Satellite communication method and related equipment

Abstract

The invention provides a satellite communication method and related equipment, and relates to the technical field of communication. The method comprises the following steps: receiving a user message sent by user equipment, the user message comprising a first message identification code and a user confidential identifier; when a feeder line link is unavailable, a protection key corresponding to the user confidential identifier in the user message is inquired, and the feeder line link is a connection link between a satellite and a core network; generating a second message authentication code based on the user message and the protection key; and when the first message authentication code is different from the second message authentication code, not storing the user message. By means of the technical means, the problems that in the prior art, whether data is from a real user or an attacker cannot be judged, and meanwhile storage space is prone to being consumed by forged data are solved.

Description

Background Art

[0002] In the research of non-terrestrial network communication, it is found that the connection between the user equipment and the satellite and the terrestrial network may be intermittent. When the feeder link between the satellite and the terrestrial network is unavailable, there may be security problems in communication: that is, for the uplink control plane data and user plane data, the satellite cannot verify its integrity, and it is difficult to determine whether the data comes from a real user or an attacker. In addition, the prior art stores all uplink data during the unavailable period of the feeder link. In this case, if an air attack sends forged data, it can easily exhaust the storage capacity, resulting in a denial of service attack. Summary of the Invention

[0003] The present disclosure provides a satellite communication method, apparatus, system, electronic device and computer-readable storage medium, which at least improve the security guarantee of users to a certain extent.

[0004] Other features and advantages of the present disclosure will become apparent from the following detailed description, or will be learned in part through the practice of the present disclosure.

[0005] According to an aspect of the present disclosure, there is provided a satellite communication method applied to a satellite, including: receiving a user message sent by a user equipment, where the user message includes a first message authentication code and a user confidentiality identifier; when the feeder link is unavailable, querying a protection key corresponding to the user confidentiality identifier in the user message, where the feeder link is a connection link between the satellite and the core network; generating a second message authentication code based on the user message and the protection key; when the first message authentication code is different from the second message authentication code, not storing the user message.

[0006] In an embodiment of the present disclosure, generating a second message authentication code based on the user message and the protection key includes: performing an exclusive OR operation on the protection key and an internal padding value to obtain a first intermediate value; performing an exclusive OR operation on the protection key and an external padding value to obtain a second intermediate value; appending the user message to the first intermediate value to obtain a first data, and calculating a hash value of the first data; appending the hash value of the first data to the second intermediate value to obtain a second data, and calculating a hash value of the second data, and using the hash value of the second data as the second message authentication code.

[0007] In an embodiment of the present disclosure, after generating the second message authentication code based on the user message and the protection key, the method further includes: when the first message authentication code is the same as the second message authentication code, storing the user message.

[0008] In one embodiment of the present disclosure, before receiving a user message sent by a user equipment, the method further includes: receiving a registration request for store-and-forward satellite operation sent by the user equipment, where the registration request includes a user confidentiality identifier and a function identifier of the store-and-forward satellite operation; when the feeder link is available, forwarding the registration request to the core network to complete the registration of the user equipment for the store-and-forward satellite operation.

[0009] In one embodiment of the present disclosure, when the feeder link is available, forwarding the registration request to the core network to complete the registration of the user equipment for the store-and-forward satellite operation includes: receiving a message response fed back by the core network, where the message response includes a protection key and a user confidentiality identifier; saving the protection key and the user confidentiality identifier; forwarding the message response to the user equipment to complete the registration of the user equipment for the store-and-forward satellite operation.

[0010] In one embodiment of the present disclosure, forwarding the message response to the user equipment to complete the registration of the user equipment for the store-and-forward satellite operation includes: receiving an authentication response fed back by the user equipment, where the authentication response includes a user confidentiality identifier and a first message authentication code; when the feeder link is unavailable, querying the protection key corresponding to the user confidentiality identifier in the authentication response; generating a second message authentication code based on the authentication response and the queried protection key; when the first message authentication code is the same as the second message authentication code, storing the authentication response and, when the feeder link is available, forwarding the authentication response to the core network to complete the registration of the user equipment for the store-and-forward satellite operation.

[0011] In one embodiment of the present disclosure, after the core network recognizes the function identifier carried in the registration request, it generates an initial authentication vector and derives a protection key based on the master key, and combines the initial authentication vector, the protection key, and the user confidentiality identifier in the registration request to obtain a message response.

[0012] In one embodiment of the present disclosure, the user equipment determines an authentication vector based on the initial authentication vector in the message response; generates a first message authentication code for the authentication response based on the protection key, where the protection key is derived based on the master key; combines the authentication vector, the user confidentiality identifier, and the first message authentication code to obtain an authentication response.

[0013] According to another aspect of the present disclosure, there is provided a satellite communication method applied to a user equipment, including: deriving a protection key based on a master key, generating a first message authentication code based on the protection key; generating a user message based on the first message authentication code and a user confidentiality identifier, and sending the user message to a satellite to determine not to store the user message when the feeder link is unavailable and the first message authentication code is different from a second message authentication code generated by the satellite, where the feeder link is a connection link between the satellite and the core network.

