Data security sharing method for commercial space TT&C network

Abstract

The application discloses a data security sharing method for a commercial spaceflight TT&C network, which is applied to a commercial spaceflight TT&C network system comprising a password service platform, a business data service platform and a data access demand end, the data access demand end is in communication connection with the password service platform and the business data service platform respectively, the business data service platform is in communication connection with the password service platform, the business data service platform comprises a plurality of spaceflight business systems, each spaceflight business system comprises a security middleware, and the method comprises the following steps: key certificate issuing; identity authentication; data access and encrypted downloading; and data decryption. The data security sharing method for the commercial spaceflight TT&C network issues intelligent password keys and digital certificates to the data access demand end through the password service platform, identity authentication is performed by using the digital certificates, the authenticity and credibility of the identity of the data access demand end are ensured, and safe access sharing of data is realized.

Description

Technical Field

[0001] This invention relates to the field of aerospace communication technology, and in particular to a data security sharing method for commercial aerospace telemetry and control networks. Background Technology

[0002] With the booming development of China's commercial space industry, related technologies such as mobile internet, the Internet of Things, cloud computing, big data, artificial intelligence, and information security are profoundly impacting industrial development and people's daily lives. Commercial space services cover various fields including land resources, surveying and mapping, agriculture, forestry, water conservancy, environmental protection, navigation, and meteorology. The business volume is expanding year by year, involving massive amounts of data and information. This data and information may be closely related to national security, economic development, and the well-being of the people. Therefore, the necessity of establishing corresponding security protection mechanisms for business data at each stage—from generation, storage, forwarding, transmission, and application—is self-evident.

[0003] The commercial aerospace sector involves various business segments, including satellite and rocket manufacturing, launch, operation, and application. These segments involve diverse data types and frequent data flows. The access authentication mechanisms of these business systems still rely on low-level authentication methods such as usernames and passwords, which are unsuitable for secure access in scenarios such as the Internet and mobile Internet. This can easily lead to the risk of user identities being impersonated and forged, thereby affecting the company's reputation and harming the interests of the company and its users. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to provide a data security sharing method for commercial aerospace telemetry and control networks, so as to perform identity authentication and realize secure access and sharing of data.

[0005] To solve the above-mentioned technical problems, the objective of this invention is achieved through the following technical solution: A data security sharing method for commercial aerospace telemetry and control networks is provided, applied to a commercial aerospace telemetry and control network system. The commercial aerospace telemetry and control network system includes a cryptographic service platform, a business data service platform, and a data access request terminal. The data access request terminal is communicatively connected to both the cryptographic service platform and the business data service platform. The business data service platform is communicatively connected to the cryptographic service platform. The business data service platform includes several aerospace business systems, each of which includes a security middleware. The data security sharing method for commercial aerospace telemetry and control networks includes the following steps: Key certificate issuance: The cryptographic service platform issues a corresponding smart cryptographic key to the data access request terminal and also issues a digital certificate to the data access request terminal; Identity authentication: The data access request terminal concatenates the request terminal's encrypted certificate and the random number generated by the received cryptographic service platform to form the original data, digitally signs the original data using the request terminal's signing private key, and sends the obtained data signature packet to the business data service platform. The business data service platform calls the cryptographic service platform to parse and verify the data signature package and perform blacklist and whitelist checks. For data access and encrypted download: the business data service platform encrypts and caches the encryption certificate sent by the data access requester, uses digital envelope technology to encrypt the data to be encrypted, generates digital envelope ciphertext, and stores it. The data access requester calls the security middleware through the business data service platform, uses the business data service platform's encryption private key to decrypt the symmetric key ciphertext to obtain the symmetric key, encrypts the symmetric key using the requester's encryption certificate to update the symmetric key ciphertext, and updates the digital envelope ciphertext according to the updated symmetric key ciphertext. For data decryption: the data access requester calls the security middleware through the business data service platform to unpack the obtained digital envelope ciphertext, obtains the corresponding symmetric key ciphertext and data ciphertext, uses an asymmetric encryption algorithm combined with the requester's encryption private key to decrypt, obtains the symmetric key, and uses a symmetric encryption algorithm combined with the decrypted symmetric key to decrypt the unpacked data ciphertext, obtaining the data to be encrypted.

