Information encryption method, core network, equipment, satellite, storage medium and computer program product

Abstract

The embodiment of the invention discloses an information encryption method, a core network, equipment, a satellite, a storage medium and a computer program product, and the information encryption method comprises the steps that the core network and relay equipment are aligned through a free space, and a first shared key is generated; receiving a second shared key sent by the relay device; determining a third shared key according to the second shared key and the first shared key; executing an encryption transmission process of information with the base station in the satellite by using the third shared key; the base station is provided with a third shared key; the third shared key in the base station is a key generated by aligning the satellite and the relay device through a free space. According to the invention, the security during information transmission can be improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to an information encryption method and a core network, equipment, satellite, storage medium, and computer program product. Background Art

[0002] In the related art, a base station is set on the ground, and a user equipment (UE) accesses a core network through the base station, wherein the user equipment (UE) and the base station negotiate a security protection key between the UE and the base station through the AS SMC to achieve secure transmission of information between the UE and the base station; information is transmitted between the base station and the core network through optical fiber, that is, there is no air interface between the base station and the core network. If the base station is set on a satellite, the base station and the core network can communicate through wireless transmission. In this way, there is an air interface between the base station and the core network, and air interface security protection is required. Since there is no air interface protection method between the base station and the core network in the related art, the security of information transmission is reduced. Summary of the invention

[0003] In order to solve the above technical problems, the embodiments of the present application hope to provide an information encryption method and a core network, equipment, satellite, storage medium, and computer program product that can improve the security of information transmission.

[0004] The technical solution of this application is implemented as follows:

[0005] The present application provides an information encryption method, which is applied to a core network. The information encryption method includes:

[0006] Aligning with the relay device through free space to generate a first shared key;

[0007] Receiving a second shared key sent by the relay device;

[0008] Determine a third shared key according to the second shared key and the first shared key;

[0009] The third shared key is used to perform an encrypted transmission process of information with a base station in the satellite; the base station is provided with the third shared key; the third shared key in the base station is a key generated by aligning the satellite and the relay device through free space.

[0010] The present application also provides an information encryption method, which is applied to a relay device. The information encryption method includes:

[0011] aligning with the satellite through free space to generate a third shared key;

[0012] Aligning with the core network through free space to generate a first shared key;

[0013] Determine a second shared key according to the third shared key and the first shared key;

[0014] Sending the second shared key to the core network; allowing the core network to determine the third shared key based on the second shared key and the first shared key; and using the third shared key to perform an encrypted transmission process of information between the core network and the base station in the satellite.

[0015] The embodiment of the present application also provides an information encryption method, which is applied to a satellite. The information encryption method includes:

[0016] aligning with the relay device through free space to generate a third shared key;

[0017] The third shared key is transmitted to the base station, so that the base station uses the third shared key to perform an encryption transmission process of information with the core network.

[0018] The present application provides a core network, wherein the core network includes:

[0019] A first generating unit, configured to align with the relay device through free space to generate a first shared key;

[0020] A receiving unit, configured to receive a second shared key sent by the relay device;

[0021] A first determining unit, configured to determine a third shared key according to the second shared key and the first shared key;

[0022] An execution unit is used to use the third shared key to execute the encrypted transmission process of information between the satellite and the base station; the base station is provided with the third shared key; the third shared key in the base station is a key generated by aligning the satellite and the relay device through free space

[0023] An embodiment of the present application provides a relay device, the relay device comprising:

[0024] The second generating unit is used to align with the satellite through free space to generate a third shared key; align with the core network through free space to generate a first shared key;

[0025] A second determining unit, configured to determine a second shared key according to the third shared key and the first shared key;

[0026] The first sending unit is used to send the second shared key to the core network; so that the core network can determine the third shared key according to the second shared key and the first shared key; and use the third shared key to perform an encrypted transmission process of information between the core network and the base station in the satellite.

[0027] An embodiment of the present application provides a satellite, the satellite comprising:

[0028] A third generating unit, configured to align with the relay device through free space to generate a third shared key;

[0029] The transmission unit is used to transmit the third shared key to the base station, so that the base station uses the third shared key to perform an encrypted transmission process of information with the core network.

[0030] The present application provides a core network, wherein the core network includes:

[0031] A first memory, a first processor and a first communication bus, wherein the first memory communicates with the first processor via the first communication bus, the first memory stores an information encryption program executable by the first processor, and when the information encryption program is executed, the above-mentioned information encryption method applied in the core network is executed by the first processor.

[0032] An embodiment of the present application provides a relay device, the relay device comprising:

[0033] A second memory, a second processor and a second communication bus, wherein the second memory communicates with the second processor via the second communication bus, and the second memory stores an information encryption program executable by the second processor. When the information encryption program is executed, the information encryption method applied to the relay device described above is executed by the second processor.

[0034] An embodiment of the present application provides a base station, the base station comprising:

[0035] A third memory, a third processor and a third communication bus, wherein the third memory communicates with the third processor via the third communication bus, and the third memory stores an information encryption program executable by the third processor. When the information encryption program is executed, the information encryption method applied in the base station described above is executed by the third processor.

[0036] An embodiment of the present application provides a storage medium having a computer program stored thereon, which is applied to a core network, a relay device and a satellite, and is characterized in that when the computer program is executed by a first processor, it implements the above-mentioned information encryption method applied to the core network; when the computer program is executed by a second processor, it implements the above-mentioned information encryption method applied to the relay device; when the computer program is executed by a third processor, it implements the above-mentioned information encryption method applied to the base station.

[0037] An embodiment of the present application also provides a computer program product, including a computer program, which can be executed by a first processor in a core network to complete the steps of the aforementioned information encryption method applied in the core network; the computer program can be executed by a second processor in a relay device to complete the steps of the aforementioned information encryption method applied in the relay device; the computer program can be executed by a third processor in a base station to complete the steps of the aforementioned information encryption method applied in the base station.

[0038] The embodiment of the present application provides an information encryption method and a core network, a device, a satellite, a storage medium, and a computer program product. The information encryption method includes: aligning the core network and the relay device through free space to generate a first shared key; receiving the second shared key sent by the relay device; determining the third shared key according to the second shared key and the first shared key; using the third shared key to realize the encrypted transmission process of information between the base station in the satellite; the base station is provided with a third shared key; the third shared key in the base station is a key generated by aligning the satellite and the relay device through free space. Using the above method implementation scheme, the core network generates the first shared key by calibrating with the relay device in free space, and receives the second shared key sent by the relay device, thereby determining the third shared key according to the second shared key and the first shared key, and the base station also obtains the third shared key generated by the satellite and the relay device through free space alignment from the satellite, so that the base station and the core network can perform encrypted communication through the third shared key, thereby improving the security of communication between the base station and the core network, that is, improving the security of information transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 A schematic diagram of an AS SMC process in the prior art provided in an embodiment of the present application;

[0040] Figure 2 A schematic diagram of an initial exchange process of IKEV2 in the prior art provided in an embodiment of the present application;

