A method and device for NTN broadcast OTA security based on PDCP key hierarchy

Abstract

The application discloses an NTN broadcast OTA security method and device based on a PDCP key hierarchy structure, and belongs to the technical field of OTA. The application uses an existing PDCP encryption key K_pdcp of a terminal as a basic key, and constructs a temporary protection system based on a one-time global key for single OTA upgrade. The satellite end only needs to encrypt the OTA firmware package once, so that the resource bottleneck is completely solved. In addition, the decryption key of each terminal is unique, and the security is equivalent to that of unicast PDCP. Meanwhile, the existing 3GPP security system is completely reused, and the engineering implementation cost is extremely low.

Description

Technical Field

[0001] This invention relates to the field of OTA technology, and in particular to an NTN broadcast OTA security method and apparatus based on the PDCP key hierarchy structure. Background Technology

[0002] With the release of 3GPP Rel-17 / 18, non-geostationary orbit (NTN) networks have become an important component of the 5G / 6G communication architecture. NTN networks provide services to ground terminals via low-Earth orbit satellites, high-Earth orbit satellites, or high-altitude platforms (HAPS), offering wide coverage and serving a massive number of terminals (a single satellite can cover millions of terminals). OTA (Over-The-Air) firmware upgrades are a core aspect of NTN terminal maintenance, used to fix security vulnerabilities, update features, and optimize performance.

[0003] In the 3GPP security architecture, PDCP (Packet Data Convergence Protocol) layer encryption is the core mechanism for ensuring data transmission security. According to 3GPP TS 33.501, each terminal independently generates a unique PDCP encryption key K_pdcp with the network through the 5GAKA authentication process, and uses ZUC-128 / 256 or AES-128 / 256 algorithms to encrypt and protect the integrity of data packets. This mechanism provides sufficient security in unicast point-to-point data transmission scenarios.

[0004] In NTN scenarios, when satellites need to simultaneously push OTA firmware upgrade packages to a large number of terminals (such as millions), the existing technical system mainly has the following two solutions:

[0005] Option A: Standard PDCP unicast encryption

[0006] The satellite uses each terminal's independent PDCP key K_pdcp to encrypt OTA packets and transmit them via a unicast channel. For N terminals, the satellite needs to perform N encryption operations and transmit N copies of the OTA packets. For example, with 1 million terminals and 100MB OTA packets, the total bandwidth consumption is 100TB.

[0007] During batch OTA updates, the resource consumption of unicast PDCP encryption increases linearly, which is not feasible in large-scale terminal scenarios.

[0008] 3GPP TS 33.501 explicitly stipulates that each terminal's PDCP key is unique, therefore the computational cost and bandwidth consumption of unicast encryption are both O(N). Given the engineering constraint that the downlink bandwidth of a single beam for low-Earth orbit satellites is only a few hundred Mbps, this linear increase makes large-scale OTA pushes impractical. This forces the industry to adopt a compromise solution of "broadcast + globally fixed key," namely, Scheme B described below.

[0009] Option B: Broadcast + Global Fixed Key

[0010] The satellite encrypts the OTA packet once using a globally fixed key and transmits it to all terminals via a broadcast channel. All terminals use the same key to decrypt it. This globally fixed key scheme poses a systemic security risk of "one breach leading to all breaches."

[0011] Currently, the industry commonly uses global fixed-key encryption in large-scale OTA scenarios, where all terminals share the same key, which is pre-stored in the terminals. The security of this scheme relies entirely on the confidentiality of this global key. Once any terminal is cracked by an attacker (through physical attacks, firmware reverse engineering, etc.) and obtains its stored OTA key, not only will the plaintext of the current OTA firmware be exposed, but the plaintext of subsequent OTA firmware will also be at risk.

[0012] While 3GPP TS 33.246 defines the key system for MBMS (Multimedia Broadcast Multicast Service) using a hierarchical key structure of MUK→MSK→MTK, this system is specifically designed for real-time streaming media broadcasting. Its key distribution relies on the GBA / GMBMS process (refer to 3GPP TS 33.220), typically requiring terminals to initially acquire and periodically update the service key (MSK) through unicast interaction. This makes the solution unsuitable for large-scale NTN firmware upgrade (OTA) scenarios—scenarios requiring minimal on-board interaction from terminals, and even supporting secure reception and decryption of upgrade packages by terminals in a purely offline receiving state. Furthermore, as an independent service layer security framework, this system fails to utilize the PDCP security context (K_pdcp) already established by NTN terminals at the access layer. This means that a separate authentication and key management system is still required, and the complexity of on-board implementation cannot be reduced by reusing existing security materials.

[0013] In the existing 3GPP security architecture, the PDCP layer key system serves unicast data protection, while the security of broadcast / multicast services is handled by an independent MBMS key system. The two belong to non-overlapping security domains and follow different key generation, distribution, and update processes.

