A satellite communication method based on dynamic password

Abstract

This invention discloses a satellite communication method based on dynamic passwords, including registration, authentication, and update processes. During registration, the satellite sends its identity ID to the nearest ground station server and records a first timestamp. The server generates two random numbers and records a second timestamp, hashes them to generate an encryption key, and then combines the random numbers and timestamps to generate ciphertext and a dynamic password, which is sent to the satellite. The server generates a shared key based on the timestamp and dynamic password and synchronizes it to the main station and all branch servers. During authentication, the satellite generates a dynamic password based on the random number, current time, and identity ID and sends it to the ground station. The server calculates the dynamic password, compares the dynamic passwords from both ends to complete authentication, and updates the two timestamps using a forward hash algorithm. This invention eliminates the need for offline registration; each authentication synchronously updates the dynamic password and statically generated elements, providing dual protection against password deduction attacks after server leakage, significantly improving the security of satellite communication authentication.

Description

Technical Field

[0001] This invention relates to the field of satellite communication technology, and in particular to a satellite communication method based on dynamic passwords. Background Technology

[0002] Nowadays, secure authentication is a prerequisite for both satellite-to-ground and inter-satellite communication. Currently, satellite communication methods include satellite communication identity authentication, satellite navigation system authentication, satellite cryptography authentication, biometric identification, and satellite-based human authentication.

[0003] Satellite communication authentication refers to identity verification through satellite communication networks to ensure the security of the identities of both communicating parties and the data transmission. Satellite communication authentication typically relies on technologies such as key exchange, encryption, and digital signatures for identity verification. The authentication technologies generated by this method are usually immutable, easily leaked or stolen, and cannot flexibly and effectively cope with modern complex security threats.

[0004] GNSS-based authentication refers to the use of precise positioning services provided by satellite navigation systems (such as GPS, GLONASS, Galileo, and Beidou) combined with static passwords to achieve location-based identity authentication. This method is vulnerable to interference, spoofing, and jamming attacks. Attackers can use jamming devices to disrupt or forge signals, preventing the receiver from correctly receiving the genuine signal. This can lead to errors or tampering with information during the authentication process, posing security risks.

[0005] Satellite digital certificate authentication refers to identity verification using digital certificates issued through satellite networks. To implement satellite digital certificate authentication, users need to equip themselves with hardware devices that support satellite communication (such as GPS receivers, satellite communication terminals, etc.). Purchasing and using these devices may require additional investment, and not all devices are compatible with different satellite authentication systems.

[0006] Biometric authentication combined with satellite technology refers to authentication using biometric technologies such as fingerprint recognition, facial recognition, or iris scanning. This method is essentially still a static password and lacks the novelty of dynamic passwords.

[0007] Current satellite dynamic authentication schemes are only used in the password authentication phase, employing a dynamic password that changes only once. However, during user registration and satellite access, a shared-key offline authentication method is still used. This method requires the main server and branch servers to distribute two password values ​​to each user. When each user registers offline on the home domain server, the home domain server assigns two password values ​​to the offline user. Furthermore, the home domain server synchronizes these two password values ​​to the main server via wired encrypted transmission. This registration and authentication method is stringent and only supports offline authentication. On the other hand, the server stores all password generation elements, and these elements remain unchanged. If, for some unknown reason, these password elements are stolen or leaked by an attacker, the attacker can deduce the dynamic password for the next authentication by combining it with the current time element, causing the encryption to fail. Summary of the Invention

[0008] To address the shortcomings of existing technologies, this invention provides a satellite communication method based on dynamic passwords, which solves the technical problems of relying on offline fixed keys, static password generation elements, and the ability of attackers to deduce subsequent dynamic passwords.

[0009] This invention provides a satellite communication method based on dynamic passwords, characterized by including: a registration process, an authentication process, and an update process.

