A lattice-based unmanned aerial vehicle assisted satellite terminal access authentication method

Abstract

The application belongs to the field of satellite network security, and particularly relates to a lattice-based unmanned aerial vehicle assisted satellite terminal access authentication method; the method comprises the following steps: a user terminal, an unmanned aerial vehicle and a satellite send a registration request to an initialized network control center; the network control center generates a pseudo identity identifier and a partial private key and returns a registration response message to the corresponding device; the user terminal generates a lattice-based complete key pair; the user terminal generates an access authentication request message and sends the message to the unmanned aerial vehicle; the unmanned aerial vehicle aggregates and signs the access authentication request message and records a timestamp; the timestamp, the pseudo identity identifier of the unmanned aerial vehicle and the aggregated signature are sent to the satellite; the satellite returns an access response message to the unmanned aerial vehicle after verifying the message sent by the unmanned aerial vehicle, and the unmanned aerial vehicle forwards the access response message to the user terminal after verifying the access response message; the user terminal completes access authentication after verifying the access response message; the application has high security and access authentication efficiency when the satellite performs authentication, and can effectively resist quantum attacks.

Description

Technical Field

[0001] This invention belongs to the field of satellite network security, specifically relating to a grid-based UAV-assisted satellite terminal access authentication method. Background Technology

[0002] With the rapid development of satellite IoT, services can be provided to terminals by connecting massive numbers of IoT devices on the ground, at sea, and in the air, covering many communication "gaps" previously inaccessible to terrestrial networks. Simultaneously, with the rapid development of satellite IoT, drone technology has also greatly improved. Highly maneuverable and long-endurance drones are beginning to be widely used in various fields such as power, rescue, and military. They can not only complement integrated space-ground information networks but also quickly establish mobile communication systems in remote or disaster-stricken areas such as mountainous regions, oceans, and deserts, enabling collaborative operations. Therefore, the "three-in-one" information network consisting of drones, satellites, and ground terminal equipment has extremely high market value and application prospects. However, due to the open communication links between satellites and drones, the vulnerability of drones to attacks, and the threat of future quantum computing to traditional cryptographic algorithms, the security of drones as communication repeaters is a key issue for their widespread application. There is an urgent need for a drone-assisted satellite terminal access authentication method that can improve the security and access authentication efficiency of user equipment when authenticating via satellite with drone assistance, while effectively resisting quantum attacks. Summary of the Invention

[0003] To address the shortcomings of existing technologies, this invention proposes a grid-based UAV-assisted satellite terminal access authentication method, which includes:

[0004] S1: Initialize the network control center;

[0005] S2: User terminals, drones, and satellites send registration requests to the network control center;

[0006] S3: The network control center generates a pseudo-identity identifier and a partial private key based on the registration requests of all devices, and returns a registration response message containing the pseudo-identity identifier and a partial private key to the corresponding device;

[0007] S4: The user terminal generates a lattice-based complete key pair based on a portion of the private key in the registration response message, and stores the complete key pair and the pseudo-identity identifier locally;

[0008] S5: The user terminal generates an access authentication request message based on the complete key pair and the pseudo-identity identifier and sends it to the drone;

[0009] S6: The drone aggregates and signs the access authentication request message and records the timestamp; it then sends the timestamp, the drone's pseudo-identity identifier, and the aggregated signature to the satellite.

[0010] S7: The satellite verifies the message sent by the drone. If it is valid, it returns an access response message to the drone; if it is invalid, it forwards the invalid response message to the drone.

[0011] S8: The UAV verifies the access response message. If it is valid, it forwards the access response message to the user terminal. If it is invalid, the access fails. If the UAV receives an invalid response message forwarded by the satellite, it forwards the terminal's access authentication request message to the UAV one by one.

[0012] S9: The user terminal verifies the access response message. If it is valid, a secure channel is successfully established and access authentication is completed; otherwise, access fails.

[0013] Preferably, initializing the network control center includes: selecting the ring dimension n and vector dimension k of the common matrix A, and defining the modulus space. large module Select two collision-avoidance hash functions , , where h is a vector of length k; select a hash function H3 for LWE key derivation and aggregate signature: Define the noise distribution for LWE key exchange. LWE dimension And lattice-based aggregate signature parameters.

