Beidou user-oriented short message encryption communication system and method

Abstract

The invention relates to the technical field of information security, and discloses a Beidou user-oriented short message encryption communication system and method, the system comprises a plurality of users and a user intercommunication domain planning management system, and each user is in communication connection with an encryption and decryption component. The problem that in the prior art, it is difficult to rapidly and flexibly achieve safe information transmission is solved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a short message encryption communication system and method for Beidou users. Background Art

[0002] The BeiDou satellite navigation system is independently designed and developed by my country, and can provide global users with all-weather real-time navigation, rapid positioning, short message communication and precise timing services. Among them, short message communication is a unique feature of my country's BeiDou satellite navigation system, which is different from other global satellite navigation systems. BeiDou short message communication uses BeiDou satellites to achieve earth-to-sky communication, is not restricted by time and space, has the advantages of all-weather and not affected by natural disasters, and plays an increasingly important role in all walks of life and fields related to national life, and has significantly solved a series of problems such as reliable communication, network construction and system maintenance of user systems. However, the civil BeiDou short message communication uses plain text data transmission. For some specific industry users (such as hydrological monitoring, geographic surveying and mapping, transportation, marine fisheries, power applications, emergency rescue, etc.), sensitive information may exist in the data transmitted through BeiDou short messages. This information is only allowed to be transmitted between industry users. If data leakage occurs, it may cause serious consequences or safety accidents.

[0003] At present, some civilian Beidou short message encryption communication systems generally rely on other communication networks (such as the Internet) to solve the key negotiation and synchronization problems between the sender and receiver of the Beidou terminal. For users who do not have real-time Internet connectivity, their information encryption application needs cannot be met; or some civilian Beidou short message encryption communication systems rely on the Beidou system's in-band channel to conduct multiple negotiations to complete key synchronization, which does not fully consider the short message communication frequency limit of the civilian Beidou user terminal and the scarcity of Beidou system's in-band transmission resources, resulting in the actual application effect not meeting expectations. Summary of the invention

[0004] In order to overcome the shortcomings of the prior art, the present invention provides a short message encryption communication system and method for Beidou users, which solves the problems existing in the prior art such as difficulty in quickly and flexibly realizing secure information transmission.

[0005] The technical solution adopted by the present invention to solve the above problems is:

[0006] A short message encryption communication system for Beidou users includes several users and a user intercommunication domain planning and management system, and each user communication is connected with an encryption and decryption component.

[0007] As an optimal technical solution, a user intercommunication domain planning and management system is used to: plan and manage the intercommunication domains for information transmission of users, and clearly identify users in the same intercommunication domain; assign an independent key to each intercommunication domain, and all users in the same intercommunication domain are configured with the key to achieve information encryption and intercommunication; different intercommunication domains have different keys and cannot perform information encryption and intercommunication; then send each user's intercommunication domain configuration data to the encryption and decryption components connected to each user's communication. If the user is in multiple intercommunication domains, the user has multiple sets of intercommunication domain configuration data; wherein the intercommunication domain configuration data includes the intercommunication domain number and the intercommunication domain key.

[0008] As a preferred technical solution, the encryption and decryption component is used to: when the user is working, the user selects a key to encrypt and protect the information data to be transmitted.

[0009] As a preferred technical solution, the design method of the short message encryption transmission protocol format for encrypted communication is: re-arrange the short message payload field, and specifically divide the bits of a set length as encryption and decryption identification fields to support the sender and receiver to correctly complete the information encryption and decryption operations.

[0010] As a preferred technical solution, the short message payload field of the short message encryption transmission protocol of encrypted communication includes the following contents: cipher frame header, industry code, intercommunication domain number, short message information, and authentication code MAC.

[0011] As a preferred technical solution, during encrypted communication, the short message information, the cipher frame header, the industry code, and the intercommunication domain number are used as a whole to calculate the authentication code MAC.