[0041] Figure 3 A schematic diagram of a scenario in which a base station is set on a satellite in the prior art provided in an embodiment of the present application;

[0042] Figure 4 A schematic diagram of a lack of protection between a base station and a security gateway in the prior art provided in an embodiment of the present application;

[0043] Figure 5 A method for encrypting information provided in this application embodiment Figure 1 ;

[0044] Figure 6 An exemplary quantum key distribution schematic diagram provided for an embodiment of the present application;

[0045] Figure 7 An exemplary IPSEC quantum key encryption process diagram provided in the embodiment of the present application Figure 1 ;

[0046] Figure 8 An exemplary IPSEC quantum key encryption process diagram provided in the embodiment of the present application Figure 2 ;

[0047] Fig. 9 An exemplary IPSEC quantum key encryption process diagram provided in the embodiment of the present application Figure 3 ;

[0048] Fig.10 A method for encrypting information provided in this application embodiment Figure 2 ;

[0049] Fig.11 A method for encrypting information provided in this application embodiment Figure 3 ;

[0050] Fig.12 A schematic diagram of the structure of a core network provided in an embodiment of the present application Figure 1 ;

[0051] Fig.13 A schematic diagram of the structure of a core network provided in an embodiment of the present application Figure 2 ;

[0052] Fig.14 A schematic diagram of the structure of a relay device provided in an embodiment of the present application Figure 1 ;

[0053] Fig.15 A schematic diagram of the structure of a relay device provided in an embodiment of the present application Figure 2 ;

[0054] Fig.16 A schematic diagram of the structure of a satellite provided in an embodiment of the present application Figure 1 ;

[0055] Fig.17 A schematic diagram of the structure of a satellite provided in an embodiment of the present application Figure 2 . DETAILED DESCRIPTION

[0056] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. It should be understood that the specific embodiments described here are only used to explain the present application and are not used to limit the present application.

[0057] In related technologies, 5G negotiates security protection between UE and base station through AS SMC. The specific AS SMC process is as follows: Figure 1 As shown in the figure: RRC integrity protection negotiation is divided into two steps. The gNB sends the AS SMC message 1b to the UE. 1b: The message contains the integrity algorithm, encryption algorithm, and message hash value. After receiving the message, the UE verifies the integrity of the AS SMC message. If the verification is successful, RRC integrity protection and downlink decryption are started. After the 2b message is sent, RRC uplink encryption is enabled. 2b: Send the AS security mode complete message to the gNB. After receiving the message, the gNB enables RRC uplink decryption.

[0058] IPSEC in the related technology relies on the SA established by IKE to encrypt or authenticate IP packets. This patent has two ideas: one is to generate the corresponding SA by using the IKEV2 negotiation process, and use KA to replace the encryption key in the SA; the other is to omit the IKEV2 negotiation process and directly use IPsec for encryption. Both parties need to set the encryption algorithm in advance, which is less flexible.

[0059] IKEV2 first establishes the initial exchange process as follows Figure 2 As shown, the field description in the initial exchange is shown in Table 1:

[0060] Table 1

[0061]

[0062]

[0063] The initial exchange process includes the first exchange (IKE_SA_INIT exchange) and the second exchange (IKE_AUTH exchange):

[0064] During the first exchange: Message 1 (Initiator→Responder) contains the header (HDR), the security association (SA) payload (SAi) (listing the encryption and hashing algorithms supported by the initiator), the key exchange (KEi) payload (containing the initiator's Diffie-Hellman public key), the asymmetric (Nonce) payload (Ni) (used to ensure the freshness of the message), and the (optional) certificate request (CERTREQ) payload.

[0065] Message 2 (Responder→Initiator) contains a header (HDR), a security association (SA) payload (SAr) (listing the SA proposal selected by the responder (Responder)), a key exchange (KEr) payload (containing the responder's Diffie-Hellman public key), an asymmetric (Nonce) payload (Nr) (used to ensure the freshness of the message), an (optional) certificate request (CERTREQ) payload, and an (optional) certificate (CERT) payload.

[0066] During the second exchange: Message three (Initiator→Responder) contains a header (HDR), an encrypted security payload (SK{…}), which includes: the initiator's identity (IDi), (optional) the initiator's certificate (CERT), (optional) a certificate request (CERTREQ), (optional) a deletion payload (Dr), an authentication payload (AUTH) (used to verify the integrity and authenticity of messages one and two), a second security association (SAi2) payload (listing proposals for IPsec), a traffic selector (TSi) payload (defining the traffic the initiator wants to protect), and a traffic selector (TSr) payload (defining the traffic the responder wants to protect).

[0067] Message four (Responder→Initiator) contains a header (HDR), an encrypted security payload (SK{…}), which includes: the responder's identity (IDr), (optional) the responder's certificate (CERT), an authentication payload (AUTH) (used to verify the integrity and authenticity of messages one, two, and three), a second security association (SAi2) payload (confirming the proposal for IPsec), a traffic selector (TSi) payload, and a traffic selector (TSr) payload.

[0068] NTN gNB satellite launch scenario Figure 3 As shown in the figure, the NR Uu wireless interface is used between the UE and the satellite, and the SRI (satellite wireless interface, which belongs to the transmission connection) is used between the satellite and the ground NTN gateway. The NTN gateway exists as a transport layer node and supports various transport layer protocols.

[0069] like Figure 4 As shown in the figure: When the base station is put on the satellite, the air interface is divided into two sections. The first section is between the UE and the satellite base station, which is protected by AS SMC. The second section is between the satellite base station and the satellite gateway.

[0070] There is no protection, which reduces the security of information transmission between the base station and the core network.

[0071] The problems existing in the related art can be solved by the methods in the following embodiments.

[0072] The present application embodiment provides an information encryption method, which is applied to a core network. Figure 5 A flow chart of an information encryption method provided in an embodiment of the present application, such as Figure 5 As shown, the information encryption method may include:

[0073] S101 . Align with a relay device through free space to generate a first shared key.

[0074] An information encryption method provided in an embodiment of the present application is suitable for generating an encryption key between a core network and a base station.

[0075] In the embodiments of the present application, the core network is a security gateway, which can be implemented in various forms, and the specific embodiments of the present application do not limit this.

[0076] In the embodiment of the present application, the relay device may be a quantum ground station, or other devices. The specific relay device may be determined based on actual conditions, and the embodiment of the present application does not limit this.

[0077] In the embodiment of the present application, the free space may be an open space, or may be a wireless space or an atmospheric space without any medium. The specific free space may be determined according to actual conditions, and the embodiment of the present application does not limit this.

[0078] In an embodiment of the present application, a quantum key distribution (QKD) transmitter or a QKD receiver is provided in the core network, and a QKD transmitter or a QKD receiver is also provided in the relay device. When the QKD transmitter in the core network is aligned with the QKD receiver in the relay device, or the QKD receiver in the core network is aligned with the QKD transmitter in the relay device, the core network and the relay device are aligned in free space, thereby generating a first shared key.

[0079] In an embodiment of the present application, the first shared key may be generated between the core network and the relay device in other ways. The specific method of generating the first shared key between the core network and the relay device may be determined based on actual conditions, and the embodiment of the present application does not limit this.

