Satellite-ground fusion network data processing method and device, electronic equipment, storage medium and computer program product

Abstract

The invention provides a satellite-ground fusion network data processing method and device, electronic equipment, a storage medium and a computer program product, and relates to the technical field of network information security, and the method comprises the steps: generating a first encryption key and a first integrity protection key based on a first key; wherein the first key is generated by a ground station and a spaceborne base station based on a second key, and the spaceborne base station and the ground station generate the first key through an authentication and key negotiation mechanism; and processing the first data based on the first encryption key and the first integrity protection key to obtain second data and sending the second data to the satellite-borne base station.

Description

Technical Field

[0001] This application relates to the field of network information security technology, and in particular to a satellite-ground converged network data processing method, apparatus, electronic device, storage medium and computer program product. Background Technology

[0002] In a converged space-ground network, if the base station is on satellite and the core network is on the ground, the security mechanism of the transmission channel between the base station and the core network (called the space-ground backhaul link) adopts the IPSec (Internet Protocol Security) protocol to ensure the confidentiality and integrity of data transmission. IPSec protects the communication between the base station and the core network through encryption and authentication mechanisms, and is the main security protocol for both terrestrial and space-ground network backhaul links.

[0003] In related technologies, the topology of low-Earth orbit (LEO) satellite networks is highly dynamic. The high-speed movement of satellites in their orbits leads to frequent switching of links between satellites and ground stations, and inter-satellite links also constantly change due to satellite position variations. This dynamism causes the network topology to change multiple times in a short period, requiring frequent recalculation and reconvergence of routing protocols. Furthermore, the air interface transmission distance of LEO satellites is typically long, with signal propagation distances reaching hundreds of kilometers, making them susceptible to environmental interference such as radiation from cosmic rays and charged particles like solar particles. These factors make the backhaul links of LEO satellite networks face more severe security threats. Summary of the Invention

[0004] This application provides a satellite-ground converged network data processing method, apparatus, electronic device, storage medium, and computer program product.

[0005] The technical solution of this application is implemented as follows: This application provides a satellite-ground fusion network data processing method, including: A first encryption key and a first integrity protection key are generated based on a first key; wherein, the first key is generated by the ground station and the satellite base station based on a second key, and the satellite base station and the ground station generate the first key through an authentication and key negotiation mechanism; The first data is processed based on the first encryption key and the first integrity protection key to obtain the second data, which is then sent to the satellite base station.

[0006] In the above scheme, before generating the first encryption key and the first integrity protection key based on the first key, the method further includes: Send a first request to the satellite-borne base station; wherein the first request includes: an identifier; The system receives first information from the satellite-borne base station in response to the first request; wherein the first information is used to request the ground station to perform an authentication challenge; and the first information is formed based on the identifier. The authentication challenge parameters are obtained by parsing the first information, and response information is generated based on the authentication challenge parameters; The response information is sent to the satellite-based base station, which then performs authentication based on the response information.

[0007] In the above scheme, the authentication challenge parameters include: a random number and an authentication token; The process of parsing the first information to obtain authentication challenge parameters and generating response information based on the authentication challenge parameters includes: The first information is parsed to obtain the random number and the authentication token; After the authentication token is verified, the response information is generated based on the random number and the authentication token.

[0008] The method in the above scheme further includes: The third data is received from the satellite-borne base station after verifying and decrypting the second data.

[0009] In the above scheme, the step of processing the first data based on the first encryption key and the first integrity protection key, generating the second data, and sending it to the satellite base station includes: The first data is encrypted using the first encryption key to obtain the fourth data. The fourth data is signed based on the first integrity protection key to obtain the second data, which is then sent to the satellite base station.

[0010] In the above scheme, both the ground station and the satellite base station have a secure environment for storing the second key.

[0011] This application also provides a satellite-ground fusion network data processing method, including: Receive the second data sent by the ground station; The second data is obtained by the ground station processing the first data based on the first encryption key and the first integrity protection key; the first encryption key and the first integrity protection key are generated based on the first key; the first key is generated by the ground station and the satellite base station based on the second key, and the satellite base station and the ground station generate the first key through an authentication and key negotiation mechanism. In the above scheme, before receiving the second data sent by the ground station, the method further includes: Receive a first request sent by a ground station; wherein the first request includes: an identifier; Authentication information is generated based on the identifier; wherein, the authentication information includes: authentication challenge parameters; Based on the authentication challenge parameters, the first information is determined and sent to the ground station; Receive the response information sent by the ground station, and authenticate the response information based on the authentication information.

[0012] In the above scheme, the authentication information includes one or more of the following: random number, authentication token, expected response information, and first key; The authentication of the response information based on the authentication information includes: The response information is authenticated based on the expected response information.

[0013] The method in the above scheme further includes: After verifying and decrypting the second data, the third data is obtained and then sent to the ground station.

[0014] In the above scheme, obtaining the third data after verifying and decrypting the second data includes: A second encryption key and a second integrity protection key are generated based on the first key; wherein the second encryption key is the same as the first encryption key; and the second integrity protection key is the same as the first integrity protection key. The second data is authenticated and signed based on the second integrity protection key to obtain the fifth data; The third data is obtained by decrypting the fifth data using the second encryption key.

[0015] This application also provides a satellite-ground fusion network data processing device, including: A generation unit is used to generate a first encryption key and a first integrity protection key based on a first key; wherein, the first key is generated by the ground station and the satellite base station based on a second key, and the satellite base station and the ground station generate the first key through an authentication and key negotiation mechanism; The first sending unit is used to process the first data based on the first encryption key and the first integrity protection key, obtain the second data, and send it to the satellite base station.

[0016] This application also provides a satellite-ground fusion network data processing device, including: The first receiving unit is used to receive the second data sent by the ground station; The second data is obtained by the ground station processing the first data based on the first encryption key and the first integrity protection key; the first encryption key and the first integrity protection key are generated based on the first key; the first key is generated by the ground station and the satellite base station based on the second key, and the satellite base station and the ground station generate the first key through an authentication and key negotiation mechanism.

[0017] This application embodiment also provides a first electronic device, including a first memory, a first processor and a first communication interface. The first memory stores a computer program that can run on the first processor and the first communication interface. When the first processor executes the computer program, it implements the steps in the ground station method. When the first communication interface executes the computer program, it implements the steps in the method of the ground station.

[0018] This application embodiment also provides a second electronic device, including a second memory, a second processor, and a second communication interface. The second memory stores a computer program that can run on the second processor and the second communication interface. When the second processor executes the computer program, it implements the steps in the method of the satellite base station. When the second communication interface executes the computer program, it implements the steps in the method of the spaceborne base station.

