Inter-satellite authentication method and system based on identity-based cryptography scheme

Abstract

The application provides an inter-satellite authentication method and system based on an identity-based cryptography scheme. The method relates to the field of satellite communication and comprises the following steps: an initiating node selects a random short vector, and multiplies the random short vector with a locally pre-stored node characteristic matrix to obtain an authentication credential; the initiating node acquires identity information of a responding node, and encrypts plaintext data to obtain authentication ciphertext; the plaintext data comprises a node characteristic of the initiating node, the random short vector and the authentication credential; the initiating node sends the authentication ciphertext to the responding node; the responding node decrypts the authentication ciphertext by using a private key of the responding node to obtain decrypted data; the decrypted data comprises a to-be-verified vector and the authentication credential; the responding node acquires the identity information of the initiating node, and generates an authentication result; the authentication result is compared with the authentication credential; and if the authentication result is the same as the authentication credential, it is determined that the authentication is passed.

Description

Technical Field

[0001] This invention relates to the field of satellite communications, and in particular to an inter-satellite authentication method and system based on an identity-based cryptographic scheme. Background Technology

[0002] In modern satellite networks, especially low-Earth orbit satellite constellations, secure and efficient inter-satellite authentication protocols are crucial for ensuring communication security. Existing public key infrastructures (PKIs) suffer from high transmission overhead and frequent authentication due to certificate management requirements, resulting in high latency, strong interoperability, and other problems unsuitable for inter-satellite authentication.

[0003] Current inter-satellite authentication methods mainly include combined public key mechanisms, hierarchical authentication mechanisms, blockchain, and zero trust. Among them, the combined public key mechanism provides key management through matrix mapping and key combination, but its security is highly dependent on the confidentiality of the public key matrix, which poses a security risk due to collusion attacks and lacks resistance to quantum attacks. The hierarchical authentication mechanism adopts a hierarchical control system of "ground control center - high-orbit satellite - low-orbit satellite", which is heavily dependent on ground stations and high-orbit satellites and has the risk of single point of failure. The blockchain solution stores satellite identity and certificate information on a distributed ledger, which does not rely on a single ground authentication center, but the storage, synchronization, and consensus mechanisms of blockchain have high storage and communication overhead, and the uncertainty of authentication latency is not suitable for the resource-constrained on-board environment. Zero trust-based authentication schemes have extremely high security and dynamic risk control, but their implementation and policy management are complex and they are highly dependent on ground systems.

[0004] Furthermore, existing group authentication methods require the use of certificates to obtain public keys. Taking existing public key encryption schemes such as RSA and ECC as examples, the certificate size is approximately 1~2KB, while using identity information as the public key can reduce the public key transmission bandwidth requirement to less than 256 bits. In addition, taking SM9 as an example, identity authentication requires more than two exchanges of ciphertext and encryption / decryption operations to achieve authentication. Summary of the Invention

[0005] To address the technical problems existing in the prior art, the present invention aims to provide an inter-satellite authentication method and system based on an identity-based cryptographic scheme. This method enables inter-satellite authentication in scenarios such as low-Earth orbit satellites, meeting the requirements of non-interactive, certificate-free, highly dynamic, and low-central-dependency scenarios, and quickly completing identity authentication.

[0006] To achieve the above-mentioned objectives, this invention provides an inter-satellite authentication method based on an identity-based cryptographic scheme, the method comprising:

[0007] The initiating node selects a random short vector and multiplies it with the locally pre-stored node feature matrix to obtain the authentication credential.

[0008] The initiating node obtains the identity information of the responding node and uses the identity information of the responding node as a public key to encrypt plaintext data to obtain authentication ciphertext; the plaintext data includes the node characteristics of the initiating node, the random short vector, and the authentication credential; the node characteristics of the initiating node are multiplied by the node characteristic matrix to obtain the identity information of the initiating node; the identity information includes satellite number or satellite parameters;

[0009] The initiating node sends the authentication ciphertext to the responding node;

[0010] The responding node uses its own private key to decrypt the authentication ciphertext to obtain decrypted data; the decrypted data includes a vector to be verified and the authentication credential;

[0011] The response node obtains the identity information of the initiating node and generates an authentication result using the locally pre-stored node feature matrix, the vector to be verified, and the identity information of the initiating node.

