Inter-satellite authentication method and system based on identity-based password scheme

Abstract

The invention provides an inter-satellite authentication method and system based on an identity-based password scheme. The method comprises the following steps that: an initiating node selects a random short vector, and multiplies the random short vector by utilizing a locally pre-stored node characteristic matrix to obtain an authentication credential; the initiating node obtains identity information of the response node and encrypts plaintext data to obtain an authentication ciphertext; the plaintext data comprises a node feature of the initiating node, a random short vector and an authentication certificate; the initiating node sends the authentication ciphertext to the response node; the response node decrypts the authentication ciphertext by using a private key of the response node to obtain decrypted data; the decrypted data comprises a vector to be verified and an authentication certificate; the response node obtains identity information of the initiating node and generates an authentication result; comparing the authentication result with the authentication certificate; and if the authentication result is the same as the authentication certificate, determining that the authentication is passed.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of satellite communication, in particular to an inter-satellite authentication method and system based on an identity-based cryptography scheme. BACKGROUND

[0002] In modern satellite networks, especially in low-orbit satellite constellations, a secure and efficient inter-satellite identity authentication protocol is the core to ensure communication security. The existing public key infrastructure requires certificate management, resulting in large transmission overhead and frequent authentication, thus producing high latency, strong interaction dependence and other problems that are not suitable for inter-satellite authentication.

[0003] Current inter-satellite authentication methods mainly include combined public key mechanism, hierarchical authentication mechanism, blockchain, and zero trust, among others. The combined public key mechanism provides key management through matrix mapping and key combination, but its security highly depends on the secrecy of the public key matrix, which has security risks due to collusion attacks and is not resistant to quantum attacks. The hierarchical authentication mechanism adopts a hierarchical control of "ground control center-high orbit satellite-low orbit satellite", which heavily relies on ground stations and high orbit satellites and has a single point of failure risk. The blockchain scheme stores satellite identities and certificate information on a distributed ledger, which does not rely on a single ground authentication center, but the storage, synchronization and consensus mechanism of the blockchain has large storage and communication overhead and uncertain authentication delay, which is not suitable for resource-constrained on-board environments. The zero-trust-based authentication scheme has extremely high security and dynamic risk control, but it is complex to implement and manage strategies and has a strong dependence on ground systems.

[0004] Moreover, existing group authentication methods require the use of certificates to obtain public keys. For example, in the existing public key encryption RSA scheme and ECC scheme, the certificate size is about 1-2 KB, while using identity information as a public key can reduce the public key transmission bandwidth requirement to less than 256 bits. In addition, for example, in the SM9 scheme, identity authentication requires more than two interactions of ciphertext and encryption and decryption operations to achieve authentication. SUMMARY

[0005] To solve the technical problems existing in the prior art, the purpose of the present application is to provide an inter-satellite authentication method and system based on an identity-based cryptography scheme, which can implement inter-satellite authentication in low-orbit satellite scenarios and other scenarios through an identity-based cryptography scheme, meet the needs of non-interactive, certificate-free, high-dynamic, and low-central-dependence scenarios, and quickly complete identity authentication.

[0006] To achieve the above-mentioned application purpose, the present application provides an inter-satellite authentication method based on an identity-based cryptography scheme, the method comprising:

[0007] The initiating node selects a random short vector and multiplies it with a locally pre-stored node feature matrix to obtain an authentication credential;

[0008] The initiating node obtains identity information of the response node, and encrypts the plaintext data as authentication ciphertext by taking the identity information of the response node as a public key; the plaintext data comprises node features of the initiating node, the random short vector and the authentication credential; the node features of the initiating node multiplied by the node feature matrix can obtain the identity information of the initiating node; the identity information comprises a satellite number or a satellite parameter;

[0009] The initiating node sends the authentication ciphertext to the response node.

[0010] The response node decrypts the authentication ciphertext by using a private key of the response node to obtain decryption data; the decryption data comprises a to-be-verified vector and the authentication credential.