[0014] Preferably, in step S4, the process of generating a lattice-based complete key pair includes:

[0015] Randomly select short vectors According to the short vector Calculate private key components , This represents a portion of the private key of user terminal i. Represents the common matrix;

[0016] Based on partial private keys short vector and private key components Generate a complete private key: Based on partial private key short vector and common matrix Generate a complete public key: .

[0017] Preferably, step S5 specifically includes:

[0018] Randomly select secret vector and noise vector Generate temporary key pairs based on LWE. , and temporary vectors ;

[0019] Based on the fake identity of the user terminal and temporary vectors Generate commitment vector and challenge vector ;

[0020] Use the complete private key to sign the user terminal's access authentication request message and generate an authentication response. and signature message , The private key component representing the complete private key of the user terminal. Represents a portion of the user terminal's private key; records the timestamp of the access authentication request message sent. ;

[0021] Will contain pseudo-identity identifiers Complete public key Temporary public key Challenge Vector Authentication Response Signature message and timestamp The access authentication request message is sent to the drone.

[0022] Preferably, in step S6, the aggregated signature is represented as follows:

[0023]

[0024] in, Indicates aggregate signature, This represents a pseudo-identity identifier for the user terminal. Represents the challenge vector. Indicates an authentication response. Indicates a signed message. This represents the complete public key of the user terminal. This represents the temporary public key of the user terminal.

[0025] Preferably, in step S7, the process of the satellite verifying the message sent by the drone includes:

[0026] The satellite checks the validity of the timestamp and challenge vector in the message sent by the drone. If valid, the satellite randomly selects a secret vector. and noise vector Generate temporary key pairs based on LWE , and temporary vectors ';

[0027] Based on the user terminal's public key and the satellite's temporary private key, the satellite calculates a unique session key for each terminal. and commitment vector Returns a pseudo-identifier containing the satellite. Public key Temporary public key Challenge Vector Authentication Response Signature message The hash value of the session key and timestamp The access response message; among which, This represents a portion of the satellite's private key. A pseudo-identifier for the satellite. The private key component representing the complete private key of the satellite terminal;

[0028] If the response is invalid, the failure message will be forwarded to the drone.

[0029] Preferably, step S8 specifically includes: checking the timestamp of the access response message, recording the forwarding timestamp after successful checking, and sending the forwarding timestamp and access response message to the user terminal.

[0030] Preferably, step S9 specifically includes: checking the validity of the forwarding timestamp and the challenge vector in the access response message; if valid, then calculating the session key. ,verify and Are they equal? This represents the temporary private key generated by the user terminal. This represents the temporary public key generated by the satellite. This represents the session key in the access response message; if they are equal, the verification is successful, a secure channel has been successfully established, and access authentication is completed; if they are not equal, the access fails.

[0031] The beneficial effects of this invention are as follows: During the user terminal registration stage, this invention generates a partial private key and a pseudo-identity identifier based on a lattice for the user equipment. The user terminal generates a complete key pair. During the interaction between the user terminal and the satellite for access authentication, the UAV groups multiple terminals and performs aggregated signatures. This improves user access efficiency while ensuring the security of user access authentication. At the same time, the entire authentication process is based on a difficult problem on a lattice, which can effectively resist quantum computing attacks and ensure the long-term security of future satellite networks, showing good application prospects. Attached Figure Description

[0032] Figure 1 This is a flowchart of the UAV-assisted satellite terminal access authentication method based on grid in this invention;

[0033] Figure 2 This is a flowchart of the user terminal access authentication interaction process based on the UAV in this invention.

[0034] Figure 3 This is a flowchart of the identity registration and complete key pair generation process in this invention. Detailed Implementation

[0035] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0036] This invention proposes a grid-based UAV-assisted satellite terminal access authentication method, the method comprising the following:

[0037] This invention mainly comprises the following three stages: system initialization stage, registration stage, and access authentication stage. These three stages will be described in detail below.

[0038] I. System Initialization Phase: Establish system parameters. The main system parameters include: generator matrix dimension parameters, modulus parameters, distribution parameters, LWE key exchange parameters, aggregate signature parameters, three hash functions, and pseudo-identity identifiers for user terminals, UAVs, and satellites.

[0039] II. Registration Phase: User terminals, drones, and satellites embed their real identity information into registration information and send registration requests to the network control center. Upon receiving the registration information, the network control center generates a partial private key based on the real identity information of different terminals using the Gaussian sampling algorithm SampleD(). This partial private key and a pseudo-identity identifier are embedded into the response message, which is then sent to the user terminal, drone, and satellite in a registration response. The user terminal, drone, and satellite generate a complete key pair based on the partial private key in the registration response using a lattice cryptography method and store the received pseudo-identity identifier locally.

