Certification methods, apparatus, equipment, storage media and program products

Abstract

This invention discloses an authentication method, apparatus, device, storage medium, and program product. The method includes: receiving an authentication request sent by a terminal device, the authentication request including a first identifier of the terminal device; querying a plurality of pre-configured first authentication vectors according to the first identifier; wherein the plurality of first authentication vectors are generated by a ground core network based on first information, the first information including a first sequence number of the ground core network, a second identifier of the satellite group to which the first satellite belongs, a random number, and a first key between the terminal device and the ground core network; and authenticating the terminal device according to the plurality of first authentication vectors. This invention, by pre-setting the first authentication vectors on the satellite, enables direct identity authentication between the terminal device and the satellite, effectively reducing signaling interaction between the satellite and the ground core network, reducing authentication latency between the mobile device and the satellite, achieving seamless global communication coverage, and adapting to 5G network element uplink scenarios.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and in particular to an authentication method, apparatus, device, storage medium, and program product. Background Technology

[0002] For the converged networking of satellite and mobile communications, existing technologies propose a core network (CN) on-board mode, and draw the following conclusions regarding the satellite store-and-forward mode: whether to deploy a complete CN on the satellite or adopt a separate Mobility Management Entity (MME) architecture depends on the operator's deployment. If a separate MME architecture is adopted, the Home Subscriber Server (HSS) is located on the ground, and the MME function is divided into two parts: on-board MME—the MME portion on the satellite, and terrestrial MME—the MME portion on the terrestrial network. If a complete CN is deployed on the satellite, then the evolved Node B (eNB), MME, Serving Gateway (SGW), Packet Data Network Gateway (PGW), HSS, Evolved Serving Mobile Location Center (E-SMLC), and Short Message Service Center (SMSC) will all be placed on each satellite.

[0003] However, the aforementioned solutions are designed for 4G networks, and there is currently no research on the architecture of 5G network elements on satellites. Furthermore, in traditional 5G Authentication and Key Agreement (5GAKA) authentication schemes, when a mobile device performs 5G AKA authentication with its home network, the home network can only generate one 5G first authentication vector for the user equipment (UE) at a time, based on parameters such as the shared key, random number, and sequence number. Therefore, in scenarios where the Access and Mobility Management Function (AMF) is deployed to satellites, each time the UE accesses a new satellite, the participation of the terrestrial home network is required to generate the corresponding 5G first authentication vector and achieve identity authentication between the UE and the satellite. Because satellite-to-ground latency is significantly higher than terrestrial latency, and the satellite needs to interact frequently with the terrestrial core network, the authentication latency between the mobile device and the satellite is substantial, making it unsuitable for scenarios where 5G network elements are deployed to satellites. Summary of the Invention

[0004] To address the problems existing in the prior art, embodiments of the present invention provide an authentication method, apparatus, device, storage medium, and program product, which can effectively reduce signaling interaction between satellite and ground core network, reduce authentication latency between mobile devices and satellite, and adapt to 5G network element uplink scenarios.

[0005] In a first aspect, embodiments of the present invention provide an authentication method applied to a first network element on a first satellite, comprising:

[0006] Receive an authentication request sent by a terminal device, the authentication request including a first identifier of the terminal device;

[0007] Based on the first identifier, a plurality of pre-configured first authentication vectors are queried; wherein, the plurality of first authentication vectors are generated by the ground core network based on first information, the first information including the first serial number of the ground core network, the second identifier of the satellite group to which the first satellite belongs, a random number, and a first key between the terminal device and the ground core network;

[0008] The terminal device is authenticated based on the plurality of first authentication vectors.

[0009] As an improvement to the above scheme, the first authentication vector includes: the random number, the authentication token, and the first hash expected response value.

[0010] As an improvement to the above solution, the method further includes:

[0011] Receive the second information sent by the ground core network;

[0012] The second information is triggered when the ground core network predicts, based on the trajectory information of the satellites in the satellite group, that the first satellite is the satellite that the terminal device will access next. The second information includes the plurality of first authentication vectors, the first identifier of the terminal device, and the plurality of second keys.

[0013] As an improvement to the above scheme, the step of authenticating the terminal device based on the plurality of first authentication vectors includes:

[0014] A target authentication vector is determined based on the plurality of first authentication vectors; wherein the target authentication vector is the first unused first authentication vector selected sequentially from the plurality of first authentication vectors.

[0015] The terminal device is authenticated based on the target authentication vector.

[0016] As an improvement to the above scheme, the step of authenticating the terminal device based on the target authentication vector includes:

[0017] Extract the random number and authentication token from the target authentication vector;

[0018] Send third information to the terminal device; wherein the third information includes a random number and an authentication token in the target authentication vector; the third information is used to instruct the terminal device to verify the second sequence number and the first message verification code obtained based on the random number and the authentication token, and to complete the authentication of the first satellite after the verification is successful.

[0019] As an improvement to the above scheme, the second serial number is a hidden first serial number recovered from the authentication token based on the third key; the third key is calculated based on the random number; the first message verification code is generated based on the first key, the second serial number, the first identifier, and the random number.

[0020] As an improvement to the above scheme, the conditions for the second serial number and the first message verification code to pass the verification include:

[0021] The first message verification code is consistent with the second message verification code in the authentication token;

[0022] The third serial number stored in the terminal device is less than the second serial number.

[0023] As an improvement to the above solution, the method further includes:

[0024] The terminal sends a fourth message; wherein the fourth message is triggered by the terminal device after completing authentication of the first satellite; the fourth message includes an authentication response value.

[0025] Calculate the second hash expected response value based on the authentication response value and the random number;

[0026] The expected response value of the second hash is verified, and the authentication of the terminal device is completed after the verification is successful.

[0027] As an improvement to the above scheme, the authentication response value is calculated based on the first key, the second identifier, and the random number.

[0028] As an improvement to the above scheme, the conditions for the first expected hash response value to pass the verification include:

[0029] The first expected hash response value in the target authentication vector is consistent with the second expected hash response value.

[0030] As an improvement to the above solution, the method further includes:

[0031] Delete the target authentication vector from the plurality of first authentication vectors;

[0032] Send a fifth message to the second satellite; wherein the second satellite is the next satellite in the satellite group that the terminal device will access after the first satellite; the fifth message includes a first authentication vector remaining after deleting the target authentication vector and a first identifier of the terminal device, so that the second satellite authenticates the terminal device based on the remaining first authentication vector.

[0033] As an improvement to the above solution, the method further includes:

[0034] The sixth message is periodically sent to the ground core network;

[0035] The sixth information includes at least one authentication response value that has been authenticated within the period and ordered according to the authentication sequence; the sixth information is used to instruct the ground core network to compare the received at least one authentication response value with the expected response value stored locally; if there is an expected response value that matches at least one authentication response value, the authentication process corresponding to the corresponding authentication response value is determined to be successful.

[0036] Secondly, embodiments of the present invention provide an authentication method applied to a terrestrial core network, comprising:

[0037] Based on the first information, multiple first authentication vectors are generated; wherein, the first information includes the serial number of the ground core network, the second identifier of the satellite group, a random number, and the first key between the terminal device and the ground core network;

[0038] Based on the trajectory information of the satellites in the satellite group, predict the first satellite that the terminal device will connect to next;

[0039] The second information is sent to the first satellite; wherein the second information includes the plurality of first authentication vectors, so that the first satellite authenticates the terminal device according to the plurality of first authentication vectors.

[0040] As an improvement to the above scheme, the first authentication vector includes: the random number, the authentication token, and the first hash expected response value.

[0041] As an improvement to the above solution, the method further includes:

[0042] Receive a first message sent by the terminal device; the first message includes a third identifier of the terminal device;

[0043] Calculate the first identifier of the terminal device based on the current timestamp and the third identifier;

[0044] A second message is sent to the terminal device; the second message includes the first identifier.

