the validity of the key, the receiving end uses the currently broadcasted key to verify the validity of the telegram data of the past fast authentication cycle and the validity of the message digest of the current cycle telegram through a fast authentication. There is no need to wait for the generation of the authentication code and key corresponding to the message of the current cycle, thus achieving real-time authentication of the telegram.

[0012] In one embodiment, Figure 4 and Figure 5 When the receiver is in cold start state, the receiver needs to complete the initial authentication first to verify the validity of the key. The steps are as follows: S1. The RF front end performs analog-to-digital conversion on the received signal, and then the receiver performs capture, tracking, message demodulation and other steps, and decodes the resulting message symbols; S2. Store the message data until the key information and digital signature information of a slow authentication cycle are collected; S3. Use the public key to operate the digital signature to obtain the message digest of the key information, use the one-way function to generate the message digest of the received key information, and compare the two. If they are equal, the key is valid and the verified key is saved; if the two are not equal, the key is invalid and the authentication fails.

[0013] In one embodiment, when the digital signature is verified or the receiver is in a hot start state, the authenticated key information is saved, and the receiver can continue to implement fast authentication. j Take a quick authentication cycle as an example, the quick authentication steps are as follows: F1. In the hot start state, the receiver RF front end performs analog-to-digital conversion on the received signal, and then performs capture, tracking, telegram demodulation and other steps to decode the obtained telegram symbols. If the receiver completes the initial authentication and the signal is in the locked state, there is no need to recapture the signal, and it can continue to track and perform the telegram demodulation and decoding process; F2. Store the telegram data. j During a fast authentication cycle, the receiver stores the message information ( D j , MAC j ); F3. Key validity verification. j+n ) fast authentication cycle, receive the key K i-n And verify the validity of the key by K i-n Perform multiple one-way operations and compare the calculated key value with the fast authentication key verified by the slow authentication cycle. If the two are equal, it means K i-n If the key is valid, the authentication fails. The number of single function operations depends on the valid key stored in the receiver and the serial number of the received key in the key chain; F4.MAC verification. K i-n Effective, will D j and K i-n Substitute the MAC generation function for calculation and compare the calculation result with the stored MAC j Compare them. If the two are equal, the MAC verification is successful, indicating that D j If the message digest is valid, the message has not been tampered with. Otherwise, the MAC verification fails and the authentication fails. F5.Hash verification. When MAC verification succeeds, the receiver continues to receive the first ( j+n ) authentication cycle message information M j+n , substitute this value into the one-way function to calculate its message digest, and then compare it with the value stored by the receiver D j Hash j Compare them. If they are equal, it means the message information M j+n Valid, authentication successful, otherwise M j+n Invalid, authentication failed, achieving the effect of verifying the message as it is received.

[0014] The real-time authentication message design and terminal authentication method of the above-mentioned satellite navigation system, this application constructs a hierarchical real-time authentication data packet structure to enable the terminal to implement the authentication function in stages, and the slow authentication cycle data packet is protected by a digital signature to generate the validity of the root key. As the first authentication of the receiver, the slow authentication is used to establish a trust basis for terminal message authentication; the nested multiple fast authentication cycle data packets arrange the order of information such as keys, messages, message digests, message authentication codes, and use the one-to-one mapping relationship between message digests and information to achieve a fast authentication and verify the information of two fast authentication cycles at the same time, and build an efficient architecture for real-time authentication. Among them, a cryptographic algorithm is used to generate authentication information, and the mathematical security of the cryptographic algorithm is used to ensure the security of the authentication information. It can be seen that the authentication information generation system is rigorous. The root key is generated by using a one-way function to generate a key chain, so that the receiver only needs to perform a slow cycle authentication to verify the validity of the key. When verifying the key later, it only needs to calculate the verified key through the key chain. The validity of the current key can be verified by comparing the calculated key with the verified key, thereby shortening the key verification time. The message digest of the telegram information of the authentication cycle where the delayed broadcast key is located is generated through a one-way function, and the message authentication code is obtained by encrypting the combined data of the telegram and the message digest with the key, so that the receiving terminal can verify the telegrams of two fast authentication cycles at a time. The one-way nature of the one-way function protects the telegrams of the period where the delayed key is located from being leaked. The telegrams of the period where the delayed broadcast key is located can be compared with the verified valid message digest through a one-way function to verify the validity of the information, thereby achieving real-time authentication at the cost of a small telegram overhead.