[0014] Therefore, in the NTN scenario, when the satellite needs to push OTA firmware upgrade packages to a large number of terminals (such as millions) at the same time, how to design a broadcast OTA key management method without modifying the existing 3GPP PDCP security system so that: (1) the satellite only needs to encrypt the OTA firmware package once, and the amount of computation is independent of the number of terminals; (2) the decryption key of each terminal is still unique, and the security is equivalent to unicast PDCP encryption; is becoming a pain point that the industry urgently needs to solve. Summary of the Invention

[0015] To address the problems of high computational resource requirements or poor security in existing OTA (Over-The-Air) technologies, the present invention aims to provide an NTN broadcast OTA security method and apparatus based on the PDCP key hierarchy structure, so as to at least partially solve the above problems.

[0016] To achieve the above objectives, the technical solution of the present invention is as follows:

[0017] In a first aspect, the present invention provides an NTN broadcast OTA security method based on a PDCP key hierarchy structure, the method being applied to network-side equipment in a satellite or associated gateway station, characterized in that the method includes the following steps:

[0018] In response to the OTA upgrade command, the network-side device generates a one-time global OTA key K_ota;

[0019] The network-side device uses the global OTA key K_ota to encrypt the OTA firmware package, generating OTA ciphertext C_ota;

[0020] The network-side equipment obtains the unique PDCP encryption key K_pdcp_i generated at the access layer for each terminal in the target upgrade group;

[0021] For each terminal in the target upgrade group, the network-side device uses the terminal's PDCP encryption key K_pdcp_i or its derived key to encrypt the global OTA key K_ota, generating an encryption key material Su_ue_i that is uniquely corresponding to the terminal.

[0022] The network-side device sends a broadcast message through a broadcast channel. The broadcast message includes the OTA ciphertext C_ota and a mapping table between the identifiers of each terminal in the target upgrade group and the corresponding encryption key material S_ue_i.

[0023] This enables the target terminal of this OTA upgrade to determine the corresponding encryption key material S_ue_i based on its own terminal identifier and the mapping table after receiving the broadcast message, and to decrypt the encryption key material S_ue_i using the PDCP encryption key K_pdcp_i stored locally on the terminal to obtain the global OTA key K_ota, and then decrypt the OTA ciphertext C_ota to obtain the OTA firmware package required for the upgrade.

[0024] In some preferred embodiments, for each terminal in the target upgrade group, the network-side device uses the terminal's PDCP encryption key K_pdcp_i or its derived key to encrypt the global OTA key K_ota, generating corresponding ciphertext and a first GCM authentication tag uniquely corresponding to the terminal, and concatenates the ciphertext and the first GCM authentication tag to form the encryption key material Su_ue_i;

[0025] The first GCM authentication tag is used to verify the integrity of the ciphertext during the decryption process after the terminal receives the encryption key material S_ue_i. If the verification is successful, the ciphertext is decrypted and the global OTA key K_ota is obtained; otherwise, the broadcast information is stopped and discarded.

[0026] In some preferred embodiments, when the network-side device uses the global OTA key K_ota to encrypt the OTA firmware package, it also generates a second GCM authentication tag;

[0027] The second GCM authentication tag is used to enable the terminal to ensure the integrity of the OTA ciphertext C_ota by verifying the second GCM authentication tag when the terminal decrypts the OTA ciphertext C_ota.

[0028] Secondly, the present invention also provides an NTN broadcast OTA security device based on a PDCP key hierarchy structure, comprising:

[0029] The global OTA key generation module is used to generate a one-time global OTA key K_ota;

[0030] An OTA packet encryption module is used to encrypt OTA firmware packets using the global OTA key K_ota to generate OTA ciphertext C_ota;

[0031] The terminal encryption key material generation module is used to read the unique PDCP encryption key K_pdcp_i of each terminal in the target upgrade group from the local key storage, and to encrypt the global OTA key K_ota using the PDCP encryption key K_pdcp_i or its derived key of each terminal to generate encryption key material Su_ue_i uniquely corresponding to each terminal.

[0032] The broadcast transmission module is used to assemble the OTA ciphertext C_ota and the mapping table between the identifiers of each terminal in the target upgrade group and the corresponding encryption key material S_ue_i into a broadcast message, and send it through the broadcast channel.

[0033] Thirdly, the present invention also provides an NTN broadcast OTA security method based on a PDCP key hierarchy structure, the method being applied to the terminal side, and the method comprising the following steps:

[0034] The terminal receives a broadcast message from the satellite, which includes the OTA ciphertext C_ota and a mapping table between the identifiers of each terminal in the target upgrade group and the corresponding encryption key material S_ue_i.

[0035] The terminal determines the corresponding encryption key material S_ue_i based on its own terminal identifier and the mapping table;

[0036] The terminal uses the locally securely stored PDCP encryption key K_pdcp_i to decrypt the encryption key material S_ue_i to obtain a one-time global OTA key K_ota;

[0037] The terminal uses the global OTA key K_ota to decrypt the OTA ciphertext C_ota, obtains the OTA firmware package, and performs the upgrade.

[0038] In some preferred embodiments, if the terminal does not find its own terminal identifier in the mapping table, then the terminal is not the target terminal for this OTA upgrade.

