Satellite system-oriented encryption communication system and method

Abstract

The invention relates to the technical field of information security, and discloses an encrypted communication system and method for a satellite system, and the system comprises a key management center, a plurality of user terminals, and a ground forwarding control center which is in communication connection with the key management center. According to the invention, the problem that user information security transmission is difficult to realize quickly and efficiently in the prior art is solved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an encryption communication system and method for a satellite system. Background Art

[0002] At present, with the continuous evolution of science and technology, various communication means and communication systems are booming, especially wireless communication, which is the main communication method in ocean, aviation, and space navigation because it is not restricted by geographical conditions, has strong mobility, and good anti-destruction ability. Among them, satellite systems have been widely used due to their wide coverage, long communication distance, low transmission delay, large user capacity, all-weather availability, and are not easily affected by natural disasters and human interference. In this type of system, the data content transmitted by each user through the wireless channel may contain sensitive information. If data leakage occurs, it will cause serious consequences or safety accidents. Therefore, it is necessary to encrypt and protect the transmitted data content to ensure the security of system application.

[0003] For some low-bandwidth center-forwarding satellite systems, especially those with bursty data communications and no link maintenance function, on the one hand, due to limited channel transmission resources, in the absence of an out-of-band channel, the traditional encryption communication method based on link negotiation and multiple interactions to achieve key synchronization is difficult to apply in practice; on the other hand, since there are a large number of users in the system and new users are joining the network in real time at any time, how to implement user key planning and configuration to ensure flexible information exchange among a large number of users is a major problem that needs to be solved urgently. Summary of the invention

[0004] In order to overcome the deficiencies of the prior art, the present invention provides an encrypted communication system and method for a satellite system, which solves the problems existing in the prior art such as difficulty in realizing fast and efficient secure transmission of user information.

[0005] The technical solution adopted by the present invention to solve the above problems is:

[0006] An encrypted communication system for a satellite system includes a key management center, a number of user terminals, and a ground forwarding control center connected to the key management center.

[0007] As a preferred technical solution, each user terminal is provided with a terminal encryption and decryption component, a password intercommunication server is provided in the ground forwarding control center, and an online communication link is provided between the password intercommunication server and the key management center.

[0008] As a preferred technical solution, the encryption and decryption component of each user terminal is only configured with its own communication key.

[0009] As a preferred technical solution, the password intercommunication server configures the communication keys of all user terminals.

[0010] As a preferred technical solution, the user information message transmitted by the user terminal during encrypted communication includes a packet header, a key version number, user information, an authentication code MAC, and a packet tail.

[0011] A satellite system-oriented encrypted communication method uses the satellite system-oriented encrypted communication system to perform encrypted communication.

[0012] As a preferred technical solution, when performing encrypted communication, the ground forwarding control center decrypts the information sent by the user terminal as the sender, and uses the communication key of the user terminal as the receiver to encrypt the information before forwarding it.

[0013] As a preferred technical solution, when performing encrypted communication, the user terminal as the sender and the user terminal as the receiver both perform key self-synchronization, including the following steps:

[0014] Z1, after the user terminal completes the network registration in the system, the key management center allocates an initial root key and the initial version number corresponding to the key to each user terminal, and the key management center pushes the initial root key and the initial version number corresponding to the key to the password intercommunication server;

[0015] Z2, the user terminal as the sender uses the initial root key to generate message digest values ​​based on a one-way hash operation, intercepts the data that meets the requirements from the message digest value generated by each rollover, and uses the rollover number as the corresponding key version number to complete the one-way rollover derivation of the user communication key;

[0016] Z3, the user terminal as the recipient performs a rolling process based on the previous communication key and the current communication key version number to complete the key self-synchronization between the user terminal as the recipient and the password intercommunication server.

[0017] As a preferred technical solution, encrypted communication includes the following steps:

[0018] S1, the user terminal as the sender encrypts the information and sends it to the satellite channel;

[0019] S2, the ground forwarding control center receives the information from the satellite channel, decrypts the information, encrypts it, and sends it to the satellite channel;

[0020] S3, the user terminal as the receiving party receives and decrypts the information from the satellite channel.