[0012] As a preferred technical solution, during encrypted communication, the authentication code MAC and the short message information are encrypted as a whole and then transmitted.

[0013] A short message encryption communication method for Beidou users uses the short message encryption communication system for Beidou users to perform encrypted communication.

[0014] As a preferred technical solution, the following steps are included:

[0015] S1, the information sender sends the user's plaintext information to its own encryption and decryption component for cryptographic processing;

[0016] S2, the encryption and decryption component of the information sender selects the corresponding intercommunication domain key according to the intercommunication domain to which the information to be transmitted belongs, calculates the authentication code and encrypts the payload data according to the short message encryption transmission protocol format, and returns it to the information sender after encapsulating the data format;

[0017] S3, the information sender packages the data returned by its own encryption and decryption components according to the Beidou short message air transmission protocol and sends it to the satellite channel for processing by the Beidou ground system;

[0018] S4, the information receiver receives the user information packet processed by the Beidou system and forwarded by the satellite through the satellite channel according to the communication relationship planned in the information exchange domain;

[0019] S5, the information receiving party sends the received user ciphertext information to its own encryption and decryption component for cryptographic processing;

[0020] S6, the encryption and decryption component of the information receiver extracts data from the Beidou short message payload field, checks whether it is consistent with its own industry code and interoperability domain number, obtains the interoperability domain key, combines the cipher frame header, decrypts the ciphertext data of the user information packet, and then verifies the message authentication code. After the authentication is passed, the user plaintext information is returned to the information receiver.

[0021] As a preferred technical solution, in step S6, the method for obtaining the intercommunication domain key is: extract the corresponding intercommunication domain key data according to the intercommunication domain number in the Beidou short message payload field: if the information recipient is located in N intercommunication domains, then select the data of the group consistent with the message intercommunication domain number from the N groups of intercommunication domain configuration data stored locally, and use the intercommunication domain key of the group for decryption processing; wherein N≥2 and N is an integer.

[0022] Compared with the prior art, the present invention has the following beneficial effects:

[0023] (1) The present invention can effectively solve the security problem of user information of civil Beidou industry users transmitted through air wireless channels, eliminate the risk of data leakage, and ensure user information security and system application security;

[0024] (2) The present invention adopts the encryption protection design based on the isolation of information transmission and communication domains, which can not only flexibly plan and configure the information sharing and communication scope among multiple terminal users according to actual needs, but also meet the multi-domain independent communication needs of a single user, which is conducive to large-scale promotion and application;

[0025] (3) By adopting the present invention, key synchronization can be quickly achieved without additional interaction between users, which greatly reduces the user information transmission delay, effectively reduces the system channel resource overhead, and significantly enhances the system application service performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 A schematic diagram for planning user interconnection domains;

[0027] Figure 2 Deployment of application model diagram for encrypted communication system;

[0028] Figure 3 This is the format diagram of the short message encryption transmission protocol;

[0029] Figure 4 Flowchart for encrypted transmission of multi-domain information. DETAILED DESCRIPTION

[0030] The present invention will be further described in detail below in conjunction with embodiments and drawings, but the embodiments of the present invention are not limited thereto.

[0031] Example 1

[0032] like Figures 1 to 4 As shown, the present invention is based on a symmetric cryptographic system and adopts the principle of implementing isolation protection according to the information transmission and intercommunication domain, and proposes a short message encryption communication system for civil Beidou industry user applications, which not only solves the problem of encryption protection of user sensitive information transmission, avoids user information from being eavesdropped, forged and tampered with during air transmission, eliminates the risk of data leakage, and ensures the information security and application security of the user system; it can also flexibly plan and configure the scope of information sharing and intercommunication between users according to actual needs; in addition, key synchronization can be quickly achieved without additional interaction between users, which greatly reduces the user information transmission delay, effectively reduces the system channel resource overhead, and significantly enhances the system application service performance.