[0014] According to another aspect of the present disclosure, there is provided a satellite communication device applied to a satellite, including: a receiving module configured to receive a user message sent by a user equipment, where the user message includes a first message authentication code and a user confidentiality identifier; a query module configured to query a protection key corresponding to the user confidentiality identifier in the user message when a feeder link is unavailable, where the feeder link is a connection link between the satellite and a core network; a first generation module configured to generate a second message authentication code based on the user message and the protection key; and a storage module configured not to store the user message when the first message authentication code is different from the second message authentication code.

[0015] According to another aspect of the present disclosure, there is provided a satellite communication device applied to a user equipment, including: a second generation module configured to derive a protection key based on a master key and generate a first message authentication code based on the protection key; and a sending module configured to generate a user message based on the first message authentication code and the user confidentiality identifier, and send the user message to the satellite to determine not to store the user message when the feeder link is unavailable and the first message authentication code is different from a second message authentication code generated by the satellite, where the feeder link is a connection link between the satellite and a core network.

[0016] According to another aspect of the present disclosure, there is provided an electronic device, including: a processor; and a memory for storing executable instructions of the processor; where the processor is configured to execute any one of the above satellite communication methods by executing the executable instructions.

[0017] According to another aspect of the present disclosure, there is provided a computer-readable storage medium having a computer program stored thereon, where the computer program, when executed by a processor, implements any one of the above satellite communication methods.

[0018] In an embodiment of the present disclosure, when the feeder link is unavailable, a protection key corresponding to the user confidentiality identifier in the user message is queried, a second message authentication code is generated based on the user message and the protection key, and the user message is not stored when the first message authentication code is different from the second message authentication code. By the above technical means, the problems in the prior art that it is impossible to determine whether the data comes from a real user or an attacker and the storage space is easily consumed by forged data are solved, and then the user data is verified, the consumption of the storage capacity by the forged data is avoided, and the communication security is guaranteed.

[0019] It should be understood that the above general description and the following detailed description are only exemplary and explanatory, and cannot limit the present disclosure. Description of the Drawings

[0020] The accompanying drawings herein are incorporated into and constitute a part of this specification, showing embodiments consistent with the present disclosure, and are used together with the specification to explain the principles of the present disclosure. Obviously, the accompanying drawings in the following description are only some embodiments of the present disclosure, and those of ordinary skill in the art can obtain other drawings based on these drawings without creative efforts.

[0021] Figure 1 A schematic diagram showing the architecture of a satellite communication system in an embodiment of the present disclosure.

[0022] Figure 2 A flowchart showing a satellite communication method in an embodiment of the present disclosure.

[0023] Figure 3 A flowchart showing a method for generating a message authentication code in an embodiment of the present disclosure.

[0024] Figure 4 A flowchart showing a method for a user equipment to generate an authentication response in an embodiment of the present disclosure.

[0025] Figure 5 A flowchart showing a registration method for store-and-forward satellite operations in an embodiment of the present disclosure.

[0026] Figure 6 A flowchart showing another satellite communication method in an embodiment of the present disclosure.

[0027] Figure 7 A schematic diagram showing a satellite communication device in an embodiment of the present disclosure.

[0028] Figure 8 A schematic diagram showing another satellite communication device in an embodiment of the present disclosure.

[0029] Figure 9 A block diagram showing the structure of an electronic device in an embodiment of the present disclosure. Detailed implementation manners

[0030] Example embodiments will now be described more fully with reference to the accompanying drawings. However, the example embodiments can be implemented in various forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this disclosure will be more complete and comprehensive, and will fully convey the concept of the example embodiments to those skilled in the art. The features, structures, or characteristics described may be combined in any suitable manner in one or more embodiments.

[0031] In addition, the accompanying drawings are only schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and thus repeated descriptions thereof will be omitted. Some of the block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities may be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0032] It should be understood that the various steps recited in the method embodiments of the present disclosure may be executed in a different order and / or executed in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this regard.

[0033] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order of functions performed by these devices, modules or units or their interdependent relationships.

[0034] It should be noted that the modifiers "one" and "multiple" mentioned in the present disclosure are illustrative rather than restrictive. Those skilled in the art should understand that, unless otherwise clearly specified in the context, it should be understood as "one or more".

[0035] It should be pointed out that, without conflict, the embodiments of the present disclosure and the technical features in the embodiments may be combined with each other.

[0036] For the sake of easy understanding, several terms related to the present disclosure are first explained as follows:

[0037] SUCI (Subscriber Confidentiality Identifier) is an important identifier in a communication network, which is used to protect the privacy and security of users. It is a newly introduced mechanism in the communication network, aiming to replace the IMSI (International Mobile Subscriber Identity) to prevent the permanent identity information of users from being stolen or misused during transmission.