[0039] In some preferred embodiments, when the terminal decrypts the OTA ciphertext C_ota, it also obtains a second GCM authentication tag. The terminal first verifies the second GCM authentication tag to ensure the integrity of the OTA ciphertext C_ota, and obtains the OTA firmware package after successful verification.

[0040] Fourthly, the present invention also provides an NTN broadcast OTA security device based on a PDCP key hierarchy structure, comprising:

[0041] The broadcast receiving module is used to listen to the broadcast channel and receive broadcast messages broadcast by the satellite. The broadcast message includes the OTA ciphertext C_ota and a mapping table between the identifiers of each terminal in the target upgrade group and the corresponding encryption key material S_ue_i. The broadcast receiving module is also used to determine the corresponding encryption key material S_ue_i based on the identifier of the terminal.

[0042] The seed decryption module is used to decrypt the encryption key material S_ue_i using the PDCP encryption key K_pdcp_i securely stored locally on the terminal, to obtain a one-time global OTA key K_ota;

[0043] The OTA decryption and upgrade module is used to decrypt the OTA ciphertext C_ota using the global OTA key K_ota, obtain the OTA firmware package, and perform the upgrade.

[0044] By adopting the above technical solution, the beneficial effects of the present invention are as follows:

[0045] 1. OTA firmware packages are encrypted only once, completely resolving resource bottlenecks.

[0046] Unlike existing unicast PDCP encryption schemes that require N encryption steps, this invention only requires the satellite to perform AES-256-GCM encryption once on the OTA firmware package, and the computational load is independent of the number of terminals. For 1 million terminals and a 100MB OTA packet, the total broadcast data volume is approximately the size of the OTA ciphertext plus the size of the Sue_i list, reducing bandwidth consumption from approximately 100TB in the unicast scheme to the hundreds of megabits per second, a reduction of over 99.9%.

[0047] 2. Each terminal has a unique decryption key, providing security equivalent to unicast PDCP.

[0048] Although all terminals ultimately recover the same global decryption key K_ota, each terminal obtains K_ota through a completely different path: the satellite uses a terminal-specific PDCP encryption key K_pdcp to encrypt and protect K_ota, generating a S_ue_i that corresponds one-to-one with that terminal. Only terminals possessing the correct K_pdcp key can decrypt the corresponding S_ue_i and recover K_ota. The security level and protection strength are the same as unicast PDCP encryption.

[0049] 3. Fully reuses the existing 3GPP security architecture, resulting in extremely low engineering implementation costs.

[0050] This invention does not modify any existing protocols, but only adds a new layer of key protection logic based on the existing PDCP key. All cryptographic primitives (AES-256-GCM) are standard algorithms defined by 3GPP. The terminal side only needs to add a lightweight AES encryption and decryption module, without involving new cryptographic primitives. Attached Figure Description

[0051] Figure 1 This is a flowchart illustrating an NTN broadcast OTA security method based on a PDCP key hierarchy structure in Embodiment 1 of the present invention.

[0052] Figure 2 This is a schematic diagram of the structure of an NTN broadcast OTA security device based on a PDCP key hierarchy structure in Embodiment 2 of the present invention;

[0053] Figure 3 This is a flowchart illustrating an NTN broadcast OTA security method based on a PDCP key hierarchy structure in Embodiment 3 of the present invention.

[0054] Figure 4 This is a schematic diagram of the structure of an NTN broadcast OTA security device based on a PDCP key hierarchy structure in Embodiment 4 of the present invention. Detailed Implementation

[0055] The specific embodiments of the present invention will be further described below with reference to the accompanying drawings. It should be noted that these descriptions are for the purpose of aiding understanding the present invention, but do not constitute a limitation thereof. Furthermore, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0056] Example 1

[0057] See Figure 1 This is a flowchart illustrating an NTN broadcast OTA security method based on a PDCP key hierarchy structure provided in an embodiment of the present invention. Figure 1 The execution entity of the method shown is a network-side device deployed in an NTN satellite or associated gateway station. This network-side device can be a software and / or hardware device, and can include, but is not limited to, a single network server, a server group consisting of multiple network servers, or a cloud based on cloud computing consisting of a large number of computers or network servers. Cloud computing is a type of distributed computing, consisting of a super virtual computer composed of a group of loosely coupled computers. This embodiment does not impose any limitations on this.

[0058] The method provided in this embodiment of the invention includes the following steps:

[0059] Step S11: In response to the OTA upgrade command, the network-side device generates a one-time global OTA key K_ota.

[0060] For example, network-side devices generate a 256-bit, one-time global OTA key K_ota using a Hardware Security Module (HSM) or Hardware Random Number Generator (HRNG). This global OTA key K_ota is only valid for this upgrade and is destroyed immediately after the upgrade is complete.

[0061] Step S12: The network-side device uses the global OTA key K_ota to encrypt the OTA firmware package and generate OTA ciphertext C_ota.