[0012] The authentication result is compared with the authentication credential; if the authentication result is the same as the authentication credential, the authentication is deemed successful.

[0013] According to one technical solution of the present invention, before the initiating node generates the authentication credential, it further includes:

[0014] The ground key generation center (KGC) generates a corresponding private key for each node based on the identity information of each node, as well as a node feature matrix and node features shared by all nodes; and sends the private key, the node feature matrix and node features of each node to the corresponding node for local storage.

[0015] According to one technical solution of the present invention, the identity information is converted into a fixed-length vector through a hash function.

[0016] According to one technical solution of the present invention, the plaintext data further includes a timestamp;

[0017] The decrypted data also includes the timestamp;

[0018] The response node determines whether the timestamp is within a preset valid time window; if it is within the valid time window, it compares the authentication result with the authentication credential.

[0019] According to one technical solution of the present invention, the node characteristics of the initiating node and the random short vector are first summed, and then concatenated with the authentication credential and the timestamp in sequence to form the plaintext data;

[0020] The decrypted data is restored to a concatenated structure consisting of the vector to be verified, the authentication credential, and the timestamp, which are then sequentially assembled.

[0021] This invention also provides an inter-satellite authentication system based on an identity-based cryptographic scheme, comprising:

[0022] The credential generation unit is used to select a random short vector and multiply it by a locally pre-stored node feature matrix to obtain an authentication credential.

[0023] An encryption unit is used to obtain the identity information of the response node and use the identity information of the response node as a public key to encrypt plaintext data to obtain authentication ciphertext; the plaintext data includes the node characteristics of the initiating node, the random short vector, and the authentication credential; the node characteristics of the initiating node are multiplied by the node characteristic matrix to obtain the identity information of the initiating node; the identity information includes satellite number or satellite parameters;

[0024] A sending unit is used to send the authentication ciphertext to the response node;

[0025] The decryption unit is used to decrypt the authentication ciphertext using the private key of the response node to obtain decrypted data; the decrypted data includes a verification vector and the authentication credential.

[0026] The verification unit is used to obtain the identity information of the initiating node and generate an authentication result using the locally pre-stored node feature matrix, the verification vector, and the identity information of the initiating node.

[0027] Furthermore, the authentication result is compared with the authentication credential; if the authentication result is the same as the authentication credential, the authentication is deemed successful.

[0028] According to one technical solution of the present invention, it further includes a ground key generation center (KGC) for:

[0029] Before the initiating node generates authentication credentials, a corresponding private key is generated for each node based on the identity information of each node, as well as a node feature matrix and node features shared by all nodes; and the private key of each node, the node feature matrix and node features are sent to the corresponding node for local storage.

[0030] According to one technical solution of the present invention, the encryption unit is further used to convert the identity information into a fixed-length vector through a hash function.

[0031] According to one technical solution of the present invention, the plaintext data further includes a timestamp; the decrypted data further includes the timestamp;

[0032] The verification unit is further configured to determine whether the timestamp is within a preset valid time window; if it is within the valid time window, the authentication result is compared with the authentication credential.

[0033] According to one technical solution of the present invention, the encryption unit is further configured to first sum the node characteristics of the initiating node and the random short vector, and then concatenate them with the authentication credential and the timestamp in sequence to form the plaintext data;

[0034] The decryption unit is also used to restore the decrypted data into a concatenated structure consisting of the vector to be verified, the authentication credential, and the timestamp concatenated in sequence.

[0035] The present invention provides an inter-satellite authentication method and system based on an identity-based cryptographic scheme, which has the following beneficial effects:

[0036] 1. This invention is applicable to all IBE schemes. In the post-quantum era, a quantum-resistant IBE scheme can be selected to ensure that the method has the ability to resist quantum attacks.