[0019] This application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a first processor, implements the steps in the method of the ground station.

[0020] This application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a second processor, implements the steps in the method of the satellite-borne base station.

[0021] This application also provides a computer program product, including a computer program that, when executed by a first processor, implements the steps in the method of the ground station.

[0022] This application also provides a computer program product, including a computer program that, when executed by a second processor, implements the steps in the method of the satellite-borne base station.

[0023] In this embodiment, a first encryption key and a first integrity protection key are generated based on a first key. The first key is generated by the ground station and the satellite-based base station based on a second key. The satellite-based base station and the ground station generate the first key through an authentication and key negotiation mechanism. First data is processed based on the first encryption key and the first integrity protection key to obtain second data, which is then sent to the satellite-based base station. The first key is generated through authentication between the satellite-based base station and the ground station, and the first encryption key and the first integrity protection key are further derived from it, thereby achieving encryption and integrity protection of the data on the backhaul link. This method avoids the problems of frequent negotiation and long connection establishment times in related technologies, enhancing security in high-speed handover scenarios with low-Earth orbit satellites. Attached Figure Description

[0024] Figure 1 This illustration shows the effect of the satellite-ground fusion network data processing method provided in the embodiments of this application. Figure 1 ; Figure 2 A flowchart illustrating the satellite-ground fusion network data processing method provided in this application embodiment. Figure 1 ; Figure 3 A flowchart illustrating the satellite-ground fusion network data processing method provided in this application embodiment. Figure 2 ; Figure 4 A flowchart illustrating the satellite-ground fusion network data processing method provided in this application embodiment. Figure 3 ; Figure 5 A flowchart illustrating the satellite-ground fusion network data processing method provided in this application embodiment. Figure 4 ; Figure 6 A flowchart illustrating the satellite-ground fusion network data processing method provided in this application embodiment. Figure 5 ; Figure 7 A flowchart illustrating the satellite-ground fusion network data processing method provided in this application embodiment. Figure 6 ; Figure 8 A flowchart illustrating the satellite-ground fusion network data processing method provided in this application embodiment. Figure 7 ; Figure 9 An interactive schematic diagram of the satellite-ground fusion network data processing method provided in the embodiments of this application; Figure 10 Schematic diagram of the structure of the satellite-ground fusion network data processing device provided in the embodiments of this application Figure 1 ; Figure 11 A schematic diagram of a hardware entity of the first electronic device provided in an embodiment of this application; Figure 12 Schematic diagram of the structure of the satellite-ground fusion network data processing device provided in the embodiments of this application Figure 2 ; Figure 13 This is a schematic diagram of a hardware entity of a second electronic device provided in an embodiment of this application.

[0025] It should be noted that the terms "first" and "second" mentioned above are only used to distinguish between different options and do not represent the degree of superiority or inferiority of the options or their priority in the implementation process. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application are further described in detail below with reference to the accompanying drawings and embodiments. The described embodiments should not be regarded as limitations on this application. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0027] In the following description, references are made to “some embodiments,” which describe a subset of all possible embodiments. However, it is understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0028] If the application documents contain similar descriptions such as "first / second", the following explanation shall be added: In the following description, the terms "first / second / third" are used only to distinguish similar objects and do not represent a specific order of objects. It is understood that "first / second / third" may be interchanged in a specific order or sequence where permitted, so that the embodiments of this application described herein can be implemented in an order other than that illustrated or described herein.

[0029] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0030] In the following description, the terms "space-ground converged network," "3GPP AKA mechanism," "first key," "encryption key," and "integrity protection key," etc., are key concepts of this invention and will be explained later. For ease of understanding, these key concepts are briefly defined below: 1) Space-Ground Converged Network: This refers to a network architecture that combines terrestrial communication systems with low-Earth orbit satellite communication systems. Ground gateway stations, satellite-based base stations, and the terrestrial core network together constitute the data transmission link. This network supports ground terminals accessing the core network via satellite, achieving wide-area coverage and dynamic connectivity.

[0031] 2) 3GPP AKA (Authentication and Key Agreement) mechanism: A user authentication and key negotiation mechanism used to establish a secure channel between user equipment and the network. The AKA mechanism completes two-way authentication by generating parameters such as random numbers, authentication tokens, and expected responses, and generates session keys based on long-term keys.

[0032] 3) First Key: This refers to the initial key (such as KAUSF) generated during the 3GPP AKA authentication process, which serves as the basis for generating other encryption keys and integrity protection keys. The first key is determined by the ground station and the satellite base station during the authentication phase and is used for security assurance in subsequent data processing.

[0033] 4) Encryption Key: Used to encrypt data to ensure confidentiality during transmission. In this invention, the encryption key is generated based on the first key, and is used at the ground station to encrypt the first data to form the fourth data.

[0034] 5) Integrity Protection Key: Used to sign the encrypted data to ensure its integrity and tamper-proof nature during transmission. In this invention, the integrity protection key is also generated based on the first key, and is used at the ground station to sign the encrypted data, ultimately forming the second data which is then sent to the satellite base station.

[0035] 6) Subscription Permanent Identifier (SUPI): This is a unique and permanent identifier used to identify users in 5G networks. In this invention, the ground station must include this identifier when sending an authentication request to the satellite base station for authentication.

[0036] 7) Authentication Challenge Parameters: These are the set of parameters used to challenge the ground station or satellite base station during the authentication process. They typically include a Random Access Number (RAND) and an Authentication Token (AUTN). After receiving the authentication challenge parameters, the ground station needs to generate response information based on its local algorithm to complete the authentication process.

[0037] 8) Pre-connection mechanism: This is a technical means to establish a connection with the onboard base station in advance before the low-orbit satellite passes overhead, aiming to reduce the connection time during actual data transmission and improve overall communication efficiency.

[0038] 9) Fast retransmission mechanism: This is a data retransmission strategy designed for communication environments with high error rates. By quickly detecting packet loss and initiating retransmission in a timely manner, it reduces data transmission delay caused by bit errors and improves transmission reliability.

[0039] The satellite-ground fusion network data processing method provided in this application embodiment is used for, for example Figure 1 The system architecture shown includes a ground station (ground gateway station), a satellite base station, and a ground core network. The ground gateway station possesses a 3GPP AKA function module (e.g., implemented through a Subscriber Identity Module (SIM) card or a secure device storing long-term keys). The satellite base station must have Unified Data Management (UDM) and Authentication Server Function (AUSF) authentication capabilities. The ground station, acting as a terminal, uses the 3GPP-defined AKA (Authentication and Key Agreement) mechanism to authenticate with the satellite base station, generating encryption and integrity protection keys based on the AKA mechanism to protect the security of the backhaul link.