[0040] III. Access Authentication Phase: The user terminal randomly selects a pseudo-identity identifier and generates a temporary key pair based on LWE (Learning With...). It randomly selects a temporary short vector to generate a commitment and challenge vector, and generates a response message and signature message based on the private key generated during registration. The public key, temporary public key, pseudo-identity identifier, challenge vector, response message, signature message, and timestamp are embedded in the access authentication message. When a UAV connected to the satellite receives access authentication messages from multiple user terminals within the same time interval, it verifies the validity of the timestamps of the multiple authentication messages. If valid, it aggregates and signs the access authentication messages from multiple terminals and forwards the aggregated signature and the UAV's pseudo-identity identifier to the satellite. Upon receiving the aggregated signature from the UAV, the satellite first checks the validity of the UAV's sending timestamp. If valid, it verifies the challenge vector in the access authentication messages from multiple user terminals. After successful verification, the satellite uses LWE (Learning With...) to... Errors (with fault-tolerant learning) generate temporary key pairs and calculate independent session keys for each user terminal. When returning the authentication response message, the satellite's public key, temporary public key, pseudo-identity identifier, challenge vector, response message, signature message, hash value of the session key, and timestamp are embedded in the authentication response message. The UAV verifies the validity of the timestamp in the received authentication response message. If valid, it forwards the response message directly to multiple user terminals. After receiving the authentication response message, the user terminal first checks the validity of the UAV's forwarding timestamp. If valid, it verifies the satellite's challenge vector. If successful, it verifies the hash value of the session key. If successful, a secure channel is established, and access authentication is completed. Figure 1 , Figure 2 As shown, the specific process is as follows:

[0041] S1: Initialize the network control center.

[0042] In the UAV-assisted satellite access authentication scheme of this invention, the Network Control Center (NCC) performs system initialization: selecting the ring dimension n and vector dimension k of the common matrix A, and defining the modulus space. large module Select two collision-avoidance hash functions , , where h is a vector of length k, and each component can only be 1, 0, or -1. And a hash function H3 is selected for LWE key derivation and aggregate signature: Define the noise distribution for LWE key exchange. LWE dimension And lattice-based aggregate signature parameters.

[0043] S2: User terminals, drones, and satellites send registration requests to the network control center.

[0044] The registration request information includes the user's identity and timestamp. For example... Figure 3 As shown, the user terminal (GUE) will display the real identity information. The registration request is embedded in the network control center for registration, containing the drone's (UAV) real identity information. The registration request is embedded in the network control center for registration, containing the true identity information of the low-Earth orbit satellite (SAT). The registration request is embedded and sent to the network control center for registration.

[0045] S3: The network control center generates a pseudo-identity identifier and a partial private key based on the registration requests of all devices, and returns a registration response message containing the pseudo-identity identifier and a partial private key to the corresponding device.

[0046] The network control center assigns pseudo-identity identifiers based on different request messages from user terminals, drones, and satellites. Simultaneously, a partial private key is generated based on the hash value H(ID) of the real identity ID and the Gaussian sampling algorithm SampleD(A,R,u,s). Return a pseudo-identity identifier to the corresponding device. and part of the private key The registration response message.

[0047] S4: The user terminal generates a lattice-based complete key pair based on a portion of the private key in the registration response message, and stores the complete key pair and pseudo-identity identifier locally.

[0048] After receiving a portion of the private key from the network control center, each terminal randomly selects a short vector. According to the short vector Calculate private key components , This represents a portion of the private key of user terminal i.

[0049] Based on partial private keys short vector and private key components Generate a complete private key: Based on partial private key short vector and common matrix Generate a complete public key: .

[0050] Complete key pair The pseudo-identity identifier is stored locally.

[0051] S5: The user terminal generates an access authentication request message based on the complete key pair and the pseudo-identity identifier and sends it to the drone.

[0052] The user terminal randomly selects a pseudo-identity identifier (PID) from multiple pseudo-identity identifiers generated by the network control center. GUE .