[0021] As a preferred technical solution, step S1 includes the following steps:

[0022] S11, the user terminal as the sender sends the user plaintext information to its own encryption and decryption component for cryptographic processing;

[0023] S12, the encryption and decryption component of the user terminal as the sender performs key derivation and rolling to generate a new round of communication keys, and updates the key version number stored locally, calculates the authentication code MAC with the current communication key version number and the user plaintext information, and encrypts the user plaintext information and the authentication code MAC, and then returns the current communication key version number and the ciphertext data to the user terminal as the sender;

[0024] S13, the user terminal as the sender packages the data returned by its own encryption and decryption component and sends it to the satellite channel according to the protocol;

[0025] Step S2 includes the following steps:

[0026] S21, the ground forwarding control center receives the user information packet sent by the user terminal as the sender through the satellite channel;

[0027] S22, the ground forwarding control center sends the received user information packet data to the password intercommunication server for password processing;

[0028] S23, the password intercommunication server extracts the communication key version number from the user information package, uses the corresponding user communication key to complete the key self-synchronization process, and updates the key version number stored locally, then decrypts the message and verifies the message authentication code. After the authentication is passed, the current key of the user terminal as the recipient is used to roll over and generate a new key, update and store the corresponding key version number, and complete the authentication code calculation and information data encryption of the new message;

[0029] S24, the password intercommunication server returns the communication key version number of the user terminal as the receiving party and the ciphertext data after the intercommunication processing to the ground forwarding control center;

[0030] S25, the ground forwarding control center packages the data returned by the password intercommunication server according to the protocol and sends it to the satellite channel;

[0031] Step S3 includes the following steps:

[0032] S31, a user terminal as a receiving party receives a user information packet through a satellite channel;

[0033] S32, the user terminal as the receiving party sends the received user ciphertext information to its own encryption and decryption component for cryptographic processing;

[0034] S33, the encryption and decryption component of the user terminal as the recipient extracts the communication key version number from the message, performs key rolling derivation to complete the key self-synchronization process, and updates the locally stored key version number, then decrypts the message and verifies the message authentication code. After the authentication is passed, the user plaintext information is returned to the user terminal as the recipient.

[0035] Compared with the prior art, the present invention has the following beneficial effects:

[0036] (1) The present invention can effectively solve the security problem of user information transmission in the air wireless channel of the low-bandwidth center-forwarding satellite system, thereby ensuring the security of user information and system application;

[0037] (2) The present invention can effectively solve the problem of difficulty in key synchronization negotiation interaction caused by the scarcity of wireless channel transmission resources for low-bandwidth center-forwarding satellite systems, especially satellite systems with burst data communication and no link maintenance function. Through the key self-synchronization design, key synchronization can be quickly completed without additional communication interaction between users, thereby reducing user information transmission delay, improving channel resource utilization efficiency, significantly enhancing system service performance, and facilitating large-scale promotion and application;

[0038] (3) The present invention can effectively solve the problem of flexible intercommunication between massive users in a low-bandwidth central forwarding satellite system. The end user only needs to configure his own communication key to realize information encryption and intercommunication among users in the entire network, with one key at a time, thus efficiently ensuring the secure transmission of user information. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 A schematic diagram of deployment and application of a satellite system according to the present invention;

[0040] Figure 2 Schematic diagram of the process of deriving the communication key of the information sender user;

[0041] Figure 3 This is a schematic diagram of the key self-synchronization process of the information receiver;

[0042] Figure 4 Flowchart for information encryption transmission. DETAILED DESCRIPTION

[0043] The present invention will be further described in detail below in conjunction with embodiments and drawings, but the embodiments of the present invention are not limited thereto.