[0010] The registration process includes the following steps:

[0011] Step A1: The satellite sends its own identity ID to the nearest ground station server, and the ground station server records the timestamp of receipt as the first timestamp;

[0012] Step A2: The ground station server generates two random numbers, hashes the timestamps of the generated random numbers, and combines them with the corresponding random numbers to generate two encryption keys, wherein the timestamps of the generated random numbers are used as the second timestamp;

[0013] Step A3: The ground station server generates ciphertext by hashing the random number and two timestamps, and combines it with the satellite's identity ID to generate a dynamic identity key;

[0014] Step A4: The ground station server sends two encryption keys and two timestamps to the satellite; the satellite uses the two encryption keys and two timestamps to deduce two random numbers.

[0015] Step A5: The ground station server generates a shared key based on the two timestamps and the dynamic identity key, and shares the shared key and the two encryption keys between servers to complete the registration process;

[0016] The certification process includes the following steps:

[0017] Step B1: The satellite generates a dynamic password for the satellite based on the random number from the satellite terminal, the current time, and the identity ID through hash processing;

[0018] Step B2: The satellite sends the satellite-side dynamic password, current time, and current dynamic identity key to the nearest ground station server;

[0019] Step B3: The ground station server generates random numbers for the two authentication stages based on the two current encryption keys and two current timestamps on the server side, combined with hash processing.

[0020] Step B4: The ground station server generates the ciphertext for the authentication phase, the satellite's identity ID, and the server-side dynamic password sequentially based on the random numbers from the two authentication phases and the two current timestamps.

[0021] Step B5: Authentication is successful when the dynamic password on the server side matches the dynamic password on the satellite side;

[0022] The update process includes:

[0023] Once authentication is successful, both the ground station server and the satellite will update the first and second timestamps through hash processing, and gradually update the two encryption keys, ciphertext, and dynamic identity key based on the updated timestamps. The ground station server will then share the updated data between servers.

[0024] Furthermore, in step A2, the formulas for generating the two encryption keys are as follows:

[0025] R1 F =r1 F ⊕h(T second );

[0026] R2 F =r2 F ⊕h(T first );

[0027] In the formula, R1 F R2 F Two encryption keys generated for the ground station server; r1 F r2 F Two random numbers generated for the ground station server; T first This is the current first timestamp; T second `h()` is the current second timestamp; `h()` is the hash function; `⊕` is the XOR operator.

[0028] Furthermore, in step A3, the formula for generating the ciphertext is:

[0029] HF =h(r1 F ||T first ||h(T second ));

[0030] The formula for generating dynamic passwords is:

[0031] P F =H F ⊕ID;

[0032] In the formula, H F Ciphertext generated for the ground station server; r1 F The first random number generated for the ground station server; T first This is the current first timestamp; T second The current second timestamp; h() is the hash function; || is the concatenation operator; ⊕ is the XOR operator; ID is the satellite identity ID; P F A dynamic identity key generated for the ground station server.

[0033] Furthermore, in step A5, the formula for generating the shared key is:

[0034] Pw F =T first ||T second ||P F ;

[0035] In the formula, T first This is the current first timestamp; T second The current second timestamp; || is the concatenation operator; P F A dynamic identity key generated for the ground station server.

[0036] Furthermore, in step B1, the formula for generating the dynamic password on the satellite end is:

[0037] Pt W =h(ID||r2 W ||T);

[0038] In the formula, Pt W The dynamic password generated by the satellite; ID is the satellite identity ID; r2 W The second random number is derived by the satellite from the current encryption key; T is the current time; || is the concatenation operator; h() is the hash function.

[0039] Furthermore, in step B3, the formula for generating random numbers for the two authentication stages is:

[0040] r1'=R1 F ⊕h(T second ); r2'=R2F ⊕h(T first );

[0041] The formula for calculating ciphertext is:

[0042] H'=h(r1'||T first ||h(T second ));

[0043] The formula for generating a satellite identity ID is:

[0044] ID'=P W ⊕H';

[0045] The formula for generating a dynamic password on the server side is:

[0046] Pt'=h(ID'||r2'||T);

[0047] In the formula, r1' and r2' are random numbers for the two authentication stages; R1 F R2 F T represents the current encryption keys for the two servers; first This is the current first timestamp; T second The current second timestamp; h() is the hash function; H' is the calculated ciphertext; ID' is the calculated satellite identity ID; T is the current time; || is the concatenation operator; ⊕ is the XOR operator; P W 'Pt' is the current dynamic identity key on the satellite side; 'Pt' is the dynamic password on the server side.