[0038] The master key is a high-security key, usually generated by an authentication and key agreement protocol (such as the AKA protocol). It is the basis of the entire security system and is used to derive other sub-keys.

[0039] The protection key, also known as the integrity protection key, is a sub-key derived from the master key and is specifically used to protect the integrity of data.

[0040] A MAC (Message Authentication Code) is a short data block used to verify the integrity and authenticity of a message. It is generated by combining the message and a key, and the recipient can use the same key to verify whether the message has been tampered with. MAC is an important tool for ensuring data integrity and authentication in information security.

[0041] The following will describe in detail the specific implementation manners of the embodiments of the present disclosure with reference to the accompanying drawings.

[0042] Figure 1 The figure shows a schematic diagram of a satellite communication system structure in an embodiment of the present disclosure, and this system can apply the satellite communication method or satellite communication device in various embodiments of the present disclosure.

[0043] As Figure 1 shown, the system architecture may include a user equipment 101, a satellite 102, and a core network 103. The user equipment 101 may be an electronic device used by a user, including but not limited to mobile phones, computers, tablets, etc. The core network is a key component in the network architecture. The user equipment 101 communicates with the core network 103 through the satellite 102.

[0044] Figure 2 The figure shows a flowchart of a satellite communication method in an embodiment of the present disclosure, which is applied to a satellite. As Figure 2 shown, it includes the following steps:

[0045] S201: Receive a user message sent by a user equipment, where the user message includes a first message authentication code and a user confidentiality identifier;

[0046] S202: When the feeder link is unavailable, query the protection key corresponding to the user confidentiality identifier in the user message, where the feeder link is the connection link between the satellite and the core network;

[0047] S203: Generate a second message authentication code based on the user message and the protection key;

[0048] S204: When the first message authentication code is different from the second message authentication code, do not store the user message.

[0049] The user equipment derives a protection key based on the master key, generates a first message authentication code for the user message based on the protection key, combines the user confidentiality identifier, the first message authentication code, and the information to be sent according to a preset format to obtain a user message, and then sends the user message to the satellite.

[0050] After the satellite receives the user message sent by the user equipment, it detects the status of the feeder link. If the feeder link is available, it directly forwards the user message to the core network; if the feeder link is unavailable, it queries the protection key corresponding to the user confidentiality identifier in the user message in the relationship comparison table, generates a second message authentication code based on the user message and the protection key, compares the first message authentication code with the second message authentication code. If they are the same, it stores the user message and forwards the user message to the core network when the feeder link is available. If they are different, it discards the user message.

[0051] According to the technical solution provided by the embodiments of the present disclosure, a user message sent by a user equipment is received, where the user message includes a first message authentication code and a user confidentiality identifier; when the feeder link is unavailable, the protection key corresponding to the user confidentiality identifier in the user message is queried, where the feeder link is a connection link between the satellite and the core network; a second message authentication code is generated based on the user message and the protection key; when the first message authentication code is different from the second message authentication code, the user message is not stored. Through the above technical means, the problem in the prior art that it is impossible to determine whether the data comes from a real user or an attacker, and at the same time the storage space is easily consumed by forged data is solved. Furthermore, the user data is verified, the consumption of the storage capacity by the forged data is avoided, and the communication security is guaranteed.

[0052] Figure 3 The flowchart showing the method for generating a message authentication code in an embodiment of the present disclosure is as Figure 3 shown. The user equipment performs the following steps:

[0053] S301, perform an exclusive OR operation on the protection key and the internal padding value to obtain a first intermediate value;

[0054] S302, perform an exclusive OR operation on the protection key and the external padding value to obtain a second intermediate value;

[0055] S303, append the user message to the first intermediate value to obtain a first data, and calculate the hash value of the first data;

[0056] S304, append the hash value of the first data to the second intermediate value to obtain a second data, and calculate the hash value of the second data. Take the hash value of the second data as the second message authentication code.

[0057] The internal padding value and the external padding value are preset values. After connecting the user message to the first intermediate value, the first data is obtained (at this time, the user message used should be the remaining part after removing the first message authentication code and the user confidentiality identifier, and the main body is the information that the user really needs to send). The hash value of the first data is calculated using a hash function. After connecting the hash value of the first data to the second intermediate value, the second data is obtained, and the hash value of the second data is calculated using a hash function. The hash value of the second data is used as the second message authentication code. In the embodiment of the present disclosure, the second message authentication code is generated through the above technical means, and then the authenticity of the user message is verified by comparing the first message authentication code and the second message authentication code.

[0058] In an embodiment of the present disclosure, after generating the second message authentication code based on the user message and the protection key, the method further includes: when the first message authentication code is the same as the second message authentication code, storing the user message.

[0059] In an embodiment of the present disclosure, before receiving the user message sent by the user equipment, the method further includes: receiving a registration request for the store-and-forward satellite operation sent by the user equipment, where the registration request includes a user confidentiality identifier and a function identifier of the store-and-forward satellite operation; when the feeder link is available, forwarding the registration request to the core network to complete the registration of the user equipment for the store-and-forward satellite operation.