[0080] In the embodiment of the present application, after the core network and the relay device align through free space to generate the first shared key, the first shared key exists in both the core network and the relay device.

[0081] S102: Receive a second shared key sent by the relay device.

[0082] In an embodiment of the present application, the core network may receive the second shared key sent by the relay device after calibrating with the relay device through free space to generate a first shared key; the core network may first receive the second shared key sent by the relay device, and then align with the relay device through free space to generate the first shared key; the core network may also align with the relay device through free space to generate the first shared key while receiving the second shared key sent by the relay device; the specific order of the core network and the relay device calibrating through free space to generate the first shared key, and the second shared key sent by the relay device can be determined according to actual conditions, and the embodiment of the present application does not limit this.

[0083] In an embodiment of the present application, the second shared key sent by the relay device can be a key generated by the relay device, or a key obtained by the relay device after processing the generated key. The specific way in which the relay device obtains the second shared key can be determined based on actual conditions, and the embodiment of the present application does not limit this.

[0084] Exemplarily, the relay device may be aligned with the core network through free space to generate a first shared key, and then generate a second shared key based on the first shared key and the third shared key.

[0085] S103: Determine a third shared key according to the second shared key and the first shared key.

[0086] In an embodiment of the present application, after the core network and the relay device calibrate through free space to generate a first shared key and receive a second shared key sent by the relay device, the third shared key can be determined based on the second shared key and the first shared key.

[0087] In an embodiment of the present application, the process of the core network determining the third shared key based on the second shared key and the first shared key includes: determining the XOR value between the second shared key and the first shared key to obtain the third shared key.

[0088] In an embodiment of the present application, if the second shared key is a key obtained by XORing the first shared key and the third shared key, the XOR value between the second shared key and the first shared key can be determined to obtain the third shared key.

[0089] It should be noted that the first shared key and the third shared key can also be used to perform other processing operations to obtain the second shared key, and then the second shared key and the first shared key can be used to perform reverse operations to determine the third shared key; the specific implementation method can be determined based on actual conditions, and the embodiments of the present application are not limited to this.

[0090] S104, using the third shared key to perform the encrypted transmission process of information between the base station in the satellite; the base station is provided with a third shared key; the third shared key in the base station is a key generated by aligning the satellite and the relay device through free space.

[0091] In the embodiment of the present application, after the core network determines the third shared key based on the second shared key and the first shared key, it uses the third shared key to perform the encryption transmission process of information between the core network and the base station in the satellite.

[0092] In an embodiment of the present application, after the core network determines the third shared key, the core network uses the third shared key to encrypt and decrypt communication information during communication with the base station, thereby ensuring the security of communication information transmitted between the core network and the base station.

[0093] In an embodiment of the present application, a QKD transmitter or a QKD receiver is provided in the satellite, and a QKD transmitter or a QKD receiver is also provided in the relay device. When the QKD transmitter in the satellite is aligned with the QKD receiver in the relay device, or the QKD receiver in the satellite is aligned with the QKD transmitter in the relay device, the satellite and the relay device are aligned in free space, thereby generating a third shared key.

[0094] In an embodiment of the present application, a third shared key may be generated between the satellite and the relay device in other ways. The specific method of generating the third shared key between the satellite and the relay device may be determined based on actual conditions, and the embodiment of the present application does not limit this.

[0095] In the embodiment of the present application, after the satellite and the relay device are aligned in free space to generate the third shared key, the third shared key exists in both the satellite and the relay device.

[0096] It should be noted that the base station is set on the satellite. After the satellite and the relay device are aligned through free space to generate the third shared key, the satellite transmits the third shared key to the base station so that the base station can use the third shared key to encrypt and transmit information with the core network.

[0097] For example, Figure 6As shown: Quantum key distribution relies on dedicated quantum ground stations (relay equipment), and the environmental requirements of quantum ground stations are much higher than those of ordinary satellite ground gateways. Unlike traditional key distribution methods, quantum key distribution is theoretically unconditionally secure, and its security is guaranteed by the basic principles of quantum mechanics. The quantum no-cloning theorem shows that it is impossible to perfectly clone any quantum state. Therefore, any eavesdropping on the quantum key distribution process may change the quantum state itself, causing a high bit error rate, thereby allowing the eavesdropping to be discovered. Generally speaking, the transmission of quantum states in the QKD process is achieved by encoding, transmitting, and measuring photons. Therefore, quantum key distribution QKD is a secure way to transmit keys, which can send keys between two distant communication terminals. Exemplarily, the satellite is provided with a QKD transmitter or a QKD receiver, the quantum ground station (relay device) has a corresponding QKD receiver or QKD transmitter, and the security gateway (core network) also has a corresponding QKD receiver or QKD transmitter. The satellite, quantum ground station, and security gateway all have quantum key management functions. The two ends of the satellite and the quantum ground station (relay device) share a key KA (third shared key) through free space, and the quantum ground station (relay device) and the security gateway (core network) share a key KC (first shared key) through free space. The process includes: the two ends of the satellite and the quantum ground station share a key KA through free space (that is, the satellite and the relay device are aligned through free space to generate a third shared key); the satellite transmits KA to the gNB (that is, the satellite transmits the third shared key to the base station); the quantum ground station (relay device) and the security gateway (core network) share a key KC (first shared key) through free space. That is, the relay device and the core network are aligned through free space to generate a first shared key); the quantum ground station holds KA and KC, and as a trusted relay, uses QKD technology based on optical fiber to pass the intermediate value of the quantum key (that is, the XOR value KAC of KA and KC) to the security gateway of the core network (the relay device determines the second shared key based on the third shared key and the first shared key; and sends the second shared key to the core network); after receiving KAC, the security gateway performs an XOR operation with the KC it holds to obtain KA (the core network determines the third shared key based on the second shared key and the first shared key); the onboard gNB and the security gateway of the core network can obtain the quantum key KA (that is, the third shared key) through calculation without transmitting the key, and then use the quantum key KA to encrypt the information based on IPsec (using the third shared key to perform the encrypted transmission process of information between the base station in the satellite), thereby realizing quantum security protection for the backhaul link.

[0098] In an embodiment of the present application, the core network uses a third shared key to execute an encrypted transmission process of information between the core network and the base station in the satellite, including: executing an IPsec operation process; when the IPsec operation process is completed, using the third shared key to execute an encrypted transmission process of information between the core network and the base station in the satellite.

[0099] In an embodiment of the present application, the core network does not change the initialization process, that is, it directly executes the four messages in the IPsec operation process in the prior art. After completing the execution of the four messages in the IPsec operation process, it does not use the negotiated key material for encryption, but directly uses the third shared key (KA) for encryption.

[0100] In an embodiment of the present application, the core network executes an IPsec operation process, including: receiving message one sent by a base station; selecting information in a security-associated payload to obtain selection information; and sending message two to the base station; receiving message three sent by the base station; decrypting message three using a third shared key to obtain message three to be transmitted; and responding to message three to be transmitted to obtain message four to be transmitted; encrypting the payload in message four to be transmitted using the third shared key to obtain message four; and sending message four to the base station.

