Satellite communication system and terminal registration method thereof

Abstract

The invention discloses a satellite communication system and a terminal registration method thereof, and the method comprises the steps: enabling a RCST and an AuC to carry out the mutual authentication according to a 5G-AKA authentication mechanism after the RCST of a satellite terminal reaches a TDMA synchronization state; after mutual authentication of the RCST and the AuC succeeds, association authentication is carried out on all subsystems of the RCST in the process that the RCST and the AuC carry out non-access stratum (NAS) security mode agreement; and after the association authentication succeeds, the AuC accepts the registration request of the RCST to complete the registration process of the RCST. According to the invention, on the basis that bidirectional authentication between the satellite terminal and the authentication center is realized, association authentication of the subsystem of the satellite terminal can be realized, so that the problem that an attacker intrudes a terminal system due to the fact that the attacker forges a certificate and passes verification is avoided; and the problem that mismatching of satellite terminal subsystems causes serious adverse effects on operation of the network access terminal can be avoided.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and in particular to a satellite communication system and its terminal registration method. Background Technology

[0002] Currently, most DVB-S2X / RCS2 satellite communication systems in actual use only perform one-way authentication of terminals by verifying the terminal's identifier, such as the MAC address. This method can only verify the legitimacy of the terminal and has poor security.

[0003] Currently, some DVB-S2X / RCS2 satellite communication systems can perform two-way authentication using X.509 certificate authentication as specified in the DVB-RCS2 protocol. During the X.509 certificate authentication process used in DVB-S2X / RCS2 satellite communication systems, once the satellite terminal (RCST) reaches the "TDMA synchronization" state, before the network trusts it, it interacts with the Network Control Center (NCC) following the key distribution protocol steps. This sequentially completes the NCC's certificate application and authentication for the RCST, and the RCST's certificate application and authentication for the NCC, achieving two-way authentication between the satellite terminal and the network. Subsequently, a key update process will proceed. The certificate message carries X.509 certificate information, and its format conforms to the X.509 certificate standard protocol of the International Telecommunication Union Telecommunication Standardization Sector (ITU-T).

[0004] X.509 certificates are a digital certificate standard developed by the ITU-T for use in Public Key Infrastructure (PKI) for identity authentication. X.509 certificates are issued by a trusted third-party authority and contain information such as version number, serial number, signature algorithm, issuer, validity period, certificate subject, subject public key information, and signature. The issuer uses the signature algorithm to perform calculations on the certificate subject and encrypts the result using their private key to obtain a signature. The verifier uses the issuer's public key to decrypt the signature and compares the decrypted result with the result of performing calculations on the certificate subject using the same signature algorithm. If they match, the verifier verifies the issuer's certificate as legitimate.

[0005] The DVB-S2X / RCS2 satellite communication system, which uses X.509 certificate authentication according to the DVB-RCS2 protocol for two-way authentication, has high security. However, if the satellite terminal certificate is not updated for a long time, attackers may forge certificates to pass verification and thus intrude into the terminal system.

[0006] Furthermore, current satellite communication systems often use a mix of modems, antennas, BUCs, and LNBs on the terminal side. Incompatibility between these subsystems can severely impact the operation of network-connected terminals, potentially affecting the entire satellite network and causing malfunctions in other satellite terminals. Traditional X.509 certificate authentication also fails to address this issue. Summary of the Invention

[0007] In view of this, the purpose of this invention is to propose a satellite communication system and its terminal registration method. On the basis of realizing two-way authentication between the satellite terminal and the authentication center, it can also realize the association authentication of the satellite terminal's subsystems. This not only avoids the problem that attackers can forge certificates and pass the verification to invade the terminal system when the satellite terminal certificate has not been updated for a long time, thus improving security, but also avoids the problem that mismatch between satellite terminal subsystems can cause serious adverse effects on the operation of the network-connected terminal.

[0008] To achieve the above objectives, the present invention provides a terminal registration method for a satellite communication system, comprising: After the satellite terminal RCST reaches the "TDMA synchronization" state, RCST and AuC authenticate each other according to the 5G-AKA authentication mechanism; After RCST and AuC successfully authenticate each other, RCST performs association authentication on each of its subsystems during the non-access stratum NAS security mode agreement process with AuC. After successful association authentication, AuC accepts RCST's registration request and completes the RCST registration process.