[0040] This application provides a method for processing data in a satellite-ground fusion network. Please refer to [link to relevant documentation]. Figure 2 This is a flowchart illustrating the satellite-ground fusion network data processing method provided in this application embodiment. Figure 1 , will combine Figure 2 The steps shown are explained below: S101. Generate a first encryption key and a first integrity protection key based on the first key; wherein, the first key is generated by the ground station and the satellite base station based on the second key, and the satellite base station and the ground station generate the first key through an authentication and key negotiation mechanism.

[0041] In this embodiment, a ground station refers to a communication node deployed on the ground, used for communication connections with onboard base stations on low-Earth orbit satellites. First key (K AUSF The first key (AK) refers to the initial key generated by the ground station and the satellite base station after completing two-way authentication under the 3GPP AKA mechanism. This first key serves as the basis for generating subsequent security keys, possesses high security, and is jointly held by only the two parties involved in the authentication. The first key plays a crucial role throughout the communication process, being used to generate the first encryption key and the first integrity protection key, thereby ensuring the confidentiality and integrity of data transmission.

[0042] The first encryption key (Ksatenc) is generated by the ground station based on the first key using a key derivation function. The first encryption key is calculated as follows: First encryption key = KDF(KAUSF The first encryption key is used to encrypt the data to be transmitted, thereby ensuring that the data is not stolen or tampered with by a third party during transmission. The first integrity protection key (Ksacint) is also generated by the ground station based on the first key through a key derivation function. The calculation method of the first integrity protection key is: First Integrity Protection Key = KDF(K AUSF The first integrity protection key is used to sign the encrypted data to ensure its integrity and tamper-proof nature during transmission.

[0043] In this embodiment, a clear generation relationship exists between the first key, the first encryption key, and the first integrity protection key. The first key is the starting point of the entire security mechanism, while the first encryption key and the first integrity protection key are used for data encryption and integrity protection, respectively. This hierarchical structure ensures that even if one key is leaked, the security of the other parts will not be affected. Furthermore, since each session uses an independent first key to generate the corresponding encryption and integrity protection keys, replay attacks and man-in-the-middle attacks can be effectively prevented.

[0044] The second key can be the root key used to generate the first key. Both the ground station and the satellite base station have a secure environment for storing the second key. The secure environment for storing the first key can include, for example, a (U)SIM card, a trusted execution environment, or a trusted platform module.

[0045] S102. Process the first data based on the first encryption key and the first integrity protection key to obtain the second data and send it to the satellite base station.

[0046] In this embodiment, the first data refers to the raw service data that the ground station needs to send to the satellite base station, such as user data and control information. The ground station first encrypts the first data using a first encryption key to generate encrypted data; then it signs the encrypted data using a first integrity protection key to generate a message authentication code (MAC); finally, the encrypted data and the MAC are combined to form the second data, which is then sent by the ground station to the satellite base station.

[0047] The second data refers to the final data packet formed after encryption and signing processes. This second data consists of encrypted data content and signature information used to verify integrity.

[0048] In this embodiment, encryption ensures that data is not eavesdropped on or tampered with during transmission; integrity protection ensures that data is not modified during transmission. Encryption and integrity protection complement each other, forming a complete secure transmission mechanism. For example, if integrity protection is not used when a ground station sends user location information, an attacker may tamper with the data during transmission, causing the satellite base station to receive incorrect location information, thereby triggering service anomalies.

[0049] In this embodiment of the application, after S102 is executed, the third data fed back by the satellite base station after verifying and decrypting the second data can also be received.

[0050] In this embodiment, the third data refers to the result data returned by the spaceborne base station after receiving the second data, decrypting and verifying its integrity. The spaceborne base station uses the same encryption key as the ground station to decrypt the second data and obtain the original data content; simultaneously, it uses the same integrity protection key to perform signature verification on the second data to ensure that the second data has not been tampered with. If the verification passes, the spaceborne base station forwards the decrypted third data to the ground station and sends it to the ground core network.

[0051] The interaction between the satellite-based base station and the ground station relies on a shared first encryption key and a first integrity protection key. Since these keys are generated during the authentication phase, both parties can ensure the consistency of decryption and verification operations. Furthermore, because the keys used in each session are temporarily generated, even if a key is leaked during a transmission, it will not affect the security of other sessions.

[0052] In this embodiment, the ground station also undertakes the function of receiving and processing third-party data. After receiving the third-party data, the ground station can distribute the third-party data to different system components, such as the core network, user equipment, or data analysis platform, according to service requirements. By distributing the third-party data to different system components according to service requirements, secure data exchange on the satellite-to-ground backhaul link is achieved.

[0053] The satellite-ground integrated network data processing method provided in this application embodiment achieves secure authentication between the ground station and the satellite-borne base station, and generates a first encryption key and a first integrity protection key based on the authentication result. During data transmission, the first encryption key is used to encrypt the data, and the first integrity protection key is used to sign the data, ensuring the confidentiality and integrity of the data. Simultaneously, time utilization is optimized through a pre-connection mechanism and a fast retransmission mechanism, improving the transmission efficiency and reliability of the satellite-ground backhaul link. The satellite-ground integrated network data processing method provided in this application embodiment effectively solves the limitations of the IPSec protocol in low-Earth orbit satellite networks and is suitable for satellite-ground communication scenarios with high dynamics and significant environmental interference.

[0054] Please see Figure 3 This is a flowchart illustrating the satellite-ground fusion network data processing method provided in this application embodiment. Figure 2 , will combine Figure 3 The steps shown are explained below: S201. Send a first request to the satellite base station; wherein the first request includes: an identifier.

[0055] In this embodiment, the identifier may include SUPI, which is carried by the ground gateway station in the first request and communicates with the satellite base station through the 3GPP AKA mechanism. By using this identifier, the identities of both communicating parties can be ensured to be unforgeable, thereby improving the overall system security.

[0056] In this embodiment of the application, by introducing a unique permanent identifier as the basic information for authentication, the system can improve the reliability of identity verification during communication, prevent unauthorized devices from accessing or impersonating the user, and thus enhance the security of the backhaul link.

[0057] S202, Receive the first information fed back by the satellite base station in response to the first request; wherein, the first information is used to request the ground station to perform an authentication challenge; the first information is formed based on the identifier.