[0006] The beneficial technical effects of this invention are as follows: The data security sharing method for commercial aerospace telemetry and control networks of this invention issues corresponding smart cryptographic keys and digital certificates to data access requesters through a cryptographic service platform. By using digital certificates for identity authentication, the authenticity and trustworthiness of the data access requester's identity can be ensured, preventing identity spoofing and information leakage, thus achieving secure data access and sharing. Furthermore, the use of digital envelope technology for encryption protects the key, ensuring that it will not be stolen or tampered with during transmission. The encryption and decryption of the digital envelope technology ensures that only the intended recipient can open and obtain the data. The use of digital envelopes significantly enhances key security during data sharing, ensuring data confidentiality. Furthermore, digital envelope technology allows for the secure transmission of public keys over the public internet, while private keys remain securely stored, preventing key leaks, simplifying key management, and improving key management and exchange efficiency. During data encryption, only the symmetric key ciphertext is updated to update the digital envelope ciphertext, eliminating the need for re-encryption and decryption. This optimizes the encryption process, increasing encryption and decryption speed during data sharing. It ensures data sharing security while improving speed and efficiency, reducing computational complexity and resource consumption, making it suitable for various scenarios and highly practical. Attached Figure Description

[0007] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0008] Figure 1 This is a flowchart illustrating a data security sharing method for commercial aerospace telemetry and control networks provided in an embodiment of the present invention. Detailed Implementation

[0009] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0010] Please see Figure 1 , Figure 1This is a flowchart illustrating a data security sharing method for commercial aerospace telemetry and control networks provided in an embodiment of the present invention. The method is applied to a commercial aerospace telemetry and control network system, which includes a cryptographic service platform, a business data service platform, and a data access request terminal. The data access request terminal is communicatively connected to both the cryptographic service platform and the business data service platform. The business data service platform is communicatively connected to the cryptographic service platform. The business data service platform includes several aerospace business systems, each of which includes a security middleware. The data security sharing method for commercial aerospace telemetry and control networks includes the following steps:

[0011] Step S11, Key Certificate Issuance: The cryptographic service platform issues a corresponding smart cryptographic key and a digital certificate to the data access requester. The smart cryptographic key includes a requester encryption key pair and a requester signature key pair. Each key pair includes a public key and a private key; therefore, the requester encryption key pair includes a requester encryption public key and a requester encryption private key, and the requester signature key pair includes a requester signature public key and a requester signature private key. The cryptographic service platform provides a certificate application and download interface for the data access requester to issue digital certificates. The digital certificate uses advanced encryption technology to ensure the security and integrity of data during transmission, effectively preventing data tampering or forgery. The digital certificate includes a requester signature certificate and a requester encryption certificate; therefore, the cryptographic service platform issues both to the data access requester. The requester signature certificate is used to prove the identity of the data access requester, and the requester encryption certificate is used to encrypt data to improve data security.

[0012] Step S12, Identity Authentication: The data access requesting party concatenates its encrypted certificate and the random number generated by the received cryptographic service platform to form the original data. It then digitally signs the original data using its private signing key, obtaining a data signature packet, which is sent to the business data service platform. The business data service platform calls the cryptographic service platform to parse and verify the data signature packet, and performs blacklist and whitelist checks. The encrypted certificate is the one issued by the cryptographic service platform to the data access requesting party, and the private signing key is the one issued by the cryptographic service platform to the data access requesting party. By verifying the encrypted certificate and checking the blacklist and whitelist of the data signature packet, identity verification and confirmation of the corresponding encrypted certificate's status on the business data service platform can be achieved.

[0013] Step S13, Data Access and Encrypted Download: The business data service platform encrypts and caches the encryption certificate sent by the data access requester, and uses digital envelope technology to encrypt the data to be encrypted, generating and storing the ciphertext in the digital envelope. The data access requester calls the security middleware through the business data service platform, uses the platform's encryption private key to decrypt the symmetric key ciphertext to obtain the symmetric key, encrypts the symmetric key using the requester's encryption certificate to update the symmetric key ciphertext, and updates the digital envelope ciphertext according to the updated symmetric key ciphertext. The data to be encrypted can be data information or a file. The requester's encryption certificate contains the requester's encryption public key.