[0101] It should be noted that message one includes a security association payload; message two includes selection information; and the payload in message three is information obtained after the base station encrypts the payload in message three to be transmitted using the third shared key.

[0102] In the embodiment of the present application, the security association payload (SAi) lists the encryption and hash algorithms supported by the initiator (Initiator).

[0103] It should be noted that the message 1 sent by the base station and received by the core network does not contain Kei, and the message 2 sent by the core network to the base station does not contain Ker, which reduces the parameters of the DH key public key exchange. The base station and the core network only negotiate the symmetric encryption algorithm. After the negotiation is completed, KA is used as the encryption key to protect the IP data packet.

[0104] In the embodiments of the present application, Figure 7As shown, in the case of IKEV2 security negotiation, the base station (gNB) sends Message1 (i.e., message one) to the security gateway (core network). Message one includes a security header (HDR), a security association (SAi1), and a random number (Ni); after receiving Message one, the security gateway selects the security association, that is, selects the encryption and hashing algorithm, and feeds back Message2 (message two) to the gNB; both the gNB and the security gateway know the key KA (the third shared key), and the gNB uses KA to encrypt the payload and sends Message3 (message three) to the security gateway; after receiving Message 3, the security gateway decrypts it and responds to Message 3, that is, uses KA to encrypt the payload of Message4 (message four) and sends it to the gNB.

[0105] In an embodiment of the present application, after the core network receives message three sent by the base station, it will also use the third shared key to decrypt message three to obtain the base station ID, security-associated payload and traffic selector; determine the base station ID, security-associated payload and traffic selector as message three to be transmitted; respond to message three to be transmitted to obtain message four to be transmitted; use the third shared key to encrypt the payload in message four to be transmitted to obtain message four; and send message four to the base station.

[0106] In the embodiment of the present application, when performing IKEV2 security negotiation, the base station (gNB) sends Message1 (i.e., message one) to the security gateway (core network), where Message one includes a security header (HDR), a security association (SAi1), and a random number (Ni); after receiving Message one, the security gateway selects the security association, i.e., selects the encryption and hashing algorithm, and feeds back Message2 (message two) to the gNB; both the gNB and the security gateway know the key KA (the third shared key), and the gNB sends Message3 (message three) to the security gateway, such as Fig. 9 As shown: Message three carries a security header (HDR), an identity ID (IDi), a security association payload (SAi2) and a traffic selector (TSi, TSr). Message three is decrypted using the third shared key to obtain message three to be transmitted, namely the base station ID, the security association payload and the traffic selector; then the payload (HDR, SK{IDr, SAi2, TSi, TSr}) in message four to be transmitted is encrypted using the third shared key to obtain message four; and message four is sent to the base station.

[0107] In the embodiment of the present application, the encryption key has been negotiated between the gNB (base station) and the security gateway (core network). Since the quantum key has implicitly authenticated the hardware device when it was distributed, the mutual authentication function is no longer required in the interaction between message three and message four. The other party can decrypt the payload, which is equivalent to identity authentication. Among them, message three carries a security header, and the payload is encrypted using the third shared key KA. The payload contains the identity ID, security association, and traffic selector; the payload is decrypted in message 4, and after decryption, a security association and response are performed, and message 4 is sent to the gNB; at this point, the security association and identity authentication established by the IPSEC channel are completed.

[0108] In an embodiment of the present application, the core network executes an IPsec operation process, including: receiving message one sent by a base station; selecting information in a security association payload to obtain selection information; and sending message two to the base station; determining a target encryption key based on a key exchange payload and a third shared key; receiving message three sent by the base station; decrypting message three using the target encryption key to obtain message three to be transmitted; and responding to message three to be transmitted to obtain message four to be transmitted; encrypting the payload in message four to be transmitted using the target encryption key to obtain message four; and sending message four to the base station.

[0109] It should be noted that message one includes a security association payload and a key exchange payload; message two includes selection information; and the payload in message three is information obtained after the base station encrypts the payload in message three to be transmitted using the target encryption key.

[0110] In the embodiment of the present application, when executing the IPsec operation process, the initialization process may not be changed. After the interaction of message 1 and message 2 is completed, the encryption key generated after DH negotiation is used to perform a secondary operation with KA to obtain a new key for protecting the IP data packet. For example, Figure 8As shown: in the case of IKEV2 security negotiation, the base station (gNB) sends Message1 (i.e., message one) to the security gateway (core network). Message one includes a security header (HDR), a security association (SAi1), a key exchange (KEi) payload (including a DH public key) and a random number (Ni); after receiving Message one, the security gateway selects the security association, that is, selects the encryption and hashing algorithm, and sends Message2 (message two) to the gNB, including the security header (HDR), the security association (SAr1), the DH public key of the security gateway (KEr) and the random number (Nr); both the gNB and the security gateway know the key KA (the third shared key), and the gNB and the security gateway can calculate the encryption key S (key exchange payload) through negotiation between Messages one and two, and mix S and KA to obtain a new key K' (target encryption key), and use K' to encrypt the payload and send Message3 (message three) to the security gateway; after receiving Message three, the security gateway decrypts it and responds to Message three, that is, uses K' to encrypt the payload of Message4 (message four) and sends it to the gNB.

[0111] In an embodiment of the present application, after the core network receives message three sent by the base station, it will also use the target encryption key to decrypt message three to obtain the base station ID, security-associated payload and traffic selector; determine the base station ID, security-associated payload and traffic selector as message three to be transmitted; respond to message three to be transmitted to obtain message four to be transmitted; use the target encryption key to encrypt the payload in message four to be transmitted to obtain message four; and send message four to the base station.

[0112] In the embodiment of the present application, when performing IKEV2 security negotiation, the base station (gNB) sends Message1 (i.e., message one) to the security gateway (core network), where Message one includes a security header (HDR), a security association (SAi1), a key exchange (KEi) payload (including a DH public key) and a random number (Ni); after receiving Message one, the security gateway selects the security association, that is, selects an encryption and hashing algorithm, and sends Message2 (message two) to the gNB, including a security header (HDR), a security association (SAr1), a DH public key of the security gateway (KEr) and a random number (Nr); both the gNB and the security gateway know the key KA (the third shared key), and the gNB and the security gateway can calculate the encryption key S (key exchange payload) through negotiation between Messages one and two, and mix S and KA to obtain a new key K' (target encryption key), and use K' to encrypt the payload and send Message3 (message three) to the security gateway, such as Fig. 9As shown: Message three carries a security header (HDR), an identity ID (IDi), a security association payload (SAi2) and a traffic selector (TSi, TSr). By using the target encryption key to decrypt message three, the message three to be transmitted, namely the base station ID, the security association payload and the traffic selector, can be obtained; and then the target encryption key is used to encrypt the payload (HDR, SK{IDr, SAi2, TSi, TSr}) in message four to be transmitted to obtain message four; and message four is sent to the base station.