[0009] Preferably, the RCST and AuC authenticate each other according to the 5G-AKA authentication mechanism, specifically including: RCST sends a registration request to AuC carrying SUPI / SUCI identification information; AuC returns an authentication request to RCST carrying the authentication token AUTN and the newly generated random number RAND; RCST extracts AUTN and RAND from the authentication request for authentication calculation; If RCST determines that authentication (AuC) is successful based on the authentication calculation result, it then extracts the authentication result from the authentication calculation result. The information is encapsulated into an authentication response message and sent to AuC; AuC extracts from the received authentication response message Information, transformed to obtain , compared with locally calculated If the two match, then AuC authentication RCST is successful.

[0010] Preferably, during the non-access stratum NAS security mode agreement process with AuC, the RCST performs association authentication on each subsystem of the RCST, specifically including: AuC derives the encryption and integrity protection key for NAS, selects the encryption and integrity protection algorithm, and sends the algorithm information in the security mode command message to RCST. After receiving the security mode command message, RCST extracts the algorithm information, deduces the encryption and integrity protection key for NAS, performs an integrity protection check on the message, and then replies to AuC with a security mode completion message, which carries the identification information of each RCST subsystem after encryption and integrity protection processing. After receiving the security mode completion message, AuC performs integrity protection checks and decryption to obtain the identification information of each RCST subsystem. Then, it compares the identification information of each RCST subsystem stored in the database with the identification information of each RCST subsystem to perform association authentication.

[0011] Preferably, the identification information of each subsystem of the RCST includes: The RCST's MAC address, serial number, antenna serial number, BUC serial number, and LNB serial number.

[0012] This invention also provides a satellite communication system, comprising: a satellite terminal RCST and an authentication center AuC; wherein, Once RCST has reached the "TDMA synchronization" state and both the forward and reverse links of the satellite have been established, it sends a registration request to AuC. AuC performs mutual authentication with RCST based on the 5G-AKA authentication mechanism. After RCST and AuC successfully authenticate each other, RCST performs association authentication on each of its subsystems during the non-access stratum NAS security mode agreement process with AuC. After successful association authentication, AuC accepts RCST's registration request and completes the RCST registration process.

[0013] In the technical solution of this invention, after the satellite terminal RCST reaches the "TDMA synchronization" state, RCST and AuC authenticate each other according to the 5G-AKA authentication mechanism; after RCST and AuC successfully authenticate each other, RCST performs association authentication on each subsystem of RCST during the non-access stratum NAS security mode agreement with AuC; after the association authentication is successful, AuC accepts the registration request of RCST and completes the registration process of RCST.

[0014] This invention transplants the 5G-AKA authentication mechanism to the DVB-S2X / RCS2 satellite communication system, enabling two-way authentication between the satellite terminal and the authentication center, replacing the original X.509 certificate authentication method. Because 5G-AKA authentication issues a different RAND each time the terminal registers and recalculates based on this RAND, it avoids the problem of attackers forging certificates and gaining access to the terminal system when the satellite terminal certificate has not been updated for a long time, thus improving security.

[0015] Furthermore, in the technical solution of this invention, the identification information of each subsystem of the terminal is encrypted and transmitted to the authentication center during the authentication process. The authentication center checks the relationship between each subsystem. Only when the relationship is consistent can the authentication pass. This solves the problem of terminal operation abnormality and satellite network operation abnormality caused by the mismatch between the subsystems of the terminal, thereby further improving the system security. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 A flowchart of a terminal registration method for a satellite communication system provided in an embodiment of the present invention; Figure 2 This is a schematic diagram of the interaction message format between a terminal and an authentication center provided in an embodiment of the present invention; Figure 3a A flowchart illustrating a method for mutual authentication between AuC and RCST provided in this embodiment of the invention; Figure 3b This is a schematic diagram of an RCST authentication AuC failure process provided in an embodiment of the present invention; Figure 3c This is a schematic diagram of an AuC authentication RCST failure process provided in an embodiment of the present invention; Figure 3d This is a schematic diagram illustrating the input-output relationship of an authentication algorithm provided in an embodiment of the present invention. Figure 3e This is a schematic diagram of an association authentication failure process provided by an embodiment of the present invention; Figure 4 A flowchart illustrating a method for associating and authenticating various subsystems of RCST during a NAS security mode agreement between RCST and AuC, as provided in an embodiment of the present invention. Figure 5This is a flowchart illustrating how an AuC accepts a registration request from an RCST and completes the RCST registration process, as provided in an embodiment of the present invention. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of the present invention clearer, the present invention will be further described in detail below with reference to specific embodiments and accompanying drawings.