[0058] In this embodiment, the first information is a data structure generated and returned by the satellite-borne base station after receiving the first request sent by the ground station. It typically includes a random number (RAND), an authentication token (AUTN), and related parameters required for authentication. These parameters are calculated based on a unique permanent identifier and a long-term key pre-stored in the system. Their purpose is to trigger the ground station to enter the authentication process to complete the authentication of both communicating parties.

[0059] In this embodiment of the application, by receiving the first information generated based on the unique permanent identifier, the ground station can effectively initiate the authentication process. The ground station's initiation behavior makes the authentication process between the two communicating parties more efficient and reliable, thereby reducing the connection delay problem caused by the first information.

[0060] S203. Parse the first information to obtain authentication challenge parameters, and generate response information based on the authentication challenge parameters.

[0061] In this embodiment, the authentication challenge parameters refer to key data extracted from the first information, such as a random number (RAND) and an authentication token (AUTN). The ground station uses a locally stored algorithm and a long-term key to process the key data extracted from the first information, such as the random number (RAND) and the authentication token (AUTN), to generate a response message (RES) as a response to the authentication challenge initiated by the satellite base station.

[0062] In this embodiment, the ground station can effectively respond to the authentication challenge initiated by the satellite base station by parsing the first information and generating response information, thereby ensuring the ground station's legitimacy to participate in subsequent key negotiation and further guaranteeing the security of the communication link.

[0063] In this embodiment of the application, S203 can also be implemented by S2031 to S2032, which will be described in conjunction with the steps: S2031. Parse the first information to obtain the random number and the authentication token.

[0064] In this embodiment, the random number (RAND) is a set of unpredictable random values ​​generated by the satellite-borne base station to challenge the ground gateway station. The random number serves as one of the basic inputs in the AKA authentication process, ensuring the uniqueness of each authentication process and preventing replay attacks or forged requests. The authentication token (AUTN) is authentication information generated by the satellite-borne base station and sent to the ground gateway station, containing fields such as timestamp and synchronization identifier, used to verify the identity of the ground gateway station.

[0065] S2032. After the authentication token is verified, the response information is generated based on the random number and the authentication token.

[0066] In this embodiment, after the ground gateway station receives the authentication token, it verifies the validity of the authentication token using a locally stored long-term key and algorithm. If the verification result matches the expectation, the authentication token is considered valid. Based on this, the ground gateway station uses the parsed random number and the verified authentication token to calculate the response information (RES) according to a preset encryption algorithm, and returns the response information (RES) to the satellite base station to complete the authentication process.

[0067] In this embodiment, an explicit random number and authentication token parsing mechanism are introduced during the authentication process, and a response message is generated after successful verification. This improves the accuracy and security of the authentication process. Consequently, the system effectively prevents unauthorized access and man-in-the-middle attacks, further enhancing the overall security of the satellite-ground converged network backhaul link.

[0068] S204. The response information is sent to the satellite-based base station for authentication based on the response information.

[0069] In this embodiment, the response information is data generated by the ground station and sent to the satellite base station to verify whether the ground station has passed the authentication challenge. The satellite base station compares the received response information with the expected response (XRES) stored by the satellite base station itself. If the response information matches the XRES, the satellite base station considers the authentication successful, and the satellite base station can continue with key negotiation and subsequent data transmission.

[0070] In this embodiment, the communication system is configured so that the terminal device sends response information to the satellite-borne base station. Based on this process, the terminal device and the ground station can complete two-way authentication, ensuring that only legitimate terminals can establish a secure connection. This mechanism effectively prevents unauthorized access and attacks, ultimately improving the security and stability of the entire satellite-ground integrated network.

[0071] In this embodiment, the ground station sends a first request to the satellite-based base station and receives first information generated based on an identifier. The user equipment parses the first information and generates response information, which is then sent back to the satellite-based base station for authentication, thus achieving a fast and secure authentication process. This method reduces negotiation time, thereby increasing the effective duration of data transmission under low-Earth orbit satellite networks. This reduces the risk of connection interruption and further enhances the overall performance and security of the space-ground integrated network.

[0072] Please see Figure 4 This is a flowchart illustrating the satellite-ground fusion network data processing method provided in this application embodiment. Figure 3 , Figure 2 S102 in the middle can also be implemented through S301 to S302, which will combine Figure 4 The steps shown are explained below: S301. Encrypt the first data based on the first encryption key to obtain the fourth data.

[0073] In this embodiment, the encryption process can employ a symmetric encryption algorithm, such as the Advanced Encryption Standard (AES). The ground station combines the first data with the first encryption key to generate the fourth data. The fourth data is defined as the encrypted data.

[0074] S302. Sign the fourth data based on the first integrity protection key to obtain the second data and send it to the satellite base station.

[0075] In this embodiment, the signature operation can use a Hash-based Message Authentication Code (HMAC) algorithm to combine the fourth data with the first integrity protection key to generate a fixed-length digest. This fixed-length digest is then appended to the fourth data to form the final second data. After receiving the second data, the satellite-based base station can recalculate the digest using the same integrity protection key. The base station then compares the recalculated digest with the received fixed-length digest to verify the integrity and legitimacy of the second data's origin.

[0076] In this embodiment, by separating the encryption and integrity protection steps—encrypting first and then signing—the confidentiality and integrity of the first data during transmission can be ensured. This method of separating encryption and integrity protection, and encrypting first and then signing, can prevent man-in-the-middle attacks and tampering with the first data, thereby improving the overall security of the satellite-ground integrated network backhaul link and adapting to the high dynamism, long distance, and susceptibility to interference characteristics of low-Earth orbit satellite networks.

[0077] Please see Figure 5 This is a flowchart illustrating the satellite-ground fusion network data processing method provided in this application embodiment. Figure 4 , will combine Figure 4 The steps shown are explained below: S401. Receive second data sent by the ground station; wherein the second data is obtained by the ground station processing the first data based on the first encryption key and the first integrity protection key; the first encryption key and the first integrity protection key are generated based on the first key; the first key is generated by the ground station and the satellite base station based on the second key, and the satellite base station and the ground station generate the first key through an authentication and key negotiation mechanism.

[0078] In this embodiment, the ground station refers to a communication node deployed on the ground for communication with a satellite-borne base station on a low-Earth orbit satellite. The ground station in this invention has a 3GPP AKA functional module, capable of performing authentication with the satellite-borne base station through security mechanisms (such as a SIM card or long-term keys), and generating encryption and integrity protection keys for data transmission based on the authentication process. The second data refers to the data packet generated by the ground station after encrypting and signing the original data using the first encryption key and the first integrity protection key.