[0060] The registration request sent by the user equipment to the satellite, where the registration request is used to indicate the registration of the store-and-forward satellite operation, and it carries a user confidentiality identifier and a function identifier of the store-and-forward satellite operation. After receiving the registration request, the satellite checks the status of the feeder link between itself and the core network. If the feeder link is available, the registration request is forwarded to the core network. If the feeder link is unavailable, the registration request is discarded. In the embodiment of the present disclosure, the registration of the user equipment for the store-and-forward satellite operation is achieved through the above technical means, and then when the feeder link is unavailable, the data sent by the user equipment is subjected to the store-and-forward satellite operation.

[0061] In an embodiment of the present disclosure, when the feeder link is available, forwarding the registration request to the core network to complete the registration of the user equipment for the store-and-forward satellite operation includes: receiving a message response feedback from the core network, where the message response includes a protection key and a user confidentiality identifier; saving the protection key and the user confidentiality identifier; forwarding the message response to the user equipment to complete the registration of the user equipment for the store-and-forward satellite operation.

[0062] The core network generates a corresponding message response according to the registration request and then feeds back the message response to the satellite. After receiving the message response, the satellite saves the protection key and the user confidentiality identifier carried in the message response into the relationship correspondence table (subsequently, the protection key corresponding to the user confidentiality identifier can be queried through the relationship correspondence table), and then forwards the message response to the user equipment. Through the above technical means, the embodiments of the present disclosure facilitate subsequent querying of the protection key based on the user confidentiality identifier.

[0063] In an embodiment of the present disclosure, forwarding the message response to the user equipment to complete the registration of the user equipment for the store-and-forward satellite operation includes: receiving an authentication response fed back by the user equipment, where the authentication response includes a user confidentiality identifier and a first message authentication code; when the feeder link is unavailable, querying the protection key corresponding to the user confidentiality identifier in the authentication response; generating a second message authentication code based on the authentication response and the queried protection key; when the first message authentication code is the same as the second message authentication code, storing the authentication response and, when the feeder link is available, forwarding the authentication response to the core network to complete the registration of the user equipment for the store-and-forward satellite operation.

[0064] The user equipment generates a corresponding authentication response according to the message response and then feeds back the authentication response to the satellite. After receiving the authentication response, the satellite checks the status of the feeder link. If the feeder link is available, it directly forwards the authentication response to the core network. If the feeder link is unavailable, it first stores the authentication response and then, when the feeder link is available, forwards the authentication response to the core network, thus completing the registration of the user equipment for the store-and-forward satellite operation. Through the above technical means, the embodiments of the present disclosure generate a second message authentication code, and then verify the authenticity of the authentication response by comparing the first message authentication code and the second message authentication code.

[0065] In an embodiment of the present disclosure, after the core network recognizes the function identifier carried in the registration request, it generates an initial authentication vector and derives a protection key based on the master key, and combines the initial authentication vector, the protection key, and the user confidentiality identifier in the registration request to obtain a message response.

[0066] If the function identifier is recognized, it indicates that the user equipment needs to register for the store-and-forward satellite operation. At this time, an initial authentication vector is generated, and a protection key is derived based on the master key. Data such as the initial authentication vector, the protection key, and the user confidentiality identifier are assembled or processed according to a preset format to obtain a message response. Then the message response is sent to the satellite. Through the above technical means, the embodiments of the present disclosure complete the preliminary authentication of the user equipment and complete the final authentication after receiving the message response.

[0067] Figure 4 The flowchart showing the method for the user equipment to generate an authentication response in an embodiment of the present disclosure is as Figure 4As shown, after the user equipment receives the message response, it performs the following steps:

[0068] S401, determine the authentication vector based on the initial authentication vector in the message response;

[0069] S402, generate the first message authentication code of the authentication response based on the protection key, where the protection key is derived from the master key;

[0070] S403, combine the authentication vector, the user confidentiality identifier, and the first message authentication code to obtain the authentication response.

[0071] Process the initial authentication vector according to a preset algorithm to obtain the authentication vector. Perform an exclusive OR operation on the protection key and the internal padding value to obtain the first intermediate value, and perform an exclusive OR operation on the protection key and the external padding value to obtain the second intermediate value. Append the authentication vector to the first intermediate value to obtain the first data, and calculate the hash value of the first data. Append the hash value of the first data to the second intermediate value to obtain the second data, and calculate the hash value of the second data. Use the hash value of the second data as the first message authentication code. Assemble or process the authentication vector, the user confidentiality identifier, and the first message authentication code according to a preset format to obtain the authentication response. In the embodiments of the present disclosure, the first message authentication code is generated by the above technical means as the verification basis of the authentication response, ensuring communication security.