[0048] Furthermore, during the update process, the specific formula for updating the first and second timestamps through hash processing is as follows:

[0049] T first =h(T first );T second =h(T second );

[0050] In the formula, T first First timestamp; T second is the second timestamp; h() is the hash function.

[0051] The beneficial effects of this invention are:

[0052] This invention does not require pre-storing the shared key offline, so users do not need to be offline to register. On the other hand, by combining forward hashing and TOTP algorithms, each authentication not only updates the dynamic password transmitted over the network, but also updates the static generation elements that generate the dynamic password. This dual protection overcomes the possibility that attackers can deduce the next dynamic password that can be accepted by the ground server after the server password is leaked or spied on, thus improving the security of password authentication. Attached Figure Description

[0053] The features and advantages of the invention will be more clearly understood by referring to the accompanying drawings, which are schematic and should not be construed as limiting the invention in any way. In the drawings:

[0054] Figure 1 This is a flowchart illustrating a specific embodiment of the present invention;

[0055] Figure 2 This is a schematic diagram of the registration process in a specific embodiment of the present invention;

[0056] Figure 3 This is a schematic diagram of the authentication process in a specific embodiment of the present invention. Detailed Implementation

[0057] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0058] The present invention will be further illustrated below with reference to specific embodiments. Those skilled in the art should understand that these embodiments are for illustrative purposes only and are not intended to limit the scope of the invention. Modifications to the present invention in various equivalent forms all fall within the scope defined by the appended claims.

[0059] like Figure 1 The present invention provides a satellite communication method based on dynamic passwords, including: a registration process, an authentication process, and an update process.

[0060] Among them, such as Figure 2 As shown, the registration process includes the following steps:

[0061] Step A1: The satellite sends its identity ID to the nearest ground station server. The ground station server records the timestamp of the received data, which is used as the first timestamp T. first ;

[0062] Step A2: The ground station server generates two random numbers r1 F r2 F The timestamp of the generated random number is hashed and combined with the corresponding random number to generate two encryption keys R1. F R2 F The timestamp for generating the random number is used as the second timestamp T. second ;

[0063] The formulas for generating the two encryption keys are:

[0064] R1 F =r1 F ⊕h(T second );

[0065] R2 F =r2 F ⊕h(T first );

[0066] In the formula, R1 F R2 F Two encryption keys generated for the ground station server; r1 F r2 F Two random numbers generated for the ground station server; T first This is the current first timestamp; T second The current second timestamp; h() is the hash function; ⊕ is the XOR operator;

[0067] Step A3: The ground station server uses random number r1 F Two timestamps T first T second Ciphertext H is generated through hash processing. F And generate a dynamic identity key P by combining the satellite's identity ID. F ;

[0068] The formula for generating ciphertext is:

[0069] H F =h(r1 F ||T first ||h(T second ));

[0070] The formula for generating dynamic passwords is:

[0071] P F =H F ⊕ID;

[0072] In the formula, H F Ciphertext generated for the ground station server; r1 F The first random number generated for the ground station server; Tfirst This is the current first timestamp; T second The current second timestamp; h() is the hash function; || is the concatenation operator; ⊕ is the XOR operator; ID is the satellite identity ID; P F A dynamic identity key generated for the ground station server;

[0073] Step A4: The ground station server will use the two encryption keys R1 F R2 F And two timestamps T first T second Send it to the satellite; at this time, the satellite will send the encryption key R1 F R2 F And two timestamps T first T second The encryption key R1 is stored on the satellite side. W R2 W ; and based on the two encryption keys and two timestamps, two random numbers are derived and stored on the satellite, using the following formula:

[0074] r1 W =R1 W ⊕h(T second );

[0075] r2 W =R2 W ⊕h(T first );

[0076] In the formula, r1 W r2 W R1 is the random number derived from the reverse; W R2 W The current encryption key on the satellite; T first This is the current first timestamp; T second This is the current second timestamp;

[0077] At the same time, according to r1 W Generate the ciphertext H at the satellite end W The specific formula is as follows:

[0078] H W =h(r1 W ||T first ||h(T second ));

[0079] Then, a dynamic identity key for the satellite is generated based on the HW, using the following formula:

[0080] P W =ID⊕H W ;

[0081] Step A5: The ground station server uses two timestamps T first T second and dynamic identity key P F Generate shared key Pw F and the shared key Pw F and two encryption keys R1 F R2 F The data is sent to the main server, which receives it and records R1. F R2 F and Pw F It is then synchronized to all ground branch servers for data sharing between servers, completing the registration process; other servers can then use Pw... F Get two timestamps T first T second ;

[0082] The formula for generating the shared key is:

[0083] Pw F =T first ||T second ||P F ;

[0084] In the formula, T first This is the current first timestamp; T second The current second timestamp; || is the concatenation operator; P F A dynamic identity key generated for the ground station server;

[0085] like Figure 3 As shown, the authentication process includes the following steps:

[0086] Step B1: The satellite uses random number r2 W The current time T and the identity ID are used to generate a dynamic password Pt for the satellite terminal through hash processing. W ;

[0087] The formula for generating dynamic passwords on the satellite is:

[0088] Pt W =h(ID||r2 W ||T);

[0089] In the formula, Pt W The dynamic password generated by the satellite; ID is the satellite identity ID; r2 W The second random number is derived by the satellite from the current encryption key; T is the current time; || is the concatenation operator; h() is the hash function;

[0090] Step B2: The satellite will transmit the dynamic password Pt from the satellite end. W Dynamic identity key P F And the current time T is sent to the nearest ground station server, which can be the nearest main station server or the nearest ground station branch server;

[0091] Step B3: The ground station server uses its currently stored encryption key R1 F R2 F And two timestamps T first T second By combining hash processing, random numbers r1' and r2' are generated for the two authentication stages.

[0092] The formula for calculating two random numbers is:

[0093] r1'=R1 F ⊕h(T second ); r2'=R2 F ⊕h(T first );

[0094] In the formula, r1' and r2' are two random numbers obtained by reverse engineering from the ground station server; R1 F R2 F T is the current encryption key on the server side; first This is the current first timestamp; T second This is the current second timestamp;

[0095] Step B4 calculates the ciphertext H' of the authentication stage, the satellite's identity ID, and the server's dynamic password Pt' in sequence based on the random numbers r1' and r2' from the two authentication stages;

[0096] The formula for calculating ciphertext is:

[0097] H'=h(r1'||T first ||h(T second ));

[0098] The formula for calculating the satellite identity ID is:

[0099] ID'=P W ⊕H';

[0100] The formula for generating dynamic passwords on the server side is:

[0101] Pt'=h(ID'||r2'||T);

[0102] In the formula, r1' and r2' are random numbers for the two authentication stages; R1 F R2 F T represents the current encryption keys for the two servers;first This is the current first timestamp; T second The current second timestamp; h() is the hash function; H' is the calculated ciphertext; ID' is the calculated satellite identity ID; T is the current time; || is the concatenation operator; ⊕ is the XOR operator; P W Pt' is the current dynamic identity key on the satellite side; Pt' is the dynamic password on the server side.

[0103] Step B5: Authentication is successful when the dynamic password on the server side matches the dynamic password on the satellite side;

[0104] The update process includes:

[0105] Once authentication is successful, both the ground station server and the satellite will perform hash processing on the first timestamp T. first And the second timestamp T second The update is performed, and the two encryption keys are updated according to the two updated timestamps. The ground station server then shares the updated data among the servers.

[0106] The satellite updates the ciphertext using two updated timestamps and two encryption keys, and simultaneously updates the dynamic identity key.