[0044] Example 1

[0045] like Figures 1 to 4As shown, the present invention is based on a symmetric cryptographic system, through an innovative user key planning and configuration mode, combined with a key self-synchronization design, to propose a mass user encrypted communication method for a low-bandwidth central forwarding satellite system, which not only solves the problem of encryption protection of user sensitive information transmission, avoids eavesdropping, forgery and tampering of user information during air transmission, and ensures the information security and application security of the user system; and on the basis of simplifying the key negotiation and synchronization process, reducing the frequency of device communication interaction, and improving the utilization efficiency of channel transmission resources, effectively solves the key synchronization problem between users and the flexible intercommunication problem of mass users, so that users only need to store their own communication keys, one password at a time, and can quickly and efficiently realize secure transmission of user information.

[0046] The present invention mainly plans and configures user keys so that target users do not rely on user registration information in the system during actual application, do not need to synchronize data in real time, and do not need to frequently change configuration data, so that information encryption and intercommunication between users in the whole system can be realized; and further, through key self-synchronization technology, key synchronization can be completed without additional communication interaction between the sending and receiving users, and one-time one-key can be realized. The ground forwarding center of the satellite system, as an intermediate node between the communication sender and the receiver, can quickly complete the encryption, decryption, intercommunication and forwarding of user information content, and fully and efficiently meet the needs of user information security transmission. The user information message adopts technical means such as data encryption and authentication code verification to realize encryption protection and anti-tampering protection for the transmitted user information.

[0047] The key points of the present invention include four parts: system deployment application model, user communication key configuration method, key self-synchronization technology design, and information encryption transmission processing flow.

[0048] 1. System deployment application model

[0049] System deployment and application model of low-bandwidth center-forwarding satellite system encrypted communication Figure 1 shown.

[0050] A cryptographic intercommunication server is deployed in the ground relay control center of the satellite system, and encryption and decryption components are installed in the user terminal to encrypt and protect the user information content transmitted through the air wireless channel. The cryptographic intercommunication server encrypts and decrypts the information content transmitted between users.

[0051] The key management center is connected to the password intercommunication server online to facilitate key synchronization of new users at any time; the key management center and the user terminal (encryption and decryption component) do not need to be connected online. After the user terminal completes the network registration, the distribution and import of configuration data (including keys) can be completed online or manually offline.

[0052] 2. User communication key configuration method

[0053] The sender and receiver of user information only configure their own communication keys, and the password intercommunication server of the ground forwarding control center configures the communication keys of all users in the system that have been connected to the network, as shown in Table 1.

[0054] Table 1 User communication key configuration table

[0055]

[0056] According to the key planning configuration method in Table 1, the password intercommunication server of the ground forwarding control center is configured with all user communication keys, which can decrypt the sender's ciphertext information and encrypt it with the receiver's communication key before forwarding it.

[0057] 3. Key self-synchronization technology design

[0058] After the user completes the network registration in the system, the key management center assigns an initial root key and the initial version number T1 corresponding to the key to each user, and distributes it to the encryption and decryption components of the user terminal. At the same time, the key management center also pushes the user's key information to the password intercommunication server (the key management center and the password intercommunication server are deployed at the same location).

[0059] The sender of user information uses the initial root key to generate message digest values ​​based on a one-way hash operation. From the message digest value generated by each rollover, data of a specific length that meets the requirements is intercepted as the new round of communication key, and the rollover number is used as the corresponding key version number to complete the one-way rollover derivation of the user communication key, realizing one-time one-key, ensuring the security of user information transmission and system application security. The above process is as follows: Figure 2 shown.

[0060] When the sender of user information performs encrypted transmission, the message must carry the corresponding key version number. In this way, the user terminal as the receiver performs a rolling process based on the previous communication key and the current communication key version number to complete the key self-synchronization between the user terminal as the receiver and the sender (password intercommunication server). Figure 3 As shown in the figure, key self-synchronization technology can effectively avoid the tedious key negotiation and synchronization interaction process between the sender and the receiver, one key at a time, improve the efficiency of channel transmission resource utilization, and realize encrypted information communication between massive users.

[0061] 4. Information encryption transmission process

[0062] In the massive user encrypted communication system of low-bandwidth center-forwarding satellite system, the process of information encryption transmission is as follows: Figure 4 shown.