[0072] In an alternative embodiment, deriving the protection key from the master key includes: appending the master key to a preset string to obtain the third data, and calculating the hash value of the third data; intercepting the data of the first preset number of bits before the hash value of the third data as the protection key.

[0073] Connect the master key to a preset string to obtain the third data, calculate the hash value of the third data using a hash function, and then intercept the data of the first preset number of bits before the hash value of the third data as the protection key.

[0074] In addition, the protection key can also be derived from the master key using the HMAC-based KDF (HKDF) derivation function.

[0075] Figure 5 The flowchart of the registration method for the store-and-forward satellite operation in an embodiment of the present disclosure is shown, which is applied to a satellite, as Figure 5 shown, and includes the following steps:

[0076] S501, when receiving a registration request for the store-and-forward satellite operation sent by the user equipment, check the status of the feeder link;

[0077] S502. When the feeder link is available, forward the registration request to the core network to receive a message response feedback from the core network, where the message response includes a protection key and a user confidentiality identifier.

[0078] S503. Save the protection key and the user confidentiality identifier into a relationship correspondence table, and forward the message response to the user equipment to receive an authentication response feedback from the user equipment, where the authentication response includes a first message authentication code and the user confidentiality identifier.

[0079] S504. When the feeder link is unavailable, query the protection key corresponding to the user confidentiality identifier in the relationship correspondence table, and generate a second message authentication code based on the protection key and the authentication response.

[0080] S505. Compare the first message authentication code with the second message authentication code. If they are the same, store the authentication response, and when the feeder link is available, forward the authentication response to the core network to complete the registration of the user equipment for the store-and-forward satellite operation.

[0081] Figure 6 The flowchart showing another satellite communication method in an embodiment of the present disclosure is applied to a user equipment. As Figure 6 shown, it includes the following steps:

[0082] S601. Derive a protection key based on a master key, and generate a first message authentication code based on the protection key.

[0083] S602. Generate a user message based on the first message authentication code and the user confidentiality identifier, and send the user message to the satellite to determine not to store the user message when the feeder link is unavailable and the first message authentication code is different from the second message authentication code generated by the satellite, where the feeder link is a connection link between the satellite and the core network.

[0084] Based on the same inventive concept, an embodiment of the present disclosure also provides a satellite communication device as in the following embodiment. Since the principle of solving problems in this device embodiment is similar to that of the above method embodiment, the implementation of this device embodiment can refer to the implementation of the above method embodiment, and the repeated parts will not be elaborated. Through the above technical means, the embodiment of the present disclosure generates a first message authentication code as the verification basis for the user message to ensure communication security.

[0085] Figure 7 The schematic diagram showing a satellite communication device in an embodiment of the present disclosure is as Figure 7 shown. The satellite communication device may include:

[0086] A receiving module 701, configured to receive a user message sent by a user equipment, where the user message includes a first message authentication code and a user confidentiality identifier.

[0087] A query module 702, configured to query a protection key corresponding to a user confidentiality identifier in a user message when a feeder link is unavailable, where the feeder link is a connection link between a satellite and a core network;

[0088] A first generation module 703, configured to generate a second message authentication code based on the user message and the protection key;

[0089] A storage module 704, configured to not store the user message when the first message authentication code is different from the second message authentication code.

[0090] According to the technical solution provided by the embodiments of the present disclosure, a user message sent by a user equipment is received, where the user message includes a first message authentication code and a user confidentiality identifier; when the feeder link is unavailable, a protection key corresponding to the user confidentiality identifier in the user message is queried, where the feeder link is a connection link between a satellite and a core network; a second message authentication code is generated based on the user message and the protection key; when the first message authentication code is different from the second message authentication code, the user message is not stored. Through the above technical means, the problems in the prior art that it is impossible to determine whether the data comes from a real user or an attacker, and the storage space is easily consumed by forged data are solved. Furthermore, the user data is verified, the consumption of the storage capacity by the forged data is avoided, and the communication security is guaranteed.

[0091] In one embodiment, the first generation module 703 is further configured to perform an exclusive OR operation on the protection key and an internal padding value to obtain a first intermediate value; perform an exclusive OR operation on the protection key and an external padding value to obtain a second intermediate value; append the user message to the first intermediate value to obtain a first data, and calculate a hash value of the first data; append the hash value of the first data to the second intermediate value to obtain a second data, and calculate a hash value of the second data, and use the hash value of the second data as the second message authentication code.

[0092] In one embodiment, after the storage module 704 is further configured to generate a second message authentication code based on the user message and the protection key, the method further includes: storing the user message when the first message authentication code is the same as the second message authentication code.

[0093] In one embodiment, the receiving module 701 is further configured to receive a registration request for a store-and-forward satellite operation sent by the user equipment, where the registration request includes a user confidentiality identifier and a function identifier of the store-and-forward satellite operation; when the feeder link is available, forward the registration request to the core network to complete the registration of the user equipment for the store-and-forward satellite operation.