[0011] The response node obtains identity information of the initiating node, and generates an authentication result by using a locally pre-stored node feature matrix, the to-be-verified vector and the identity information of the initiating node.

[0012] The authentication result is compared with the authentication credential; if the authentication result is the same as the authentication credential, it is determined that the authentication is passed.

[0013] According to one technical solution of the present application, before the initiating node generates the authentication credential, the method further comprises:

[0014] A ground key generation center KGC generates a corresponding private key for each node based on identity information of each node, and generates a node feature matrix and node features shared by all nodes; and sends the private key of each node, the node feature matrix and the node features to the corresponding node for local storage.

[0015] According to one technical solution of the present application, the identity information is converted into a fixed-length vector by a hash function.

[0016] According to one technical solution of the present application, the plaintext data further comprises a timestamp.

[0017] The decryption data further comprises the timestamp.

[0018] The response node judges whether the timestamp is within a preset valid time window; if the timestamp is within the valid time window, the authentication result is compared with the authentication credential.

[0019] According to one technical solution of the present application, the node features of the initiating node and the random short vector are summed first, and then are sequentially spliced with the authentication credential and the timestamp to constitute the plaintext data.

[0020] The decryption data is restored to a splicing structure constituted by the to-be-verified vector, the authentication credential and the timestamp being sequentially spliced.

[0021] The application also provides an inter-satellite authentication system based on an identity-based cryptography scheme, comprising:

[0022] a credential generation unit configured to select a random short vector and multiply the random short vector with a locally pre-stored node feature matrix to obtain an authentication credential;

[0023] an encryption unit configured to obtain identity information of a response node and encrypt plaintext data to obtain authentication ciphertext by taking the identity information of the response node as a public key; the plaintext data comprises node features of an initiating node, the random short vector and the authentication credential; multiplication of the node features of the initiating node and the node feature matrix can obtain identity information of the initiating node; the identity information comprises a satellite number or a satellite parameter;

[0024] a sending unit configured to send the authentication ciphertext to the response node;

[0025] a decryption unit configured to decrypt the authentication ciphertext using a private key of the response node to obtain decryption data; the decryption data comprises a verification vector and the authentication credential;

[0026] a verification unit configured to obtain identity information of an initiating node and generate an authentication result by using a locally pre-stored node feature matrix, the verification vector and the identity information of the initiating node;

[0027] and compare the authentication result with the authentication credential; if the authentication result is the same as the authentication credential, it is determined that the authentication is passed.

[0028] According to one technical solution of the application, the application further comprises a ground key generation center KGC configured to:

[0029] generate a private key corresponding to each node and generate a node feature matrix and node features shared by all nodes based on the identity information of each node before the initiating node generates an authentication credential; and send the private key of each node, the node feature matrix and the node features to the corresponding node for local storage.

[0030] According to one technical solution of the application, the encryption unit is further configured to convert the identity information into a fixed-length vector through a hash function.

[0031] According to one technical solution of the application, the plaintext data further comprises a timestamp; and the decryption data further comprises the timestamp.

[0032] The verification unit is further configured to determine whether the timestamp is within a preset valid time window; and if the timestamp is within the valid time window, compare the authentication result with the authentication credential.

[0033] According to one technical solution of the present application, the encryption unit is further configured to first sum the node feature of the initiating node and the random short vector, and then sequentially splice the authentication credential and the timestamp to form the plaintext data.

[0034] The decryption unit is further configured to restore the decrypted data into a splicing structure sequentially spliced by the to-be-verified vector, the authentication credential and the timestamp.