[0014] Step S14, Data Decryption: The data access request end calls the security middleware through the business data service platform to unpack the obtained digital envelope ciphertext, obtain the corresponding symmetric key ciphertext and data ciphertext, and use an asymmetric encryption algorithm combined with the request end's encryption private key to decrypt it, obtain the symmetric key, and use a symmetric encryption algorithm combined with the decrypted symmetric key to decrypt the unpacked data ciphertext, obtain the data to be encrypted.

[0015] The data access request end refers to the request end that needs to access data from commercial aerospace telemetry and control network systems such as telemetry. The data access request end includes aerospace telemetry and control personnel, aerospace telemetry and control equipment, and aerospace telemetry and control organizations. The cryptographic service platform is used for certificate management and provides functions such as key management, middleware management, and log auditing for the security middleware. The data security sharing method for commercial aerospace telemetry and control networks describes a method that issues corresponding smart cryptographic keys and digital certificates to data access requesters through a cryptographic service platform. Using digital certificates for identity authentication ensures the authenticity and trustworthiness of the data access requester's identity, preventing identity spoofing and information leakage, and achieving secure data access and sharing. Employing digital envelope technology for encryption protects the key, ensuring it is not stolen or tampered with during transmission. The encryption and decryption of digital envelopes ensures that only designated recipients can open and obtain the key, significantly enhancing key security and data confidentiality during data sharing. Furthermore, digital envelope technology allows secure transmission of public keys over public networks while keeping private keys securely stored, avoiding key leakage, simplifying key management complexity, and improving key management and exchange efficiency. During data encryption, only the symmetric key ciphertext is updated to update the digital envelope ciphertext; there is no need to re-encrypt and decrypt the data, optimizing the encryption process and improving encryption and decryption speed during data sharing. This method ensures data sharing security while increasing speed and efficiency, reducing computational complexity and resource consumption, making it applicable to various scenarios and highly practical. The data security sharing method for commercial aerospace telemetry and control networks described in the security middleware can facilitate the recording of data access and sharing operations, including information such as operation time, operators, and operation content, so as to facilitate subsequent auditing and accountability, making the operation auditable.

[0016] Specifically, step S12 includes:

[0017] The data access requesting party sends a login access request to the business data service platform, and the business data service platform sends a random number request to the password service platform based on the received login access request;

[0018] The cryptographic service platform generates a random number based on the received random number request and sends the generated random number to the data access requesting end;

[0019] The data access requester concatenates the requester's encrypted certificate and the received random number to form the original data, and digitally signs the original data using the requester's signing private key to obtain a data signature packet, which is then sent to the business data service platform. The digital signature is a PKCS#7 signature, and the obtained data signature packet contains a signing certificate corresponding to the requester's signing private key. This signing certificate is used to verify the legitimacy of the data access requester's identity.

[0020] The business data service platform calls the cryptographic service platform to parse the data signature packet, verify the validity period, certificate chain, CRL (Certificate Revocation List), and OCSP (Online Certificate Status Protocol) of the signing certificate corresponding to the private key of the data access request client, and perform whitelist service verification to confirm the status of the signing certificate corresponding to the private key of the data access request client on the cryptographic service platform. Among them, the verification of the CRL and OCSP of the signing certificate corresponding to the private key of the data access request client can be checked against the blacklist and whitelist respectively.

[0021] Preferably, after step S12, the method further includes:

[0022] When identity authentication fails, the business data service platform rejects the login access request from the data access requester; when identity authentication succeeds, the data access requester successfully logs into the business data service platform, and the business data service platform obtains the requester's encryption certificate from the data access requester.

[0023] Preferably, the step of digitally signing the original data using the request-side signing private key in step S12 specifically involves: the data access request end signing the original data using the request-side signing private key via a secure cryptographic device. The secure cryptographic device corresponds one-to-one with the data access request end and is used to store the corresponding smart cryptographic key.

[0024] Preferably, step S11 may further include: storing a smart password key corresponding to the data access request terminal of the secure cryptographic device.

[0025] Specifically, step S13 includes:

[0026] The business data service platform encrypts and caches the encryption certificates sent by the requesting parties when it receives data access requests.