[0019] It should be noted that, unless otherwise defined, the technical or scientific terms used in the embodiments of this invention should have the ordinary meaning understood by one of ordinary skill in the art to which this disclosure pertains. The terms "first," "second," and similar terms used in this disclosure do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" mean that the element or object preceding the word encompasses the elements or objects listed following the word and their equivalents, without excluding other elements or objects. Terms such as "connected" or "linked" are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. Terms such as "upper," "lower," "left," and "right" are used only to indicate relative positional relationships; when the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0020] The inventors of this invention considered that 5G-AKA (5G Authentication and Key Agreement) is the authentication and key distribution mechanism between the terminal and the core network in fifth-generation mobile communication technology. The terminal and the core network hold the same terminal identifier SUPI (Subscription Permanent Identifier), encrypted operator operation code OPC, terminal key K, and other parameters. By transmitting parameters such as random number RAND through the air interface and running the same authentication algorithm such as Milenage, the results are compared to achieve bidirectional authentication between the terminal and the core network. Furthermore, the terminal authentication algorithm can run on the hardware entity of the SIM (Subscriber Identity Module) card / eSIM (embedded SIM card) chip, making it difficult to crack and providing higher security.

[0021] In addition, for the current satellite communication system, there is a situation where the terminal side modem (modulator), antenna, BUC (upconversion power amplifier), and LNB (low-frequency downconversion amplifier) ​​are used interchangeably. The mismatch between the subsystems may have a serious adverse effect on the operation of the terminal connected to the network. This effect may even affect the entire satellite network and cause other satellite terminals to malfunction.

[0022] Due to their different communication systems, the DVB (Digital Video Broadcasting Satellite)-S2X / RCS2 satellite communication system and the terrestrial 5G mobile communication system originally had incompatible authentication mechanisms. This invention aims to port the 5G-AKA authentication mechanism to the DVB-S2X / RCS2 satellite communication system, enabling bidirectional authentication between the satellite terminal and the authentication center. Hardware-level authentication calculations are performed on the terminal side using a SIM card / eSIM chip, improving security. Simultaneously, during the authentication process, the identifiers of each subsystem of the terminal are encrypted and transmitted to the authentication center. The authentication center checks the correlation between the subsystems; authentication is only successful if the correlations match, thus resolving the issues of terminal malfunction and satellite network malfunction caused by incompatibility between terminal subsystems.

[0023] The technical solutions of the embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0024] An embodiment of the present invention proposes a satellite communication system, comprising: a satellite terminal (RCST) and an authentication center (AuC). Among them, RCST sends a registration request to AuC when it reaches the "TDMA (Time Division Multiple Access) synchronization" state and both the forward and reverse links of the satellite are established; AuC performs mutual authentication with RCST based on the 5G-AKA authentication mechanism. After RCST and AuC successfully authenticate each other, RCST performs association authentication on each of its subsystems during the Non-Access Stratum (NAS) security mode agreement process with AuC. After successful association authentication, AuC accepts RCST's registration request and completes the RCST registration process.

[0025] Based on the aforementioned satellite communication system, this invention proposes a terminal registration method for a satellite communication system, as follows: Figure 1 As shown, it includes the following steps: Step S101: RCST reaches the "TDMA synchronization" state; In this step, after RCST reaches the "TDMA synchronization" state, both the forward and reverse links of the satellite are established, and RCST and AuC can send information to each other.