[0079] The first key is a shared key determined during authentication between the satellite base station and the ground station. Generated by the 3GPP AKA authentication process, the first key forms the foundation of the entire backhaul link security mechanism. It is used to derive encryption and integrity protection keys, ensuring the security of subsequent data transmission. The generation of the first key depends on the authentication process between the satellite base station and the ground station; only authenticated satellite base stations and ground stations can obtain the same first key, thus preventing man-in-the-middle attacks.

[0080] In this embodiment of the application, after S401 is executed, the second data can be verified and decrypted to obtain the third data, and the third data can be sent to the ground station.

[0081] In this embodiment, verification and decryption refer to the process by which the satellite-based base station performs integrity verification and decryption operations on the received second data. Integrity verification determines whether the data has been tampered with by comparing the signature in the second data with the locally calculated signature; decryption uses the encryption key to restore the encrypted data to plaintext data.

[0082] The third data refers to the original data content obtained after verification and decryption. The third data can be business data, control messages, or other types of communication content.

[0083] In this embodiment, the ground station also undertakes the function of receiving and processing third-party data. After receiving the third-party data, the ground station can distribute the third-party data to different system components, such as the core network, user equipment, or data analysis platform, according to service requirements. By distributing the third-party data to different system components according to service requirements, secure data exchange on the satellite-to-ground backhaul link is achieved.

[0084] In this embodiment, an encryption and integrity protection mechanism based on a first key enables efficient and secure data transmission in a space-ground integrated network. The method in this embodiment reduces the bandwidth and time limitations of traditional protocols, thereby improving the effective time and reliability of data transmission. Furthermore, the method in this embodiment can adapt to the highly dynamic characteristics of low-Earth orbit satellite networks, thus enhancing the overall system performance and security.

[0085] Please see Figure 6 This is a flowchart illustrating the satellite-ground fusion network data processing method provided in this application embodiment. Figure 5 , will combine Figure 6 The steps shown are explained below: S501, Receive a first request sent by the ground station; wherein the first request includes: an identifier.

[0086] In this embodiment, the identifier is a long-term, immutable identity used to uniquely identify users in a 5G network. By using the identifier, the ground station can ensure accurate identification of both communicating parties even during frequent satellite switching.

[0087] S502. Generate authentication information based on the unique permanent identifier; wherein, the authentication information includes: authentication challenge parameters.

[0088] In this embodiment, the authentication information is a set of data structures generated by the satellite-borne base station based on an identifier after receiving an authentication request from the ground station, used to verify the identities of both communicating parties. The authentication information includes authentication challenge parameters, such as RAND (random number) and AUTN (authentication token). In some other embodiments, it may also include expected response information and a first key.

[0089] In this embodiment, the authentication challenge parameter is used to initiate a successful authentication process. RAND is a random number generated by the satellite base station, used to challenge the ground station to prove that the ground station possesses a legitimate long-term key K. AUTN is used to verify whether the ground station can correctly calculate XRES (expected response information), thereby determining the legitimacy of the ground station.

[0090] S503. Based on the authentication challenge parameters, determine the first information and send it to the ground station.

[0091] In this embodiment, the first information is a message generated by the satellite-borne base station based on authentication challenge parameters and sent to the ground station. This typically includes authentication challenge parameters such as RAND and AUTN. The purpose of the first information is to allow the ground station to perform local calculations and return a response result to complete the two-way authentication process.

[0092] In this embodiment, the satellite-borne base station packages RAND and AUTN into an authentication challenge message and sends it to the ground station. Upon receiving the message, the ground station uses its locally stored long-term key K to perform an algorithm calculation, generates RES (response information), and returns it to the satellite-borne base station. This step verifies the identity of the ground station and lays the foundation for subsequent key generation.

[0093] S504. Receive the response information sent by the ground station, and authenticate the response information based on the authentication information.

[0094] In this embodiment of the application, after receiving the response information, the satellite base station compares the response information with the locally stored XRES (expected response information). If the response information is consistent with the XRES, the satellite base station determines that the authentication is successful; otherwise, it determines that the authentication fails.

[0095] In this embodiment, by comparing RES and XRES, the satellite-borne base station can confirm whether the ground station possesses the correct long-term key K, thereby verifying the legitimacy of the ground station. This process of verifying the legitimacy of the ground station by comparing RES and XRES not only ensures the authenticity of the identities of both communicating parties but also provides a prerequisite for subsequent key generation.

[0096] In this embodiment, an authentication process is added before data transmission, and authentication information is generated and verified. By adding an authentication process before data transmission, the identities of both communicating parties can be effectively verified, thereby preventing man-in-the-middle attacks and unauthorized access, and thus improving the security and stability of the backhaul link of the space-ground converged network.

[0097] In this embodiment, S504 can also be implemented by S5041 to S5042, which will be described in conjunction with the steps: S5041. Authenticate the response information based on the expected response information.

[0098] In this embodiment of the application, the core of the authentication process is to compare the response information (RES) returned by the ground gateway station with the expected response information (XRES) stored locally by the satellite base station. If the two match, the authentication is successful, indicating that the ground gateway station has a legitimate identity and has not been tampered with.

[0099] The authentication information includes one or more of the following: a random number, an authentication token, expected response information, and a first key.

[0100] Authentication information is a collection of information used to verify the identities of communicating parties and the integrity of data. In this application, the authentication information includes various types of elements to improve the security and flexibility of the system containing the authentication information. Specifically, the authentication information may include: Random number (RAND): In the 5G AKA mechanism, the random number is an unpredictable value generated by the satellite base station and sent to the ground gateway station to challenge the authentication of the ground terminal. The random number is typically used only once to prevent replay attacks. Authentication Token (AUTN): An authentication parameter generated by the satellite-based base station and sent to the ground gateway station, used to verify the legitimacy of the ground terminal. Authentication tokens typically consist of a timestamp, synchronization code, and Message Authentication Code (MAC). Expected Response Information (XRES): This is the expected response result calculated by the ground gateway station based on the long-term key K after receiving a random number. The spaceborne base station compares the expected response result calculated by the ground gateway station based on the long-term key K with the received response information to complete the authentication. First key: This is the master key generated in the 5G AKA mechanism. The first key is used to derive encryption keys and integrity protection keys, and it ensures the data security of the backhaul link.