[0045] As an improvement to the above scheme, the step of generating multiple first authentication vectors based on the first information includes:

[0046] Generate a random number;

[0047] A second authentication vector is generated based on the currently generated random number, the first serial number of the ground core network, the second identifier of the satellite group to which the first satellite belongs, and the first key between the terminal device and the ground core network;

[0048] Generate the next random number, and generate a new second authentication vector based on the next random number, until the number of generated second authentication vectors meets the preset number threshold condition;

[0049] The plurality of first authentication vectors are generated based on the generated plurality of second authentication vectors.

[0050] As an improvement to the above scheme, the step of calculating the first identifier of the terminal device based on the current timestamp and the third identifier includes:

[0051] Decrypt the third identifier to obtain the fourth identifier;

[0052] The first identifier of the terminal device is calculated based on the current timestamp and the fourth identifier.

[0053] As an improvement to the above scheme, the step of generating a second authentication vector based on the currently generated random number, the first sequence number of the ground core network, the second identifier of the satellite group to which the first satellite belongs, and the first key between the terminal device and the ground core network includes:

[0054] The second message verification code is calculated based on the random number, the first serial number of the ground core network, the second identifier of the satellite group to which the first satellite belongs, and the first key between the terminal device and the ground core network;

[0055] Generate a third key based on the random number and the first key;

[0056] An authentication token is generated based on the third key, the first serial number, and the second message verification code.

[0057] Generate a fourth key and a fifth key based on the random number and the first key;

[0058] Generate the expected response value based on the random number, the first key, and the second identifier;

[0059] A sixth key is generated based on the first key, the second identifier, the third key, the first serial number, the fourth key, and the fifth key;

[0060] A second authentication vector is generated based on the random number, the authentication token, the expected response value, and the sixth key.

[0061] As an improvement to the above scheme, the step of generating the plurality of first authentication vectors based on the generated plurality of second authentication vectors includes:

[0062] For each of the second authentication vectors, a first hash expected response value is calculated based on the expected response value in the second authentication vector and the random number.

[0063] Calculate the second key based on the second identifier, the first key, and the sixth key in the second authentication vector;

[0064] A first authentication vector is generated based on the random number, the authentication token in the second authentication vector, and the first hash expected response value.

[0065] As an improvement to the above solution, the method further includes:

[0066] Receive a sixth message periodically transmitted by any satellite in the satellite group; wherein the sixth message includes at least one authentication response value that has been authenticated by the corresponding satellite within the periodic time and is ordered according to the authentication sequence;

[0067] Compare at least one of the received authentication response values ​​with the expected response value stored locally;

[0068] If there is an expected response value that matches at least one of the authentication response values, the authentication process corresponding to the corresponding authentication response value is determined to be successful.

[0069] Thirdly, embodiments of the present invention provide an authentication device applied to a first network element on a first satellite, comprising:

[0070] A request receiving module is used to receive an authentication request sent by a terminal device, wherein the authentication request includes a first identifier of the terminal device;

[0071] The query module is used to query a plurality of pre-configured first authentication vectors based on the first identifier; wherein the plurality of first authentication vectors are generated by the ground core network based on first information, the first information including the first serial number of the ground core network, the second identifier of the satellite group to which the first satellite belongs, a random number, and a first key between the terminal device and the ground core network;

[0072] The first authentication module is used to authenticate the terminal device based on the plurality of first authentication vectors.

[0073] Fourthly, embodiments of the present invention provide an authentication device applied to a terrestrial core network, comprising:

[0074] An authentication vector generation module is used to generate multiple first authentication vectors based on first information; wherein, the first information includes the serial number of the ground core network, the second identifier of the satellite group, a random number, and a first key between the terminal device and the ground core network;

[0075] The satellite prediction module is used to predict the first satellite that the terminal device will connect to next, based on the trajectory information of the satellites in the satellite group.

[0076] A first information sending module is used to send second information to the first satellite; wherein the second information includes the plurality of first authentication vectors, so that the first satellite authenticates the terminal device according to the plurality of first authentication vectors.

[0077] Fifthly, embodiments of the present invention provide an authentication device, comprising: a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor executes the computer program to implement an authentication method as described in any one of the first aspects or an authentication method as described in any one of the second aspects.

[0078] In a sixth aspect, embodiments of the present invention provide a computer-readable storage medium storing a computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform an authentication method as described in any one of the first aspects or an authentication method as described in any one of the second aspects.

[0079] In a seventh aspect, embodiments of the present invention provide a computer program product, including a computer program / instructions that, when executed by a processor, implement the authentication method as described in any of the first aspects or the authentication method as described in any of the second aspects.

[0080] Compared to existing technologies, the authentication method, apparatus, device, storage medium, and program product of this invention, in the scenario of 5G network element satellite deployment, pre-configures a first authentication vector on the satellite. Subsequently, after receiving an authentication request from a terminal device, the first network element on the satellite queries multiple pre-configured first authentication vectors based on the first identifier of the terminal device carried in the authentication request. These multiple first authentication vectors are generated by the ground core network based on first information, including the first sequence number of the ground core network, the second identifier of the satellite group to which the first satellite belongs, a random number, and a first key between the terminal device and the ground core network. Then, based on the retrieved first authentication vectors, the terminal device is authenticated, achieving direct identity authentication between the terminal device and the satellite. This enables the terminal device to successfully access the satellite network even in areas with extremely harsh geographical conditions or severely weak infrastructure, eliminating dependence on the ground core network. It effectively reduces signaling interaction between the satellite and the ground core network, lowers authentication latency between the mobile device and the satellite, achieves seamless global communication coverage, and is suitable for 5G network element satellite deployment scenarios. Attached Figure Description

[0081] To more clearly illustrate the technical solution of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0082] Figure 1 This is a flowchart of an authentication method provided in an embodiment of the present invention;

[0083] Figure 2 This is a schematic diagram of the authentication process between a terminal device and a satellite in a satellite constellation, provided in an embodiment of the present invention.

[0084] Figure 3 This is another flowchart of an authentication method provided in an embodiment of the present invention;

[0085] Figure 4 This is a structural block diagram of an authentication device provided in an embodiment of the present invention;

[0086] Figure 5 This is another structural block diagram of an authentication device provided in an embodiment of the present invention;

[0087] Figure 6 This is a structural block diagram of an authentication device provided in an embodiment of the present invention. Detailed Implementation

[0088] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0089] It is understood that the various numerical designations used in the embodiments of this invention are merely for descriptive convenience and are not intended to limit the scope of this application. The order of the process numbers does not imply the order of execution; the execution order of each process should be determined by its function and internal logic.

[0090] In embodiments of the invention, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, without necessarily requiring or implying any such actual relationship or order between these entities or operations. The terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element. The terms "multiple or several" refer to two or more, and the same applies to "multiple / items or several kinds / items." "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship.

[0091] This invention applies to 5G network element uplink scenarios. The 5G network elements include, but are not limited to: Access and Mobility Management Function (AMF) network elements, Unified Data Management (UDM) network elements, and Session Management Function (SMF) network elements.

[0092] It should be noted that the term "network element" can also be replaced by "entity" or "device", and the term "terrestrial core network" can also be replaced by "home network of terminal equipment" or "home network", without specific limitation in the embodiments of the present invention.

[0093] For example, this embodiment of the invention takes the first network element as the AMF network element as an example, and describes the authentication process between the terminal device and the satellite for the scenario of AMF network element going online.