[0035] The present application provides an inter-satellite authentication method and system based on an identity-based cryptography scheme, which has the following beneficial effects:

[0036] 1. The present application is applicable to all IBE schemes, and in the post-quantum era, a quantum-resistant IBE scheme can be selected to ensure that the method has the ability to resist quantum attacks;

[0037] 2. The present application completes the verification information calculation of the responding node through the correspondence between the node feature and the identity information, only needs to send the ciphertext once and the authentication pass information once, and can reduce the transmission bandwidth by more than 50%;

[0038] 3. The present application only needs to interact between the satellite node and the KGC during initialization, and only needs to obtain the identity information during the subsequent authentication process, thereby reducing the dependence of the authentication process on the KGC; secondly, the time stamp is introduced in the authentication process to ensure the timeliness of the authentication, thereby realizing non-interactive and low-centralized inter-satellite authentication;

[0039] 4. The present application is applicable to large-scale inter-satellite networking authentication and other task environments with extremely high requirements for time delay and reliability, and can realize inter-satellite authentication through an identity-based cryptography scheme in low-orbit satellite scenarios, meet the scene requirements of non-interactive, certificateless, high-dynamic and low-central dependence, and quickly complete identity authentication. BRIEF DESCRIPTION OF DRAWINGS

[0040] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed in the embodiments. Obviously, the drawings described below are only some embodiments of the present application, and other drawings can also be obtained by those skilled in the art without creative labor on the basis of these drawings.

[0041] Figure 1 The flowchart of the initialization stage in the inter-satellite authentication method based on the identity-based cryptography scheme according to an embodiment of the present application is schematically represented.

[0042] Figure 2 The flowchart of the authentication initiation stage and the responding authentication stage in the inter-satellite authentication method based on the identity-based cryptography scheme according to an embodiment of the present application is schematically represented. DETAILED DESCRIPTION

[0043] The description of the embodiments of this specification should be considered in conjunction with the accompanying drawings, which are incorporated in and constitute a part of this specification. In the drawings, the shapes or thicknesses of the embodiments can be exaggerated and illustrated in a simplified or convenient manner. Also, parts of structures in the drawings will be described separately, and it is noted that elements not shown or described in the drawings are in a form known to those skilled in the art.

[0044] The description of the embodiments herein, any reference to direction or orientation is merely intended for convenience of description and is not intended in any way to limit the scope of the present application. The following description of the preferred embodiments will refer to a combination of features that can exist independently from each other or in other combinations. The application is not limited to the preferred embodiments. The scope of the application is defined by the claims. As Figures 1-2 indicated; DETAILED DESCRIPTION

[0046] The inter-satellite authentication method based on an identity-based cryptographic scheme in the embodiment includes:

[0047] The initiating node selects a random short vector and multiplies the random short vector with a locally pre-stored node feature matrix to obtain an authentication credential;

[0048] The initiating node obtains the identity information of the responding node and encrypts the plaintext data to obtain authentication ciphertext by taking the identity information of the responding node as a public key; the plaintext data includes the node features of the initiating node, the random short vector, and the authentication credential; the node features of the initiating node multiplied by the node feature matrix can obtain the identity information of the initiating node; the identity information includes a satellite number or a satellite parameter;

[0049] The initiating node sends the authentication ciphertext to the responding node;

[0050] The responding node decrypts the authentication ciphertext using its own private key to obtain decryption data; the decryption data includes a to-be-verified vector and the authentication credential;

[0051] The responding node obtains the identity information of the initiating node and generates an authentication result using the locally pre-stored node feature matrix, the to-be-verified vector, and the identity information of the initiating node;

[0052] The authentication result is compared with the authentication credential; if the authentication result is the same as the authentication credential, it is determined that the authentication is passed.

[0053] In the embodiment, the method consists of two parts, the first part is the initiating authentication stage, and the second part is the responding authentication stage.

[0054] Wherein each node is configured with an identity-based encryption algorithm (IBE), which includes:

[0055] IBE.KeyGen (private key generation): contains initialization algorithm and key extraction algorithm, input security parameters and identity information, output private key;

[0056] IBE.Enc (encryption): input identity information and plaintext, output ciphertext;

[0057] IBE.Dec (decryption): input ciphertext and private key, output plaintext.

[0058] The above identity-based encryption algorithm IBE can use quantum-resistant encryption schemes, such as GPV08, ABB or MP12 based on lattice encryption. Taking GPV08 as an example, it contains a trapdoor generation algorithm TrapGen and an image sampling algorithm SamplePre, which can map user identity information to a vector through a hash function and generate a corresponding short vector private key, meeting the demand of binding node features and identity information.