[0037] 2. This invention completes the verification information calculation of the response node by corresponding node features and identity information. It only requires one encrypted transmission and one authentication pass / fail message transmission, which can reduce the transmission bandwidth by more than 50%.

[0038] 3. This invention only requires interaction between the satellite node and KGC during initialization. Subsequent authentication processes only require obtaining identity information, reducing the authentication process's dependence on KGC. Secondly, the introduction of timestamps during the authentication process ensures the timeliness of authentication, thereby achieving non-interactive, decentralized inter-satellite authentication.

[0039] 4. This invention is applicable to mission environments with extremely high requirements for latency and reliability, such as large-scale inter-satellite network authentication. It can achieve inter-satellite authentication in scenarios such as low-Earth orbit satellites through identity-based cryptography schemes, meeting the needs of non-interactive, certificate-free, highly dynamic, and low-central-dependency scenarios, and quickly completing identity authentication. Attached Figure Description

[0040] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly described below. Obviously, the drawings described below are merely some embodiments of the present invention, and those skilled in the art can obtain other drawings based on these drawings without creative effort.

[0041] Figure 1 This diagram illustrates the initialization phase of an inter-satellite authentication method based on an identity-based cryptography scheme according to an embodiment of the present invention.

[0042] Figure 2 The flowchart illustrates the authentication initiation phase and the authentication response phase in an inter-satellite authentication method based on an identity-based cryptography scheme according to an embodiment of the present invention. Detailed Implementation

[0043] The description of the embodiments in this specification should be taken in conjunction with the accompanying drawings, which should form part of the complete specification. In the drawings, the shape or thickness of the embodiments may be exaggerated and may be indicated in a simplified or convenient manner. Furthermore, parts of the various structures in the drawings will be described separately; it is worth noting that elements not shown in the figures or not described in words are in a form known to those skilled in the art.

[0044] The descriptions of the embodiments herein, including any references to directions and orientations, are for ease of description only and should not be construed as limiting the scope of the invention. The following description of preferred embodiments involves combinations of features, which may exist independently or in combination; the invention is not particularly limited to the preferred embodiments. The scope of the invention is defined by the claims. Figures 1-2 As shown; Specific Implementation Method 1

[0046] This embodiment provides an inter-satellite authentication method based on an identity-based cryptography scheme, the method comprising:

[0047] The initiating node selects a random short vector and multiplies it with the locally pre-stored node feature matrix to obtain the authentication credential.

[0048] The initiating node obtains the identity information of the responding node and uses the responding node's identity information as a public key to encrypt the plaintext data to obtain the authentication ciphertext. The plaintext data includes the initiating node's node characteristics, a random short vector, and authentication credentials. Multiplying the initiating node's node characteristics by the node characteristic matrix yields the initiating node's identity information, which includes the satellite number or satellite parameters.

[0049] The initiating node sends the authentication ciphertext to the responding node;

[0050] The responding node uses its own private key to decrypt the authentication ciphertext to obtain decrypted data; the decrypted data includes a vector to be verified and authentication credentials;

[0051] The responding node obtains the identity information of the initiating node and generates the authentication result using the locally pre-stored node feature matrix, the vector to be verified, and the identity information of the initiating node.

[0052] The authentication result is compared with the authentication certificate; if the authentication result is the same as the authentication certificate, the authentication is deemed successful.

[0053] In this embodiment, the method consists of two parts: the first part is the authentication initiation phase, and the second part is the authentication response phase.

[0054] Each node is configured with an Identity-Based Encryption (IBE) algorithm, which includes:

[0055] IBE.KeyGen (Private Key Generation): Includes initialization and key extraction algorithms. Input security parameters and identity information, and output the private key.

[0056] IBE.Enc (encryption): Input identity information and plaintext, output ciphertext;

[0057] IBE.Dec (Decrypt): Input ciphertext and private key, output plaintext.