[0033] The present invention mainly deploys a user intercommunication domain planning and management system to manage and plan the intercommunication domain of information transmission for the industry users of civil Beidou on demand, and clarify which users are in the same intercommunication domain; an intercommunication domain is assigned an independent communication encryption key, and all users in the intercommunication domain are configured with the key to achieve information encryption intercommunication; different intercommunication domains have different keys, and information encryption intercommunication cannot be performed. An industry can plan multiple intercommunication domains as needed, and different users are assigned to the domains; a user can also be planned in multiple intercommunication domains as needed, and multiple intercommunication domain keys are configured to implement encryption protection for the transmitted information. After the user intercommunication domain planning and management system generates the intercommunication domain configuration data, the data can be sent down and imported into the encryption and decryption component in an online or manual offline manner. The user intercommunication domain planning and management system is not necessarily connected to the user (encryption and decryption component) online.

[0034] The main points of the present invention include four parts: user intercommunication domain planning and management, system deployment application model, short message encryption transmission protocol design and information encryption transmission process.

[0035] 1. User intercommunication domain planning and management

[0036] User intercommunication domain planning is divided according to the information transmission and sharing scope of industry users, such as Figure 1 shown.

[0037] According to the user interconnection domain planning diagram, users a, b, and c are planned in interconnection domain 1, users c, d, e, and f are planned in interconnection domain 2, and users g, h, i, j, and k are planned in interconnection domain 3. Among them, user c, as a cross-domain user, belongs to both interconnection domain 1 and interconnection domain 2.

[0038] According to the information communication relationship, the intercommunication domain key configuration of each user is shown in Table 1.

[0039] Table 1 User intercommunication domain key configuration table

[0040]

[0041] Users a and b configure the key Key1 of intercommunication domain 1; users d, e, and f configure the key Key2 of intercommunication domain 2; users g, h, i, j, and k configure the key Key3 of intercommunication domain 3; user c, as a cross-domain user, configures the key Key1 of intercommunication domain 1 and the key Key2 of intercommunication domain 2.

[0042] 2. System deployment application model

[0043] Deployment and application of short message encryption communication system for civil Beidou industry users Figure 2 shown.

[0044] The user intercommunication domain planning and management system plans and configures the corresponding intercommunication domain for users in the industry according to the actual needs of information communication, and then sends each user's intercommunication domain configuration data (including intercommunication domain number and intercommunication domain key) to the corresponding encryption and decryption components. If the user is in multiple intercommunication domains, the user has multiple sets of intercommunication domain configuration data (one intercommunication domain corresponds to one set of intercommunication domain configuration data). When the user device is working, the corresponding intercommunication domain key is automatically selected according to the communication relationship to encrypt and protect the information data to be transmitted.

[0045] 3. Design of short message encryption transmission protocol

[0046] At the Beidou system level, civil Beidou short messages are transmitted in plain text. Therefore, the existing message format needs to be redesigned to meet the protocol parsing requirements for encrypted transmission of user information data packets. At the same time, in order to avoid the Beidou system treating user information data packets transmitted via satellite as illegal messages and denying service, the redesigned message format should be compatible with the existing Beidou short message air transmission protocol format to the greatest extent possible. Therefore, a feasible approach is to not change the message header and trailer format, but only re-arrange the short message content payload data, and specifically allocate a small number of bits of a set length as encryption and decryption identification fields to support both the sender and the receiver to correctly complete information encryption and decryption operations. The short message encryption transmission protocol uses technical means such as data encryption and authentication code verification to achieve encryption protection and anti-tampering protection for transmitted user information.

[0047] The format of short message encryption transmission protocol is as follows Figure 3 shown.

[0048] in:

[0049] (1) Cryptographic frame header: used for initialization synchronization of the algorithms between the sender and receiver in this communication, and for plain text transmission.

[0050] (2) Industry code: used to identify the industry category of the user, transmitted in plain text.

[0051] (3) Intercommunication domain number: It is used to identify which intercommunication domain key is used for encryption protection in this communication and is transmitted in plain text.