[0062] For example, the network-side device uses a global OTA key K_ota to encrypt the OTA firmware package using the AES-256-GCM algorithm. This encryption step is performed only once and is independent of the number of terminals covered by this upgrade plan (i.e., the number of terminals in the target upgrade group). Of course, in other embodiments, encryption can also be performed using other algorithms specified in 3GPP TS 33.501.

[0063] Step S13: The network-side device obtains the unique PDCP encryption key K_pdcp_i generated at the access layer for each terminal in the target upgrade group.

[0064] Before the method provided in this embodiment of the invention is executed, each terminal in the target upgrade group has completed RRC access and 5G AKA authentication (defined in 3GPP TS 33.501). In addition, each terminal and the satellite have generated a unique PDCP encryption key K_pdcp (each terminal's K_pdcp is different). The satellite or its associated gateway station can know and securely store the list of K_pdcp of each terminal covered by this upgrade plan during RRC access. Therefore, the network-side equipment can obtain the unique PDCP encryption key K_pdcp_i generated by each terminal in the target upgrade group at the access layer.

[0065] Step S14: For each terminal in the target upgrade group, the network-side device uses the terminal's PDCP encryption key K_pdcp_i or its derived key to encrypt the global OTA key K_ota, generating an encryption key material S_ue_i that is uniquely corresponding to the terminal.

[0066] For example, the network-side device uses the terminal's PDCP encryption key K_pdcp_i or its derived key to encrypt the global OTA key K_ota using the AES-256-GCM algorithm. This encryption step is performed N times for N terminals. Of course, in other embodiments, encryption can also be performed using other algorithms specified in 3GPP TS 33.501.

[0067] In this step, since each terminal's PDCP encryption key K_pdcp_i is unique and therefore different, even if the same global OTA key K_ota is used to encrypt it, the generated encryption key material S_ue_i will be completely different.

[0068] The global OTA key K_ota for the encrypted object is only 32 bytes. The network-side device performs one AES-256-GCM encryption operation on each terminal, and the time taken for a single operation is only in the microsecond range. It only takes about 1 second for 1 million terminals.

[0069] Step S15: The network-side device sends a broadcast message through the broadcast channel. The broadcast message contains the OTA ciphertext C_ota and a mapping table of the identifiers of each terminal in the target upgrade group and the corresponding encryption key material S_ue_i.

[0070] The total broadcast data volume is approximately: OTA firmware package size + N × (terminal identifier length + K_ota encrypted output length), where OTA firmware package refers to OTA ciphertext C_ota, and K_ota encrypted output refers to the encryption key material Sue_i output in step S14.

[0071] In the broadcast message, the mapping table represents the identifier of each terminal in all target upgrade groups and the corresponding encryption key material S_ue_i in the form of {terminal identifier, S_ue_i}. For each terminal, its terminal identifier and PDCP encryption key K_pdcp_i are uniquely corresponding. Therefore, the PDCP encryption key K_pdcp_i and encryption key material S_ue_i of each terminal are also uniquely corresponding.

[0072] Thus, when a terminal in the target upgrade group receives the broadcast message, it can determine its own unique encryption key material S_ue_i based on its own terminal identifier and the mapping table {terminal identifier, S_ue_i}. Then, it can decrypt the encryption key material S_ue_i using the PDCP encryption key K_pdcp_i stored securely on the terminal's local storage, thereby obtaining the one-time global OTA key K_ota generated in step S11. Finally, it can decrypt the OTA ciphertext C_ota to obtain the OTA firmware package required for the upgrade.

[0073] For example, a low-Earth orbit satellite IoT system needs to simultaneously push a 50MB firmware upgrade package to 1 million marine buoy terminals. In traditional solution A, the satellite needs to encrypt 1 million times, with a total transmission bandwidth of 50TB. Based on a single beam speed of 500Mbps, this would require approximately 11.1 days of continuous transmission, which is completely impractical. In traditional solution B, the satellite encrypts once and broadcasts 50MB, with a transmission time of approximately 0.8 seconds. However, all terminals share the same key, and if any terminal is compromised, all subsequent OTA packages will be leaked across the entire network. In this invention, the satellite encrypts the OTA package once (processing 50MB), performs AES-256-GCM encryption once for each terminal to generate a terminal-specific encryption key (processing approximately 64MB, taking approximately 1 second), broadcasts a total data volume of approximately 114MB, and transmits in approximately 1.8 seconds. Each terminal has a unique decryption path, and the security is the same as unicast PDCP.

[0074] As can be seen from the embodiments of the present invention, the satellite only needs to encrypt the OTA firmware package once, and the computational load is independent of the number of terminals; the decryption key for each terminal remains unique, and the security is equivalent to unicast PDCP encryption. Furthermore, it is compatible with 3GPP standards, as shown in:

[0075] 1. Since the algorithms used in steps S12 and S14 are cryptographic primitives already adopted in the 3GPP standard (such as the encryption algorithm defined in TS 33.501 which is based on AES), the terminal side has the corresponding computing capabilities and there is no need to introduce new cryptographic primitives or dedicated hardware.

[0076] 2. This invention does not modify any PDCP or NAS layer encryption mechanism. The existing security context of the terminal (i.e., the PDCP encryption key K_pdcp) can be directly reused without changing the existing authentication and key negotiation process.