[0101] In this embodiment, by employing multiple authentication information types and authentication methods based on expected response information, a more efficient and flexible security protection mechanism can be achieved. By using multiple authentication information types and authentication methods based on expected response information, a stable backhaul link can be maintained in the dynamic environment of low-Earth orbit satellite networks, thereby improving communication efficiency and security, and ultimately meeting the requirements of future space-ground integrated networks for high reliability and strong anti-interference capabilities.

[0102] Please see Figure 7 This is a flowchart illustrating the satellite-ground fusion network data processing method provided in this application embodiment. Figure 6 , Figure 5 The illustrated S402 can also be implemented via S601 to S603, combining Figure 7 The steps shown are explained below: S601. Generate a second encryption key and a second integrity protection key based on the first key; wherein the second encryption key is the same as the first encryption key; and the second integrity protection key is the same as the first integrity protection key.

[0103] In this embodiment, the second encryption key, denoted as Ksatenc, is a symmetric encryption key generated by the satellite-based base station during the authentication process for data decryption. The second encryption key is generated from the first key KAUSF using a key derivation function (KDF) and calculated in conjunction with parameters such as the satellite ID and user identifier SUPI to ensure its uniqueness and security. The second encryption key is used to decrypt data sent by the ground gateway station to recover the original plaintext content. The second integrity protection key, denoted as Ksacint, is a symmetric key generated by the satellite-based base station during the authentication process for data signature verification. The second integrity protection key is also generated from the first key KAUSF using a key derivation function, and is calculated in conjunction with parameters such as the satellite ID and user identifier SUPI. The second integrity protection key is used to perform integrity verification on data sent by the ground gateway station to prevent data tampering.

[0104] S602. Based on the second integrity protection key, authenticate and sign the second data to obtain the fifth data.

[0105] In this embodiment, the spaceborne base station hashes the data to be transmitted using the second integrity protection key Ksacint and attaches a signature to generate fifth data. The fifth data contains an integrity check value, which the spaceborne base station can use at the receiving end to verify whether the fifth data has been tampered with during transmission. This process, by signing the data using the second integrity protection key, enables the spaceborne base station to accurately determine the source and integrity of the fifth data when receiving data, thereby ensuring the authenticity and credibility of the fifth data. If the fifth data is tampered with during transmission, the spaceborne base station will fail the signature verification and will therefore refuse to process the fifth data.

[0106] S603. Decrypt the fifth data based on the second encryption key to obtain the third data.

[0107] In this embodiment, the third data refers to the original data content restored by the spaceborne base station after decrypting the fifth data using the second encryption key Ksatenc. Since the fifth data has been signed and verified using the second integrity protection key, it has been confirmed that the fifth data has not been tampered with before decryption, thus ensuring the reliability of the third data. This step restores the data by decrypting the fifth data using the second encryption key, enabling the spaceborne base station to obtain the original service data sent by the ground gateway station. The decryption process must use the same second encryption key as the ground gateway station to ensure the correct restoration of the third data.

[0108] In this embodiment, by generating a second encryption key and a second integrity protection key based on a first key, and using these keys to authenticate, sign, and decrypt data, efficient security protection of the backhaul link of the space-ground integrated network can be achieved. This unifies the key system and improves data processing efficiency, thereby enhancing the system's anti-attack capability and data integrity, and ultimately meeting the application requirements of low-Earth orbit satellite networks in scenarios with high dynamics and limited bandwidth.

[0109] Please see Figure 8 This is a flowchart illustrating the satellite-ground fusion network data processing method provided in this application embodiment. Figure 7 , will combine Figure 8 The steps shown are explained below: S11, Authentication Request.

[0110] The ground station sends an authentication request to the satellite-borne base station, and the request includes SUPI. S12, Generate AV.

[0111] After receiving the authentication request, the satellite base station generates an authentication vector AV(RAND, AUTN, XRES*,KAUSF).

[0112] S13, Identity Verification Challenge.

[0113] The satellite-based base station sends an authentication challenge message, including AUTN and RAND parameters, to the ground gateway station.

[0114] S14. Calculate the authentication response.

[0115] The ground station receives the authentication challenge message from the satellite base station and parses the AUTN and RAND within it.

[0116] Verification and authentication: The ground station uses locally stored algorithms and parameters to verify the correctness of AUTN, and generates RES* and sends it to the satellite base station.

[0117] S15, Authentication Response.

[0118] The satellite-borne base station receives the RES* sent by the ground gateway station and compares it with the XRES* stored locally. If the comparison is successful, the authentication is successful.

[0119] S16. Verification.

[0120] This application also provides a pre-connection mechanism: the ground station establishes a connection with the satellite-borne base station before the low-Earth orbit satellite passes overhead, reducing the connection time during actual data transmission. Connection maintenance: the connection is maintained during the satellite's overhead passage, reducing the time for connection disconnection and re-establishment. Fast retransmission mechanism: the ground station and the satellite-borne base station employ a fast retransmission mechanism to reduce data retransmission time caused by bit errors. Retransmission strategy: the retransmission strategy is dynamically adjusted based on the bit error rate and network conditions to improve the reliability of data transmission.

[0121] Please see Figure 9 This is an interactive schematic diagram of the satellite-ground fusion network data processing method provided in the embodiments of this application, which will be combined with Figure 9 The steps shown are explained below: S701. The ground station generates a first encryption key and a first integrity protection key based on the first key; wherein, the first key is generated by the ground station and the satellite base station based on the second key, and the satellite base station and the ground station generate the first key through an authentication and key negotiation mechanism.

[0122] In this embodiment, the implementation steps of S701 can be referred to S101, and will not be described in detail here.

[0123] S702, the ground station processes the first data based on the first encryption key and the first integrity protection key, obtains the second data, and sends it to the satellite base station. In this embodiment, the implementation steps of S702 can be referred to S102, and will not be described in detail here.

[0124] Please see Figure 10 This is a schematic diagram of the structure of the satellite-ground fusion network data processing device provided in the embodiments of this application. Figure 1 .

[0125] This application provides a satellite-ground fusion network data processing device 600, including: The generation unit 601 is used to generate a first encryption key and a first integrity protection key based on a first key; wherein, the first key is generated by the ground station and the satellite base station based on a second key, and the satellite base station and the ground station generate the first key through an authentication and key negotiation mechanism; The first sending unit 602 is used to process the first data based on the first encryption key and the first integrity protection key, obtain the second data, and send it to the satellite base station.