[0015] In one embodiment, the key used to calculate the MAC in each authentication cycle comes from the key chain, such as Figure 3 The entire key chain is generated by a root key through multiple one-way function calculations, and the end point of these calculations is used as the authentication root key. The key chain of the key chain is recorded as , the authentication root key is recorded as , then the chain number is Key It can be calculated by the following methods, including: ; in, is the low-order truncation function. represents a monotonic function, The chain number is The key of is the key length. Figure 3 As shown in the figure, the key chain generation order is opposite to the key application order. During the application process, the satellite starts with the authentication root key and publishes the key in sequence until , generate the root key Not public.

[0016] In one embodiment, the message digest is generated by using the electronic message information of the period in which the delayed broadcast key is located through a one-way function, including: Using the i + n ) authentication cycle’s message information is generated through a one-way function j The message digest of the authentication cycle is ; in, Indicates the length of the Hash.

[0017] In one embodiment, the message authentication code is calculated using a key pair data consisting of a message and a message digest, including: The key is used to calculate the data consisting of the message and the message digest to obtain the j The message authentication code for the authentication cycle is ; in, Indicates the length of the MAC. For delay n The key broadcasted in each authentication cycle, , the symbol || represents the information connector.

[0018] In one embodiment, calculating and generating a digital signature of a root key includes: Key To the key Calculate the digital signature, the calculation expression is as follows: ; in, Represents the digital signature algorithm, Indicates the length of the digital signature. Represents the satellite private key.

[0019] In one embodiment, the process of verifying the validity of the key includes: Key K i-n Perform multiple one-way operations and compare the calculated key value with the fast authentication key verified by the slow authentication cycle. If the two are equal, it means K i-n If the key is valid, the authentication fails. The number of single function operations depends on the valid key stored in the receiver and the serial number of the received key in the key chain.

[0020] In a specific embodiment, the Beidou civil navigation signal B2a message structure is taken as an example. The signal adopts the B-CNAV2 navigation message structure, and its frame structure is as follows: Figure 6 As shown, each information type consists of 6 bits PRN, 6 bits MesType, 18 bits SOW, 234 bits of telegram data and 24 bits CRC, of ​​which 234 bits of telegram data are used to carry telegram information of different information types. A maximum of 63 page types can be defined. Currently, 8 valid information types are defined, namely 10, 11, 30, 31, 32, 33, 34, and 40. In order to realize real-time telegram authentication in B2a signals, two information types 50 and 51 are added. According to the data format of the present invention, a telegram authentication model combining fast authentication and slow authentication is designed. Slow authentication refers to the initial authentication of the receiver, which determines the validity of the key by verifying the legitimacy of the digital signature, and its period is 150 s; fast authentication refers to the completion of a slow authentication, in which the receiver verifies the legitimacy of the MAC to determine whether the telegram has been tampered with, and its period is 30 s. The arrangement format of the two data types is as follows Figure 7 and Figure 8 , this scheme uses commercial cryptographic algorithms to generate message digests and MACs, so , each frame is filled with 128 bits, and the length of the digital signature is , each frame is filled with 52 bits. In order to achieve the same security level as the Galileo public service message authentication, , CI represents the necessary information for message authentication. The CI data of a slow authentication cycle is 65 bits in total, and the reserved bit Rev is 6 bits long. The relationship between the fast authentication cycle and the slow authentication cycle is as follows: Fig. 9 As shown, the broadcasting order of the two newly defined page types and the existing page types is 5X, 10, 11, 3X, 40. It has been verified that after the initial authentication, the receiver verifies the validity of the key, and the fast authentication cycle can realize real-time message authentication.