[0058] The aforementioned Identity-Based Cryptography (IBE) algorithm can employ quantum-resistant cryptographic schemes, such as the lattice-based GPV08, ABB, or MP12 schemes. Taking GPV08 as an example, it includes the TrapGen trapdoor generation algorithm and the SamplePre preimage sampling algorithm, which can map user identity information into a vector through a hash function and generate a corresponding short vector private key, satisfying the requirement of binding node features with identity information.

[0059] I. For example Figure 2 As shown, during the authentication initiation phase:

[0060] 1. Initiating Node First, download the response node from KGC (Key Generation Center). identity information Initiating node Select a short random vector The legal node feature matrix P and the random short vector are used together. Multiply to obtain the initiating node Authentication certificate ;

[0061] 2. Initiating node A calls the IBE.Enc algorithm, inputting the response node. identity information He Mingwen (Initiating node uses node characteristics) With random short vectors Added together with the authentication certificate Cascade), using response nodes identity information Encrypt the data and output the authentication ciphertext. and send to the response node. ;in, This indicates string concatenation.

[0062] II. Figure 2As shown, during the response authentication phase:

[0063] 1. Response node B decrypts the authentication ciphertext. Download from KGC initiating node identity information And call the IBE.Dec algorithm, inputting the response node. private key and authentication ciphertext Output the decryption result ;

[0064] 2. After decryption, use the legitimate node feature matrix P and the identity information of the initiating node. Vector to be verified Perform authentication calculations to obtain the authentication result;

[0065] The responding node checks if the authentication credentials of the initiating node match the authentication result. If they match, authentication succeeds; otherwise, it fails. The responding node then sends a confirmation message to the initiating node A indicating whether authentication was successful.

[0066] Specifically, the response node Regarding the decryption results , perform calculations and order For the authentication result. Determine. Whether or not If they are the same, the authentication passes; otherwise, it fails.

[0067] The inter-satellite authentication method based on identity-based cryptography provided in this embodiment is suitable for non-interactive, certificate-free, low-bandwidth, and low-centralization inter-satellite networks. By using identity information as the public key for encryption and adding and subtracting ciphertext, the authentication efficiency can be effectively improved and the interaction bandwidth reduced. Specific Implementation Method Two

[0069] This embodiment is a further explanation of embodiment one. In this embodiment, before the initiating node generates the authentication credential, it also includes:

[0070] The ground key generation center (KGC) generates a corresponding private key for each node based on the identity information of each node, as well as a node feature matrix and node features shared by all nodes; and sends the private key, node feature matrix and node features of each node to the corresponding node for local storage.

[0071] In this embodiment, such as Figure 1 As shown, the method also includes a zero-level initialization phase, which consists of steps that all (legitimate satellite) nodes must complete before interaction.

[0072] During the initialization phase, node i interacts with KGC, as follows:

[0073] 1. KGC selects an Identity-Based Cryptography (IBE) algorithm as the basic encryption algorithm, and any node... (Including all legitimate nodes) will include identity information As input to KGC, KGC calls the IBE.KeyGen algorithm to calculate the private key. ;

[0074] Among them, identity information The private key is a vector. It is a matrix.

[0075] 2. KGC calls the trapdoor generation algorithm to generate a feature matrix of legitimate nodes. The trapdoor corresponding to the feature matrix of the legal node ;

[0076] The trapdoor generation algorithm described above can be selected from GPV08's TrapGen algorithm.

[0077] 3. KGC calls the preimage sampling algorithm to input the feature matrix. Trap Door and identity information Output node features Satisfying the relationship Furthermore, the problem of small integer solutions on lattices (SIS) is used as the underlying difficult problem to ensure safety.

[0078] The above-mentioned preimage sampling algorithm can be selected from the GPV08 preimage sampling algorithm SamplePre.

[0079] 4. KGC will generate a feature matrix of valid nodes. Node features and nodes private key Send together to the node .