[0113] In the embodiment of the present application, the encryption key has been negotiated between the gNB (base station) and the security gateway (core network). Since the quantum key has implicitly authenticated the hardware device when it was distributed, the mutual authentication function is no longer required in the interaction between message three and message four. The other party can decrypt the payload, which is equivalent to identity authentication. Among them, message three carries a security header, and the payload is encrypted using the target encryption key K'. The payload contains the identity ID, security association, and traffic selector; the payload is decrypted in message 4, and after decryption, a security association and response are performed, and message 4 is sent to the gNB; at this point, the security association and identity authentication established by the IPSEC channel are completed.

[0114] In an embodiment of the present application, the core network uses the third shared key to execute an encrypted transmission process of information between the core network and the base station in the satellite, including: using the target encryption key to execute an encrypted transmission process of information between the core network and the base station in the satellite.

[0115] In an embodiment of the present application, when the base station has information to be transmitted to be sent to the core network, the base station uses the target encryption key to encrypt the information to be transmitted to obtain the ciphertext to be transmitted, and the ciphertext to be transmitted is transmitted to the core network. The core network uses the target encryption key to decrypt the ciphertext to be transmitted to obtain the plaintext to be transmitted, that is, the information to be transmitted.

[0116] In an embodiment of the present application, when there is information to be transmitted in the core network to be sent to the base station, the core network uses the target encryption key to encrypt the information to be transmitted to obtain the ciphertext to be transmitted, and the ciphertext to be transmitted is transmitted to the base station. The base station uses the target encryption key to decrypt the ciphertext to be transmitted to obtain the plaintext to be transmitted, that is, the information to be transmitted.

[0117] In an embodiment of the present application, the core network uses a third shared key to execute an encrypted transmission process of information between the core network and the base station in the satellite, including: obtaining a preset encryption algorithm; using the preset encryption algorithm and according to the third shared key to execute an encrypted transmission process of information between the core network and the base station in the satellite.

[0118] In an embodiment of the present application, the preset encryption algorithm can be a configured encryption algorithm, an encryption algorithm transmitted to the core network by other devices, or an encryption algorithm obtained by the core network through other means. The specific way in which the core network obtains the preset encryption algorithm can be determined based on actual conditions, and the embodiment of the present application does not limit this.

[0119] Exemplarily, without using IKE negotiation, encrypted transmission of messages between the satellite and the core network can be achieved by directly manually configuring an encryption algorithm (preset encryption algorithm) and an encryption key KA (third shared key).

[0120] In an embodiment of the present application, when there is information to be transmitted in the core network to be sent to the base station, the core network uses a preset encryption algorithm and a third shared key to encrypt the information to be transmitted to obtain a ciphertext to be transmitted, and the ciphertext to be transmitted is transmitted to the base station. The base station uses a preset encryption algorithm and a third shared key to decrypt the ciphertext to be transmitted to obtain a plaintext to be transmitted, that is, the information to be transmitted.

[0121] In an embodiment of the present application, when the base station has information to be transmitted to be sent to the core network, the base station uses a preset encryption algorithm and a third shared key to encrypt the information to be transmitted to obtain a ciphertext to be transmitted, and the ciphertext to be transmitted is transmitted to the core network. The core network uses a preset encryption algorithm and a third shared key to decrypt the ciphertext to be transmitted to obtain a plaintext to be transmitted, that is, the information to be transmitted.

[0122] It can be understood that the core network generates a first shared key by calibrating with the relay device in free space, and receives a second shared key sent by the relay device, thereby determining a third shared key based on the second shared key and the first shared key, and the base station also obtains from the satellite the third shared key generated by aligning the satellite and the relay device in free space, which enables encrypted communication between the base station and the core network through the third shared key, thereby improving the security of communication between the base station and the core network, that is, improving the security of information transmission.

[0123] The present application embodiment further provides an information encryption method, which is applied to a relay device. Fig.10 A flow chart of an information encryption method provided in an embodiment of the present application, such as Fig.10 As shown, the information encryption method may include:

[0124] S201. Align with the satellite in free space to generate a third shared key.

[0125] An information encryption method provided in an embodiment of the present application is suitable for generating an encryption key between a core network and a base station.

[0126] In the embodiment of the present application, the relay device may be a quantum ground station, or other devices. The specific relay device may be determined according to actual conditions, and the embodiment of the present application does not limit this.

[0127] In the embodiment of the present application, the free space may be an open space, or may be a wireless space or an atmospheric space without any medium. The specific free space may be determined according to actual conditions, and the embodiment of the present application does not limit this.

[0128] In an embodiment of the present application, a QKD transmitter or a QKD receiver is provided in the satellite, and a QKD transmitter or a QKD receiver is also provided in the relay device. When the QKD transmitter in the satellite is aligned with the QKD receiver in the relay device, or the QKD receiver in the satellite is aligned with the QKD transmitter in the relay device, the satellite and the relay device are aligned in free space, thereby generating a third shared key.

[0129] In an embodiment of the present application, a third shared key may be generated between the satellite and the relay device in other ways. The specific method of generating the third shared key between the satellite and the relay device may be determined based on actual conditions, and the embodiment of the present application does not limit this.

[0130] In the embodiment of the present application, after the satellite and the relay device are aligned in free space to generate the third shared key, the third shared key exists in both the satellite and the relay device.

[0131] S202. Align with the core network through free space to generate a first shared key.

[0132] In an embodiment of the present application, the relay device may first align with the satellite through free space to generate a third shared key, and then align with the core network through free space to generate a first shared key; the relay device may also first align with the core network through free space to generate a first shared key, and then align with the satellite through free space to generate a third shared key; the relay device may also align with the core network through free space to generate a first shared key while aligning with the satellite through free space to generate a third shared key; the specific method may be determined based on actual conditions, and the embodiment of the present application is not limited to this.

[0133] In an embodiment of the present application, a QKD transmitter or a QKD receiver is provided in the core network, and a QKD transmitter or a QKD receiver is also provided in the relay device. When the QKD transmitter in the core network is aligned with the QKD receiver in the relay device, or the QKD receiver in the core network is aligned with the QKD transmitter in the relay device, the core network and the relay device are aligned in free space, thereby generating a first shared key.

[0134] In an embodiment of the present application, the first shared key may be generated between the core network and the relay device in other ways. The specific method of generating the first shared key between the core network and the relay device may be determined based on actual conditions, and the embodiment of the present application does not limit this.

[0135] In the embodiment of the present application, after the core network and the relay device align through free space to generate the first shared key, the first shared key exists in both the core network and the relay device.

[0136] S203: Determine a second shared key according to the third shared key and the first shared key.

[0137] In an embodiment of the present application, the relay device can first be aligned with the satellite through free space to generate a third shared key, and then aligned with the core network through free space to generate a first shared key. Then, the second shared key is determined based on the third shared key and the first shared key.

[0138] In an embodiment of the present application, the process of the relay device determining the second shared key based on the third shared key and the first shared key includes: determining the XOR value of the third shared key and the first shared key to obtain the second shared key.