[0126] In this embodiment of the application, the first sending unit 602 in the satellite-ground fusion network data processing device 600 is used to send a first request to the satellite-borne base station; wherein, the first request includes: an identifier; the first receiving unit 603 is used to receive first information fed back by the satellite-borne base station in response to the first request; wherein, the first information is used to request the ground station to perform an authentication challenge; the first information is formed based on the identifier; the first information is parsed to obtain authentication challenge parameters, and response information is generated based on the authentication challenge parameters; the first sending unit 602 is used to send the response information to the satellite-borne base station, so that the satellite-borne base station can perform authentication based on the response information.

[0127] In this embodiment of the application, the authentication challenge parameters include: a random number and an authentication token; the satellite-ground fusion network data processing device 600 parses the first information to obtain the random number and the authentication token; after the authentication token is verified, the response information is generated based on the random number and the authentication token.

[0128] In this embodiment of the application, the satellite-ground fusion network data processing device 600 is used in the first receiving unit 603 to receive the third data fed back by the satellite base station after verifying and decrypting the second data.

[0129] In this embodiment of the application, the first sending unit 602 in the satellite-ground fusion network data processing device 600 is used to encrypt the first data based on the first encryption key to obtain the fourth data; The fourth data is signed based on the first integrity protection key to obtain the second data, which is then sent to the satellite base station.

[0130] In this embodiment of the application, both the ground station and the satellite base station have a secure environment for storing the second key.

[0131] It should be noted that, in the embodiments of this application, if the above-described satellite-ground integrated network data processing method is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiments of this application, or the part that contributes to the related technology, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a satellite-ground integrated network data processing device (which may be a personal computer, etc.) to execute all or part of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), magnetic disks, or optical disks. Thus, the embodiments of this application are not limited to any specific hardware and software combination.

[0132] Correspondingly, embodiments of this application provide a computer-readable storage medium storing a computer program thereon, which, when executed by a first processor, implements the steps in the method on one side of the ground station.

[0133] It should be noted that the descriptions of the storage medium and device embodiments above are similar to the descriptions of the method embodiments above, and have similar beneficial effects. For technical details not disclosed in the storage medium and device embodiments of this application, please refer to the descriptions of the method embodiments of this application for understanding.

[0134] It should be noted that, Figure 11 A hardware entity schematic diagram of the first electronic device provided in the embodiments of this application, such as... Figure 11 As shown, this application embodiment provides a first electronic device 900, including a first memory 702, a first processor 701 and a first communication interface 703. The first memory 702 stores a computer program that can run on the first processor 701 and the first communication interface 703. When the first processor 701 executes the computer program, it implements the steps in the ground station method. When the first communication interface 703 executes the computer program, it implements the steps in the method of the ground station, wherein; The first processor 701 typically controls the overall operation of the first electronic device 700.

[0135] The first memory 702 is configured to store instructions and applications executable by the first processor 701, and can also cache data to be processed or already processed by the first processor 701 and the various modules in the first electronic device 700 (e.g., image data, audio data, voice communication data and video communication data), which can be implemented by flash memory or random access memory (RAM).

[0136] Correspondingly, this application embodiment also provides a computer program product, including a computer program that can be executed by a first processor 701 of a first electronic device 700 to complete the steps in the method on the ground station side.

[0137] Please see Figure 12 This is a schematic diagram of the structure of the satellite-ground fusion network data processing device provided in the embodiments of this application. Figure 2 .

[0138] This application provides a satellite-ground fusion network data processing device 800, including: The first receiving unit 801 is used to receive the second data sent by the ground station; The second data is obtained by the ground station processing the first data based on the first encryption key and the first integrity protection key; the first encryption key and the first integrity protection key are generated based on the first key; the first key is generated by the ground station and the satellite base station based on the second key, and the satellite base station and the ground station generate the first key through an authentication and key negotiation mechanism.

[0139] In this embodiment of the application, the first receiving unit 801 in the satellite-ground fusion network data processing device 800 is used to receive a first request sent by a ground station; wherein, the first request includes: an identifier; and authentication information is generated based on the identifier; wherein, the authentication information includes: authentication challenge parameters; and is used to determine first information based on the authentication challenge parameters and send it to the ground station; the first receiving unit 801 is used to receive response information sent by the ground station and authenticate the response information based on the authentication information.

[0140] In this embodiment of the application, the authentication information includes one or more of the following: a random number, an authentication token, expected response information, and a first key; the satellite-ground fusion network data processing device 800 is used to authenticate the response information based on the expected response information.

[0141] In this embodiment of the application, the satellite-ground fusion network data processing device 800 is used to verify and decrypt the second data to obtain the third data, and then send the third data to the ground station.

[0142] In this embodiment of the application, the satellite-ground fusion network data processing device 800 generates a second encryption key and a second integrity protection key based on the first key; wherein, the second encryption key is the same as the first encryption key; the second integrity protection key is the same as the first integrity protection key; the second data is authenticated and signed based on the second integrity protection key to obtain the fifth data; and the fifth data is decrypted based on the second encryption key to obtain the third data.

[0143] Correspondingly, embodiments of this application provide a computer-readable storage medium storing a computer program thereon, which, when executed by a second processor, implements the steps in the method on the satellite base station side.

[0144] It should be noted that the descriptions of the storage medium and device embodiments above are similar to the descriptions of the method embodiments above, and have similar beneficial effects. For technical details not disclosed in the storage medium and device embodiments of this application, please refer to the descriptions of the method embodiments of this application for understanding.

[0145] It should be noted that, Figure 13 This is a schematic diagram of a hardware entity of the second electronic device provided in an embodiment of this application, such as... Figure 13 As shown, this application embodiment provides a second electronic device 900, including a second memory 902, a second processor 901, and a second communication interface 903. The second memory 902 stores a computer program that can run on the second processor 901 and the second communication interface 903. When the second processor 901 executes the computer program, it implements the steps in the method of the satellite base station. When the second communication interface 903 executes the computer program, it implements the steps in the method of the spaceborne base station, wherein; The second processor 901 typically controls the overall operation of the second electronic device 900.

[0146] The second memory 902 is configured to store instructions and applications executable by the second processor 901, and can also cache data to be processed or already processed by the second processor 901 and the various modules in the second electronic device 900 (e.g., image data, audio data, voice communication data and video communication data), which can be implemented by flash memory or random access memory (RAM).

[0147] Correspondingly, this application also provides a computer program product, including a computer program that can be executed by a second processor 901 of a second electronic device 900 to complete the steps in the method on the satellite base station side.