[0094] Please see Figure 1 , Figure 1 This is a flowchart of an authentication method provided in an embodiment of the present invention. The authentication method is applied to a first network element on a first satellite and includes:

[0095] S11: Receive an authentication request sent by a terminal device, the authentication request including a first identifier of the terminal device;

[0096] S12: Based on the first identifier, query a plurality of pre-configured first authentication vectors; wherein, the plurality of first authentication vectors are generated by the ground core network based on first information, the first information including the first serial number of the ground core network, the second identifier of the satellite group to which the first satellite belongs, a random number, and the first key between the terminal device and the ground core network;

[0097] S13: Authenticate the terminal device according to the plurality of first authentication vectors.

[0098] In this embodiment of the invention, several satellites from the same operator are arranged into a satellite group to ensure that at least one satellite can cover the area where the terminal device is located at any time, thereby ensuring continuous service to the terminal device and enhancing signal coverage and service quality.

[0099] It should be noted that the terminal device can be referred to as User Equipment (UE). This terminal device can be a Personal Communication Service (PCS) telephone, cordless phone, Session Initiation Protocol (SIP) phone, Wireless Local Loop (WLL) station, Personal Digital Assistant (PDA), etc. It can also be a smartphone, tablet, PDA, Mobile Station (MS), Mobile Terminal, etc. This terminal device can communicate with one or more network devices via a Radio Access Network (RAN). For example, the terminal device can be a mobile phone (or "cellular" phone) or a computer with a terminal device. It can also be a portable, pocket-sized, handheld, computer-embedded, or vehicle-mounted mobile device that exchanges voice and / or data with the radio access network. The terminal device can also be a handheld device with wireless communication capabilities, a computing device or other processing device connected to a wireless modem, an in-vehicle device, a wearable device, a drone device, a satellite terminal, or a terminal device in a future network evolution, etc. The implementation of this invention is not limited.

[0100] In the scenario where the first network element is deployed (i.e., each satellite in the satellite group is equipped with a first network element), after the terminal device performs initial registration with the ground core network, the ground core network generates multiple first authentication vectors for the satellite group based on the first information, and pre-sets multiple first authentication vectors on the satellites in the satellite group; wherein, the first information includes, but is not limited to: the first sequence number of the ground core network, the second identifier of the satellite group, a random number, and the first key between the terminal device and the ground core network; the first authentication vectors are used for identity authentication when the terminal device subsequently accesses the satellites in the satellite group.

[0101] The second identifier includes the Serving Network Identifier (SNID, also known as the Serving Network Identifier), which is used to identify the Public Land Mobile Network (PLMN) that provides communication services to users.

[0102] Assuming the first satellite is the next satellite in a satellite constellation that a terminal device will connect to, the terminal device sends an authentication request to the first network element of that first satellite. Upon receiving the authentication request, the first network element queries multiple pre-configured first authentication vectors based on the terminal device's first identifier carried in the request; where the first identifier is the terminal device's temporary identity identifier. Then, based on the retrieved first authentication vectors, the first network element performs authentication on the terminal device, achieving direct authentication between the terminal device and the satellite. This eliminates reliance on the terrestrial core network, enabling successful satellite network access even in areas with extremely harsh geographical conditions or severely weak infrastructure. It effectively reduces signaling interaction between the satellite and the terrestrial core network, lowers authentication latency between the terminal device and the satellite, achieves seamless global communication coverage, and is suitable for 5G network element deployment scenarios.

[0103] Meanwhile, by grouping several satellites from the same operator into a satellite constellation, it can be ensured that at least one satellite can cover the area where the terminal device is located at any given time. The terrestrial home network generates a series of first authentication vectors for the terminal device in advance, and then pre-configures them in the satellite constellation. When the terminal device accesses the satellite constellation, only one of the first authentication vectors needs to be extracted to complete 5G AKA authentication with the terminal device, which can further reduce the authentication latency of the terminal device accessing the satellite.

[0104] The first authentication vector includes: the random number, the authentication token, and the expected first hash response value.

[0105] Furthermore, the process by which the ground core network generates multiple first authentication vectors is as follows:

[0106] First, the terminal device performs an initial registration procedure with the terrestrial core network. During the registration process, the terminal device sends a first message to the terrestrial core network; this first message includes the terminal device's third identifier.

[0107] The third identifier includes the terminal device's Subscription Concealed Identifier (SUCI).

[0108] Upon receiving the first message, the second network element in the terrestrial core network (such as a Unified Data Management (UDM) network element or an Authentication Credential Repository and Processing Function (ARPF) network element) obtains the current timestamp T0. Then, based on the current timestamp T0 and the third identifier, it calculates the first identifier of the terminal device. Specifically, the third identifier is decrypted to obtain the fourth identifier; the fourth identifier includes the terminal device's Subscription Concealed Identifier (SUPI). The first identifier of the terminal device is calculated based on the current timestamp and the fourth identifier. For example, a hash operation is performed on the current timestamp and the fourth identifier to obtain the first identifier of the terminal device. The specific calculation process is as follows:

[0109] TID = H(T0, SUPI)(1);

[0110] Where TID (Terminal Identification) represents the first identifier of the terminal device, T0 represents the current timestamp, and H() represents the hash operation.

[0111] It should be noted that the embodiments of the present invention do not limit the process of SUCI decryption. For example, the SUCI can be structurally parsed based on the SUCI format and encoding rules, and then the corresponding decryption key can be obtained based on the encryption key identifier in the SUCI. The SUCI can then be decrypted using the encryption algorithm corresponding to the encryption algorithm identifier based on the decryption key to obtain the SUPI in the decrypted SUCI.

[0112] The second network element in the ground core network sends a second message to the terminal device; the second message includes the first identifier calculated above. Subsequently, satellites in the satellite constellation can identify the responding terminal device based on the first identifier.

[0113] After completing the initial registration procedure described above, the second network element of the ground core network generates multiple first authentication vectors for the satellite group based on the first information, which are then used to provide access services to terminal devices. The number of first authentication vectors generated, n, is greater than or equal to the number of satellites j in the satellite group. The specific process is as follows:

[0114] Generate a random number;

[0115] A second authentication vector is generated based on the currently generated random number, the first serial number of the ground core network, the second identifier of the satellite group to which the first satellite belongs, and the first key between the terminal device and the ground core network;

[0116] Generate the next random number, and generate a new second authentication vector based on the next random number, until the number of generated second authentication vectors meets the preset number threshold condition;

[0117] The plurality of first authentication vectors are generated based on the generated plurality of second authentication vectors.

[0118] The step of generating a second authentication vector based on a currently generated random number, the first sequence number of the ground core network, the second identifier of the satellite group to which the first satellite belongs, and the first key between the terminal device and the ground core network includes:

[0119] The second message verification code is calculated based on the random number, the first serial number of the ground core network, the second identifier of the satellite group to which the first satellite belongs, and the first key between the terminal device and the ground core network;

[0120] Generate a third key based on the random number and the first key;

[0121] An authentication token is generated based on the third key, the first serial number, and the second message verification code.

[0122] Generate a fourth key and a fifth key based on the random number and the first key;

[0123] Generate the expected response value based on the random number, the first key, and the second identifier;

[0124] A sixth key is generated based on the first key, the second identifier, the third key, the first serial number, the fourth key, and the fifth key;

[0125] A second authentication vector is generated based on the random number, the authentication token, the expected response value, and the sixth key.

[0126] The step of generating the plurality of first authentication vectors based on the generated plurality of second authentication vectors includes:

[0127] For each of the second authentication vectors, a first hash expected response value is calculated based on the expected response value in the second authentication vector and the random number.

[0128] Calculate the second key based on the second identifier, the first key, and the sixth key in the second authentication vector;

[0129] A first authentication vector is generated based on the random number, the authentication token in the second authentication vector, and the first hash expected response value.

