CN114827998A - Satellite terminal network access authentication device based on encryption chip - Google Patents

Satellite terminal network access authentication device based on encryption chip Download PDF

Info

Publication number
CN114827998A
CN114827998A CN202210267333.5A CN202210267333A CN114827998A CN 114827998 A CN114827998 A CN 114827998A CN 202210267333 A CN202210267333 A CN 202210267333A CN 114827998 A CN114827998 A CN 114827998A
Authority
CN
China
Prior art keywords
satellite terminal
encryption chip
mac
random number
sends
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN202210267333.5A
Other languages
Chinese (zh)
Other versions
CN114827998B (en
Inventor
高颂
黄曜明
曹天洋
姬天相
张超
冯帅
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Beijing Aerospace Science & Industry Century Satellite Hi Tech Co ltd
Original Assignee
Beijing Aerospace Science & Industry Century Satellite Hi Tech Co ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Beijing Aerospace Science & Industry Century Satellite Hi Tech Co ltd filed Critical Beijing Aerospace Science & Industry Century Satellite Hi Tech Co ltd
Priority to CN202210267333.5A priority Critical patent/CN114827998B/en
Publication of CN114827998A publication Critical patent/CN114827998A/en
Application granted granted Critical
Publication of CN114827998B publication Critical patent/CN114827998B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04WWIRELESS COMMUNICATION NETWORKS
    • H04W12/00Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06Authentication
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/06Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
    • H04L9/0643Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H04L9/3228One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04WWIRELESS COMMUNICATION NETWORKS
    • H04W84/00Network topologies
    • H04W84/02Hierarchically pre-organised networks, e.g. paging networks, cellular networks, WLAN [Wireless Local Area Network] or WLL [Wireless Local Loop]
    • H04W84/04Large scale networks; Deep hierarchical networks
    • H04W84/06Airborne or Satellite Networks

Abstract

The invention discloses a satellite terminal network access authentication device based on an encryption chip, wherein the encryption chip is adopted at a satellite terminal of a satellite communication system; the encryption chip calculates and obtains a temporary key tempkey according to the first random number of 24 bytes, and then generates a second random number of 32 bytes and sends the second random number to a data dispatching center of the satellite communication system. The encryption chip calculates and obtains a first mac information verification code according to the temporary key tempkey and sends the first mac information verification code to the data scheduling center; and the data scheduling center calculates and obtains a second mac information verification code according to the 32-byte second random number, compares the second mac information verification code with the first mac information verification code, and allows the satellite terminal to access the network if the second mac information verification code is equal to the first mac information verification code, or refuses the satellite terminal to access the network if the second mac information verification code is not equal to the first mac information verification code. The device provided by the invention can simply and quickly authenticate, improves the network access efficiency and simultaneously improves the information security level.