[0148] It should be understood that the phrase "one embodiment" or "an embodiment" throughout the specification means that a specific feature, structure, or characteristic related to the embodiment is included in at least one embodiment of this application. Therefore, "in one embodiment" or "in an embodiment" appearing throughout the specification does not necessarily refer to the same embodiment. Furthermore, these specific features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. It should be understood that in the various embodiments of this application, the sequence numbers of the above-described processes do not imply a sequential order of execution; the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application. The sequence numbers of the above-described embodiments are merely descriptive and do not represent the superiority or inferiority of the embodiments.

[0149] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0150] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods, such as: multiple units or components can be combined, or integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the various components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the apparatus or units can be electrical, mechanical, or other forms.

[0151] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units. They may be located in one place or distributed across multiple network units. Some or all of the units may be selected to achieve the purpose of this embodiment according to actual needs.

[0152] In addition, each functional unit in the various embodiments of this application can be integrated into one processing unit, or each unit can be a separate unit, or two or more units can be integrated into one unit; the integrated unit can be implemented in hardware or in the form of hardware plus software functional units.

[0153] Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps of the above method embodiments. The aforementioned storage medium includes various media that can store program code, such as mobile storage devices, read-only memory (ROM), magnetic disks, or optical disks.

[0154] Alternatively, if the integrated units described above are implemented as software functional modules and sold or used as independent products, they can also be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, or the parts that contribute to related technologies, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as mobile storage devices, ROMs, magnetic disks, or optical disks.

[0155] The above description is merely an embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application.

Claims

1. A data processing method for a satellite-ground fusion network, characterized in that, include: A first encryption key and a first integrity protection key are generated based on a first key; wherein, the first key is generated by the ground station and the satellite base station based on a second key, and the satellite base station and the ground station generate the first key through an authentication and key negotiation mechanism; The first data is processed based on the first encryption key and the first integrity protection key to obtain the second data, which is then sent to the satellite base station.

2. The satellite-ground fusion network data processing method according to claim 1, characterized in that, Before generating the first encryption key and the first integrity protection key based on the first key, the method further includes: Send a first request to the satellite-borne base station; wherein the first request includes: an identifier; The system receives first information from the satellite-borne base station in response to the first request; wherein the first information is used to request the ground station to perform an authentication challenge; and the first information is formed based on the identifier. The authentication challenge parameters are obtained by parsing the first information, and response information is generated based on the authentication challenge parameters; The response information is sent to the satellite-based base station, which then performs authentication based on the response information.

3. The satellite-ground fusion network data processing method according to claim 2, characterized in that, The authentication challenge parameters include: a random number and an authentication token; The process of parsing the first information to obtain authentication challenge parameters and generating response information based on the authentication challenge parameters includes: The first information is parsed to obtain the random number and the authentication token; After the authentication token is verified, the response information is generated based on the random number and the authentication token.

4. The satellite-ground fusion network data processing method according to any one of claims 1 to 3, characterized in that, The method further includes: The third data is received from the satellite-borne base station after verifying and decrypting the second data.

5. The satellite-ground fusion network data processing method according to any one of claims 1 to 3, characterized in that, The process of processing the first data based on the first encryption key and the first integrity protection key, generating the second data, and sending it to the satellite-borne base station includes: The first data is encrypted using the first encryption key to obtain the fourth data. The fourth data is signed based on the first integrity protection key to obtain the second data, which is then sent to the satellite base station.

6. The satellite-ground fusion network data processing method according to any one of claims 1 to 3, characterized in that, Both the ground station and the satellite-borne base station have a secure environment for storing the second key.

7. A method for processing data in a satellite-ground fusion network, characterized in that, include: Receive the second data sent by the ground station; The second data is obtained by the ground station processing the first data based on the first encryption key and the first integrity protection key; the first encryption key and the first integrity protection key are generated based on the first key; the first key is generated by the ground station and the satellite base station based on the second key, and the satellite base station and the ground station generate the first key through an authentication and key negotiation mechanism.

8. The satellite-ground fusion network data processing method according to claim 7, characterized in that, Before receiving the second data sent by the ground station, the method further includes: Receive a first request sent by a ground station; wherein the first request includes: an identifier; Authentication information is generated based on the identifier; wherein, the authentication information includes: authentication challenge parameters; Based on the authentication challenge parameters, the first information is determined and sent to the ground station; Receive the response information sent by the ground station, and authenticate the response information based on the authentication information.

9. The satellite-ground fusion network data processing method according to claim 8, characterized in that, The authentication information includes one or more of the following: a random number, an authentication token, expected response information, and a first key; The authentication of the response information based on the authentication information includes: The response information is authenticated based on the expected response information.

10. The satellite-ground fusion network data processing method according to any one of claims 7 to 9, characterized in that, The method further includes: After verifying and decrypting the second data, the third data is obtained and sent to the ground station.

11. The satellite-ground fusion network data processing method according to claim 10, characterized in that, The process of verifying and decrypting the second data to obtain the third data includes: A second encryption key and a second integrity protection key are generated based on the first key; wherein the second encryption key is the same as the first encryption key; and the second integrity protection key is the same as the first integrity protection key. The second data is authenticated and signed based on the second integrity protection key to obtain the fifth data; The third data is obtained by decrypting the fifth data using the second encryption key.

12. A satellite-ground fusion network data processing device, characterized in that, include: A generation unit is used to generate a first encryption key and a first integrity protection key based on a first key; wherein, the first key is generated by the ground station and the satellite base station based on a second key, and the satellite base station and the ground station generate the first key through an authentication and key negotiation mechanism; The first sending unit is used to process the first data based on the first encryption key and the first integrity protection key, obtain the second data, and send it to the satellite base station.

13. A satellite-ground fusion network data processing device, characterized in that, include: The first receiving unit is used to receive the second data sent by the ground station; The second data is obtained by the ground station processing the first data based on the first encryption key and the first integrity protection key; the first encryption key and the first integrity protection key are generated based on the first key. The first key is generated by the ground station and the satellite base station based on the second key. The satellite base station and the ground station generate the first key through an authentication and key negotiation mechanism.

14. An electronic device, characterized in that, The method includes a memory, a processor, and a communication interface. The memory stores a computer program that can run on the processor and the communication interface. When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6, or implements the steps of the method according to any one of claims 7 to 11. When the communication interface executes the computer program, it implements the steps of the method according to any one of claims 1 to 6, or the steps of the method according to any one of claims 7 to 11.

15. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6, or implements the steps of the method according to any one of claims 7 to 11.

16. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6, or the steps of the method according to any one of claims 7 to 11.

Images