[0053] Randomly select secret vector and noise vector Generate temporary key pairs based on LWE. , and temporary vectors ;

[0054] Based on the fake identity of the user terminal and temporary vectors Generate commitment vector and challenge vector ;

[0055] Use the complete private key to sign the user terminal's access authentication request message and generate an authentication response. and signature message , The private key component representing the complete private key of the user terminal. Represents a portion of the user terminal's private key; records the timestamp of the access authentication request message sent. ;

[0056] Will contain pseudo-identity identifiers Complete public key Temporary public key Challenge Vector Authentication Response Signature message and timestamp The access authentication request message is sent to the drone.

[0057] S6: The drone aggregates and signs the access authentication request message and records the timestamp; it then sends the timestamp, the drone's pseudo-identity identifier, and the aggregated signature to the satellite.

[0058] If a drone receives access authentication request messages from multiple terminals within the same time interval, the drone will aggregate and sign the access authentication request messages from multiple terminals within the group.

[0059]

[0060] in, Indicates aggregate signature, This represents a pseudo-identity identifier for the user terminal. Represents the challenge vector. Indicates an authentication response. Indicates a signed message. This represents the complete public key of the user terminal. This represents the temporary public key of the user terminal.

[0061] Record timestamp The timestamp, the drone's pseudo-identifier, and the aggregated signature are sent to the satellite.

[0062] S7: The satellite verifies the message sent by the drone. If it is valid, it returns an access response message to the drone; if it is invalid, it forwards the invalid response message to the drone.

[0063] After receiving the message from the drone, the satellite first checks the validity of the timestamp and challenge vector in the message sent by the drone. If valid, the satellite randomly selects a secret vector. and noise vector Generate temporary key pairs based on LWE , and temporary vectors ';

[0064] Based on the user terminal's public key and the satellite's temporary private key, the satellite calculates a unique session key for each terminal. and commitment vector Returns a pseudo-identifier containing the satellite. Public key Temporary public key Challenge Vector Authentication Response Signature message The hash value of the session key and timestamp The access response message; among which, This represents a portion of the satellite's private key. A pseudo-identifier for the satellite. The private key component representing the complete private key of the satellite terminal;

[0065] If invalid, the invalid response message will be forwarded to the drone.

[0066] S8: The UAV verifies the access response message. If it is valid, it forwards the access response message to the user terminal; if it is invalid, the access fails. If the UAV receives an invalid response message forwarded by the satellite, it forwards the terminal's access authentication request message to the UAV one by one.

[0067] timestamp of access response message Perform the check, record the forwarding timestamp after successful check, and send the forwarding timestamp to the user terminal. and access response messages.

[0068] If the drone receives an invalid response message relayed by the satellite, the drone will forward the access authentication request messages from multiple terminals to the satellite one by one, and the satellite will respond to the access request messages from multiple terminals one by one.

[0069] S9: The user terminal verifies the access response message. If it is valid, a secure channel is successfully established and access authentication is completed; otherwise, access fails.

[0070] After receiving the access authentication response, the user terminal checks the validity of the forwarding timestamp and the challenge vector in the access response message. If valid, it calculates the session key. ,verify and If the values ​​are equal, the verification is successful, a secure channel has been successfully established, and access authentication has been completed. If the values ​​are not equal, the access has failed.

[0071] In summary, this invention assigns pseudo-identity identifiers and partial private keys to both the drone and the terminal during the registration phase, and then the terminal generates the complete key, thus protecting the legitimate user's true identity and user key. When a user sends an access authentication request to the satellite, the terminal's pseudo-identity identifier, a lattice-based signature message, and an LWE-based temporary public key are first sent to the drone. The drone aggregates and signs the access authentication requests from multiple users and then sends them to the satellite. The satellite then uniformly authenticates multiple terminals, improving the efficiency of terminal access. This method utilizes drones to assist terminals that cannot directly access the satellite in authentication. Under the lattice-based access authentication method, it ensures both the security of the authentication process and the confidentiality of user identity information, while also guaranteeing the efficiency of terminal access.