[0059] I. As shown in Figure 2 , in the authentication initiation phase:

[0060] 1. The initiator node first downloads the identity information of the responder node from the KGC (Key Generation Center, Key Generation Center), and the initiator node selects a random short vector , and multiplies the legal node feature matrix P with the random short vector to obtain the authentication credential of the initiator node ;

[0061] 2. The initiator node A calls the IBE.Enc algorithm, inputs the identity information of the responder node and the plaintext (the initiator node adds the node feature to the random short vector and concatenates with the authentication credential ), and encrypts it with the identity information of the responder node to output the authentication ciphertext and send it to the responder node ; wherein, represents string concatenation.

[0062] II. As shown in Figure 2As shown, in the response authentication stage:

[0063] 1. The response node B decrypts the authentication ciphertext, and the response node downloads the identity information of the initiator node from the KGC , and calls the IBE.Dec algorithm, inputs the private key of the response node and the authentication ciphertext , and outputs the decryption result ; ;

[0064] 2. After completing the decryption, the authentication operation is performed by using the legal node feature matrix P, the identity information of the initiator node , and the to-be-verified vector , and the authentication result is obtained.

[0065] The response node judges whether the authentication credential of the initiator node is the same as the authentication result, if the authentication credential is the same as the authentication result, the authentication is passed, and if the authentication credential is not the same as the authentication result, the authentication is not passed. Then the response node B sends the information whether the authentication is passed to the initiator node A.

[0066] Specifically, the response node calculates the decryption result , and let be the authentication result. It is judged whether is the same as , if yes, the authentication is passed, otherwise, the authentication is not passed.

[0067] The inter-satellite authentication method based on the identity-based encryption scheme provided by the embodiment is applicable to non-interactive, certificateless, low-bandwidth, and low-centralization demand inter-satellite networking. Through the encryption of the identity information as the public key and the addition and subtraction operation of the ciphertext, the efficiency of the authentication can be effectively improved, and the interactive bandwidth can be reduced. Specific implementation method two

[0069] The embodiment is a further description of the first embodiment. In the embodiment, before the initiator node generates the authentication credential, the method further includes:

[0070] The ground key generation center KGC generates corresponding private keys for each node based on the identity information of each node, and generates a node feature matrix and a node feature shared by all nodes, and sends the private keys, the node feature matrix and the node feature of each node to the corresponding node for local storage.

[0071] In the embodiment, as shown in the method further includes a zeroth part initialization stage, and the initialization step is a step to be completed by all (legal satellite) nodes before interaction. Figure 1 ​​​

[0072] In the initialization phase, node i interacts with the KGC as follows:

[0073] 1. The KGC selects an identity-based encryption algorithm IBE as the underlying encryption algorithm, and any node (including all legitimate nodes) inputs identity information to the KGC as input. The KGC calls the IBE.KeyGen algorithm to calculate the private key .

[0074] where the identity information is a vector, and the private key is a matrix.

[0075] 2. The KGC calls a trapdoor generation algorithm to generate a legitimate node feature matrix and a trapdoor corresponding to the legitimate node feature matrix.

[0076] The trapdoor generation algorithm method can be the trapdoor generation algorithm TrapGen of GPV08.

[0077] 3. The KGC calls an image sampling algorithm to input the feature matrix , the trapdoor , and the identity information , and outputs the node feature , which satisfies the relationship ; and uses the small integer solution problem (SIS) on the lattice as the underlying difficult problem to ensure security.

[0078] The image sampling algorithm can be the image sampling algorithm SamplePre of GPV08.

[0079] 4. The KGC sends the legitimate node feature matrix , the node feature , and the private key of the node to the node .