[0094] In one embodiment, the receiving module 701 is further configured to receive a message response fed back by the core network, where the message response includes a protection key and a user confidentiality identifier; save the protection key and the user confidentiality identifier; and forward the message response to the user equipment to complete the registration of the user equipment for the store-and-forward satellite operation.

[0095] In one embodiment, the receiving module 701 is further configured to receive an authentication response fed back by the user equipment, where the authentication response includes a user confidentiality identifier and a first message authentication code; when the feeder link is unavailable, query the protection key corresponding to the user confidentiality identifier in the authentication response; generate a second message authentication code based on the authentication response and the queried protection key; when the first message authentication code is the same as the second message authentication code, store the authentication response, and when the feeder link is available, forward the authentication response to the core network to complete the registration of the user equipment for the store-and-forward satellite operation.

[0096] In one embodiment, after the receiving module 701 identifies the function identifier carried in the registration request through the core network, it generates an initial authentication vector and derives a protection key based on the master key, and combines the initial authentication vector, the protection key, and the user confidentiality identifier in the registration request to obtain a message response.

[0097] In one embodiment, the receiving module 701 is further configured to determine an authentication vector based on the initial authentication vector in the message response; generate a first message authentication code for the authentication response based on the protection key, where the protection key is derived based on the master key; and combine the authentication vector, the user confidentiality identifier, and the first message authentication code to obtain the authentication response.

[0098] In one embodiment, the receiving module 701 is further configured to append the master key to a preset string to obtain a third data, calculate the hash value of the third data; and intercept the data of a preset number of bits before the hash value of the third data as the protection key.

[0099] In one embodiment, the receiving module 701 is further configured to, when receiving a registration request for store-and-forward satellite operation sent by a user equipment, check the status of the feeder link; when the feeder link is available, forward the registration request to the core network to receive a message response feedback by the core network, where the message response includes a protection key and a user confidentiality identifier; save the protection key and the user confidentiality identifier into a relationship correspondence table, and forward the message response to the user equipment to receive an authentication response feedback by the user equipment, where the authentication response includes a first message authentication code and the user confidentiality identifier; when the feeder link is unavailable, query the protection key corresponding to the user confidentiality identifier in the relationship correspondence table, and generate a second message authentication code based on the protection key and the authentication response; compare the first message authentication code with the second message authentication code, if they are the same, store the authentication response, and when the feeder link is available, forward the authentication response to the core network to complete the registration of the user equipment for the store-and-forward satellite operation.

[0100] Figure 8 Schematic diagram showing another satellite communication device in an embodiment of the present disclosure, applied to a user equipment, such as Figure 8 shown, the satellite communication device may include:

[0101] A second generation module 801, configured to derive a protection key based on a master key and generate a first message authentication code based on the protection key;

[0102] A sending module 802, configured to generate a user message based on the first message authentication code and the user confidentiality identifier, and send the user message to the satellite to determine not to store the user message when the feeder link is unavailable and the first message authentication code is different from a second message authentication code generated by the satellite, where the feeder link is a connection link between the satellite and the core network.

[0103] In an embodiment of the present disclosure, a satellite communication system is provided, including: a registration request sent by a user equipment to a satellite regarding a store-and-forward satellite operation, where the registration request includes a user confidentiality identifier and a function identifier of the store-and-forward satellite operation; when the feeder link is available, the satellite forwards the registration request to a core network; the core network sends a message response corresponding to the registration request to the satellite, where the message response includes a protection key and a user confidentiality identifier; the satellite saves the protection key and the user confidentiality identifier, and forwards the message response to the user equipment; the user equipment sends an authentication response corresponding to the message response to the satellite, where the authentication response includes a user confidentiality identifier and a first message authentication code; when the feeder link is unavailable, the satellite queries the protection key corresponding to the user confidentiality identifier in the authentication response, and generates a second message authentication code based on the protection key and the authentication response. When the first message authentication code is the same as the second message authentication code, the satellite stores the authentication response, and when the feeder link is available, forwards the authentication response to the core network to complete the registration of the user equipment for the store-and-forward satellite operation.

[0104] Those skilled in the art of the present disclosure can understand that various aspects of the present disclosure can be implemented as a system, a method, or a program product. Therefore, various aspects of the present disclosure can be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or an implementation combining hardware and software aspects, which can be collectively referred to as "circuit", "module", or "system" here.

[0105] The following refers to Figure 9 to describe the electronic device 900 according to this embodiment of the present disclosure. Figure 9 The displayed electronic device 900 is only an example and should not impose any limitation on the functions and usage scope of the embodiments of the present disclosure.

[0106] As Figure 9 shown, the electronic device 900 is presented in the form of a general computing device. The components of the electronic device 900 may include but are not limited to: at least one of the above-mentioned processing units 910, at least one of the above-mentioned storage units 920, and a bus 930 connecting different system components (including the storage unit 920 and the processing unit 910).