[0080] This implementation deeply integrates the SIS (Short Integer Solution) problem with the identity information of satellite nodes. KGC generates a node feature vector for each legitimate satellite node. To satisfy Where P is the publicly available feature matrix of legal nodes, This represents the node's identity information (a vector mapped by a hash function). Since the trapdoor is unknown, from... Find the short vector that satisfies this equation. Computationally equivalent to solving a difficult SIS problem, this binding relationship is resistant to forgery. During the authentication process, the correctness of the verification logic depends on this SIS binding relationship, while its security is guaranteed by the difficulty of the SIS problem, thus achieving efficient and secure inter-satellite authentication without certificates and with only a single communication. Specific Implementation Method 3

[0082] This embodiment is a further explanation of embodiment two. In this embodiment, the identity information is converted into a fixed-length vector through a hash function.

[0083] In this embodiment, taking an identity-based integer matrix homomorphic encryption scheme as an example, identity information A hash function is used to generate strings related to node information. Establish a connection with the encryption scheme, that is, with As a vector, it is used in the encryption scheme. Specific Implementation Method Four

[0085] This embodiment is a further explanation of embodiment one. In this embodiment, the plaintext data also includes a timestamp.

[0086] The decrypted data also includes timestamps;

[0087] The response node determines whether the timestamp is within a preset valid time window; if it is within the valid time window, it compares the authentication result with the authentication credential.

[0088] In this implementation, to prevent attackers from intercepting and replaying authentication messages, the initiating node incorporates the current timestamp when constructing the authentication plaintext. Therefore, the authentication plaintext is... ,in For timestamps.

[0089] Initiating node A calls the IBE.Enc algorithm, inputting the response node. identity information and authentication plaintext Use response nodes identity information Encrypt the data and output the authentication ciphertext. and send to the response node. ;

[0090] Node B responds to the authentication ciphertext Perform decryption and output the decryption result. ; Response node Regarding the decryption results First, determine the timestamp. Is it within the validity period? If so, proceed with the calculation. and order For the authentication result. Determine. Whether or not If they are the same, the authentication passes; otherwise, it fails. Detailed Implementation Method Five

[0092] This implementation method is a further explanation of implementation method four. In this implementation method, the node characteristics of the initiating node and the random short vector are first summed, and then concatenated with the authentication credential and the timestamp in sequence to form plaintext data.

[0093] The decrypted data is restored to a concatenated structure consisting of the vector to be verified, the authentication credential, and the timestamp.

[0094] In this invention, an identity-based cryptography scheme is used as the underlying encryption algorithm, with identity as the public key. A quantum-resistant identity-based cryptography scheme can be selected to ensure the ciphertext's resistance to quantum attacks in the post-quantum era. Furthermore, the security of mature cryptographic schemes based on difficult problems ensures that collusion attacks cannot affect the scheme's security. Secondly, this invention uses the identity-based cryptography scheme for inter-satellite authentication, placing the storage and computational overhead burden on the ground key generation center. The central node only needs to participate in the initialization phase, while the satellite only needs to perform authentication, matrix and vector multiplication, encryption, and decryption operations. Moreover, the satellite node's identity is used as the public key, abandoning the existing certificate mechanism and greatly reducing the key transmission bandwidth. In addition, according to the construction process of this method, the entire authentication process only requires one ciphertext transmission, which can achieve non-interactive authentication, reduce inter-satellite interaction dependencies and authentication latency, and is suitable for inter-satellite environments with high dynamics and low centralization requirements. Specific Implementation Method Six

[0096] This embodiment of an inter-satellite authentication system based on an identity-based cryptographic scheme includes:

[0097] The credential generation unit is used to select a random short vector and multiply it by the locally pre-stored node feature matrix to obtain the authentication credential.

[0098] The encryption unit is used to obtain the identity information of the responding node and use the identity information of the responding node as a public key to encrypt the plaintext data to obtain the authentication ciphertext; the plaintext data includes the node characteristics of the initiating node, a random short vector, and authentication credentials; the node characteristics of the initiating node are multiplied by the node characteristic matrix to obtain the identity information of the initiating node; the identity information includes satellite number or satellite parameters;

[0099] The sending unit is used to send the authentication ciphertext to the response node;

[0100] The decryption unit is used to decrypt the authentication ciphertext using the private key of the responding node to obtain decrypted data; the decrypted data includes a verification vector and authentication credentials.