[0080] The SIS (Short Integer Solution) problem is deeply integrated with the identity information of the satellite node in this embodiment. The KGC generates a node feature vector for each legitimate satellite node, which satisfies , where P is a public legitimate node feature matrix, is the identity information (vector after mapping by a hash function) of the node. Since the short vector cannot be solved from without the trapdoor, the satellite node cannot obtain the private key of the node.It is computationally equivalent to solving SIS problem, so the binding relation is resistant to forgery. In the authentication process, the correctness of the verification logic depends on the SIS binding relation, and the security is guaranteed by the difficulty of SIS problem, so that efficient and secure inter-satellite authentication is realized under the condition of no certificate and only single communication. Specific embodiment three

[0082] In this embodiment, the identity information is converted into a fixed-length vector by a hash function.

[0083] In this embodiment, taking an identity-based integer matrix homomorphism encryption scheme as an example, the identity information is a string related to node information, and a hash function is used to establish a connection with the encryption scheme, that is, to as a vector, and operations are performed in the encryption scheme. Specific embodiment four

[0085] This embodiment is a further description of embodiment one, in which the plaintext data further includes a timestamp;

[0086] The decrypted data further includes a timestamp;

[0087] The response node judges whether the timestamp is within a preset valid time window; if it is within the valid time window, the authentication result is compared with the authentication credential.

[0088] In this embodiment, to prevent an attacker from intercepting and replaying the authentication message, the initiator node introduces a current timestamp when constructing the authentication plaintext. The authentication plaintext is , wherein is the timestamp.

[0089] The initiator node A calls the IBE.Enc algorithm, inputs the identity information of the response node and the authentication plaintext , encrypts the identity information of the response node , outputs the authentication ciphertext , and sends it to the response node ;

[0090] The response node B decrypts the authentication ciphertext , and outputs the decryption result ; the response node , for the decryption result , first judges whether the timestamp is within the valid period, and if so, calculates and order For the authentication result. Determine. Whether or not If they are the same, the authentication passes; otherwise, it fails. Detailed Implementation Method Five

[0092] This implementation method is a further explanation of implementation method four. In this implementation method, the node characteristics of the initiating node and the random short vector are first summed, and then concatenated with the authentication credential and the timestamp in sequence to form plaintext data.

[0093] The decrypted data is restored to a concatenated structure consisting of the vector to be verified, the authentication credential, and the timestamp.

[0094] In this invention, an identity-based cryptography scheme is used as the underlying encryption algorithm, with identity as the public key. A quantum-resistant identity-based cryptography scheme can be selected to ensure the ciphertext's resistance to quantum attacks in the post-quantum era. Furthermore, the security of mature cryptographic schemes based on difficult problems ensures that collusion attacks cannot affect the scheme's security. Secondly, this invention uses the identity-based cryptography scheme for inter-satellite authentication, placing the storage and computational overhead burden on the ground key generation center. The central node only needs to participate in the initialization phase, while the satellite only needs to perform authentication, matrix and vector multiplication, encryption, and decryption operations. Moreover, the satellite node's identity is used as the public key, abandoning the existing certificate mechanism and greatly reducing the key transmission bandwidth. In addition, according to the construction process of this method, the entire authentication process only requires one ciphertext transmission, which can achieve non-interactive authentication, reduce inter-satellite interaction dependence and authentication latency, and is suitable for inter-satellite environments with high dynamics and low centralization requirements. Specific Implementation Method Six

[0096] This embodiment of an inter-satellite authentication system based on an identity-based cryptographic scheme includes:

[0097] The credential generation unit is used to select a random short vector and multiply it by the locally pre-stored node feature matrix to obtain the authentication credential.

[0098] The encryption unit is used to obtain the identity information of the responding node and use the identity information of the responding node as a public key to encrypt the plaintext data to obtain the authentication ciphertext; the plaintext data includes the node characteristics of the initiating node, a random short vector, and authentication credentials; the node characteristics of the initiating node are multiplied by the node characteristic matrix to obtain the identity information of the initiating node; the identity information includes satellite number or satellite parameters;

[0099] The sending unit is used to send the authentication ciphertext to the response node;

[0100] The decryption unit is used to decrypt the authentication ciphertext using the private key of the responding node to obtain decrypted data; the decrypted data includes a verification vector and authentication credentials.