[0130] For example, the second network element first generates multiple second authentication vectors based on the first information. The specific calculation process is as follows:

[0131]

[0132] Where R1 represents the random number generated in the first round, MAC1 represents the second message verification code calculated in the first round, K represents the first key (also known as the shared key) between the terminal device and the ground core network, SNID represents the second identifier of the satellite group (also known as the network identifier), and SQN HN The first sequence number (SQN) of the terrestrial core network is represented by AK1, the third key (also known as the protection key or authentication key) calculated in the first round is represented by AUTN1, the authentication token calculated in the first round is represented by CK1, the fourth key (also known as the confidentiality key) calculated in the first round is represented by IK1, and the fifth key (also known as the integrity key) calculated in the first round is represented by IK1. K represents the expected response value obtained from the first round of calculation. AUSF1 This represents the sixth key (also known as the derived key) calculated in the first round, and 5G HE AV1 represents the second authentication vector (also known as the 5G Home Environment Authentication Vector, 5G HE AV) calculated in the first round. AMF * This indicates the authentication management domain.

[0133] Specifically, the second network element first generates a random number R1, and then, based on the first key K between the terminal device and the ground core network, and the first sequence number SQN of the ground core network... HN The second identifier of the satellite constellation, SNID, is used to calculate the second message verification code, MAC1 = f1(K, SQN). HN The third key AK1 = f5(K, R1) is used to hide the first serial number SQN. HN ,

[0134] It should be noted that f1 is an encryption algorithm used to calculate Message Authentication Code (MAC); for example, it encrypts specific message content using a key to generate a fixed-length MAC. For instance, it uses the first sequence number SQN... HNThe random number R1 and the second identifier SNID of the satellite group are concatenated to form an input message M1; then, the message M1 is encrypted using the first key K (e.g., Advanced Encryption Standard (AES)) to obtain an intermediate result C1; then, C1 is subjected to some specific transformations and processing, such as selecting certain specific bits of C1 for combination or further logical operations, to finally obtain the second message verification code MAC1 for this round.

[0135] It should be noted that f5 is an encryption algorithm for calculating the authentication key (AK); for example, the first key K is used to encrypt the random number R1 (such as Advanced Encryption Standard (AES)) to obtain an intermediate result H1; then, H1 undergoes some specific transformations and processing, such as selecting certain specific bits of H1 for combination or further logical operations, and finally obtaining the third key AK1 for this round.

[0136] Then calculate the authentication token. For example, the first sequence number SQN of the ground core network. HN Perform an XOR operation with the third key AK1 obtained above, and then multiply the XOR result with the authentication management domain AMF. * The second message verification code MAC1 obtained from the above calculation is concatenated to obtain the authentication token AUTN1 for this round.

[0137] Next, the fourth key CK1 = f3(K, R1) and the fifth key IK1 = f4(K, R1) are derived, with the expected response value. Sixth Key Derive the second authentication vector for this round.

[0138] Wherein, KDF represents Key Derivation Function. In this embodiment of the invention, it is achieved by using the first key K, the second identifier SNID of the satellite group, and the first sequence number SQN. HN The XOR operation result of the third key AK1, the concatenation result of the fourth key CK1 and the fifth key IK1, and the sixth key K for this round are generated using the key derivation function. AUSF1 .

[0139] It should be noted that f3 is an encryption algorithm for calculating the cipher key (CK), which is used in subsequent data encryption processes to ensure the confidentiality of the communication content. For example, the first key K is used to encrypt the random number R1 (e.g., using the Advanced Encryption Standard (AES)) to obtain an encrypted value F1; then, some bit operations and adjustments are performed on F1, such as selecting specific bits of F1 for combination or rearranging them according to certain rules, finally obtaining the fourth key CK1 for this round.

[0140] It should be noted that f4 is an encryption algorithm for calculating the Integrity Key (IK), used to verify the integrity of data during transmission and prevent data tampering. For example, a first key K is used to encrypt a random number R1 (such as using Advanced Encryption Standard (AES)) to obtain an encrypted result G1; then, the bits of G1 are calculated and combined using a specific function to finally obtain the fifth key IK1 for this round.

[0141] It should be noted that f2 is an algorithm for calculating the expected response (XERS), used to verify the legitimacy of the terminal device. For example, the second identifier of the satellite constellation (SNID) and a random number (R1) are concatenated to form an input message W1; W1 is then encrypted using a first key (e.g., Advanced Encryption Standard (AES)) to obtain an encrypted result E1; subsequently, a series of bit operations and transformations are performed on E1, such as shifting and XORing, to adjust it to a fixed length, ultimately yielding the expected response value for this round.

[0142] The subsequent random number R1, authentication token AUTN1, expected response value AUTN1, and sixth key K will be used in this round. AUSF1 The vectors are then concatenated to obtain the second authentication vector 5G HE AV1 for this round.

[0143] The first serial number SQN HN The value is increased by a set step size. Repeat the above steps until n second authentication vectors (5GHE AV) are generated. i (i = 1, 2, ..., n), where the number of generated second authentication vectors n is less than or equal to the number of satellites j in the satellite group.

[0144] It should be noted that the embodiments of the present invention do not limit the value of the set step size; for example, the set step size can be 1. The UDM will use the UE's temporary identity identifier... TIDThe generated n 5G authentication vectors are sent to AUSF.

[0145] Finally, the second network element combines the terminal's first identifier (TID) with the generated n second authentication vectors (5G HE AV). i Sending to third network elements (such as Authentication Server Function (AUSF) network elements) of the ground core network.

[0146] The third network element targets each second authentication vector (5G HE AV) issued by the second network element. i Perform the following operations to generate the first authentication vector (also known as the 5G Serving Environment Authentication Vector, 5G SE AV). The specific calculation process is as follows:

[0147]

[0148] Among them, K SEAFi This represents the i-th second key (also known as the Security Anchor Function (SEAF) key); This represents the expected response value of the i-th first hash, obtained by applying a random number R. i and expected response value Obtained by performing a hash operation;

[0149] The third network element will receive the second authentication vector 5G HE AV. i Then, the expected response value will be temporarily stored. And from the expected response value The expected first hash response value is calculated using a hash algorithm. From the sixth key K AUSFi Derive the second key K SEAFi .

[0150] In this embodiment of the invention, the second key K can be calculated using a key derivation function (KDF). SEAFi For example, by using the first key K, the second identifier SNID of the satellite group, and the expected response value The concatenation result is used to generate the second key K for this round using a key derivation function. SEAFi .

[0151] Then, for the random number R i Authenticator Token (AUTN) i First hash expected response value The vectors are concatenated to obtain the first authentication vector for this round: 5G SE AV. i(i = 1, 2, ..., n).

[0152] Furthermore, the method also includes:

[0153] Receive the second information sent by the ground core network;

[0154] The second information is triggered when the ground core network predicts, based on the trajectory information of the satellites in the satellite group, that the first satellite is the satellite that the terminal device will access next. The second information includes the plurality of first authentication vectors, the first identifier of the terminal device, and the plurality of second keys.

[0155] In this embodiment of the invention, the ground core network predicts the next satellite that the terminal device will access, such as the first satellite, based on the trajectory information of each satellite in the satellite constellation; then, the third network element of the ground core network will generate all the first authentication vectors 5G SE AV mentioned above. i (i = 1, 2, ..., n), all second keys K SEAFi The terminal device's first identifier (TID) is sent to the first satellite.

[0156] When a terminal device enters or is within the coverage area of ​​the first satellite, the terminal device sends an authentication request carrying a first identifier (TID) to the first satellite. The first network element of the first satellite retrieves multiple stored first authentication vectors (5G SE AV) based on the first identifier (TID). i (i = 1, 2, ..., n), perform identity authentication on the terminal device.

[0157] Specifically, authenticating the terminal device based on the plurality of first authentication vectors includes:

[0158] A target authentication vector is determined based on the plurality of first authentication vectors; wherein the target authentication vector is the first unused first authentication vector selected sequentially from the plurality of first authentication vectors.