[0052] (4) Short message information: The user information data content to be transmitted. This field and the authentication code plain text are encrypted as a whole before transmission.

[0053] (5) Authentication code MAC: used by the receiver to verify the integrity of the message. The authentication code is calculated for the cipher frame header, industry code, intercommunication domain number, and plain text data of the short message information. This field is encrypted together with the plain text of the short message information before transmission.

[0054] 4. Information encryption transmission process

[0055] In the short message encryption communication system for civil Beidou industry users, the process of information encryption transmission is as follows: Figure 4 shown.

[0056] The specific steps of the information encryption transmission process are as follows:

[0057] (1) Information sender a sends the user's plaintext information to encryption and decryption component a for cryptographic processing.

[0058] (2) Encryption and decryption component a selects the corresponding intercommunication domain key Key1 according to the intercommunication domain 1 to which the information to be transmitted belongs, calculates the authentication code and encrypts the payload data according to the short message encryption transmission protocol format, and returns it to user a after encapsulating it in data format.

[0059] (3) User a packages the data returned by encryption and decryption component a according to the Beidou short message air transmission protocol and sends it to the satellite channel for processing by the Beidou ground system.

[0060] (4) According to the communication relationship planned in the information exchange domain, user c, as the recipient of this information, receives the user information packet processed by the Beidou system and forwarded by the satellite through the satellite downlink channel.

[0061] (5) User c sends the received user ciphertext information to encryption and decryption component c for cryptographic processing.

[0062] (6) The encryption and decryption component c extracts the corresponding data from the payload field of the Beidou short message, checks whether it is consistent with its own industry code and interoperability domain number, extracts the corresponding local interoperability domain key (here is the interoperability domain key Key1), and decrypts the ciphertext data of the user information packet in combination with the cipher frame header, and then verifies the message authentication code. After the authentication is passed, the user plaintext information is returned to user c. The method for obtaining the interoperability domain key is: extract the corresponding interoperability domain key data according to the interoperability domain number in the payload field of the Beidou short message. If the information receiver is located in N interoperability domains, then select the group of data that is consistent with the message interoperability domain number from the N groups of interoperability domain configuration data stored locally, and use its interoperability domain key for decryption processing; where N ≥ 2 and N is an integer.

[0063] Similarly, steps (7) to (12) shown in the figure are the transmission process of user d sending information and user c receiving information in intercommunication domain 2. The information processing process is consistent with the principles of steps (1) to (6). Receiver c extracts the intercommunication domain number from the message, selects the set of data that is consistent with the intercommunication domain number of the message from the multiple sets of intercommunication domain configuration data stored locally by user c, obtains the intercommunication domain key (here, intercommunication domain key Key2) from it, and performs cryptographic operations.

[0064] The advantages of the present invention are:

[0065] The present invention can effectively solve the security problem of user information of civil Beidou industry users transmitted through air wireless channels, eliminate the risk of data leakage, and ensure the security of user information and system applications;

[0066] The present invention adopts the encryption protection design based on the isolation of information transmission intercommunication domains, which can not only flexibly plan and configure the information sharing and intercommunication scope among multiple terminal users according to actual needs, but also meet the multi-domain independent intercommunication needs of a single user, which is conducive to large-scale promotion and application;

[0067] By adopting the present invention, key synchronization can be quickly achieved without additional interaction between users, which greatly reduces the user information transmission delay, effectively reduces the system channel resource overhead, and significantly enhances the system application service performance.

[0068] As described above, the present invention can be preferably implemented.

[0069] All features disclosed in all embodiments in this specification, or steps in all methods or processes implicitly disclosed, except for mutually exclusive features and / or steps, can be combined and / or expanded or replaced in any manner.

[0070] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any form. According to the technical essence of the present invention, within the spirit and principles of the present invention, any simple modification, equivalent replacement and improvement made to the above embodiment still falls within the protection scope of the technical solution of the present invention.