[0077] It is easy to understand that in step S14, for each terminal in the target upgrade group, the network-side device uses the terminal's PDCP encryption key K_pdcp_i or its derived key, employing the AES-256-GCM algorithm, to encrypt the global OTA key K_ota, generating corresponding ciphertext and a first GCM authentication tag uniquely corresponding to that terminal. This ciphertext and the first GCM authentication tag are then concatenated to form the encryption key material S_ue_i. The first GCM authentication tag is used to verify the integrity of the ciphertext during the decryption process after the terminal receives the encryption key material S_ue_i. If the verification passes, the ciphertext is decrypted to obtain the one-time global OTA key K_ota; otherwise, the broadcast information is stopped and discarded.

[0078] It is easy to understand that in step S12, when the network-side device uses the global OTA key K_ota and the AES-256-GCM algorithm to encrypt the OTA firmware package, it also generates a second GCM authentication tag. The second GCM authentication tag is used to ensure the integrity of the OTA ciphertext C_ota when the terminal decrypts it.

[0079] Example 2

[0080] This invention also provides an NTN broadcast OTA security device based on a PDCP key hierarchy structure, which can execute the method steps provided in Embodiment 1, such as... Figure 2 As shown, the device includes a global OTA key generation module, an OTA packet encryption module, a terminal encryption key material generation module, and a broadcast transmission module.

[0081] The global OTA key generation module is used to generate a one-time global OTA key K_ota, for example, by generating a 256-bit, one-time global OTA key K_ota through a Hardware Security Module (HSM) or a Hardware Random Number Generator (HRNG). This global OTA key K_ota is only valid for this upgrade and is destroyed immediately after the upgrade is completed.

[0082] The OTA packet encryption module is used to encrypt OTA firmware packets using the global OTA key K_ota, generating OTA ciphertext C_ota. For example, using the global OTA key K_ota, the OTA firmware packet can be encrypted using the AES-256-GCM algorithm. This encryption step is performed only once and is independent of the number of terminals covered by this upgrade plan (i.e., the number of terminals in the target upgrade group). Of course, other algorithms specified in 3GPP TS 33.501 can also be used for encryption.

[0083] The terminal encryption key material generation module is used to read the unique PDCP encryption key K_pdcp_i for each terminal in the target upgrade group from the local key storage, and to encrypt the global OTA key K_ota using the PDCP encryption key K_pdcp_i or its derived key for each terminal, generating encryption key material Su_ue_i uniquely corresponding to each terminal. For example, the global OTA key K_ota can be encrypted using the AES-256-GCM algorithm. For N terminals, this encryption process is performed N times. Of course, other algorithms specified in 3GPP TS 33.501 can also be used for encryption.

[0084] Since each terminal has a unique PDCP encryption key K_pdcp_i, the generated encryption key material S_ue_i will be completely different even when using it to encrypt the same global OTA key K_ota.

[0085] The broadcast transmission module is used to assemble the OTA ciphertext C_ota and the mapping table of the identifiers of each terminal in the target upgrade group and the corresponding encryption key material S_ue_i into a broadcast message, and send it through the NTN broadcast channel.

[0086] It is easy to understand that when the terminal encryption key material generation module uses the PDCP encryption key K_pdcp_i or its derived key for each terminal and employs the AES-256-GCM algorithm to encrypt the global OTA key K_ota, it generates corresponding ciphertext and a first GCM authentication tag uniquely corresponding to that terminal. This ciphertext and the first GCM authentication tag are then concatenated to form the encryption key material S_ue_i. The first GCM authentication tag is used by the terminal to verify the integrity of the ciphertext during the decryption process after receiving the encryption key material S_ue_i. If the verification passes, the ciphertext is decrypted to obtain the one-time global OTA key K_ota; otherwise, the broadcast information is stopped and discarded.

[0087] Another easily understood aspect is that the OTA packet encryption module uses a global OTA key K_ota and the AES-256-GCM algorithm to encrypt the OTA firmware packet, while also generating a second GCM authentication tag. This second GCM authentication tag is used by the terminal to ensure the integrity of the OTA ciphertext C_ota when decrypting it.

[0088] Example 3

[0089] This invention also provides an NTN broadcast OTA security method based on the PDCP key hierarchy structure, which is applied to the terminal side, such as... Figure 3 As shown, the method includes the following steps.

[0090] Step S21: The terminal receives a broadcast message from the satellite, which includes the OTA ciphertext C_ota and a mapping table of the identifiers of each terminal in the target upgrade group and the corresponding encryption key material S_ue_i.

[0091] Step S22: The terminal determines the corresponding encryption key material S_ue_i based on its own terminal identifier and mapping relationship table.

[0092] If the terminal finds its own terminal identifier in the mapping table, it continues with the following steps. If the terminal does not find its own terminal identifier in the mapping table, it means that the terminal is not the target terminal for this OTA upgrade, and the terminal ignores the broadcast message it received and stops.