[0159] The terminal device is authenticated based on the target authentication vector.

[0160] The step of authenticating the terminal device based on the target authentication vector includes:

[0161] Extract the random number and authentication token from the target authentication vector;

[0162] Send third information to the terminal device; wherein the third information includes a random number and an authentication token in the target authentication vector; the third information is used to instruct the terminal device to verify the second sequence number and the first message verification code obtained based on the random number and the authentication token, and to complete the authentication of the first satellite after the verification is successful.

[0163] The second serial number is a hidden first serial number recovered from the authentication token based on a third key; the third key is calculated based on the random number; the first message verification code is generated based on the first key, the second serial number, the first identifier, and the random number.

[0164] The conditions under which the second serial number and the first message verification code pass verification include:

[0165] The first message verification code is consistent with the second message verification code in the authentication token;

[0166] The third serial number stored in the terminal device is less than the second serial number.

[0167] For example, the first network element queries multiple first authentication vectors (5G SE AV). i (i = 1, 2, ..., n), select the first unused first authentication vector 5G SE AV1 in sequence, extract the random number R1 and authentication token AUTN1 from it, and send the extracted random number R1 and authentication token AUTN1 to the terminal device.

[0168] After receiving the random number R1 and authentication token AUTN1 sent by the first network element, the terminal device performs the following operations:

[0169] Calculate the third key AK1 based on the random number R1 and the first key K;

[0170] Extract the XOR operation result from the authentication token AUTN1

[0171] The result of the XOR operation between the third key AK1 and the authentication token AUTN1 The first hidden serial number SQN HN Perform the recovery to obtain the second serial number. The second serial number obtained at this time That is, the first serial number SQN HN ;

[0172] Based on the first key K, the second identifier SNID, the random number R1, and the second sequence number Calculate the first message verification code XMAC1;

[0173] For the second serial number The verification is performed against the first message verification code XMAC1; that is, whether the first message verification code XMAC1 matches the second message verification code MAC1 in the authentication token, and whether the third serial number SQN stored in the terminal device is true. UE Is it less than the second serial number? If yes, authentication is successful; otherwise, authentication fails.

[0174] Example, second serial number The calculation process for the first message verification code (XMAC) is as follows:

[0175]

[0176] After successful verification, authentication of the first satellite is completed. The terminal device then proceeds to perform the following operations:

[0177] Generate a fourth key CK1 based on the first key K and the random number R1;

[0178] Generate a fifth key IK1 based on the first key K and the random number R1;

[0179] An authentication response value is generated based on the first key K, the second identifier SNID, and the random number R1.

[0180] Based on the second identifier SNID, the third key AK1, and the second serial number The fourth key CK1 and the fifth key IK1, from which the seventh key is derived. (Also known as a derived key);

[0181] Based on the second identifier SNID and the authentication response value Generate the eighth key (Also known as the security anchor function key.)

[0182] The specific calculation process is as follows:

[0183]

[0184] Finally, the terminal device will generate a response value carrying authentication. The fourth message is sent to the first satellite.

[0185] Furthermore, the method also includes:

[0186] The terminal sends a fourth message; wherein the fourth message is triggered by the terminal device after completing authentication of the first satellite; the fourth message includes an authentication response value.

[0187] Calculate the second hash expected response value based on the authentication response value and the random number;

[0188] The expected response value of the second hash is verified, and the authentication of the terminal device is completed after the verification is successful.

[0189] The authentication response value is calculated based on the first key, the second identifier, and the random number.

[0190] The conditions under which the first hash expected response value passes verification include:

[0191] The first expected hash response value in the target authentication vector is consistent with the second expected hash response value.

[0192] For example, the first network element responds to the received authentication response value Calculate the expected response value of the second hash Then compare the expected response value of the first hash in the first authentication vector 5G SE AV1. Compared with the calculated second hash expected response value If the data is equal to the terminal device's information, the verification passes; otherwise, it fails. If the verification passes, the first satellite completes the authentication of the terminal device. If authentication is successful, the terminal device is allowed to access the first satellite and provide services through it; if authentication fails, the terminal device's attach request is rejected to prevent unauthorized access.

[0193] Furthermore, the method also includes:

[0194] Delete the target authentication vector from the plurality of first authentication vectors;

[0195] Send a fifth message to the second satellite; wherein the second satellite is the next satellite in the satellite group that the terminal device will access after the first satellite; the fifth message includes a first authentication vector remaining after deleting the target authentication vector and a first identifier of the terminal device, so that the second satellite authenticates the terminal device based on the remaining first authentication vector.

[0196] For example, after the first satellite completes the authentication of the terminal device, it deletes the first verified authentication vector 5G SE AV1 and adds the remaining n-1 authentication vectors 5G SE AV1. i(i = 2, ..., n-1) and the terminal device's first identifier (TID) are sent to the next satellite the terminal device is about to join (e.g., the second satellite). When the terminal device is about to connect to the second satellite in the satellite group, the same authentication operation as described above is performed, thus achieving identity authentication between the terminal device and the second satellite, thereby maintaining a secure communication environment. The authentication process between the terminal device and the satellites in the satellite group is as follows: Figure 2 As shown.

[0197] Furthermore, the method also includes:

[0198] The sixth message is periodically sent to the ground core network;

[0199] The sixth information includes at least one authentication response value that has been authenticated within the period and ordered according to the authentication sequence; the sixth information is used to instruct the ground core network to compare the received at least one authentication response value with the expected response value stored locally; if there is an expected response value that matches at least one authentication response value, the authentication process corresponding to the corresponding authentication response value is determined to be successful.

[0200] For example, the satellite constellation periodically sends a series of authenticated response values ​​in sequence to the third network element of the ground core network at fixed intervals. The third network element will receive the authentication response value. Compared with the previously stored expected response value Compare the authentication response values. Compared with expected response value If the results are equal, the third network element considers the authentication successful from the perspective of its home network. The third network element then notifies the second network element of the authentication result.

[0201] Compared with the prior art, the beneficial effects of the embodiments of the present invention are as follows:

[0202] By pre-setting multiple first authentication vectors in the next satellite that a terminal device will connect to within a satellite constellation, and using these vectors for subsequent authentication between the terminal device and the satellite, reliance on the terrestrial core network can be eliminated. This allows terminal devices to successfully access the satellite network even in areas with extremely harsh geographical conditions or severely weak infrastructure. It effectively reduces signaling interactions between the satellite and the terrestrial core network, improving the authentication efficiency of terminal devices accessing the satellite network. It also reduces authentication latency between the terminal device and the satellite, achieving seamless global communication coverage and adapting to 5G network element deployment scenarios.

[0203] By grouping several satellites from the same operator into a satellite constellation, it can be ensured that at least one satellite can cover the area where the terminal device is located at any given time. The terrestrial home network pre-generates a series of primary authentication vectors for the terminal device and pre-configures them in the satellite constellation. When the terminal device accesses the satellite constellation, only one primary authentication vector needs to be extracted to complete 5GAKA authentication with the terminal device, which can further reduce the authentication latency of the terminal device accessing the satellite.

[0204] Furthermore, different satellites within the satellite constellation can transmit the first authentication vector, which is then used for subsequent identity authentication with terminal devices, eliminating the reliance on the terrestrial core network.

[0205] See Figure 3 , Figure 3 This is another flowchart of an authentication method provided in an embodiment of the present invention. The authentication method, applied to a terrestrial core network, includes:

[0206] S21: Generate multiple first authentication vectors based on the first information; wherein, the first information includes the serial number of the ground core network, the second identifier of the satellite group, a random number, and the first key between the terminal device and the ground core network;

[0207] S22: Based on the trajectory information of the satellites in the satellite group, predict the first satellite that the terminal device will access next;

[0208] S23: Send the second information to the first satellite; wherein the second information includes the plurality of first authentication vectors, so that the first satellite authenticates the terminal device according to the plurality of first authentication vectors.