[0026] The AuC and RCST communicate via a DVB bidirectional satellite link, using TCP sockets for message exchange. The RCST, as the terminal, initiates the connection to the AuC and starts the interaction process. The format of the interaction messages is as follows: Figure 2 As shown, it consists of a length field (big-endian mode) with a length of 2 bytes and a data field (json_data) with a length of json_len bytes, where the content of the length field is json_len.

[0027] Step S102: RCST and AuC authenticate each other according to the 5G-AKA authentication mechanism; In this step, once the RCST reaches the "TDMA synchronization" state and both the satellite's forward and reverse links are established, the AuC and RCST authenticate each other based on the 5G-AKA authentication mechanism. This achieves bidirectional authentication between the satellite terminal and the authentication center, replacing the existing X.509 certificate authentication method. Because it uses 5G-AKA authentication, the AuC issues a different random number RAND each time the RCST registers and recalculates the authentication based on this RAND. This avoids the problem of attackers forging certificates and gaining access to the terminal system when the satellite terminal certificate has not been updated for a long time, thus improving system security.

[0028] The specific method and process for mutual authentication between AuC and RCST are as follows: Figure 3a As shown, it includes the following sub-steps: Sub-step S301: RCST sends a registration request to AuC carrying SUPI / SUCI identification information; In one specific implementation, the SUPI / SUCI identification information can be stored in the SIM card. The RCST obtains the SUPI / SUCI identification information from the SIM card and initiates a registration request carrying the SUPI / SUCI identification information to the AuC.

[0029] Sub-step S302: AuC returns an authentication request to RCST carrying the authentication token AUTN and the newly generated random number RAND; In this sub-step, AuC sends an Authentication Request message to RCST; this message carries RAND and AUTN information, where RAND is a random number newly generated by AuC for this authentication; AUTN is the authentication token, which is composed of the SQN⊕AK, AMF, and MAC fields.

[0030] Sub-step S303: RCST extracts AUTN and RAND from the authentication request and performs authentication calculation; In one specific implementation, after receiving the Authentication Request message, the RCST extracts the RAND and AUTN information and inputs it into the SIM card for authentication calculation; the SIM card outputs the authentication calculation result to the RCST.

[0031] Sub-step S304: After RCST determines that the authentication AuC is successful based on the authentication calculation result, it extracts the data from the authentication calculation result. The information is encapsulated into an authentication response message and sent to AuC; Specifically, RCST determines whether the authentication AuC is successful based on the authentication calculation result; if the authentication calculation result indicates that the MAC is equal to the XMAC, it means that the authentication AuC is successful, and then the authentication result is extracted. The information is encapsulated into an Authentication Response message and sent to AuC; If RCST authentication with AuC fails, an Authentication Failure message is sent to AuC, carrying the reason for the authentication failure, such as... Figure 3b As shown.

[0032] Sub-step S305: AuC extracts from the received authentication response message Information, transformed to obtain , compared with locally calculated If the two match, then AuC authentication RCST is successful.

[0033] Specifically, after receiving the Authentication Response message, AuC extracts the relevant information. (Response value) information, transformed to obtain (Hash response value), compared with the locally calculated value If the (expected hash response value) matches, the AuC authentication RCST is successful. If the two are inconsistent, AuC authentication with RCST fails, and AuC sends an Authentication Reject message to RCST. Figure 3c As shown.

[0034] In one specific implementation, the authentication algorithm between AuC and RCST (including the SIM card) uses the Milenage algorithm from the standard 5G-AKA. The input-output relationship of the authentication algorithms on the AuC side and the RCST side (including the SIM card) is as follows: Figure 3d As shown.

[0035] In the input parameters, K is the user root key, which is fixed and stored only in the databases of the RCST SIM card and AuC; OPc is the encrypted operator operation code, which is fixed and calculated by OP⊕E[OP]K, and is stored only in the databases of the SIM card and AuC, with E using the Rijndael encryption algorithm; RAND is a random number generated by AuC during authentication; SQN is the information sequence number, which increases with the number of authentications between RCST and AuC and remains synchronized between RCST and AuC, with its increment method conforming to 3GPP TS 33.102 Annex C; AMF is the authentication management field of the authentication management domain, which is part of the authentication token AUTN; SN_name is the service network name, i.e., PLMN information (composed of the country code MCC and the network code MNC), which is consistent between the RCST and AuC sides.