[0063] The specific steps of the information encryption transmission process are as follows:

[0064] (1) The information sender, user terminal A, sends the user's plaintext information to encryption and decryption component A for cryptographic processing.

[0065] (2) Encryption and decryption component A performs key derivation and rolling to generate a new round of communication keys, and updates the locally stored key version number. It calculates the authentication code MAC together with the current communication key version number and the user's plaintext information, encrypts the user's plaintext information and the authentication code MAC, and then returns the current communication key version number together with the ciphertext data to user terminal A.

[0066] (3) User terminal A packages the data returned by encryption and decryption component A and sends it to the satellite channel according to the protocol.

[0067] (4) The ground forwarding control center of the satellite system receives the user information packet sent by user terminal A via satellite.

[0068] (5) The ground forwarding control center of the satellite system sends the received user information packet data to the password intercommunication server for password processing.

[0069] (6) The password intercommunication server extracts the communication key version number from the user information package, uses the corresponding user communication key to complete the key self-synchronization process, and updates the locally stored key version number. It then decrypts the message and verifies the message authentication code. After the authentication is passed, it uses the target receiving user's current key to roll over and generate a new key, updates and stores the corresponding key version number, and completes the authentication code calculation and information data encryption of the new message.

[0070] (7) The password intercommunication server returns the target user's communication key version number and ciphertext data after intercommunication processing to the ground forwarding control center.

[0071] (8) The ground forwarding control center packages the data returned by the cryptographic intercommunication server according to the protocol and sends it to the satellite channel.

[0072] (9) User terminal B receives the user information packet through the satellite downlink channel.

[0073] (10) User terminal B sends the received user ciphertext information to encryption and decryption component B for cryptographic processing.

[0074] (11) Encryption and decryption component B extracts the communication key version number from the message, performs key rolling derivation to complete the key self-synchronization process, and updates the key version number stored locally. It then decrypts the message and verifies the message authentication code. After the authentication is successful, the user plaintext information is returned to user terminal B.

[0075] The advantages of the present invention are:

[0076] The present invention can effectively solve the security problem of user information transmission in the air wireless channel of the low-bandwidth center-forwarding satellite system, thereby ensuring the security of user information and system application.

[0077] The present invention can effectively solve the problem of difficulty in key synchronization negotiation interaction caused by the scarcity of wireless channel transmission resources for low-bandwidth center-forwarding satellite systems, especially satellite systems with burst data communication and no link maintenance function. Through the key self-synchronization design, key synchronization can be quickly completed without additional communication interaction between users, which reduces the user information transmission delay, improves the channel resource utilization efficiency, significantly enhances the system service performance, and is conducive to large-scale promotion and application.

[0078] The present invention can effectively solve the problem of flexible intercommunication between massive users in a low-bandwidth central forwarding satellite system. The terminal user only needs to configure his own communication key to realize information encryption and intercommunication between users in the entire network, with one key at a time, thus efficiently ensuring the secure transmission of user information.

[0079] As described above, the present invention can be preferably implemented.

[0080] All features disclosed in all embodiments in this specification, or steps in all methods or processes implicitly disclosed, except for mutually exclusive features and / or steps, can be combined and / or expanded or replaced in any manner.

[0081] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any form. According to the technical essence of the present invention, within the spirit and principles of the present invention, any simple modification, equivalent replacement and improvement made to the above embodiment still falls within the protection scope of the technical solution of the present invention.

Claims

1. An encrypted communication system for a satellite system, characterized in that: It includes a key management center, several user terminals, and a ground forwarding control center that is connected to the key management center for communication.

2. The encrypted communication system for satellite systems according to claim 1, characterized in that: Each user terminal is equipped with a terminal encryption and decryption component, the ground forwarding control center is equipped with a password intercommunication server, and there is an online communication link between the password intercommunication server and the key management center.

3. The encrypted communication system for satellite systems according to claim 2, characterized in that: The encryption and decryption components of each user terminal are only configured with their own communication keys.