[0209] In one alternative embodiment, the first authentication vector includes: the random number, the authentication token, and the first hash expected response value.

[0210] In an optional embodiment, the method further includes:

[0211] Receive a first message sent by the terminal device; the first message includes a third identifier of the terminal device;

[0212] Calculate the first identifier of the terminal device based on the current timestamp and the third identifier;

[0213] A second message is sent to the terminal device; the second message includes the first identifier.

[0214] In an optional embodiment, calculating the first identifier of the terminal device based on the current timestamp and the third identifier includes:

[0215] Decrypt the third identifier to obtain the fourth identifier;

[0216] The first identifier of the terminal device is calculated based on the current timestamp and the fourth identifier.

[0217] In one optional embodiment, generating multiple first authentication vectors based on the first information includes:

[0218] Generate a random number;

[0219] A second authentication vector is generated based on the currently generated random number, the first serial number of the ground core network, the second identifier of the satellite group to which the first satellite belongs, and the first key between the terminal device and the ground core network;

[0220] Generate the next random number, and generate a new second authentication vector based on the next random number, until the number of generated second authentication vectors meets the preset number threshold condition;

[0221] The plurality of first authentication vectors are generated based on the generated plurality of second authentication vectors.

[0222] In one optional embodiment, generating the second authentication vector based on the currently generated random number, the first sequence number of the ground core network, the second identifier of the satellite group to which the first satellite belongs, and the first key between the terminal device and the ground core network includes:

[0223] The second message verification code is calculated based on the random number, the first serial number of the ground core network, the second identifier of the satellite group to which the first satellite belongs, and the first key between the terminal device and the ground core network;

[0224] Generate a third key based on the random number and the first key;

[0225] An authentication token is generated based on the third key, the first serial number, and the second message verification code.

[0226] Generate a fourth key and a fifth key based on the random number and the first key;

[0227] Generate the expected response value based on the random number, the first key, and the second identifier;

[0228] A sixth key is generated based on the first key, the second identifier, the third key, the first serial number, the fourth key, and the fifth key;

[0229] A second authentication vector is generated based on the random number, the authentication token, the expected response value, and the sixth key.

[0230] In one optional embodiment, generating the plurality of first authentication vectors based on the generated plurality of second authentication vectors includes:

[0231] For each of the second authentication vectors, a first hash expected response value is calculated based on the expected response value in the second authentication vector and the random number.

[0232] Calculate the second key based on the second identifier, the first key, and the sixth key in the second authentication vector;

[0233] A first authentication vector is generated based on the random number, the authentication token in the second authentication vector, and the first hash expected response value.

[0234] In an optional embodiment, the method further includes:

[0235] Receive a sixth message periodically transmitted by any satellite in the satellite group; wherein the sixth message includes at least one authentication response value that has been authenticated by the corresponding satellite within the periodic time and is ordered according to the authentication sequence;

[0236] Compare at least one of the received authentication response values ​​with the expected response value stored locally;

[0237] If there is an expected response value that matches at least one of the authentication response values, the authentication process corresponding to the corresponding authentication response value is determined to be successful.

[0238] It should be noted that the working process of the authentication method applied to the ground core network described in the embodiments of the present invention can refer to the working process of the authentication method applied to the first network element on the satellite described in the above embodiments, and the technical effect achieved is the same as that of the authentication method applied to the first network element on the satellite described in the above embodiments, so it will not be repeated here.

[0239] See Figure 4 , Figure 4 This invention provides a structural block diagram of an authentication device, which is applied to a first network element on a first satellite and includes:

[0240] The request receiving module 11 is used to receive an authentication request sent by the terminal device, wherein the authentication request includes a first identifier of the terminal device;

[0241] The query module 12 is used to query a plurality of pre-configured first authentication vectors based on the first identifier; wherein the plurality of first authentication vectors are generated by the ground core network based on first information, the first information including the first serial number of the ground core network, the second identifier of the satellite group to which the first satellite belongs, a random number, and a first key between the terminal device and the ground core network;

[0242] The first authentication module 13 is used to authenticate the terminal device according to the plurality of first authentication vectors.

[0243] In one alternative embodiment, the first authentication vector includes: the random number, the authentication token, and the first hash expected response value.

[0244] In an optional embodiment, the device further includes:

[0245] The first information receiving module is used to receive the second information sent by the ground core network;

[0246] The second information is triggered when the ground core network predicts, based on the trajectory information of the satellites in the satellite group, that the first satellite is the satellite that the terminal device will access next. The second information includes the plurality of first authentication vectors, the first identifier of the terminal device, and the plurality of second keys.

[0247] In an optional embodiment, the first authentication module 13 includes:

[0248] A target authentication vector determination unit is configured to determine a target authentication vector based on the plurality of first authentication vectors; wherein the target authentication vector is the first unused first authentication vector selected sequentially from the plurality of first authentication vectors;

[0249] The device authentication unit is used to authenticate the terminal device according to the target authentication vector.

[0250] In one optional embodiment, the device authentication unit includes:

[0251] An information extraction subunit is used to extract the random number and authentication token from the target authentication vector;

[0252] The first information sending subunit is used to send third information to the terminal device; wherein the third information includes a random number and an authentication token in the target authentication vector; the third information is used to instruct the terminal device to verify the second sequence number and the first message verification code obtained according to the random number and the authentication token, and to complete the authentication of the first satellite after the verification is successful.

[0253] In one alternative embodiment, the second serial number is a hidden first serial number recovered from the authentication token based on a third key; the third key is calculated based on the random number; and the first message verification code is generated based on the first key, the second serial number, the first identifier, and the random number.

[0254] In an optional embodiment, the conditions for the second serial number and the first message verification code to pass verification include:

[0255] The first message verification code is consistent with the second message verification code in the authentication token;

[0256] The third serial number stored in the terminal device is less than the second serial number.

[0257] In an optional embodiment, the device further includes:

[0258] The second information receiving module is used to receive fourth information sent by the terminal; wherein, the fourth information is triggered by the terminal device after completing the authentication of the first satellite; the fourth information includes an authentication response value;

[0259] The hash expected response value calculation module is used to calculate the second hash expected response value based on the authentication response value and the random number;

[0260] The hash expected response value verification module is used to verify the second hash expected response value and complete the authentication of the terminal device after the verification is successful.

[0261] In one alternative embodiment, the authentication response value is calculated based on the first key, the second identifier, and the random number.

[0262] In an optional embodiment, the conditions for the first expected hash response value to pass the verification include:

[0263] The first expected hash response value in the target authentication vector is consistent with the second expected hash response value.

[0264] In an optional embodiment, the device further includes:

[0265] An authentication vector deletion module is used to delete the target authentication vector from the plurality of first authentication vectors;

[0266] The second information sending module is used to send fifth information to the second satellite; wherein the second satellite is the next satellite that the terminal device will access after the first satellite in the satellite group; the fifth information includes the first authentication vector remaining after deleting the target authentication vector and the first identifier of the terminal device, so that the second satellite authenticates the terminal device according to the remaining first authentication vector.

[0267] In an optional embodiment, the device further includes:

[0268] The third information sending module is used to periodically send the sixth information to the ground core network;

[0269] The sixth information includes at least one authentication response value that has been authenticated within the period and ordered according to the authentication sequence; the sixth information is used to instruct the ground core network to compare the received at least one authentication response value with the expected response value stored locally; if there is an expected response value that matches at least one authentication response value, the authentication process corresponding to the corresponding authentication response value is determined to be successful.