[0036] In the output parameters, AUTN is the authentication token required by AuC to authenticate AuC using the RCST calculated by AuC. The response result required by RCST for AuC authentication is calculated for the SIM card; MAC is the local result calculated by the RCST side, which is compared with XMAC in AUTN to realize RCST authentication of AuC; This is the local result calculated on the AuC side, through comparison with... Transformed The comparison is performed to enable AuC to authenticate RCST.

[0037] Step S103: After RCST and AuC successfully authenticate each other, RCST performs association authentication on each of its subsystems during the Non-Access Stratum (NAS) security mode agreement process with AuC. In this step, after RCST and AuC successfully authenticate each other, RCST and AuC agree on the NAS security mode. During this process, RCST encrypts the identifiers of each subsystem and sends them to the authentication center AuC. The authentication center AuC checks the relationship between each subsystem. Only when the relationship is consistent can the authentication pass. This solves the problem of terminal operation abnormalities and satellite network operation abnormalities caused by the mismatch between the terminal's subsystems, thereby further improving the security of the system.

[0038] During the NAS security model agreement between RCST and AuC, the specific methods and procedures for associating and authenticating the various subsystems of RCST are as follows: Figure 4 As shown, it includes the following sub-steps: Sub-step S306: AuC derives the encryption and integrity protection key for NAS, selects the encryption and integrity protection algorithm, and sends the algorithm information in the security mode command message to RCST; Specifically, after AuC successfully authenticates RCST, it deduces the encryption and integrity protection key for NAS, selects the encryption and integrity protection algorithm, and writes the algorithm information into a Security Mode Command message and sends it to RCST to perform NAS (Non-Access Stratum) security mode agreement. This message performs integrity protection processing according to the integrity protection algorithm information carried in it.

[0039] Sub-step S307: After receiving the security mode command message, RCST extracts the algorithm information, deduces the encryption and integrity protection key for NAS, performs an integrity protection check on the message, and then replies to AuC with a security mode completion message, which carries the identification information of each RCST subsystem after encryption and integrity protection processing; Specifically, upon receiving the Security Mode Command message, RCST extracts the NAS encryption and integrity protection algorithm information, deduces the encryption and integrity protection key used for NAS, performs an integrity protection check on the message, and then replies to AuC with a Security Mode Complete message, which has undergone encryption and integrity protection processing. Unlike traditional 5G-AKA, in this invention, the message also includes the identification information of each subsystem of the terminal, which is also encrypted and protected for integrity to ensure the security of its transmission over the air interface, and requests AuC to perform association authentication for each subsystem of the terminal.

[0040] Sub-step S308: After receiving the security mode completion message, AuC performs integrity protection checks and decryption processing to obtain the identification information of each RCST subsystem. Then, it compares the identification information of each RCST subsystem stored in the database with the identification information of each RCST subsystem to perform association authentication.

[0041] Specifically, after receiving the Security Mode Complete message, AuC performs integrity protection checks and decryption, obtains the identification information of each subsystem of the terminal, and then compares it with the identification information of each subsystem of the terminal stored in the database to perform association authentication. If they match, the association authentication is successful. If there is a discrepancy, the association authentication fails, and AuC sends a Registration Reject message to RCST. This message carries the reason for the registration rejection: association authentication failed (new extension). Figure 3e As shown.

[0042] The identification information of each subsystem of the aforementioned RCST may specifically include: the MAC address, serial number of the complete unit, serial number of the antenna, serial number of the BUC, and serial number of the LNB.

[0043] Step S104: After successful association authentication, AuC accepts the RCST registration request and completes the RCST registration process.