4. The encrypted communication system for satellite systems according to claim 3, characterized in that: The password intercommunication server configures the communication keys of all user terminals.

5. An encrypted communication system for a satellite system according to any one of claims 2 to 4, characterized in that: The user information message transmitted by the user terminal during encrypted communication includes a packet header, a key version number, user information, an authentication code MAC, and a packet tail.

6. An encrypted communication method for a satellite system, characterized in that: An encrypted communication system for a satellite system as described in any one of claims 2 to 5 is used for encrypted communication.

7. The method for satellite system-oriented encrypted communication according to claim 6, characterized in that: When conducting encrypted communication, the ground forwarding control center decrypts the information sent by the user terminal as the sender, and encrypts the information using the communication key of the user terminal as the receiver before forwarding it.

8. The method for satellite system-oriented encrypted communication according to claim 7, characterized in that: When performing encrypted communication, the user terminal as the sender and the user terminal as the receiver both perform key self-synchronization, including the following steps: Z1, after the user terminal completes the network registration in the system, the key management center allocates an initial root key and the initial version number corresponding to the key to each user terminal, and the key management center pushes the initial root key and the initial version number corresponding to the key to the password intercommunication server; Z2, the user terminal as the sender uses the initial root key to generate message digest values ​​based on a one-way hash operation, intercepts the data that meets the requirements from the message digest value generated by each rollover, and uses the rollover number as the corresponding key version number to complete the one-way rollover derivation of the user communication key; Z3, the user terminal as the recipient performs a rolling process based on the previous communication key and the current communication key version number to complete the key self-synchronization between the user terminal as the recipient and the password intercommunication server.

9. An encrypted communication method for a satellite system according to any one of claims 6 to 8, characterized in that: Encrypted communication involves the following steps: S1, the user terminal as the sender encrypts the information and sends it to the satellite channel; S2, the ground forwarding control center receives the information from the satellite channel, decrypts the information, encrypts it, and sends it to the satellite channel; S3, the user terminal as the receiving party receives and decrypts the information from the satellite channel.

10. The method for satellite system-oriented encrypted communication according to claim 9, characterized in that: Step S1 includes the following steps: S11, the user terminal as the sender sends the user plaintext information to its own encryption and decryption component for cryptographic processing; S12, the encryption and decryption component of the user terminal as the sender performs key derivation and rolling to generate a new round of communication keys, and updates the key version number stored locally, calculates the authentication code MAC with the current communication key version number and the user plaintext information, and encrypts the user plaintext information and the authentication code MAC, and then returns the current communication key version number and the ciphertext data to the user terminal as the sender; S13, the user terminal as the sender packages the data returned by its own encryption and decryption component and sends it to the satellite channel according to the protocol; Step S2 includes the following steps: S21, the ground forwarding control center receives the user information packet sent by the user terminal as the sender through the satellite channel; S22, the ground forwarding control center sends the received user information packet data to the password intercommunication server for password processing; S23, the password intercommunication server extracts the communication key version number from the user information package, uses the corresponding user communication key to complete the key self-synchronization process, and updates the key version number stored locally, then decrypts the message and verifies the message authentication code. After the authentication is passed, the current key of the user terminal as the recipient is used to roll over and generate a new key, update and store the corresponding key version number, and complete the authentication code calculation and information data encryption of the new message; S24, the password intercommunication server returns the communication key version number of the user terminal as the receiving party and the ciphertext data after the intercommunication processing to the ground forwarding control center; S25, the ground forwarding control center packages the data returned by the password intercommunication server according to the protocol and sends it to the satellite channel; Step S3 includes the following steps: S31, a user terminal as a receiving party receives a user information packet through a satellite channel; S32, the user terminal as the receiving party sends the received user ciphertext information to its own encryption and decryption component for cryptographic processing; S33, the encryption and decryption component of the user terminal as the recipient extracts the communication key version number from the message, performs key rolling derivation to complete the key self-synchronization process, and updates the locally stored key version number, then decrypts the message and verifies the message authentication code. After the authentication is passed, the user plaintext information is returned to the user terminal as the recipient.

Images