[0139] In the embodiment of the present application, the relay device can determine the XOR value of the third shared key and the first shared key to obtain the second shared key. The relay device can also use other methods to determine the second shared key based on the third shared key and the first shared key. The specific method of the relay device determining the XOR value of the third shared key and the first shared key to obtain the second shared key can be determined based on actual conditions, and the embodiment of the present application does not limit this.

[0140] S204, sending the second shared key to the core network; so that the core network can determine a third shared key according to the second shared key and the first shared key; and using the third shared key to perform an encrypted transmission process of information with the base station in the satellite.

[0141] In an embodiment of the present application, after the relay device determines the second shared key based on the third shared key and the first shared key, it sends the second shared key to the core network; so that the core network can determine the third shared key based on the second shared key and the first shared key; and use the third shared key to execute the encryption transmission process of information between the base station in the satellite.

[0142] Exemplarily, if the relay device determines the XOR value of the third shared key and the first shared key to obtain the second shared key, the core network may determine the XOR value between the second shared key and the first shared key to obtain the third shared key.

[0143] It can be understood that the relay device and the satellite are calibrated through free space to generate a third shared key; the relay device and the core network are calibrated through free space to generate a first shared key, and then the second shared key is generated based on the first shared key and the third shared key, and then the second shared key is sent to the core network, so that the core network can determine the third shared key based on the second shared key and the first shared key, and the base station also obtains from the satellite the third shared key generated by aligning the satellite and the relay device through free space, which enables the base station and the core network to communicate encrypted through the third shared key, thereby improving the security of communication between the base station and the core network, that is, improving the security of information transmission.

[0144] The embodiment of the present application also provides an information encryption method, which is applied to a satellite. Fig.11 A flow chart of an information encryption method provided in an embodiment of the present application, such as Fig.11 As shown, the information encryption method may include:

[0145] S301 , aligning with a relay device through free space to generate a third shared key.

[0146] An information encryption method provided in an embodiment of the present application is suitable for generating an encryption key between a core network and a base station.

[0147] In the embodiments of the present application, the satellite may be implemented in various forms, which are not limited in the specific embodiments of the present application.

[0148] In the embodiment of the present application, the relay device may be a quantum ground station, or other devices. The specific relay device may be determined based on actual conditions, and the embodiment of the present application does not limit this.

[0149] In the embodiment of the present application, the free space may be an open space, or may be a wireless space or an atmospheric space without any medium. The specific free space may be determined according to actual conditions, and the embodiment of the present application does not limit this.

[0150] In an embodiment of the present application, a QKD transmitter or a QKD receiver is provided in the satellite, and a QKD transmitter or a QKD receiver is also provided in the relay device. When the QKD transmitter in the satellite is aligned with the QKD receiver in the relay device, or the QKD receiver in the satellite is aligned with the QKD transmitter in the relay device, the satellite and the relay device are aligned in free space, thereby generating a third shared key.

[0151] In an embodiment of the present application, a third shared key may be generated between the satellite and the relay device in other ways. The specific method of generating the third shared key between the satellite and the relay device may be determined based on actual conditions, and the embodiment of the present application does not limit this.

[0152] In the embodiment of the present application, after the satellite and the relay device are aligned in free space to generate the third shared key, the third shared key exists in both the satellite and the relay device.

[0153] S302: Transmit a third shared key to the base station, so that the base station uses the third shared key to perform an encryption transmission process of information with the core network.

[0154] In an embodiment of the present application, the satellite and the relay device are aligned through free space, and after generating a third shared key, the third shared key is transmitted to the base station so that the base station can use the third shared key to perform an encrypted transmission process of information between the base station and the core network.

[0155] In an embodiment of the present application, a base station is provided on the satellite. After the satellite and the relay device are aligned through free space to generate a third shared key, the satellite transmits the third shared key to the base station so that the base station can use the third shared key to encrypt and transmit information with the core network.

[0156] It can be understood that the satellite and the relay device are aligned through free space to generate a third shared key, and the third shared key is transmitted to the base station, so that the base station can communicate with the core network based on the third shared key, thereby improving the security of communication between the base station and the core network, that is, improving the security of information transmission.

[0157] The embodiment of the present application provides a core network 1, corresponding to an information encryption method applied in the core network; Fig.12 A schematic diagram of the structure of a core network provided in an embodiment of the present application Figure 1 , the core network 1 may include:

[0158] A first generating unit 11 is used to align with the relay device through free space to generate a first shared key;

[0159] A receiving unit 12, configured to receive a second shared key sent by the relay device;

[0160] A first determining unit 13, configured to determine a third shared key according to the second shared key and the first shared key;

[0161] The execution unit 14 is used to use the third shared key to execute the encryption transmission process of information between the base station in the satellite; the base station is provided with the third shared key; the third shared key in the base station is a key generated by aligning the satellite and the relay device through free space.

[0162] In some embodiments of the present application, the execution unit 14 is used to execute the IPsec operation process; when the IPsec operation process is completed, the third shared key is used to perform an encrypted transmission process of information between the base station in the satellite.

[0163] In some embodiments of the present application, the core network further includes a selection unit, a second sending unit, a decryption unit, a response unit, and an encryption unit;

[0164] The receiving unit 12 is configured to receive a message 1 sent by the base station; the message 1 includes a security association payload; receive a message 3 sent by the base station; the payload in the message 3 is information obtained by encrypting the payload in the message 3 to be transmitted by the base station using the third shared key;

[0165] The selection unit is used to select the information in the security association payload to obtain selection information;

[0166] The second sending unit is configured to send message 2 to the base station; the message 2 includes selection information; and send message 4 to the base station;

[0167] The decryption unit is used to decrypt the message three using the third shared key to obtain the message three to be transmitted;

[0168] The response unit is used to respond to the third message to be transmitted to obtain a fourth message to be transmitted;

[0169] The encryption unit is used to encrypt the payload in the message four to be transmitted using the third shared key to obtain message four.

[0170] In some embodiments of the present application, the decryption unit is used to decrypt the message three using the third shared key to obtain the base station ID, the security association payload and the traffic selector;

[0171] The first determining unit 13 is used to determine the base station ID, the security association payload and the traffic selector as the message to be transmitted three;

[0172] The response unit is used to respond to the third message to be transmitted to obtain a fourth message to be transmitted;

[0173] The encryption unit is used to encrypt the payload in the message to be transmitted four by using the third shared key to obtain the message four;

[0174] The second sending unit is used to send the message four to the base station.

[0175] In some embodiments of the present application, the receiving unit 12 is used to receive a message 1 sent by the base station; the message 1 includes a security association payload and a key exchange payload; receive a message 3 sent by the base station; the payload in the message 3 is information obtained after the base station uses the target encryption key to encrypt the payload in the message 3 to be transmitted;

[0176] The selection unit is used to select the information in the security association payload to obtain selection information;

[0177] The second sending unit is configured to send message 2 to the base station; the message 2 includes selection information; and send message 4 to the base station;

[0178] The first determining unit 13 is used to determine a target encryption key according to the key exchange payload and the third shared key;

[0179] The decryption unit is used to decrypt the message three using the target encryption key to obtain the message three to be transmitted;

[0180] The response unit is used to respond to the third message to be transmitted to obtain a fourth message to be transmitted;

[0181] The encryption unit is used to encrypt the payload in the message four to be transmitted using the target encryption key to obtain message four.