[0044] Specifically, after successful association authentication, AuC accepts the RCST registration request and completes the RCST registration process as follows: Figure 5 As shown, it includes the following sub-steps: Sub-step 309: AuC sends a registration acceptance message to RCST; Specifically, after successful association authentication, AuC sends a Registration Accept message to RCST; If association authentication fails, AuC sends a Registration Reject message to RCST, which carries the reason for the registration rejection as association authentication failure (new extension), such as... Figure 3e As shown.

[0045] Sub-step 310: After receiving the registration acceptance message, RCST performs integrity protection checks and decryption, extracts relevant information and completes the configuration, and replies to AuC with a registration completion message; Specifically, after receiving the Registration Accept message, RCST performs integrity protection checks and decryption, extracts relevant information and completes the configuration, and replies to AuC with the Registration Complete message. At this point, the 5G-AKA process based on the DVB two-way satellite link physical layer ends.

[0046] In the message sent from AuC to RCST, the data structure of json_data is shown in Table 1, consisting only of nas_pdu (Non-Access Layer Protocol Data Unit). In the message sent from RCST to AuC, the data structure of json_data is shown in Table 2. In this table, nas_pdu is a required field, while ut_info (terminal information) and ut_info_mac (terminal information message authentication code) are optional fields, only filled in the Security Mode Complete message returned by RCST to AuC after the NAS security mode agreement is completed. The composition of the ut_info (Object type) field is shown in Table 3. Both nas_pdu and ut_info fields in the message are encrypted using the derived NAS encryption key and protected for integrity using the NAS integrity protection key. The message authentication code for nas_pdu is contained within nas_pdu, while the message authentication code for ut_info is not contained within ut_info but is carried separately in ut_info_mac. The algorithm uses the encryption and integrity protection algorithms indicated in the Security Mode Command message.

[0047] Table 1

[0048] Table 2

[0049] Table 3

[0050] In the technical solution of this invention, after the satellite terminal RCST reaches the "TDMA synchronization" state, RCST and AuC authenticate each other according to the 5G-AKA authentication mechanism; after RCST and AuC successfully authenticate each other, RCST performs association authentication on each subsystem of RCST during the non-access stratum NAS security mode agreement with AuC; after the association authentication is successful, AuC accepts the registration request of RCST and completes the registration process of RCST.

[0051] This invention transplants the 5G-AKA authentication mechanism to the DVB-S2X / RCS2 satellite communication system, enabling two-way authentication between the satellite terminal and the authentication center, replacing the original X.509 certificate authentication method. Because 5G-AKA authentication issues a different RAND each time the terminal registers and recalculates based on this RAND, it avoids the problem of attackers forging certificates and gaining access to the terminal system when the satellite terminal certificate has not been updated for a long time, thus improving security.

[0052] Furthermore, in the technical solution of this invention, the identification information of each subsystem of the terminal is encrypted and transmitted to the authentication center during the authentication process. The authentication center checks the relationship between each subsystem. Only when the relationship is consistent can the authentication pass. This solves the problem of terminal operation abnormality and satellite network operation abnormality caused by the mismatch between the subsystems of the terminal, thereby further improving the system security.

[0053] Furthermore, in the technical solution of this invention, a SIM card / eSIM chip is used on the DVB satellite terminal side to perform hardware-level authentication calculations, which increases the difficulty for attackers to obtain sensitive terminal information, thereby improving security.

[0054] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transfer medium that can be used to store information accessible by a computing device.

[0055] Those skilled in the art should understand that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of this disclosure (including the claims) is limited to these examples; within the framework of this invention, the technical features of the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other variations of the different aspects of the invention as described above, which are not provided in the details for the sake of brevity.

[0056] Additionally, to simplify the description and discussion, and to avoid obscuring the invention, the well-known power / ground connections to integrated circuit (IC) chips and other components may or may not be shown in the provided drawings. Furthermore, the apparatus may be shown in block diagram form to avoid obscuring the invention, and this also takes into account the fact that the details of implementation of these block diagram apparatuses are highly dependent on the platform on which the invention will be implemented (i.e., these details should be fully understood by those skilled in the art). While specific details (e.g., circuits) are set forth to describe exemplary embodiments of the invention, it will be apparent to those skilled in the art that the invention may be practiced without these specific details or with variations thereof. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0057] Although the invention has been described in conjunction with specific embodiments thereof, many substitutions, modifications, and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may be used with the embodiments discussed.