[0101] The verification unit is used to obtain the identity information of the initiating node and generate the authentication result using the locally pre-stored node feature matrix, verification vector and the identity information of the initiating node;

[0102] Furthermore, the authentication result is compared with the authentication certificate; if the authentication result is the same as the authentication certificate, the authentication is deemed successful. Detailed Implementation Method Seven

[0104] This embodiment is a further explanation of embodiment six. In this embodiment, a ground key generation center (KGC) is also included, which is used for:

[0105] Before the initiating node generates authentication credentials, a corresponding private key is generated for each node based on the identity information of each node, as well as a node feature matrix and node features shared by all nodes; and the private key, node feature matrix and node features of each node are sent to the corresponding node for local storage. Detailed Implementation Method Eight

[0107] This embodiment is a further explanation of embodiment seven. In this embodiment, the encryption unit is also used to convert the identity information into a fixed-length vector through a hash function. Detailed Implementation Method Nine

[0109] This embodiment is a further explanation of embodiment six. In this embodiment, the plaintext data also includes a timestamp; the decrypted data also includes a timestamp.

[0110] The verification unit is also used to determine whether the timestamp is within a preset valid time window; if it is within the valid time window, the authentication result is compared with the authentication credential. Detailed Implementation Method Ten

[0112] This embodiment is a further explanation of embodiment nine. In this embodiment, the encryption unit is also used to first sum the node characteristics of the initiating node and the random short vector, and then concatenate them with the authentication credential and the timestamp in sequence to form plaintext data.

[0113] The decryption unit is also used to restore the decrypted data into a concatenated structure consisting of the vector to be verified, the authentication credential, and the timestamp.

[0114] This invention discloses an inter-satellite authentication method and system based on an identity-based cryptographic scheme. The method includes: an initiating node selecting a random short vector and multiplying it by a locally pre-stored node feature matrix to obtain an authentication credential; the initiating node obtaining the identity information of a responding node and encrypting plaintext data to obtain authentication ciphertext; the plaintext data includes the node features of the initiating node, the random short vector, and the authentication credential; the initiating node sending the authentication ciphertext to the responding node; the responding node decrypting the authentication ciphertext using its own private key to obtain decrypted data; the decrypted data includes a vector to be verified and the authentication credential; the responding node obtaining the identity information of the initiating node and generating an authentication result; comparing the authentication result with the authentication credential; if the authentication result is the same as the authentication credential, the authentication is deemed successful.

[0115] Furthermore, it should be noted that the present invention can be provided as a method, apparatus, or computer program product. Therefore, embodiments of the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Moreover, embodiments of the present invention can take the form of a computer program product implemented on one or more computer-usable storage media containing computer-usable program code.

[0116] Embodiments of the present invention are described with reference to flowchart illustrations and / or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0117] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The functions specified in one or more boxes. These computer program instructions may also be loaded onto a computer or other programmable data processing terminal equipment to cause a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal equipment for implementing the process. Figure 1One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0118] It should also be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.

[0119] Finally, it should be noted that the above description represents a preferred embodiment of the present invention. It should be pointed out that although preferred embodiments have been described, those skilled in the art, once they understand the basic inventive concept of the present invention, can make various improvements and modifications without departing from the principles described herein. These improvements and modifications should also be considered within the scope of protection of the present invention. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the embodiments of the present invention.

Claims

1. An inter-satellite authentication method based on an identity-based cryptography scheme, characterized in that, The method comprises: The initiating node selects a random short vector and multiplies the random short vector with a locally pre-stored node feature matrix to obtain an authentication credential; The initiating node obtains identity information of the responding node and encrypts plaintext data by taking the identity information of the responding node as a public key to obtain authentication ciphertext; the plaintext data comprises node features of the initiating node, the random short vector and the authentication credential; Multiplication of the node features of the initiating node and the node feature matrix can obtain identity information of the initiating node; the identity information comprises a satellite number or a satellite parameter; The initiating node sends the authentication ciphertext to the responding node; The responding node decrypts the authentication ciphertext by using a private key of the responding node to obtain decryption data; the decryption data comprises a to-be-verified vector and the authentication credential; The responding node obtains identity information of the initiating node and generates an authentication result by using a locally pre-stored node feature matrix, the to-be-verified vector and the identity information of the initiating node; The authentication result is compared with the authentication credential; if the authentication result is the same as the authentication credential, it is determined that the authentication is passed.