[0107] Among them, the storage unit stores program codes, which can be executed by the processing unit 910, so that the processing unit 910 executes the steps according to various exemplary embodiments of the present disclosure described in the "Exemplary Method" section of this specification. For example, the processing unit 910 may execute the following steps of the above method embodiment: when receiving a registration request for store-and-forward satellite operation sent by a user device, check the status of the feeder link, where the registration request carries a user confidentiality identifier and a function identifier of the store-and-forward satellite operation, and the feeder link is a connection link between the satellite and the core network; when the feeder link is available, forward the registration request to the core network to receive a message response feedback by the core network; save the protection key and the user confidentiality identifier carried in the message response to a relationship correspondence table, and forward the message response to the user device to receive an authentication response feedback by the user device; when the feeder link is unavailable, query the protection key corresponding to the user confidentiality identifier carried in the authentication response in the relationship correspondence table, and generate a message authentication code based on the protection key and the authentication response; compare the generated message authentication code with the message authentication code carried in the authentication response, if they are the same, store the authentication response, and when the feeder link is available, forward the authentication response to the core network.

[0108] The storage unit 920 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 9201 and / or a cache storage unit 9202, and may further include a read-only storage unit (ROM) 9203.

[0109] The storage unit 920 may further include a program / utilities 9204 having a set (at least one) of program modules 9205. Such program modules 9205 include but are not limited to: an operating system, one or more application programs, other program modules, and program data. Each or some combination of these examples may include an implementation of a network environment.

[0110] The bus 930 may represent one or more of several types of bus structures, including a storage unit bus or a storage unit controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any bus structure in a variety of bus structures.

[0111] The electronic device 900 can also communicate with one or more external devices 940 (such as a keyboard, a pointing device, a Bluetooth device, etc.), and can also communicate with one or more devices that enable a user to interact with the electronic device 900, and / or communicate with any device that enables the electronic device 900 to communicate with one or more other computing devices (such as a router, a modem, etc.). Such communication can be carried out through the input / output (I / O) interface 950. Moreover, the electronic device 900 can also communicate with one or more networks (such as a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) through the network adapter 960. As shown in the figure, the network adapter 960 communicates with other modules of the electronic device 900 through the bus 930. It should be understood that, although not shown in the figure, other hardware and / or software modules can be used in combination with the electronic device 900, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0112] Through the description of the above embodiments, those skilled in the art can easily understand that the exemplary embodiments described herein can be implemented by software, or can be implemented by the way of software combined with necessary hardware. Therefore, the technical solutions according to the embodiments of the present disclosure can be embodied in the form of a software product, and the software product can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on the network, including several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the embodiments of the present disclosure.

[0113] In the disclosed exemplary embodiments, there is also provided a computer-readable storage medium, and the computer-readable storage medium can be a readable signal medium or a readable storage medium. A program product capable of implementing the above method of the present disclosure is stored on the computer-readable storage medium.

[0114] In some possible implementation manners, various aspects of the present disclosure can also be implemented in the form of a program product, which includes program code. When the program product runs on a terminal device, the program code is used to enable the terminal device to execute the steps according to various exemplary embodiments of the present disclosure described in the "Specific Embodiments" section of this specification.

[0115] More specific examples of the computer-readable storage medium in the present disclosure may include, but are not limited to: electrical connections with one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the above.

[0116] In the present disclosure, the computer-readable storage medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries the readable program code. Such a propagated data signal may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The readable signal medium may also be any readable medium other than the readable storage medium, which can send, propagate, or transmit a program for use by or in combination with an instruction execution system, apparatus, or device.

[0117] Optionally, the program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination of the above.

[0118] In specific implementation, the program code for performing the operations of the present disclosure may be written in any combination of one or more programming languages. The programming languages include object-oriented programming languages such as Java, C++, etc., and also include conventional procedural programming languages such as the "C" language or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, executed as an independent software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., by connecting through the Internet using an Internet service provider).

[0119] The embodiments of the present disclosure provide a computer program product or a computer program, which includes computer instructions stored in a computer-readable storage medium. The processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the satellite communication method provided in any of the various alternative manners in the embodiments of the present disclosure.

[0120] It should be noted that although several modules or units of a device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more of the above-described modules or units can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0121] In addition, although the steps of the methods in the present disclosure are described in a specific order in the drawings, this does not require or imply that these steps must be performed in that specific order, or that all of the shown steps must be performed to achieve the desired result. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step for execution, and / or one step may be decomposed into multiple steps for execution, etc.

[0122] Through the description of the above embodiments, those skilled in the art can easily understand that the exemplary embodiments described herein can be implemented by software or by a combination of software and necessary hardware. Therefore, the technical solutions according to the embodiments of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the methods according to the embodiments of the present disclosure.

[0123] After considering the specification and practicing the invention disclosed herein, those skilled in the art will readily conceive of other embodiments of the present disclosure. The present disclosure is intended to cover any variations, uses, or adaptations of the present disclosure, which follow the general principles of the present disclosure and include known common knowledge or conventional technical means in the technical field not disclosed by the present disclosure. The specification and examples are only regarded as exemplary, and the true scope of the present disclosure is pointed out by the appended claims.