[0058] The embodiments of this invention are intended to cover all such substitutions, modifications, and variations falling within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A terminal registration method for a satellite communication system, characterized in that, include: After the satellite terminal RCST reaches the "TDMA synchronization" state, RCST and AuC authenticate each other according to the 5G-AKA authentication mechanism; After RCST and AuC successfully authenticate each other, RCST performs association authentication on each of its subsystems during the non-access stratum NAS security mode agreement process with AuC. After successful association authentication, AuC accepts RCST's registration request and completes the RCST registration process.

2. The method according to claim 1, characterized in that, The RCST and AuC authenticate each other according to the 5G-AKA authentication mechanism, specifically including: RCST sends a registration request to AuC carrying SUPI / SUCI identification information; AuC returns an authentication request to RCST carrying the authentication token AUTN and the newly generated random number RAND; RCST extracts AUTN and RAND from the authentication request for authentication calculation; If RCST determines that authentication AuC is successful based on the authentication calculation result, it then extracts the response value from the authentication calculation result. The information is encapsulated into an authentication response message and sent to AuC; AuC extracts from the received authentication response message Information, transformed to obtain hash response value The expected hash response value obtained from local calculation If the two match, then AuC authentication RCST is successful.

3. The method according to claim 2, characterized in that, During the non-access stratum NAS security mode agreement process between RCST and AuC, the RCST performs association authentication on each subsystem of RCST, specifically including: AuC derives the encryption and integrity protection key for NAS, selects the encryption and integrity protection algorithm, and sends the algorithm information in the security mode command message to RCST. After receiving the security mode command message, RCST extracts the algorithm information, deduces the encryption and integrity protection key for NAS, performs an integrity protection check on the message, and then replies to AuC with a security mode completion message, which carries the identification information of each RCST subsystem after encryption and integrity protection processing. After receiving the security mode completion message, AuC performs integrity protection checks and decryption to obtain the identification information of each RCST subsystem. Then, it compares the identification information of each RCST subsystem stored in the database with the identification information of each RCST subsystem to perform association authentication.

4. The method according to claim 3, characterized in that, The identification information of each subsystem of the RCST includes: The RCST's MAC address, serial number, antenna serial number, BUC serial number, and LNB serial number.

5. The method according to claim 3, characterized in that, The AuC accepts the RCST registration request and completes the RCST registration process, which specifically includes: AuC sends a registration acceptance message to RCST; After receiving the registration acceptance message, RCST performs integrity protection checks and decryption, extracts relevant information, completes the configuration, and replies to AuC with a registration completion message.

6. The method according to any one of claims 1-5, characterized in that, The interaction message between RCST and AuC consists of a length field of 2 bytes and a data field of json_len bytes, where the content of the length field is json_len.

7. The method according to claim 2, characterized in that, The RCST has an embedded SIM card; and the RCST extracts the AUTN and RAND from the authentication request for authentication calculation, specifically including: RCST extracts the AUTN and RAND from the authentication request and sends them to the SIM card; The SIM card performs authentication calculations based on its stored parameters and the received AUTN and RAND, and outputs the authentication calculation results to the RCST.

8. The method according to claim 7, characterized in that, The SUPI / SUCI identification information is stored in the SIM card.

9. A satellite communication system, characterized in that, include: Satellite terminal RCST and authentication center AuC; among which, Once RCST has reached the "TDMA synchronization" state and both the forward and reverse links of the satellite have been established, it sends a registration request to AuC. AuC performs mutual authentication with RCST based on the 5G-AKA authentication mechanism. After RCST and AuC successfully authenticate each other, RCST performs association authentication on each of its subsystems during the non-access stratum NAS security mode agreement process with AuC. After successful association authentication, AuC accepts RCST's registration request and completes the RCST registration process.

10. The system according to claim 9, characterized in that, The identification information of each subsystem of the RCST includes: The RCST's MAC address, serial number, antenna serial number, BUC upconverter power amplifier serial number, and LNB low-frequency downconverter amplifier serial number.

Images