[0101] The verification unit is used to obtain the identity information of the initiating node and generate the authentication result using the locally pre-stored node feature matrix, verification vector and the identity information of the initiating node;

[0102] Furthermore, the authentication result is compared with the authentication certificate; if the authentication result is the same as the authentication certificate, the authentication is deemed successful. Detailed Implementation Method Seven

[0104] This embodiment is a further explanation of embodiment six. In this embodiment, a ground key generation center (KGC) is also included, which is used for:

[0105] Before the initiating node generates authentication credentials, a corresponding private key is generated for each node based on the identity information of each node, as well as a node feature matrix and node features shared by all nodes; and the private key, node feature matrix and node features of each node are sent to the corresponding node for local storage. Detailed Implementation Method Eight

[0107] This embodiment is a further explanation of embodiment seven. In this embodiment, the encryption unit is also used to convert the identity information into a fixed-length vector through a hash function. Detailed Implementation Method Nine

[0109] This embodiment is a further explanation of embodiment six. In this embodiment, the plaintext data also includes a timestamp; the decrypted data also includes a timestamp.

[0110] The verification unit is also used to determine whether the timestamp is within a preset valid time window; if it is within the valid time window, the authentication result is compared with the authentication credential. Detailed Implementation Method Ten

[0112] This embodiment is a further explanation of embodiment nine. In this embodiment, the encryption unit is also used to first sum the node characteristics of the initiating node and the random short vector, and then concatenate them with the authentication credential and the timestamp in sequence to form plaintext data.

[0113] The decryption unit is also used to restore the decrypted data into a concatenated structure consisting of the vector to be verified, the authentication credential, and the timestamp.

[0114] This invention discloses an inter-satellite authentication method and system based on an identity-based cryptographic scheme. The method includes: an initiating node selecting a random short vector and multiplying it by a locally pre-stored node feature matrix to obtain an authentication credential; the initiating node obtaining the identity information of a responding node and encrypting plaintext data to obtain authentication ciphertext; the plaintext data includes the node features of the initiating node, the random short vector, and the authentication credential; the initiating node sending the authentication ciphertext to the responding node; the responding node decrypting the authentication ciphertext using its own private key to obtain decrypted data; the decrypted data includes a vector to be verified and the authentication credential; the responding node obtaining the identity information of the initiating node and generating an authentication result; comparing the authentication result with the authentication credential; if the authentication result is the same as the authentication credential, the authentication is deemed successful.

[0115] Furthermore, it should be noted that the present invention can be provided as a method, apparatus, or computer program product. Therefore, embodiments of the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Moreover, embodiments of the present invention can take the form of a computer program product implemented on one or more computer-usable storage media containing computer-usable program code.

[0116] Embodiments of the present invention are described with reference to flowchart illustrations and / or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0117] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The functions specified in one or more boxes. These computer program instructions may also be loaded onto a computer or other programmable data processing terminal equipment to cause a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal equipment for implementing the process. Figure 1One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0118] It should also be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.

[0119] Finally, it should be noted that the above description represents a preferred embodiment of the present invention. It should be pointed out that although preferred embodiments have been described, those skilled in the art, once they understand the basic inventive concept of the present invention, can make various improvements and modifications without departing from the principles described herein. These improvements and modifications should also be considered within the scope of protection of the present invention. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the embodiments of the present invention.