[0107] The formula for updating timestamps is:

[0108] T first =h(T first );T second =h(T second );

[0109] In the formula, T first First timestamp; T second The second timestamp; h() is the hash function;

[0110] The formula for updating the two encryption keys based on the updated timestamps on both the server and satellite sides is as follows:

[0111] R1=r1⊕h(T second R² = r²⊕h(T) first );

[0112] The formula for updating the ciphertext is:

[0113] H = h(r1||T) first ||h(T second ));

[0114] The formula for updating the dynamic identity key is:

[0115] P = ID⊕H;

[0116] In the formula, T first This is the first timestamp after the update; T second This is the updated second timestamp; when the server updates the ciphertext, the random number r1 used is r1', which is derived in real time during authentication.

[0117] The encryption key, ciphertext, and dynamic identity key used in the next authentication are all updated, ensuring that different parameters are used in each authentication process to avoid being tracked and detected.

[0118] In this invention, during the registration process, the server and the satellite, as well as between servers, will communicate using two encryption keys R1. F R2 F And two timestamps T first T second The random number r1 generated during registration F r2 F The data will be shared. During subsequent authentication and update processes, the random numbers on both the server and satellite sides will remain unchanged; these random numbers are a key parameter in the subsequent authentication process.

[0119] During the authentication phase, the satellite will combine its ID with a random number r2. W Encoded into dynamic password Pt W And at the same time, the new P obtained after the last certification update W And T is simultaneously sent to the nearest ground server to initiate the authentication process;

[0120] The server will determine the R1 it stores. W R2 W And two timestamps T first T second The random numbers r1' and r2' are derived by reverse engineering. In this invention, the generated random numbers are only stored in the server that establishes registration with the satellite during registration. During data sharing between servers, the random numbers are not directly shared; only the encryption key containing the random number information is shared. The server receiving the shared data does not actively derive and store the random numbers based on the encryption key; it only derives the random numbers during authentication. Therefore, the derived random numbers r1' and r2' are the same as the random number r1 generated during registration. F r2 F This ensures that each server does not store all the data, thus preventing leaks.

[0121] At this point, if authentication is successful, meaning Pt is required... W = Pt', as can be seen from the generation formulas of both, to ensure that they are equal, it is only necessary for ID and ID' to be the same, r2 WSame as r2'. Based on the formula for generating ID':

[0122] ID'=P W ⊕H'=(ID⊕H W )⊕H'

[0123] =(ID⊕(h(r1 W ||T first ||h(T second ))))⊕(h(r1'||T first ||h(T second )));

[0124] That is, only r1 W If it is the same as r1', then ID=ID' can be obtained.

[0125] Given r1' and r1 F The same applies to r2' and r2. F They are the same, so only r1 F With r1 W Same, r2 F With r2 W If they are the same, it means that the current satellite has been registered, and the authentication will pass.

[0126] During the authentication update phase, the server and satellite synchronously update the timestamp, encryption key, ciphertext, and dynamic identity key for the next authentication, ensuring the data variability of each authentication.

[0127] Although embodiments of the invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the invention, and such modifications and variations all fall within the scope defined by the appended claims.