Claims

1. A short message encryption communication system for Beidou users, characterized in that: It includes several users and user intercommunication domain planning and management system, and each user communication is connected with encryption and decryption components.

2. A short message encryption communication system for Beidou users according to claim 1, characterized in that: The user intercommunication domain planning and management system is used to: plan and manage the intercommunication domains for information transmission of users, and clearly identify users in the same intercommunication domain; assign an independent key to each intercommunication domain, and all users in the same intercommunication domain are configured with the key to achieve information encryption and intercommunication; different intercommunication domains have different keys and cannot perform information encryption and intercommunication; then send each user's intercommunication domain configuration data to the encryption and decryption components connected to each user's communication. If the user is in multiple intercommunication domains, the user has multiple sets of intercommunication domain configuration data; wherein, the intercommunication domain configuration data includes the intercommunication domain number and the intercommunication domain key.

3. A short message encryption communication system for Beidou users according to claim 2, characterized in that: The encryption and decryption components are used to: When the user is working, the selected key is used to encrypt and protect the information data to be transmitted.

4. A short message encryption communication system for Beidou users according to any one of claims 1 to 3, characterized in that: The design method of the short message encryption transmission protocol format for encrypted communication is: re-arrange the short message payload field, and specially divide the bits of a set length as the encryption and decryption identification field to support the sender and receiver to correctly complete the information encryption and decryption operations.

5. A short message encryption communication system for Beidou users according to claim 4, characterized in that: The short message payload field of the short message encryption transmission protocol for encrypted communication includes the following: Cipher frame header, industry code, intercommunication domain number, short message information, authentication code MAC.

6. A short message encryption communication system for Beidou users according to claim 5, characterized in that: During encrypted communication, the authentication code MAC is calculated as a whole using the short message information, the cipher frame header, the industry code, and the intercommunication domain number.

7. A short message encryption communication system for Beidou users according to claim 6, characterized in that: During encrypted communication, the authentication code MAC and short message information are encrypted as a whole before transmission.

8. A short message encryption communication method for Beidou users, characterized in that: A short message encryption communication system for Beidou users as described in any one of claims 1 to 7 is used for encrypted communication.

9. A short message encryption communication method for Beidou users according to claim 8, characterized in that: The following steps are involved: S1, the information sender sends the user's plaintext information to its own encryption and decryption component for cryptographic processing; S2, the encryption and decryption component of the information sender selects the corresponding intercommunication domain key according to the intercommunication domain to which the information to be transmitted belongs, calculates the authentication code and encrypts the payload data according to the short message encryption transmission protocol format, and returns it to the information sender after encapsulating the data format; S3, the information sender packages the data returned by its own encryption and decryption components according to the Beidou short message air transmission protocol and sends it to the satellite channel for processing by the Beidou ground system; S4, the information receiver receives the user information packet processed by the Beidou system and forwarded by the satellite through the satellite channel according to the communication relationship planned in the information exchange domain; S5, the information receiving party sends the received user ciphertext information to its own encryption and decryption component for cryptographic processing; S6, the encryption and decryption component of the information receiver extracts data from the Beidou short message payload field, checks whether it is consistent with its own industry code and interoperability domain number, obtains the interoperability domain key, combines the cipher frame header, decrypts the ciphertext data of the user information packet, and then verifies the message authentication code. After the authentication is passed, the user plaintext information is returned to the information receiver.

10. A short message encryption communication method for Beidou users according to claim 9, characterized in that: In step S6, the method for obtaining the intercommunication domain key is: extract the corresponding intercommunication domain key data according to the intercommunication domain number in the Beidou short message payload field: if the information recipient is located in N intercommunication domains, then select the data of the group consistent with the message intercommunication domain number from the N groups of intercommunication domain configuration data stored locally, and use the intercommunication domain key of the group for decryption processing; wherein N≥2 and N is an integer.

Images