Claims

1. A satellite communication method, applied to a satellite, characterized in that: include: Receiving a user message sent by a user device, wherein the user message includes a first message authentication code and a user confidentiality identifier; When a feeder link is unavailable, querying a protection key corresponding to a user confidentiality identifier in the user message, wherein the feeder link is a connection link between the satellite and a core network; generating a second message authentication code based on the user message and the protection key; When the first message authentication code is different from the second message authentication code, the user message is not stored.

2. The method according to claim 1, characterized in that: Generating a second message authentication code based on the user message and the protection key includes: Performing an XOR operation on the protection key and the internal filling value to obtain a first intermediate value; Performing an XOR operation on the protection key and the external padding value to obtain a second intermediate value; After appending the user message to the first intermediate value, first data is obtained, and a hash value of the first data is calculated; After the hash value of the first data is added to the second intermediate value, the second data is obtained, and the hash value of the second data is calculated, and the hash value of the second data is used as the second message authentication code.

3. The method according to claim 1, characterized in that After generating a second message authentication code based on the user message and the protection key, the method further includes: When the first message authentication code is the same as the second message authentication code, the user message is stored.

4. The method according to claim 1, characterized in that: Before receiving the user message sent by the user equipment, the method further includes: receiving a registration request for a store-and-forward satellite operation sent by the user equipment, wherein the registration request includes the user confidentiality identifier and a function identifier of the store-and-forward satellite operation; When the feeder link is available, the registration request is forwarded to the core network to complete the registration of the user equipment for the store-and-forward satellite operation.

5. The method according to claim 4, characterized in that When the feeder link is available, forwarding the registration request to the core network to complete the registration of the user equipment for the store-and-forward satellite operation, comprising: receiving a message response fed back by the core network, wherein the message response includes the protection key and the user confidentiality identifier; storing the protection key and the user secret identifier; The message response is forwarded to the user equipment to complete the registration of the user equipment for the store-and-forward satellite operation.

6. The method according to claim 5, characterized in that Forwarding the message response to the user equipment to complete the registration of the user equipment for the store-and-forward satellite operation, comprising: Receiving an authentication response fed back by the user equipment, wherein the authentication response includes the user confidentiality identifier and the first message authentication code; When the feeder link is unavailable, querying the protection key corresponding to the user confidentiality identifier in the authentication response; generating the second message authentication code based on the authentication response and the queried protection key; When the first message authentication code is the same as the second message authentication code, the authentication response is stored, and when the feeder link is available, the authentication response is forwarded to the core network to complete the registration of the user equipment for the store-and-forward satellite operation.

7. The method according to claim 5, characterized in that After the core network identifies the function identifier carried in the registration request, it generates an initial authentication vector and derives a protection key based on the master key, and combines the initial authentication vector, the protection key and the user confidentiality identifier in the registration request to obtain the message response.

8. The method according to claim 6, characterized in that The user equipment determines an authentication vector based on an initial authentication vector in the message response; generates a first message authentication code of the authentication response based on the protection key, wherein the protection key is derived based on the master key; The authentication response is obtained by combining the authentication vector, the user secret identifier and the first message authentication code.

9. A satellite communication method, applied to a user equipment, characterized in that: include: deriving a protection key based on the master key, and generating a first message authentication code based on the protection key; A user message is generated based on the first message authentication code and a user confidentiality identifier, and the user message is sent to a satellite, so as to determine not to store the user message when a feeder link is unavailable and the first message authentication code is different from a second message authentication code generated by the satellite, wherein the feeder link is a connection link between the satellite and a core network.

10. A satellite communication device, applied to a satellite, characterized in that: include: A receiving module, configured to receive a user message sent by a user device, wherein the user message includes a first message authentication code and a user confidentiality identifier; A query module, configured to query a protection key corresponding to a user confidentiality identifier in the user message when a feeder link is unavailable, wherein the feeder link is a connection link between the satellite and a core network; A first generating module, configured to generate a second message authentication code based on the user message and the protection key; The storage module is configured not to store the user message when the first message authentication code is different from the second message authentication code.

11. A satellite communication device, applied to user equipment, characterized in that: include: A second generating module is configured to derive a protection key based on the master key, and generate a first message authentication code based on the protection key; The sending module is configured to generate a user message based on the first message authentication code and the user confidentiality identifier, and send the user message to the satellite, so as to determine not to store the user message when a feeder link is unavailable and the first message authentication code is different from a second message authentication code generated by the satellite, wherein the feeder link is a connection link between the satellite and a core network.

12. An electronic device, characterized in that: include: processor; as well as A memory, configured to store executable instructions of the processor; The processor is configured to execute the satellite communication method according to any one of claims 1 to 8 or 9 by executing the executable instructions.

13. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the satellite communication method described in any one of claims 1-8 or 9 is implemented.

Images