[0072] The above-described embodiments further illustrate the purpose, technical solution, and advantages of the present invention. It should be understood that the above-described embodiments are merely preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made to the present invention within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A lattice-based UAV-assisted satellite terminal access authentication method, characterized in that, Includes the following steps: S1: Initialize the network control center; S2: User terminals, drones, and satellites send registration requests to the network control center; S3: The network control center generates a pseudo-identity identifier and a partial private key based on the registration requests of all devices, and returns a registration response message containing the pseudo-identity identifier and a partial private key to the corresponding device; S4: The user terminal generates a lattice-based complete key pair based on a portion of the private key in the registration response message, and stores the complete key pair and the pseudo-identity identifier locally; S5: The user terminal generates an access authentication request message based on the complete key pair and the pseudo-identity identifier and sends it to the drone; S6: The drone aggregates and signs the access authentication request message and records the timestamp; Send the timestamp, the drone's pseudo-identifier, and the aggregated signature to the satellite; S7: The satellite verifies the message sent by the drone. If it is valid, it returns an access response message to the drone; if it is invalid, it forwards the invalid response message to the drone. S8: The UAV verifies the access response message. If it is valid, it forwards the access response message to the user terminal. If it is invalid, the access fails. If the UAV receives an invalid response message forwarded by the satellite, it forwards the terminal's access authentication request message to the UAV one by one. S9: The user terminal verifies the access response message. If it is valid, a secure channel is successfully established and access authentication is completed; otherwise, access fails.

2. The UAV-assisted satellite terminal access authentication method based on grids according to claim 1, characterized in that, Initializing the network control center includes: selecting the ring dimension n and vector dimension k of the common matrix A, and defining the modulus space. large module Select two collision-avoidance hash functions , , where h is a vector of length k; select a hash function H3 for LWE key derivation and aggregate signature: Define the noise distribution for LWE key exchange. LWE dimension And lattice-based aggregate signature parameters.

3. The method for UAV-assisted satellite terminal access authentication based on grids according to claim 1, characterized in that, In step S4, the process of generating a lattice-based complete key pair includes: Randomly select short vectors According to the short vector Calculate private key components , This represents a portion of the private key of user terminal i. Represents the common matrix; Based on partial private keys short vector and private key components Generate a complete private key: Based on partial private key short vector and common matrix Generate a complete public key: .

4. The UAV-assisted satellite terminal access authentication method based on grids according to claim 1, characterized in that, Step S5 specifically includes: Randomly select secret vector and noise vector Generate temporary key pairs based on LWE. , and temporary vectors ; Based on the fake identity of the user terminal and temporary vectors Generate commitment vector and challenge vector ; Use the complete private key to sign the user terminal's access authentication request message and generate an authentication response. and signature message , The private key component representing the complete private key of the user terminal. Represents a portion of the user terminal's private key; records the timestamp of the access authentication request message sent. ; Will contain pseudo-identity identifiers Complete public key Temporary public key Challenge Vector Authentication Response Signature message and timestamp The access authentication request message is sent to the drone.

5. The UAV-assisted satellite terminal access authentication method based on grids according to claim 1, characterized in that, In step S6, the aggregated signature is represented as follows: ； in, Indicates aggregate signature, This represents a pseudo-identity identifier for the user terminal. Represents the challenge vector. Indicates an authentication response. Indicates a signed message. This represents the complete public key of the user terminal. This represents the temporary public key of the user terminal.

6. The UAV-assisted satellite terminal access authentication method based on grids according to claim 1, characterized in that, In step S7, the process of the satellite verifying the message sent by the UAV includes: The satellite checks the validity of the timestamp and challenge vector in the message sent by the drone. If valid, the satellite randomly selects a secret vector. and noise vector Generate temporary key pairs based on LWE , and temporary vectors '; Based on the user terminal's public key and the satellite's temporary private key, the satellite calculates a unique session key for each terminal. and commitment vector Returns a pseudo-identifier containing the satellite. Public key Temporary public key Challenge Vector Authentication Response Signature message The hash value of the session key and timestamp The access response message; among which, This represents a portion of the satellite's private key. A pseudo-identifier for the satellite. The private key component representing the complete private key of the satellite terminal; If the response is invalid, the failure message will be forwarded to the drone.

7. The UAV-assisted satellite terminal access authentication method based on grids according to claim 1, characterized in that, Step S8 specifically includes: checking the timestamp of the access response message, recording the forwarding timestamp after successful checking, and sending the forwarding timestamp and access response message to the user terminal.

8. The UAV-assisted satellite terminal access authentication method based on grids according to claim 1, characterized in that, Step S9 specifically includes: checking the validity of the forwarding timestamp and the challenge vector in the access response message; if valid, then calculating the session key. ,verify and Are they equal? This represents the temporary private key generated by the user terminal. This represents the temporary public key generated by the satellite. This represents the session key in the access response message; if they are equal, the verification is successful, a secure channel has been successfully established, and access authentication is completed; if they are not equal, the access fails.

Images