[0027] The business data service platform calls the encryption interface of the security middleware to generate a symmetric encryption random key;

[0028] The data to be encrypted is symmetrically encrypted using a symmetric encryption algorithm combined with a random symmetric encryption key to obtain the ciphertext; the symmetric encryption algorithm can be the SM4 algorithm.

[0029] The symmetric encryption ciphertext is obtained by encrypting the symmetric key ciphertext using an asymmetric encryption algorithm combined with the public key of the asymmetric key pair; the asymmetric encryption algorithm can be the SM2 algorithm.

[0030] The data ciphertext and symmetric key ciphertext are integrated, encapsulated to generate a digital envelope ciphertext, and then stored.

[0031] The data access requesting party calls the security middleware through the business data service platform and uses the encryption private key of the business data service platform to decrypt the symmetric key ciphertext to obtain the symmetric key;

[0032] The symmetric key is encrypted using a demand-side encryption certificate to update the symmetric key ciphertext. The data ciphertext and the updated symmetric key ciphertext are then integrated and encapsulated to update the digital envelope ciphertext.

[0033] Preferably, the method further includes the following steps before step S13:

[0034] The business data service platform calls the security middleware to obtain the encryption key pair of the business data service platform stored in the cryptographic service platform, and caches the public key of the asymmetric key pair of the encryption key pair of the business data service platform.

[0035] Specifically, step S14 includes:

[0036] The data access requesting party calls the security middleware through the business data service platform to unpack the obtained digital envelope ciphertext and obtain the corresponding symmetric key ciphertext and data ciphertext.

[0037] The decryption interface of the security middleware is called to use an asymmetric encryption algorithm in combination with the private key of the requesting party to decrypt the symmetric key ciphertext obtained by unpacking, and obtain the symmetric key.

[0038] A symmetric encryption algorithm is used in conjunction with the symmetric key obtained from decryption to decrypt the ciphertext obtained from the unpacking process, thus obtaining the data to be encrypted.

[0039] In summary, the data security sharing method for commercial aerospace telemetry and control networks of this invention issues corresponding smart cryptographic keys and digital certificates to data access requesters through a cryptographic service platform. Using digital certificates for identity authentication ensures the authenticity and trustworthiness of the data access requester's identity, preventing identity spoofing and information leakage, and achieving secure data access and sharing. Employing digital envelope technology for encryption protects the key, ensuring it is not stolen or tampered with during transmission. The encryption and decryption of digital envelopes ensures that only designated recipients can open and obtain the key, significantly enhancing key security and data confidentiality during data sharing. Furthermore, digital envelope technology allows secure transmission of public keys over public networks while private keys are securely stored, avoiding key leakage, simplifying key management complexity, and improving key management and exchange efficiency. During data encryption, only the symmetric key ciphertext is updated to update the digital envelope ciphertext, eliminating the need for re-encryption and decryption. This optimized encryption process improves encryption and decryption speed during data sharing, ensuring data security while increasing speed and efficiency, reducing computational complexity and resource consumption. It is applicable to various scenarios and highly practical.

[0040] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and these modifications or substitutions should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A data security sharing method for a commercial space TT&C network, characterized in that, The application is applied to a commercial spaceflight TT&C network system, which comprises a password service platform, a business data service platform and a data access demand end, the data access demand end is in communication connection with the password service platform and the business data service platform respectively, the business data service platform is in communication connection with the password service platform, the business data service platform comprises a plurality of spaceflight business systems, each spaceflight business system comprises a security middleware, and the data security sharing method for the commercial spaceflight TT&C network comprises the following steps: Key certificate issuing: the password service platform issues corresponding intelligent password keys to the data access demand end, and issues digital certificates to the data access demand end; Identity authentication: the data access demand end splices the demand end encryption certificate and the received random number generated by the password service platform to form plaintext data, adopts the demand end signature private key to digitally sign the plaintext data, obtains a data signature package, and sends the data signature package to the business data service platform, the business data service platform calls the password service platform to analyze and verify the data signature package, and performs black list and white list checking; Data access and encrypted download: the business data service platform caches the demand end encryption certificate sent by the data access demand end after encryption, adopts the digital envelope technology to encrypt the data to be encrypted, generates digital envelope ciphertext and stores the same; the data access demand end adopts the encryption private key of the business data service platform to decrypt the symmetric key ciphertext to obtain the symmetric key through the business data service platform calling the security middleware, encrypts the symmetric key with the demand end encryption certificate to update the symmetric key ciphertext, and updates the digital envelope ciphertext according to the updated symmetric key ciphertext; Data decryption: the data access demand end calls the security middleware through the business data service platform to unpack the obtained digital envelope ciphertext, obtains the corresponding symmetric key ciphertext and data ciphertext, adopts the asymmetric encryption algorithm combined with the demand end encryption private key to decrypt, obtains the symmetric key, and adopts the symmetric encryption algorithm combined with the symmetric key obtained by decryption to perform symmetric algorithm decryption on the data ciphertext obtained by unpacking, and obtains the data to be encrypted.