[0182] In some embodiments of the present application, the decryption unit is used to decrypt the message three using the target encryption key to obtain the base station ID, the security association payload and the traffic selector;

[0183] The first determining unit 13 is used to determine the base station ID, the security association payload and the traffic selector as the message to be transmitted three;

[0184] The response unit is used to respond to the third message to be transmitted to obtain a fourth message to be transmitted;

[0185] The encryption unit is used to encrypt the payload in the message 4 to be transmitted using the target encryption key to obtain the message 4;

[0186] The second sending unit is used to send the message four to the base station.

[0187] In some embodiments of the present application, the execution unit 14 is used to use the target encryption key to execute an encryption transmission process of information between the base station in the satellite.

[0188] In some embodiments of the present application, the core network further includes an acquisition unit;

[0189] The acquisition unit is used to acquire a preset encryption algorithm;

[0190] The execution unit 14 is used to execute the encryption transmission process of information between the base station in the satellite by using the preset encryption algorithm and according to the third shared key.

[0191] It should be noted that, in actual applications, the above-mentioned first generating unit 11, receiving unit 12, first determining unit 13 and executing unit 14 can be implemented by the first processor 15 on the core network, specifically a CPU (Central Processing Unit), MPU (Microprocessor Unit), DSP (Digital Signal Processing) or a field programmable gate array (FPGA); the above-mentioned data storage can be implemented by the first memory 16 on the core network.

[0192] The present application also provides a core network, such as Fig.13 As shown, the core network includes: a first processor 15, a first memory 16 and a first communication bus 17. The first memory 16 communicates with the first processor 15 through the first communication bus 17. The first memory 16 stores a program executable by the first processor 15. When the program is executed, the information encryption method applied to the core network as described above is executed by the first processor 15.

[0193] In practical applications, the first memory 16 may be a volatile memory, such as a random access memory (RAM); or a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD); or a combination of the above types of memories, and provide instructions and data to the first processor 15.

[0194] An embodiment of the present application provides a computer-readable storage medium having a computer program thereon, and when the program is executed by the first processor 15, the information encryption method applied in the core network as described above is implemented.

[0195] Exemplarily, an embodiment of the present application further provides a computer program product, including a computer program, which can be executed by a first processor 15 in the core network to complete the steps of the aforementioned encryption method applied in the core network.

[0196] It can be understood that the core network generates a first shared key by calibrating with the relay device in free space, and receives a second shared key sent by the relay device, thereby determining a third shared key based on the second shared key and the first shared key, and the base station also obtains from the satellite the third shared key generated by aligning the satellite and the relay device in free space, which enables encrypted communication between the base station and the core network through the third shared key, thereby improving the security of communication between the base station and the core network, that is, improving the security of information transmission.

[0197] The embodiment of the present application provides a relay device 2, corresponding to an information encryption method applied in a relay device; Fig.14 A schematic diagram of the structure of a relay device provided in an embodiment of the present application Figure 1 , the relay device 2 may include:

[0198] The second generating unit 21 is used to align with the satellite through free space to generate a third shared key; align with the core network through free space to generate a first shared key;

[0199] A second determining unit 22, configured to determine a second shared key according to the third shared key and the first shared key;

[0200] The first sending unit 23 is used to send the second shared key to the core network; so that the core network can determine the third shared key based on the second shared key and the first shared key; and use the third shared key to perform the encryption transmission process of information between the core network and the base station in the satellite.

[0201] In some embodiments of the present application, the second determining unit 22 is used to determine an XOR value of the third shared key and the first shared key to obtain the second shared key.

[0202] It should be noted that, in actual applications, the above-mentioned second generation unit 21, the second determination unit 22 and the first sending unit 23 can be implemented by the second processor 24 on the relay device, specifically a CPU (Central Processing Unit), an MPU (Microprocessor Unit), a DSP (Digital Signal Processing) or a field programmable gate array (FPGA), etc.; the above-mentioned data storage can be implemented by the second memory 25 on the relay device.

[0203] The present application also provides a relay device, such as Fig.15 As shown, the relay device includes: a second processor 24, a second memory 25 and a second communication bus 26. The second memory 25 communicates with the second processor 24 via the second communication bus 26. The second memory 25 stores a program executable by the second processor 24. When the program is executed, the information encryption method applied to the relay device as described above is executed by the second processor 24.

[0204] In practical applications, the second memory 25 may be a volatile memory, such as a random access memory (RAM); or a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD); or a combination of the above types of memories, and provide instructions and data to the second processor 24.

[0205] An embodiment of the present application provides a computer-readable storage medium having a computer program thereon, and when the program is executed by the second processor 24, the information encryption method applied to the relay device as described above is implemented.

[0206] Exemplarily, an embodiment of the present application further provides a computer program product, including a computer program, which can be executed by the second processor 24 in the relay device to complete the steps of the aforementioned information encryption method applied in the relay device.

[0207] It can be understood that the relay device and the satellite are calibrated through free space to generate a third shared key; the relay device and the core network are calibrated through free space to generate a first shared key, and then the second shared key is generated based on the first shared key and the third shared key, and then the second shared key is sent to the core network, so that the core network can determine the third shared key based on the second shared key and the first shared key, and the base station also obtains from the satellite the third shared key generated by aligning the satellite and the relay device through free space, which enables the base station and the core network to communicate encrypted through the third shared key, thereby improving the security of communication between the base station and the core network, that is, improving the security of information transmission.

[0208] The embodiment of the present application provides a satellite 3, corresponding to an information encryption method applied in a satellite; Fig.16 A schematic diagram of the structure of a satellite provided in an embodiment of the present application Figure 1 , the satellite 3 may include:

[0209] A third generating unit 31 is used to align with the relay device through free space to generate a third shared key;

[0210] The transmission unit 32 is used to transmit the third shared key to the base station, so that the base station uses the third shared key to perform an encryption transmission process of information between the base station and the core network.

[0211] It should be noted that, in actual applications, the above-mentioned third generation unit 31 and transmission unit 32 can be implemented by a third processor 33 on the satellite, specifically a CPU (Central Processing Unit), an MPU (Microprocessor Unit), a DSP (Digital Signal Processing) or a field programmable gate array (FPGA); the above-mentioned data storage can be implemented by a third memory 34 on the satellite.

[0212] The present application also provides a satellite, such as Fig.17 As shown, the satellite includes: a third processor 33, a third memory 34 and a third communication bus 35. The third memory 34 communicates with the third processor 33 through the third communication bus 35. The third memory 34 stores a program executable by the third processor 33. When the program is executed, the information encryption method applied to the satellite as described above is executed by the third processor 33.

[0213] In practical applications, the third memory 34 may be a volatile memory, such as a random access memory (RAM); or a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD); or a combination of the above types of memories, and provide instructions and data to the third processor 33.