[0270] It should be noted that the working process of each module in the authentication device applied to the first network element on the first satellite described in the embodiments of the present invention can refer to the working process of the authentication method applied to the first network element on the first satellite described in the above embodiments, and the technical effect achieved is the same as that of the authentication method applied to the first network element on the first satellite described in the above embodiments, and will not be repeated here.

[0271] See Figure 5 , Figure 5 This is another structural block diagram of an authentication device provided in an embodiment of the present invention. The authentication device is applied to a terrestrial core network and includes:

[0272] The authentication vector generation module 21 is used to generate multiple first authentication vectors based on first information; wherein, the first information includes the serial number of the ground core network, the second identifier of the satellite group, a random number, and a first key between the terminal device and the ground core network;

[0273] The satellite prediction module 22 is used to predict the first satellite that the terminal device will access next, based on the trajectory information of the satellites in the satellite group.

[0274] The first information sending module 23 is used to send second information to the first satellite; wherein the second information includes the plurality of first authentication vectors, so that the first satellite authenticates the terminal device according to the plurality of first authentication vectors.

[0275] In one alternative embodiment, the first authentication vector includes: the random number, the authentication token, and the first hash expected response value.

[0276] In an optional embodiment, the device further includes:

[0277] The first message sending module is used to receive a first message sent by the terminal device; the first message includes a third identifier of the terminal device.

[0278] The first identifier calculation module is used to calculate the first identifier of the terminal device based on the current timestamp and the third identifier;

[0279] The second message sending module is used to send a second message to the terminal device; the second message includes the first identifier.

[0280] In an optional embodiment, the first identifier calculation module includes:

[0281] A decryption unit is used to decrypt the third identifier to obtain the fourth identifier;

[0282] The identification unit is used to calculate the first identifier of the terminal device based on the current timestamp and the fourth identifier.

[0283] In an optional embodiment, the authentication vector generation module 21 includes:

[0284] The random number generation unit is used to generate a random number.

[0285] The second authentication vector generation unit is used to generate a second authentication vector based on the currently generated random number, the first serial number of the ground core network, the second identifier of the satellite group to which the first satellite belongs, and the first key between the terminal device and the ground core network.

[0286] The random number generation unit is also used to generate the next random number so that a new second authentication vector is generated based on the next random number until the number of generated second authentication vectors meets the preset number threshold condition.

[0287] The first authentication vector generation unit is used to generate the plurality of first authentication vectors based on the generated plurality of second authentication vectors.

[0288] In one optional embodiment, the second authentication vector generation unit includes:

[0289] The second message verification code calculation subunit is used to calculate the second message verification code based on the random number, the first serial number of the ground core network, the second identifier of the satellite group to which the first satellite belongs, and the first key between the terminal device and the ground core network.

[0290] The first key generation subunit is used to generate a third key based on the random number and the first key;

[0291] The authentication token generation subunit is used to generate an authentication token based on the third key, the first sequence number, and the second message verification code.

[0292] The second key generation subunit is used to generate a fourth key and a fifth key based on the random number and the first key;

[0293] The expected response value generation subunit is used to generate the expected response value based on the random number, the first key, and the second identifier;

[0294] The third key generation subunit is used to generate a sixth key based on the first key, the second identifier, the third key, the first serial number, the fourth key, and the fifth key;

[0295] The second authentication vector generation subunit is used to generate a second authentication vector based on the random number, the authentication token, the expected response value, and the sixth key.

[0296] In one optional embodiment, the first authentication vector generation unit includes:

[0297] The first hash expected response value calculation subunit is used to calculate the first hash expected response value for each of the second authentication vectors, based on the expected response value in the second authentication vector and the random number.

[0298] The fourth key generation subunit is used to calculate the second key based on the second identifier, the first key, and the sixth key in the second authentication vector;

[0299] The first authentication vector generation subunit is used to generate a first authentication vector based on the random number, the authentication token in the second authentication vector, and the first hash expected response value.

[0300] In an optional embodiment, the device further includes:

[0301] The information receiving module is used to receive the sixth information periodically transmitted by any satellite in the satellite group; wherein the sixth information includes at least one authentication response value that has been authenticated by the corresponding satellite within the periodic time and is ordered according to the authentication sequence.

[0302] The response value comparison module is used to compare at least one of the received authentication response values ​​with the expected response values ​​stored locally; if there is an expected response value that matches at least one of the authentication response values, the authentication process corresponding to the corresponding authentication response value is determined to be successful.

[0303] It should be noted that the working process of each module in the authentication device applied to the terrestrial core network described in the embodiments of the present invention can refer to the working process of the authentication method applied to the terrestrial core network described in the above embodiments, and the technical effect achieved is the same as that of the authentication method applied to the terrestrial core network described in the above embodiments, so it will not be repeated here.

[0304] See Figure 6 , Figure 6 This is a structural block diagram of an authentication device provided in an embodiment of the present invention. The authentication device includes a processor 31, a memory 32, and a computer program stored in the memory 32 and executable on the processor 31. When the processor 31 executes the computer program, it implements the steps in the various authentication method embodiments described above, such as steps S11 to S13 or steps S21 to S23.

[0305] For example, the computer program may be divided into one or more modules / units, which are stored in the memory 32 and executed by the processor 31 to complete the present invention. The one or more modules / units may be a series of computer program instruction segments capable of performing a specific function, which describe the execution process of the computer program in the authentication device.

[0306] The authentication device may include, but is not limited to, processor 31 and memory 32. Those skilled in the art will understand that the schematic diagram is merely an example of an authentication device and does not constitute a limitation on the authentication device. It may include more or fewer components than illustrated, or combine certain components, or different components. For example, the authentication device may also include input / output devices, network access devices, buses, etc.

[0307] The processor 31 can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor. The processor 31 is the control center of the authentication device, connecting various parts of the authentication device via various interfaces and lines.

[0308] The memory 32 can be used to store the computer program and / or modules. The processor 31 implements various functions of the authentication device by running or executing the computer program and / or modules stored in the memory 32 and calling the data stored in the memory 32. The memory 32 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the mobile phone (such as audio data, phonebook, etc.). In addition, the memory 32 may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0309] Wherein, if the modules / units integrated into the authentication device are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments of the present invention can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by the processor 31, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc.

[0310] It should be noted that the device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Furthermore, in the accompanying drawings of the device embodiments provided by this invention, the connection relationships between modules indicate that they have communication connections, which can be specifically implemented as one or more communication buses or signal lines. Those skilled in the art can understand and implement this without any creative effort.

[0311] The above description represents the preferred embodiments of the present invention. It should be noted that, for those skilled in the art, various improvements and modifications can be made without departing from the principles of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. An authentication method characterized by, The first network element applied to the first satellite includes: Receive an authentication request sent by a terminal device, the authentication request including a first identifier of the terminal device; Based on the first identifier, a plurality of pre-configured first authentication vectors are queried; wherein, the plurality of first authentication vectors are generated by the ground core network based on first information, the first information including the first serial number of the ground core network, the second identifier of the satellite group to which the first satellite belongs, a random number, and a first key between the terminal device and the ground core network; The terminal device is authenticated based on the plurality of first authentication vectors.

2. The authentication method of claim 1, wherein, The first authentication vector includes: the random number, the authentication token, and the expected response value of the first hash.

3. The authentication method of claim 1, wherein, The method further includes: Receive the second information sent by the ground core network; The second information is triggered when the ground core network predicts, based on the trajectory information of the satellites in the satellite group, that the first satellite is the satellite that the terminal device will access next. The second information includes the plurality of first authentication vectors, the first identifier of the terminal device, and the plurality of second keys.