2. The data security sharing method for the commercial spaceflight TT&C network according to claim 1, characterized in that, The identity authentication step comprises: The data access demand end sends a login access request to the business data service platform, and the business data service platform sends a random number request to the password service platform according to the received login access request; The password service platform generates a random number according to the received random number request and sends the generated random number to the data access demand end; The data access demand end splices the demand end encryption certificate and the received random number to form plaintext data, adopts the demand end signature private key to digitally sign the plaintext data, obtains a data signature package, and sends the data signature package to the business data service platform; The business data service platform calls the password service platform to analyze the data signature package, checks the validity period, certificate chain, CRL and OCSP of the signature certificate corresponding to the demand end signature private key of the data access demand end, and performs white list service checking.

3. The data security sharing method for the commercial spaceflight TT&C network according to claim 1, characterized in that, The identity authentication step further comprises: When the identity authentication fails, the business data service platform rejects the login access request of the data access demand end; when the identity authentication succeeds, the data access demand end successfully logs in the business data service platform, and the business data service platform obtains the demand end encryption certificate from the data access demand end.

4. The data security sharing method for the commercial spaceflight TT&C network according to claim 1, characterized in that, The step of using the demand end signature private key to digitally sign the original data in the identity authentication step is that the data access demand end uses the demand end signature private key to digitally sign the original data through a secure password device.

5. The data security sharing method for the commercial space TT&C network according to claim 4, characterized in that, The step of issuing the secret key certificate further comprises the following steps: The secure password device stores the intelligent password key corresponding to the data access demand end.

6. The data security sharing method for the commercial spaceflight TT&C network of claim 1, wherein, The data access and encryption download step comprises the following steps: The business data service platform caches the demand end encryption certificate sent by the data access demand end after encrypting the demand end encryption certificate; The business data service platform calls the encryption interface of the secure middleware to generate a symmetric encryption random secret key; The symmetric encryption algorithm is used to encrypt the data to be encrypted in combination with the symmetric encryption random secret key to obtain data ciphertext; The symmetric encryption random secret key generated by the symmetric encryption algorithm is encrypted in combination with the public key of the asymmetric key pair to obtain symmetric key ciphertext; The data ciphertext and the symmetric key ciphertext are integrated and packaged to generate digital envelope ciphertext and stored; The data access demand end decrypts the symmetric key ciphertext to obtain the symmetric key by calling the secure middleware of the business data service platform using the encryption private key of the business data service platform; The symmetric key is encrypted using the demand end encryption certificate to update the symmetric key ciphertext, and the digital envelope ciphertext is updated according to the data ciphertext and the updated symmetric key ciphertext.

7. The data security sharing method for the commercial spaceflight TT&C network according to claim 6, characterized in that, The data decryption step comprises the following steps: The data access demand end calls the secure middleware of the business data service platform to obtain the corresponding symmetric key ciphertext and data ciphertext by unpacking the obtained digital envelope ciphertext; The decryption interface of the secure middleware is called to decrypt the symmetric key ciphertext obtained by unpacking using the asymmetric encryption algorithm in combination with the demand end encryption private key to obtain the symmetric key; The symmetric algorithm decryption is performed on the data ciphertext obtained by unpacking using the symmetric encryption algorithm in combination with the symmetric key obtained by decryption to obtain the data to be encrypted.

8. The data security sharing method for the commercial spaceflight TT&C network of claim 1, wherein, The intelligent password key comprises an encryption key pair and a signature key pair.

Images