[0021] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0022] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention. It should be pointed out that, for a person of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A real-time authentication message design and terminal authentication method for a satellite navigation system, characterized in that: The method comprises: Setting a real-time authentication data packet structure; the real-time authentication data packet is composed of a slow authentication data packet and a fast authentication data packet; wherein the slow authentication data packet performs the first key authentication, and the fast authentication data packet implements the telegram authentication; A fast authentication data packet is formed according to the key, the message, the message digest of the message information of the delayed key broadcast period, the digital signature fragment, and the message authentication code; wherein the digital signature fragments in multiple fast authentication data packets are combined into a complete digital signature; A key chain including multiple keys is obtained by using a generated root key and calculating through a one-way function. A message digest is generated through a one-way function using the telegram information of the period in which the delayed broadcast key is located, and is broadcast in advance together with the telegram information and message authentication code of the delayed broadcast key application; a message authentication code is calculated using the key pair data consisting of the telegram and the message digest; a digital signature of the generated root key is calculated; a received signal is obtained using a radio frequency front end; the received signal is converted into digital form and then the related steps are executed and the obtained telegram symbols are decoded, and the telegram data is stored until the key information and digital signature of a slow authentication period are collected; The public key is used to operate the digital signature to obtain the message digest of the key information, and the received key information is used to generate the message digest using a one-way function. The two are compared. If they are equal, the key is valid and the verified key is saved; if they are not equal, the key is invalid and the authentication fails. When the digital signature verification is passed or the receiver is in hot start state, the authenticated key information is saved, and the receiver continues to complete the fast authentication to verify the validity of the message; the information in the fast authentication cycle data packet is arranged in the order of key, message, message digest and message authentication code. By using the one-to-one mapping relationship between the message digest and the information, one fast authentication verifies the information of two fast authentication cycles at the same time, realizing real-time message authentication.

2. The method according to claim 1, characterized in that: The fast authentication process includes: F1: In the hot start state, the receiver RF front end performs analog-to-digital conversion on the received signal, and then executes the relevant steps to decode the obtained telegram symbols. If the receiver completes the initial authentication and the signal is in the locked state, there is no need to recapture the signal, and it only needs to continue tracking and executing the telegram demodulation and decoding process; F2: j During a fast authentication cycle, the receiver stores the message information ( D j , MAC j ),in, , the symbol || represents the information connector, Indicates j The message information of the authentication cycle, Hash j Indicates j The message digest of a fast authentication cycle, MAC j Indicates j A message authentication code with a fast authentication cycle; F3: In the ( j+n ) fast authentication cycle, receive the key K i-n And verify the validity of the key; F4: When K i-n Effective, will D j and K i-n Substitute the MAC generation function for calculation and compare the calculation result with the stored MAC j Compare them. If the two are equal, the MAC verification is successful, indicating that D j If the message digest is valid, the message has not been tampered with. Otherwise, the MAC verification fails and the authentication fails. F5: When MAC verification succeeds, the receiver continues to receive the first j+n ) authentication cycle message information M j+n , substitute this value into the one-way function to calculate its message digest, and then compare it with the value stored by the receiver D j Hash j Compare them. If they are equal, it means the message information M j+n Valid, authentication successful, otherwise M j+n Invalid, authentication failed.

3. The method according to claim 1, characterized in that The key chain including multiple keys is obtained by using the generated root key and calculating through a one-way function, including: in, is the low-order truncation function. represents a monotonic function, The chain number is The key of is the key length.

4. The method according to claim 1, characterized in that: The message digest is generated by using the telegram information of the period in which the delayed key is broadcast through a one-way function, including: Use delayed broadcast key location ( i + n ) authentication cycle’s message information is generated through a one-way function j The message digest of the authentication cycle is in, Indicates the length of the Hash.

5. The method according to any one of claims 1 to 4, characterized in that: The message authentication code is calculated using the key pair data consisting of the message and the message digest, including: The key is used to calculate the data consisting of the message and the message digest to obtain the j The message authentication code for the authentication cycle is in, Indicates the length of the MAC. For delay n The key broadcasted in the authentication cycle, , the symbol || represents the information connector.

6. The method according to claim 1, characterized in that Calculate and generate the digital signature of the root key, including: Key Calculate the digital signature, the calculation expression is as follows: in, Represents the digital signature algorithm, Indicates the length of the digital signature. Represents the satellite private key.

7. The method according to claim 1, characterized in that The process of verifying the validity of a key includes: Key K i-n Perform multiple one-way operations and compare the calculated key value with the fast authentication key verified by the slow authentication cycle. If the two are equal, it means K i-n If the key is valid, the authentication fails. The number of single function operations depends on the valid key stored in the receiver and the serial number of the received key in the key chain.

Images