Description

Satellite terminal network access authentication device based on encryption chip
Technical Field
The invention relates to the technical field of satellite communication, in particular to a satellite terminal network access authentication device based on an encryption chip.
Background
In a mobile satellite communication system, a user segment needs to access a mobile satellite communication network through a ground segment for mobile communication. The communication terminal representing the user segment can have different expression forms, such as a handheld terminal, a vehicle-mounted terminal or a ship-mounted terminal, and the user terminal is used for realizing the setting and the acquisition of a communication state of a terminal user by installing a wireless transceiving antenna so as to finish communication.
In the existing authentication scheme of satellite communication, the authentication mechanism of LTE is adopted for authentication through a sim card, so that the authentication scheme is complex and the field of satellite communication is not used. In addition, the scheme of using flash to keep the root key at the terminal side for authentication is too simple, the root key is not well protected, leakage is easy to occur, and information safety accidents are caused.
Disclosure of Invention
In view of this, the invention provides an encryption chip-based satellite terminal network access authentication device, which can perform authentication simply and quickly, improve network access efficiency, and improve information security level.
The invention adopts the following specific technical scheme:
a satellite terminal network access authentication device based on an encryption chip adopts the encryption chip at a satellite terminal of a satellite communication system; the encryption chip calculates and obtains a temporary key tempkey according to the first random number of 24 bytes, and then the encryption chip generates a second random number of 32 bytes and sends the second random number to a data dispatching center of the satellite communication system;
the encryption chip calculates and obtains a first mac information verification code according to the temporary key tempkey and sends the first mac information verification code to the data scheduling center; and the data scheduling center calculates and obtains a second mac according to the 32-byte second random number and compares the second mac with the first mac, if the second mac is equal to the first mac, the satellite terminal is allowed to access the network, and otherwise, the satellite terminal is refused to access the network.
Furthermore, the first random number is generated by the data dispatching center, the data dispatching center firstly sends the first random number to the satellite terminal, and the satellite terminal then sends the first random number to the encryption chip.
Further, the process of sending the second random number to the data scheduling center is as follows: the encryption chip generates a 32-byte second random number and sends the second random number to the satellite terminal, and then the satellite terminal sends the second random number to the data dispatching center.
Further, the process that the encryption chip calculates to obtain the first mac according to the temporary key tempkey and sends the first mac to the data dispatching center is as follows: the encryption chip calculates and obtains a derivative key derivative according to the tempkey and the root key, and then the encryption chip calculates and obtains the first mac according to the tempkey and the derivative key;
the encryption chip firstly sends the first mac to a satellite terminal, and then the satellite terminal sends the first mac to the data scheduling center.
Further, the root key is stored in the data area of the encryption chip and a core network of the satellite communication system in advance, and the data area cannot be read and written.
Further, the data scheduling center calculates, according to the 32-byte second random number, a second mac as:
the data scheduling center calculates and obtains a second mac according to the 32-byte second random number and the root key;
the process of the data scheduling center for acquiring the root key is as follows: the satellite terminal sends a sequence SN number and a network access request signal to the data scheduling center, the data scheduling center sends the SN number to a core network of a satellite communication system and requests to acquire a root key, and the core network sends the root key to the data scheduling center.
Further, the encryption chip and the satellite terminal adopt an icc communication protocol for communication.
Further, the encryption chip is an ATSHA204A encryption chip.
Has the advantages that:
(1) a satellite terminal network access authentication device based on an encryption chip, wherein the satellite terminal adopts the encryption chip, so that the information security level of a satellite communication system is improved; the encryption chip calculates and obtains the temporary key tempkey according to the first random number of 24 bytes, and then the encryption chip generates a second random number of 32 bytes and sends the second random number to a data scheduling center of the satellite communication system.
(2) When the first mac is calculated, the derivative key derivekey is calculated first, and then the first mac is obtained through calculation of the tempkey and the derivekey, so that brute force cracking can be prevented, and the information security level of the satellite communication system is further improved.
(3) The data area of the ATSHA204A encryption chip is set to be unreadable, so that the root key can be prevented from being cracked, and the safety of the satellite communication system is ensured.
Drawings
Fig. 1 is a schematic diagram of a satellite communication network framework of a satellite terminal network access authentication device based on an encryption chip according to the present invention.
Fig. 2 is a schematic diagram of a satellite terminal architecture according to the present invention.
Fig. 3 is a network access authentication flow chart of the satellite terminal network access authentication device based on the encryption chip.
Detailed Description