[0093] Step S23: The terminal uses the locally securely stored PDCP encryption key K_pdcp_i to decrypt the encryption key material S_ue_i to obtain a one-time global OTA key K_ota.

[0094] The one-time global OTA key K_ota is randomly generated by the satellite side, for example, by generating a 256-bit one-time global OTA key K_ota through a hardware security module (HSM) or a hardware random number generator (HRNG). This global OTA key K_ota is only valid for this upgrade.

[0095] On the satellite side, the terminal uses its PDCP encryption key K_pdcp_i or its derived key to encrypt the global OTA key K_ota using the AES-256-GCM algorithm. Therefore, on the terminal side, the terminal can use the same algorithm to decrypt it.

[0096] On the satellite side, when encrypting the global OTA key K_ota using the terminal's PDCP encryption key K_pdcp_i or its derived key and the AES-256-GCM algorithm, it generates corresponding ciphertext and a first GCM authentication tag uniquely corresponding to the terminal. The ciphertext and the first GCM authentication tag are then concatenated to form the encryption key material S_ue_i. Therefore, on the terminal side, upon receiving the encryption key material S_ue_i, the terminal verifies the integrity of the ciphertext using the first GCM authentication tag. If the verification passes, the ciphertext is decrypted to obtain the global OTA key K_ota; otherwise, the broadcast information is stopped and discarded.

[0097] Step S24: The terminal uses the global OTA key K_ota to decrypt the OTA ciphertext C_ota, obtains the OTA firmware package, and performs the upgrade.

[0098] On the satellite side, the OTA firmware package is encrypted using the global OTA key K_ota and the AES-256-GCM algorithm. Therefore, on the terminal side, the terminal can decrypt it using the same algorithm.

[0099] On the satellite side, when encrypting the OTA firmware package using the global OTA key and the AES-256-GCM algorithm K_ota, a second GCM authentication tag is also generated. Therefore, on the terminal side, when the terminal decrypts the OTA ciphertext C_ota, the terminal first verifies the second GCM authentication tag to ensure the integrity of the OTA ciphertext C_ota. After successful verification, the OTA firmware package is obtained.

[0100] Example 4

[0101] This invention also provides an NTN broadcast OTA security device based on a PDCP key hierarchy structure, which can execute the method steps provided in Embodiment 3, such as... Figure 4 As shown, the device includes a broadcast receiving module, a seed decryption module, and an OTA decryption and upgrade module.

[0102] The broadcast receiving module is used to listen to the NTN broadcast channel and receive broadcast messages broadcast by the satellite. The broadcast message contains the OTA ciphertext C_ota and a mapping table of the identifiers of each terminal in the target upgrade group and the corresponding encryption key material S_ue_i. The broadcast receiving module is also used to determine the corresponding encryption key material S_ue_i based on the identifier of the terminal and then transmit it to the seed decryption module.

[0103] If the broadcast receiving module finds its terminal identifier in the mapping table, the following modules continue to execute the corresponding content. If the broadcast receiving module does not find its terminal identifier in the mapping table, it means that the terminal is not the target terminal for this OTA upgrade, the received broadcast message is ignored, and the process stops.

[0104] The seed decryption module is used to decrypt the encryption key material S_ue_i using the PDCP encryption key K_pdcp_i stored securely on the terminal, to obtain a one-time global OTA key K_ota, which is then transmitted to the OTA decryption and upgrade module.

[0105] The one-time global OTA key K_ota is randomly generated by the satellite side, for example, by generating a 256-bit one-time global OTA key K_ota through a hardware security module (HSM) or a hardware random number generator (HRNG). This global OTA key K_ota is only valid for this upgrade.

[0106] On the satellite side, it uses the terminal's PDCP encryption key K_pdcp_i or its derived key to encrypt the global OTA key K_ota using the AES-256-GCM algorithm. Therefore, the seed decryption module also uses the same algorithm for decryption.

[0107] On the satellite side, when encrypting the global OTA key K_ota using the terminal's PDCP encryption key K_pdcp_i or its derived key and the AES-256-GCM algorithm, it generates corresponding ciphertext and a first GCM authentication tag uniquely corresponding to the terminal. The ciphertext and the first GCM authentication tag are then concatenated to form the encryption key material S_ue_i. Therefore, after the seed decryption module receives the encryption key material S_ue_i, it verifies the integrity of the ciphertext using the first GCM authentication tag. If the verification passes, the ciphertext is decrypted to obtain the global OTA key K_ota; otherwise, the broadcast is stopped and the broadcast information is discarded.

[0108] The OTA decryption and upgrade module is used to decrypt the OTA ciphertext C_ota using the global OTA key K_ota, obtain the OTA firmware package, and perform the upgrade.

[0109] On the satellite side, it uses the global OTA key K_ota to encrypt the OTA firmware package using the AES-256-GCM algorithm. Therefore, the OTA decryption and upgrade module also uses the same algorithm for decryption.