Claims

1. An inter-satellite authentication method based on an identity-based cryptographic scheme, characterized in that, The methods include: The initiating node selects a random short vector and multiplies it with the locally pre-stored node feature matrix to obtain the authentication credential. The initiating node obtains the identity information of the responding node and uses the identity information of the responding node as a public key to encrypt the plaintext data to obtain the authentication ciphertext; the plaintext data includes the node characteristics of the initiating node, the random short vector, and the authentication credential; The identity information of the initiating node can be obtained by multiplying the node features of the initiating node with the node feature matrix; the identity information includes satellite number or satellite parameters; the plaintext data also includes a timestamp. The node characteristics of the initiating node and the random short vector are first summed, and then concatenated with the authentication credential and the timestamp in sequence to form the plaintext data. The initiating node sends the authentication ciphertext to the responding node; The response node uses its own private key to decrypt the authentication ciphertext to obtain decrypted data; the decrypted data includes a vector to be verified and the authentication credential; the decrypted data also includes the timestamp; the decrypted data is restored to a concatenated structure formed by sequentially concatenating the vector to be verified, the authentication credential, and the timestamp. The response node obtains the identity information of the initiating node and generates an authentication result using the locally pre-stored node feature matrix, the vector to be verified, and the identity information of the initiating node. The authentication result is formed by multiplying the node feature matrix with the vector to be verified and then subtracting the identity information of the initiating node. The response node determines whether the timestamp is within a preset valid time window; if it is within the valid time window, it compares the authentication result with the authentication credential; if the authentication result is the same as the authentication credential, it determines that the authentication is successful.

2. The inter-satellite authentication method based on identity-based cryptography as described in claim 1, characterized in that, Before the initiating node generates authentication credentials, the following is also included: The ground key generation center (KGC) generates a corresponding private key for each node based on the identity information of each node, as well as a node feature matrix and node features shared by all nodes; and sends the private key, the node feature matrix and node features of each node to the corresponding node for local storage.

3. The inter-satellite authentication method based on identity-based cryptography as described in claim 2, characterized in that, The identity information is converted into a fixed-length vector using a hash function.

4. An inter-satellite authentication system based on an identity-based cryptographic scheme, characterized in that, include: The credential generation unit is used to select a random short vector and multiply it by a locally pre-stored node feature matrix to obtain an authentication credential. An encryption unit is used to obtain the identity information of the responding node and use the identity information of the responding node as a public key to encrypt plaintext data to obtain authentication ciphertext; the plaintext data includes the node characteristics of the initiating node, the random short vector, and the authentication credential; The identity information of the initiating node can be obtained by multiplying the node features of the initiating node with the node feature matrix; the identity information includes satellite number or satellite parameters; the plaintext data also includes a timestamp. The encryption unit is also used to first sum the node characteristics of the initiating node and the random short vector, and then concatenate them with the authentication credential and the timestamp in sequence to form the plaintext data. A sending unit is used to send the authentication ciphertext to the response node; The decryption unit is used to decrypt the authentication ciphertext using the private key of the response node to obtain decrypted data; the decrypted data includes a vector to be verified and the authentication credential; the decrypted data also includes the timestamp; The decryption unit is also used to restore the decrypted data into a concatenated structure consisting of the vector to be verified, the authentication credential, and the timestamp concatenated in sequence; The verification unit is used to obtain the identity information of the initiating node and generate an authentication result using the locally pre-stored node feature matrix, the vector to be verified, and the identity information of the initiating node. The authentication result is formed by multiplying the node feature matrix with the vector to be verified and then subtracting the identity information of the initiating node. Furthermore, the verification unit is also used to determine whether the timestamp is within a preset valid time window; if it is within the valid time window, the authentication result is compared with the authentication credential; if the authentication result is the same as the authentication credential, the authentication is deemed successful.

5. The inter-satellite authentication system based on identity-based cryptography as described in claim 4, characterized in that, It also includes the Ground Key Generation Center (KGC), used for: Before the initiating node generates authentication credentials, a corresponding private key is generated for each node based on the identity information of each node, as well as a node feature matrix and node features shared by all nodes are generated. The private key of each node, the node feature matrix, and the node features are sent to the corresponding node for local storage.

6. The inter-satellite authentication system based on identity-based cryptography as described in claim 5, characterized in that, The encryption unit is also used to convert the identity information into a fixed-length vector using a hash function.

Images