[0214] An embodiment of the present application provides a computer-readable storage medium having a computer program thereon, and when the program is executed by the third processor 33, the information encryption method applied to the satellite as described above is implemented.

[0215] Exemplarily, an embodiment of the present application further provides a computer program product, including a computer program, which can be executed by a third processor 33 in the satellite to complete the steps of the aforementioned information encryption method applied to the satellite.

[0216] It can be understood that the satellite and the relay device are aligned through free space to generate a third shared key, and the third shared key is transmitted to the base station, so that the base station can communicate with the core network based on the third shared key, thereby improving the security of communication between the base station and the core network, that is, improving the security of information transmission.

[0217] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of hardware embodiments, software embodiments, or embodiments in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) that contain computer-usable program code.

[0218] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0219] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0220] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0221] The above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application.

Claims

1. An information encryption method, characterized in that: Applied to a core network, the method comprises: Aligning with the relay device through free space to generate a first shared key; Receiving a second shared key sent by the relay device; Determine a third shared key according to the second shared key and the first shared key; The third shared key is used to perform an encrypted transmission process of information with a base station in the satellite; the base station is provided with the third shared key; the third shared key in the base station is a key generated by aligning the satellite and the relay device through free space.

2. The method according to claim 1, characterized in that The process of using the third shared key to perform encrypted transmission of information between the satellite and the base station includes: Execute IPsec operation process; When the IPsec operation process is completed, the third shared key is used to perform an encrypted transmission process of information between the base station in the satellite.

3. The method according to claim 2, characterized in that The IPsec operation process includes: Receiving a message 1 sent by the base station; the message 1 includes a security association payload; Selecting information in the security association payload to obtain selection information; and sending message 2 to the base station; the message 2 includes the selection information; receiving a message three sent by the base station; the payload in the message three is information obtained by the base station encrypting the payload in the message three to be transmitted using the third shared key; Decrypting the message three using the third shared key to obtain the message three to be transmitted; and responding to the message three to be transmitted to obtain the message four to be transmitted; The payload in the message four to be transmitted is encrypted using the third shared key to obtain message four; and the message four is sent to the base station.

4. The method according to claim 3, characterized in that After receiving the message three sent by the base station, the method further includes: Decrypting the message three using the third shared key to obtain a base station ID, a security association payload, and a traffic selector; Determine the base station ID, the security association payload and the traffic selector as the third message to be transmitted; In response to the third message to be transmitted, a fourth message to be transmitted is obtained; The payload in the message four to be transmitted is encrypted using the third shared key to obtain message four; and the message four is sent to the base station.

5. The method according to claim 2, characterized in that: The IPsec operation process includes: Receiving a message 1 sent by the base station; the message 1 includes a security association payload and a key exchange payload; Selecting information in the security association payload to obtain selection information; and sending message 2 to the base station; the message 2 includes the selection information; Determining a target encryption key according to the key exchange payload and the third shared key; receiving a message three sent by the base station; the payload in the message three is information obtained by the base station encrypting the payload in the message three to be transmitted using the target encryption key; Decrypting the message three using the target encryption key to obtain the message three to be transmitted; and responding to the message three to be transmitted to obtain the message four to be transmitted; The target encryption key is used to encrypt the payload in the message four to be transmitted to obtain message four; and the message four is sent to the base station.

6. The method according to claim 5, characterized in that After receiving the message three sent by the base station, the method further includes: Decrypting the message three using the target encryption key to obtain a base station ID, a security association payload, and a traffic selector; Determine the base station ID, the security association payload and the traffic selector as the third message to be transmitted; In response to the third message to be transmitted, a fourth message to be transmitted is obtained; The target encryption key is used to encrypt the payload in the message four to be transmitted to obtain message four; and the message four is sent to the base station.

7. The method according to any one of claims 5 or 6, characterized in that: The process of using the third shared key to perform encrypted transmission of information between the satellite and the base station includes: The target encryption key is used to perform an encrypted transmission process of information with a base station in the satellite.

8. The method according to claim 1, characterized in that The process of using the third shared key to perform encrypted transmission of information between the satellite and the base station includes: Get the preset encryption algorithm; The preset encryption algorithm is used to perform an encryption transmission process of information between the base station in the satellite according to the third shared key.

9. The method according to claim 1, characterized in that: The determining a third shared key according to the second shared key and the first shared key includes: Determine an XOR value between the second shared key and the first shared key to obtain the third shared key.

10. An information encryption method, characterized in that: Applied to a relay device, the method comprises: aligning with the satellite through free space to generate a third shared key; Aligning with the core network through free space to generate a first shared key; Determine a second shared key according to the third shared key and the first shared key; Sending the second shared key to the core network; allowing the core network to determine the third shared key based on the second shared key and the first shared key; and using the third shared key to perform an encrypted transmission process of information between the core network and the base station in the satellite.

11. The method according to claim 10, characterized in that The determining the second shared key according to the third shared key and the first shared key includes: Determine an XOR value of the third shared key and the first shared key to obtain the second shared key.

12. An information encryption method, characterized in that: Applied to a satellite, the method comprises: aligning with the relay device through free space to generate a third shared key; The third shared key is transmitted to the base station, so that the base station uses the third shared key to perform an encryption transmission process of information with the core network.

13. A core network, characterized in that: The core network includes: A first generating unit, configured to align with the relay device through free space to generate a first shared key; A receiving unit, configured to receive a second shared key sent by the relay device; A first determining unit, configured to determine a third shared key according to the second shared key and the first shared key; An execution unit is used to use the third shared key to execute the encrypted transmission process of information between the base station in the satellite; the base station is provided with the third shared key; the third shared key in the base station is a key generated by aligning the satellite and the relay device through free space.

14. A relay device, characterized in that: The relay device comprises: The second generating unit is used to align with the satellite through free space to generate a third shared key; align with the core network through free space to generate a first shared key; A second determining unit, configured to determine a second shared key according to the third shared key and the first shared key; The first sending unit is used to send the second shared key to the core network; so that the core network can determine the third shared key according to the second shared key and the first shared key; and use the third shared key to perform an encrypted transmission process of information between the core network and the base station in the satellite.

15. A satellite, characterized in that: The satellites include: A third generating unit, configured to align with the relay device through free space to generate a third shared key; The transmission unit is used to transmit the third shared key to the base station, so that the base station uses the third shared key to perform an encrypted transmission process of information with the core network.

16. A storage medium having a computer program stored thereon, applied to a core network, a relay device and a satellite, characterized in that: When the computer program is executed by the first processor in the core network, it implements the method described in any one of claims 1 to 9; when the computer program is executed by the second processor in the relay device, it implements the method described in any one of claims 10 to 11; when the computer program is executed by the third processor in the satellite, it implements the method described in claim 12.

17. A computer program product comprising a computer program, characterized in that The computer program implements the method according to any one of claims 1 to 9 when executed by a first processor, implements the method according to any one of claims 10 to 11 when executed by a second processor, and implements the method according to claim 12 when executed by a third processor.

Images