2. The inter-satellite authentication method based on identity-based cryptography scheme according to claim 1, characterized in that, Before the initiating node generates the authentication credential, the method further comprises: A ground key generation center (KGC) generates a private key corresponding to each node based on identity information of each node, and generates a node feature matrix and node features shared by all nodes; and the private key of each node, the node feature matrix and the node features are sent to the corresponding node for local storage.

3. The inter-satellite authentication method based on identity-based cryptography scheme according to claim 2, characterized in that, The identity information is converted into a fixed-length vector by using a hash function.

4. The inter-satellite authentication method based on identity-based cryptography scheme according to claim 1, characterized in that, The plaintext data further comprises a timestamp; The decryption data further comprises the timestamp; The responding node judges whether the timestamp is within a preset valid time window; If the timestamp is within the valid time window, the authentication result is compared with the authentication credential.

5. The inter-satellite authentication method based on identity-based cryptography scheme according to claim 4, characterized in that, The node features of the initiating node and the random short vector are summed first, and then are sequentially spliced with the authentication credential and the timestamp to constitute the plaintext data; The decryption data is restored to a splicing structure constituted by the to-be-verified vector, the authentication credential and the timestamp which are sequentially spliced.

6. An inter-satellite authentication system based on an identity-based cryptography scheme, characterized in that, The method comprises: A credential generation unit is configured to select a random short vector and multiply the random short vector with a locally pre-stored node feature matrix to obtain an authentication credential; An encryption unit is configured to obtain identity information of the responding node and encrypt plaintext data by taking the identity information of the responding node as a public key to obtain authentication ciphertext; the plaintext data comprises node features of the initiating node, the random short vector and the authentication credential; Multiplication of the node features of the initiating node and the node feature matrix can obtain identity information of the initiating node; the identity information comprises a satellite number or a satellite parameter; A sending unit is configured to send the authentication ciphertext to the responding node; A decryption unit is configured to decrypt the authentication ciphertext by using a private key of the responding node to obtain decryption data; the decryption data comprises a to-be-verified vector and the authentication credential; The verification unit is configured to acquire identity information of the initiating node, and generate an authentication result by using a locally pre-stored node feature matrix, the verification vector and the identity information of the initiating node; The authentication result is compared with the authentication credential, and if the authentication result is the same as the authentication credential, authentication is determined to be passed.

7. The identity-based cryptography scheme based inter-satellite authentication system according to claim 6, characterized in that, The ground key generation center (KGC) is further configured to: Before the initiating node generates the authentication credential, generate a private key corresponding to each node based on identity information of each node, and generate a node feature matrix and a node feature shared by all nodes; and send the private key of each node, the node feature matrix and the node feature to the corresponding node for local storage.

8. The identity-based cryptography scheme based inter-satellite authentication system according to claim 7, characterized in that, The encryption unit is further configured to convert the identity information into a fixed-length vector by using a hash function.

9. The identity-based cryptography scheme based inter-satellite authentication system according to claim 6, wherein, The plaintext data further includes a timestamp, and the decrypted data further includes the timestamp. The verification unit is further configured to determine whether the timestamp is within a preset valid time window, and if the timestamp is within the valid time window, compare the authentication result with the authentication credential.

10. The identity-based cryptography scheme based inter-satellite authentication system according to claim 9, characterized in that, The encryption unit is further configured to first sum the node feature of the initiating node and a random short vector, and then sequentially splice the authentication credential and the timestamp to form the plaintext data. The decryption unit is further configured to restore the decrypted data to a splicing structure in which a to-be-verified vector, an authentication credential and the timestamp are sequentially spliced.

Images