4. The authentication method of claim 2, wherein, The authentication of the terminal device based on the plurality of first authentication vectors includes: A target authentication vector is determined based on the plurality of first authentication vectors; wherein the target authentication vector is the first unused first authentication vector selected sequentially from the plurality of first authentication vectors. The terminal device is authenticated based on the target authentication vector.

5. The authentication method of claim 4, wherein, The step of authenticating the terminal device based on the target authentication vector includes: Extract the random number and authentication token from the target authentication vector; Send third information to the terminal device; wherein the third information includes a random number and an authentication token in the target authentication vector; the third information is used to instruct the terminal device to verify the second sequence number and the first message verification code obtained based on the random number and the authentication token, and to complete the authentication of the first satellite after the verification is successful.

6. The authentication method as described in claim 5, characterized in that, The second serial number is a hidden first serial number recovered from the authentication token based on a third key; the third key is calculated based on the random number; the first message verification code is generated based on the first key, the second serial number, the first identifier, and the random number.

7. The authentication method as described in claim 5, characterized in that, The conditions under which the second serial number and the first message verification code pass verification include: The first message verification code is consistent with the second message verification code in the authentication token; The third serial number stored in the terminal device is less than the second serial number.

8. The authentication method as described in claim 5, characterized in that, The method further includes: The terminal sends a fourth message; wherein the fourth message is triggered by the terminal device after completing authentication of the first satellite; the fourth message includes an authentication response value. Calculate the second hash expected response value based on the authentication response value and the random number; The expected response value of the second hash is verified, and the authentication of the terminal device is completed after the verification is successful.

9. The authentication method as described in claim 8, characterized in that, The authentication response value is calculated based on the first key, the second identifier, and the random number.

10. The authentication method as described in claim 8, characterized in that, The conditions under which the first hash expected response value passes verification include: The first expected hash response value in the target authentication vector is consistent with the second expected hash response value.

11. The authentication method as described in claim 8, characterized in that, The method further includes: Delete the target authentication vector from the plurality of first authentication vectors; Send a fifth message to the second satellite; wherein the second satellite is the next satellite in the satellite group that the terminal device will access after the first satellite; the fifth message includes a first authentication vector remaining after deleting the target authentication vector and a first identifier of the terminal device, so that the second satellite authenticates the terminal device based on the remaining first authentication vector.

12. The authentication method as described in claim 7, characterized in that, The method further includes: The sixth message is periodically sent to the ground core network; The sixth information includes at least one authentication response value that has been authenticated within the period and ordered according to the authentication sequence; the sixth information is used to instruct the ground core network to compare the received at least one authentication response value with the expected response value stored locally; if there is an expected response value that matches at least one authentication response value, the authentication process corresponding to the corresponding authentication response value is determined to be successful.

13. An authentication method, characterized in that, Applied to terrestrial core networks, including: Based on the first information, multiple first authentication vectors are generated; wherein, the first information includes the serial number of the ground core network, the second identifier of the satellite group, a random number, and the first key between the terminal device and the ground core network; Based on the trajectory information of the satellites in the satellite group, predict the first satellite that the terminal device will connect to next; The second information is sent to the first satellite; wherein the second information includes the plurality of first authentication vectors, so that the first satellite authenticates the terminal device according to the plurality of first authentication vectors.

14. The authentication method as described in claim 13, characterized in that, The first authentication vector includes: the random number, the authentication token, and the expected response value of the first hash.

15. The authentication method as described in claim 13, characterized in that, The method further includes: Receive a first message sent by the terminal device; the first message includes a third identifier of the terminal device; Calculate the first identifier of the terminal device based on the current timestamp and the third identifier; A second message is sent to the terminal device; the second message includes the first identifier.

16. The authentication method as described in claim 15, characterized in that, The step of generating multiple first authentication vectors based on the first information includes: Generate a random number; A second authentication vector is generated based on the currently generated random number, the first serial number of the ground core network, the second identifier of the satellite group to which the first satellite belongs, and the first key between the terminal device and the ground core network; Generate the next random number, and generate a new second authentication vector based on the next random number, until the number of generated second authentication vectors meets the preset number threshold condition; The plurality of first authentication vectors are generated based on the generated plurality of second authentication vectors.

17. The authentication method as described in claim 15, characterized in that, The step of calculating the first identifier of the terminal device based on the current timestamp and the third identifier includes: Decrypt the third identifier to obtain the fourth identifier; The first identifier of the terminal device is calculated based on the current timestamp and the fourth identifier.

18. The authentication method as described in claim 16, characterized in that, The step of generating a second authentication vector based on a currently generated random number, the first sequence number of the ground core network, the second identifier of the satellite group to which the first satellite belongs, and the first key between the terminal device and the ground core network includes: The second message verification code is calculated based on the random number, the first serial number of the ground core network, the second identifier of the satellite group to which the first satellite belongs, and the first key between the terminal device and the ground core network; Generate a third key based on the random number and the first key; An authentication token is generated based on the third key, the first serial number, and the second message verification code. Generate a fourth key and a fifth key based on the random number and the first key; Generate the expected response value based on the random number, the first key, and the second identifier; A sixth key is generated based on the first key, the second identifier, the third key, the first serial number, the fourth key, and the fifth key; A second authentication vector is generated based on the random number, the authentication token, the expected response value, and the sixth key.

19. The authentication method as described in claim 18, characterized in that, The step of generating the plurality of first authentication vectors based on the generated plurality of second authentication vectors includes: For each of the second authentication vectors, a first hash expected response value is calculated based on the expected response value in the second authentication vector and the random number. Calculate the second key based on the second identifier, the first key, and the sixth key in the second authentication vector; A first authentication vector is generated based on the random number, the authentication token in the second authentication vector, and the first hash expected response value.

20. The authentication method as described in claim 18, characterized in that, The method further includes: Receive a sixth message periodically transmitted by any satellite in the satellite group; wherein the sixth message includes at least one authentication response value that has been authenticated by the corresponding satellite within the periodic time and is ordered according to the authentication sequence; Compare at least one of the received authentication response values ​​with the expected response value stored locally; If there is an expected response value that matches at least one of the authentication response values, the authentication process corresponding to the corresponding authentication response value is determined to be successful.

21. An authentication device, characterized in that, The first network element applied to the first satellite includes: A request receiving module is used to receive an authentication request sent by a terminal device, wherein the authentication request includes a first identifier of the terminal device; The query module is used to query a plurality of pre-configured first authentication vectors based on the first identifier; wherein the plurality of first authentication vectors are generated by the ground core network based on first information, the first information including the first serial number of the ground core network, the second identifier of the satellite group to which the first satellite belongs, a random number, and a first key between the terminal device and the ground core network; The first authentication module is used to authenticate the terminal device based on the plurality of first authentication vectors.

22. An authentication device, characterized in that, Applied to terrestrial core networks, including: An authentication vector generation module is used to generate multiple first authentication vectors based on first information; wherein, the first information includes the serial number of the ground core network, the second identifier of the satellite group, a random number, and a first key between the terminal device and the ground core network; The satellite prediction module is used to predict the first satellite that the terminal device will connect to next, based on the trajectory information of the satellites in the satellite group. A first information sending module is used to send second information to the first satellite; wherein the second information includes the plurality of first authentication vectors, so that the first satellite authenticates the terminal device according to the plurality of first authentication vectors.

23. An authentication device, characterized in that, include: A processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor, when executing the computer program, implements the authentication method as described in any one of claims 1 to 12 or the authentication method as described in any one of claims 13 to 20.

24. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein, when the computer program is executed, it controls the device on which the computer-readable storage medium is located to perform the authentication method as described in any one of claims 1 to 12 or the authentication method as described in any one of claims 13 to 20.

25. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instruction is executed by the processor, it implements the authentication method as described in any one of claims 1 to 12 or the authentication method as described in any one of claims 13 to 20.

Images