[0110] On the satellite side, when encrypting the OTA firmware package using the global OTA key K_ota and the AES-256-GCM algorithm, a second GCM authentication tag is also generated. Therefore, when the OTA decryption and upgrade module decrypts the OTA ciphertext C_ota, it also obtains the second GCM authentication tag. The OTA decryption and upgrade module first verifies the second GCM authentication tag to ensure data integrity, and obtains the OTA firmware package after successful verification.

[0111] Compared with existing technical solutions, the method and apparatus provided by the present invention have the following advantages:

[0112] 1. Safety advantages

[0113] Because each terminal has a unique PDCP encryption key K_pdcp, the encryption key material Su_ue_i generated by the satellite after encrypting K_ota using each terminal's K_pdcp with AES is also completely different. Even if an attacker intercepts the broadcast content, without the corresponding terminal's PDCP encryption key K_pdcp, they cannot decrypt it using AES to obtain the global OTA key K_ota. Its security and protection strength are equivalent to unicast PDCP encryption. Furthermore, the probability of PDCP encryption being cracked is very low; in current technology, the security of all communication data (not just OTA firmware) relies on PDCP encryption.

[0114] Secondly, its security no longer relies on a global key. In existing technologies, the global key is usually stored permanently in the terminal's storage (such as hard drive or Flash) to ensure its availability after power failure, but this makes it easy to extract. In contrast, the PDCP encryption key K_pdcp only exists in memory during the current PDU session and is not written to permanent storage. It is regenerated every time the network is reconnected and is lost upon power failure, significantly reducing the key's exposure window.

[0115] Even assuming that the PDCP encryption key K_pdcp of a certain terminal is cracked within the upgrade window, this solution can still minimize the damage: First, the attacker can only decrypt the current global OTA key K_ota, thus decrypting the firmware ciphertext. However, since each OTA uses a different global OTA key K_ota, subsequent upgrades are unaffected. Second, the attacker cannot obtain the PDCP encryption key K_pdcp of other terminals, thus not jeopardizing the long-term identity keys and other communication security of other terminals. The only remaining risk is that the confidentiality of the current OTA firmware may be compromised, but this has been reduced from the "permanent, one-time breach, all breach" risk of traditional solutions to a "single, temporary loss of confidentiality."

[0116] 2. Advantages of satellite-side computational complexity

[0117] The computational load on the satellite end is divided into two parts:

[0118] (1) OTA packet encryption: This invention performs AES-256-GCM encryption on OTA packets only once, and the computational load is independent of the number of terminals;

[0119] (2) S_ue generation: Perform AES-256-GCM encryption operation once for each terminal, but the encryption object is only the 32-byte global OTA key K_ota. The operation takes microseconds, and only about 1 second for 1 million terminals.

[0120] 3. Advantages of compatibility with 3GPP standards

[0121] The invention is fully compatible with existing 3GPP standards, specifically in the following ways:

[0122] (1) This invention does not modify any PDCP layer or NAS layer encryption mechanism. The existing security context of the terminal (i.e. PDCP encryption key K_pdcp) can be directly reused without changing the existing authentication and key negotiation process.

[0123] (2) The encryption encapsulation of the encryption key K_ota for the OTA ciphertext in the scheme adopts the AES-256-GCM algorithm. This algorithm is a cryptographic primitive that has been adopted in the 3GPP standard (such as the encryption algorithm defined in TS 33.501, which is based on AES). The terminal side has the corresponding computing power and there is no need to introduce new cryptographic primitives or dedicated hardware.

[0124] In summary, the technical solution provided by this invention breaks through the existing technical barriers and can identify the inherent connection between the unique PDCP encryption key K_pdcp for each terminal in the PDCP unicast domain and the group key protection required in the broadcast OTA domain, thus building a "key reuse bridge" between the two. This cross-domain unified design enables the technical solution provided by this invention to simultaneously satisfy the following three constraints: (1) the number of encryption times at the satellite end is O(1), which is independent of the number of terminals; (2) the decryption path actually executed by each terminal is unique, and the security is equivalent to unicast PDCP; (3) the amount of modification to the existing 3GPP protocol stack is zero. These three constraints constitute mutually exclusive technical contradictions under the existing technical system: the broadcast architecture usually cannot achieve a unique security path for each terminal, the unicast architecture cannot achieve O(1) encryption efficiency, and the introduction of a new independent broadcast key system will inevitably lead to protocol modification. However, the technical solution provided by this invention, by discovering and utilizing the key dependency relationship between the unicast security domain and the broadcast security domain, simultaneously breaks through the above mutually exclusive constraints in a unified architecture, producing an unexpected combined effect.

[0125] The embodiments of the present invention have been described in detail above with reference to the accompanying drawings, but the present invention is not limited to the described embodiments. For those skilled in the art, various changes, modifications, substitutions, and variations can be made to these embodiments without departing from the principles and spirit of the present invention, and these variations still fall within the protection scope of the present invention.