Claims

1. A satellite communication method based on dynamic passwords, characterized in that, include: The registration process, the authentication process, and the update process. The registration process includes the following steps: Step A1: The satellite sends its own identity ID to the nearest ground station server, and the ground station server records the timestamp of receipt as the first timestamp; Step A2: The ground station server generates two random numbers, hashes the timestamps of the generated random numbers, and combines them with the corresponding random numbers to generate two encryption keys, wherein the timestamps of the generated random numbers are used as the second timestamp; Step A3: The ground station server generates ciphertext by hashing the random number and two timestamps, and combines it with the satellite's identity ID to generate a dynamic identity key; Step A4: The ground station server sends two encryption keys and two timestamps to the satellite; the satellite uses the two encryption keys and two timestamps to deduce two random numbers. Step A5: The ground station server generates a shared key based on the two timestamps and the dynamic identity key, and shares the shared key and the two encryption keys between servers to complete the registration process; The certification process includes the following steps: Step B1: The satellite generates a dynamic password for the satellite based on the random number from the satellite terminal, the current time, and the identity ID through hash processing; Step B2: The satellite sends the satellite-side dynamic password, current time, and current dynamic identity key to the nearest ground station server; Step B3: The ground station server generates random numbers for the two authentication stages based on the two current encryption keys and two current timestamps on the server side, combined with hash processing. Step B4: The ground station server generates the ciphertext for the authentication phase, the satellite's identity ID, and the server-side dynamic password sequentially based on the random numbers from the two authentication phases and the two current timestamps. Step B5: Authentication is successful when the dynamic password on the server side matches the dynamic password on the satellite side; The update process includes: Once authentication is successful, both the ground station server and the satellite will update the first and second timestamps through hash processing, and gradually update the two encryption keys, ciphertext, and dynamic identity key based on the updated timestamps. The ground station server will then share the updated data between servers.

2. The satellite communication method based on dynamic password as described in claim 1, characterized in that, In step A2, the formulas for generating the two encryption keys are as follows: R1 F =r1 F ⊕h(T second ); R2 F =r2 F ⊕h(T first ); In the formula, R1 F R2 F Two encryption keys generated for the ground station server; r1 F r2 F Two random numbers generated for the ground station server; T first This is the current first timestamp; T second `h()` is the current second timestamp; `h()` is the hash function; `⊕` is the XOR operator.

3. The satellite communication method based on dynamic password as described in claim 1, characterized in that, In step A3, the formula for generating the ciphertext is: H F =h(r1 F ||T first ||h(T second )); The formula for generating the dynamic identity key is: P F =H F ⊕ID; In the formula, H F Ciphertext generated for the ground station server; r1 F The first random number generated for the ground station server; T first This is the current first timestamp; T second The current second timestamp; h() is the hash function; || is the concatenation operator; ⊕ is the XOR operator; ID is the satellite identity ID; P F A dynamic identity key generated for the ground station server.

4. The satellite communication method based on dynamic password as described in claim 1, characterized in that, In step A5, the formula for generating the shared key is: Pw F =T first ||T second ||P F ; In the formula, T first This is the current first timestamp; T second The current second timestamp; || is the concatenation operator; P F A dynamic identity key generated for the ground station server.

5. The satellite communication method based on dynamic password as described in claim 1, characterized in that, In step B1, the formula for generating the dynamic password on the satellite end is: Pt W =h(ID||r2 W ||T); In the formula, Pt W The dynamic password generated by the satellite; ID is the satellite identity ID; r2 W The second random number is derived by the satellite from the current encryption key; T is the current time; || is the concatenation operator; h() is the hash function.

6. The satellite communication method based on dynamic password as described in claim 1, characterized in that, In step B3, the formula for generating random numbers for the two authentication stages is as follows: r1’=R1 F ⊕h(T second );r2’=R2 F ⊕h(T first ); The formula for calculating ciphertext is: H’=h(r1’||T first ||h(T second )); The formula for generating a satellite identity ID is: ID’=P W ⊕H’; The formula for generating a dynamic password on the server side is: Pt'=h(ID'||r2'||T); In the formula, r1' and r2' are random numbers for the two authentication stages; R1 F R2 F T represents the current encryption keys for the two servers; first This is the current first timestamp; T second The current second timestamp; h() is the hash function; H' is the calculated ciphertext; ID' is the calculated satellite identity ID; T is the current time; || is the concatenation operator; ⊕ is the XOR operator; P W 'Pt' is the current dynamic identity key on the satellite side; 'Pt' is the dynamic password on the server side.

7. The satellite communication method based on dynamic password as described in claim 1, characterized in that, The specific formula for updating the first and second timestamps through hash processing during the update process is as follows: T first =h(T first );T second =h(T second ); In the formula, T first First timestamp; T second is the second timestamp; h() is the hash function.

Images