Claims

1. A secure over-the-air (OTA) broadcast method for NTN broadcasts based on a PDCP key hierarchy, wherein the method is applied to network-side equipment in a satellite or associated gateway station, characterized in that... The method includes the following steps: In response to the OTA upgrade command, the network-side device generates a one-time global OTA key K_ota; The network-side device uses the global OTA key K_ota to encrypt the OTA firmware package, generating OTA ciphertext C_ota; The network-side equipment obtains the unique PDCP encryption key K_pdcp_i generated at the access layer for each terminal in the target upgrade group; For each terminal in the target upgrade group, the network-side device uses the terminal's PDCP encryption key K_pdcp_i or its derived key to encrypt the global OTA key K_ota, generating an encryption key material Su_ue_i that is uniquely corresponding to the terminal. The network-side device sends a broadcast message through a broadcast channel. The broadcast message includes the OTA ciphertext C_ota and a mapping table between the identifiers of each terminal in the target upgrade group and the corresponding encryption key material S_ue_i. This enables the target terminal of this OTA upgrade to determine the corresponding encryption key material S_ue_i based on its own terminal identifier and the mapping table after receiving the broadcast message, and to decrypt the encryption key material S_ue_i using the PDCP encryption key K_pdcp_i stored locally on the terminal to obtain the global OTA key K_ota, and then decrypt the OTA ciphertext C_ota to obtain the OTA firmware package required for the upgrade.

2. The method according to claim 1, characterized in that: For each terminal in the target upgrade group, the network-side device uses the terminal's PDCP encryption key K_pdcp_i or its derived key to encrypt the global OTA key K_ota, generating the corresponding ciphertext and a first GCM authentication tag uniquely corresponding to the terminal, and concatenates the ciphertext and the first GCM authentication tag to form the encryption key material Su_ue_i. The first GCM authentication tag is used to verify the integrity of the ciphertext during the decryption process after the terminal receives the encryption key material S_ue_i. If the verification is successful, the ciphertext is decrypted and the global OTA key K_ota is obtained; otherwise, the broadcast information is stopped and discarded.

3. The method according to claim 1, characterized in that: When the network-side device uses the global OTA key K_ota to encrypt the OTA firmware package, it also generates a second GCM authentication tag; The second GCM authentication tag is used to enable the terminal to ensure the integrity of the OTA ciphertext C_ota by verifying the second GCM authentication tag when the terminal decrypts the OTA ciphertext C_ota.

4. An NTN broadcast OTA security device based on a PDCP key hierarchy structure, characterized in that, include: The global OTA key generation module is used to generate a one-time global OTA key K_ota; An OTA packet encryption module is used to encrypt OTA firmware packets using the global OTA key K_ota to generate OTA ciphertext C_ota; The terminal encryption key material generation module is used to read the unique PDCP encryption key K_pdcp_i of each terminal in the target upgrade group from the local key storage, and to encrypt the global OTA key K_ota using the PDCP encryption key K_pdcp_i or its derived key of each terminal to generate encryption key material Su_ue_i uniquely corresponding to each terminal. The broadcast transmission module is used to assemble the OTA ciphertext C_ota and the mapping table between the identifiers of each terminal in the target upgrade group and the corresponding encryption key material S_ue_i into a broadcast message, and send it through the broadcast channel.

5. An NTN broadcast OTA security method based on a PDCP key hierarchy, wherein the method is applied to the terminal side, characterized in that, The method includes the following steps: The terminal receives a broadcast message from the satellite, which includes the OTA ciphertext C_ota and a mapping table between the identifiers of each terminal in the target upgrade group and the corresponding encryption key material S_ue_i. The terminal determines the corresponding encryption key material S_ue_i based on its own terminal identifier and the mapping table; The terminal uses the locally securely stored PDCP encryption key K_pdcp_i to decrypt the encryption key material S_ue_i to obtain a one-time global OTA key K_ota; The terminal uses the global OTA key K_ota to decrypt the OTA ciphertext C_ota, obtains the OTA firmware package, and performs the upgrade.

6. The method according to claim 5, characterized in that: If the terminal does not find its own terminal identifier in the mapping table, then the terminal is not the target terminal for this OTA upgrade.

7. The method according to claim 6, characterized in that: When the terminal decrypts the OTA ciphertext C_ota, it also obtains a second GCM authentication tag. The terminal first verifies the second GCM authentication tag to ensure the integrity of the OTA ciphertext C_ota. After successful verification, the terminal obtains the OTA firmware package.

8. An NTN broadcast OTA security device based on a PDCP key hierarchy structure, characterized in that, include: The broadcast receiving module is used to listen to the broadcast channel and receive broadcast messages broadcast by the satellite. The broadcast message includes the OTA ciphertext C_ota and a mapping table between the identifiers of each terminal in the target upgrade group and the corresponding encryption key material S_ue_i. The broadcast receiving module is also used to determine the corresponding encryption key material S_ue_i based on the identifier of the terminal. The seed decryption module is used to decrypt the encryption key material S_ue_i using the PDCP encryption key K_pdcp_i securely stored locally on the terminal, to obtain a one-time global OTA key K_ota; The OTA decryption and upgrade module is used to decrypt the OTA ciphertext C_ota using the global OTA key K_ota, obtain the OTA firmware package, and perform the upgrade.

Images