A satellite terminal network access authentication device based on an encryption chip adopts the encryption chip at a satellite terminal of a satellite communication system; the encryption chip calculates and obtains a temporary key tempkey according to the first random number of 24 bytes, and then generates a second random number of 32 bytes and sends the second random number to a data dispatching center of the satellite communication system. The encryption chip calculates and obtains a first mac information verification code according to the temporary key tempkey and sends the first mac information verification code to the data scheduling center; and the data scheduling center calculates and obtains a second mac according to the 32-byte second random number and compares the second mac with the first mac information verification code, if the second mac is equal to the first mac information verification code, the satellite terminal is allowed to access the network, and if the second mac is not equal to the first mac information verification code, the satellite terminal is refused to access the network. The device provided by the invention can simply and quickly authenticate, improves the network access efficiency and also improves the information security level. Wherein mac is an abbreviation of Message Authentication Codes.
The invention is described in detail below by way of example with reference to the accompanying drawings.
The encryption chip used only by the invention is an ATSHA204A encryption chip, and firstly, the ATSHA204A encryption chip and the algorithm thereof are introduced:
the ATSHA204A encryption chip is a high-security and rich-function encryption IC developed by ATMEL company, and uses SHA-256 algorithm to perform encryption operation, a slot (EEPROM) with 16 x 32 bytes is built in the chip to store user data and a secret key, a unique 9-byte serial number is used for distinguishing other chips, and an OTP area with 512bits is used for storing some fixed information. The chip has 2 middle communication modes outside the chip, namely a single bus mode and an I2c mode, and the invention uses an I2C mode.
ATSHA204A encrypts the rom inside the chip into three areas, one is config zone, one is slot zone, and the other is OTP zone. Once the config area and the data area of the chip are locked, there is no way to unlock, and the locked device can only be locked through lock command. The config area can use a write command to perform a write operation when it is not locked. Before the config lock, the data region (including the slot region and the OTP region) cannot be written or read. After the config is locked and before the data area is locked, the data area can only be written and can not be read, and after the data area is locked, reading and writing can be carried out according to the configuration in the config.
ATSHA204 supports a standard challenge-response protocol to simplify programming. The most basic case is that the host system sends a challenge to the device in the client, which combines the challenge with the key of the MAC command from the system. The device uses a cryptographic hash algorithm on the combination that prevents an observer on the bus from deriving the value of the key, but allows the receiver to verify that the response is correct by performing the same calculation (combining the challenge with the secret) and the stored copy of the secret.
The secure Hash algorithm SHA (secure Hash Algorithm) is a series of cryptographic Hash functions issued by the National Security Agency (NSA) and published by the National Institute of Standards and Technology (NIST), including variations of SHA-1, SHA-224, SHA-256, SHA-384, and SHA-512. Is mainly suitable for Digital Signature Algorithm (Digital Signature Algorithm DSA) defined in Digital Signature Standard (DSS)
The SHA algorithm is mainly characterized in that an input with an arbitrary length can generate an output with a fixed length, the content of the input cannot be restored from the output result, and the situation that the same output is caused by finding two different inputs cannot be realized in a calculation mode.
The satellite communication system consists of a satellite end, a ground end and a user end. The satellite end plays a role of a relay station in the air, namely, electromagnetic waves transmitted by a ground station are amplified and then returned to another ground station, and the satellite body comprises two major subsystems: on-board equipment and satellite masters. The ground station is the interface between the satellite system and the ground public network, and the ground user can enter and exit the satellite system via the ground station to form a link. The user terminal is various satellite user terminals.
As shown in fig. 1, the satellite communication network architecture adopted by the present invention is composed of a satellite terminal, a satellite, a line card, a data scheduling center and a core network, wherein the satellite terminal is a user terminal.
For any communication system, security is crucial. Common copy cards and pseudo base stations face threats to a communication system and threats to information security. Authentication is to authenticate the authenticity of a terminal or a network and ensure the security of communication data (not intercepted, not tampered and not forged). Compared with the complex authentication mechanism based on the sim card in LTE and 5G, the invention provides an authentication scheme different from the sim card in the field of satellite communication. The invention adopts the sha204 encryption chip to encrypt and authenticate, and provides a relatively simple and convenient authentication process, thereby greatly improving the network access efficiency. As shown in fig. 2, the terminal architecture of the present invention employs an encryption chip to communicate with a satellite terminal through ic.
The SHA256 algorithm used by the ATSHA204 can output a fixed-length output of 32 bytes (256 bits), and based on the characteristics of the SHA algorithm, program-initiated key verification or key verification of a server and a client can be completely achieved to protect our products.
There are four principals involved in authentication and key agreement: the ATSHA204A comprises an encryption chip, a satellite terminal, a data scheduling management center and a core network. Firstly, a root key needs to be burnt and written in a data area of an ATSHA204A encryption chip, and the data area is set to be unreadable or unwritable, so that the root key cannot be cracked; and then storing a root key of the corresponding terminal at the core network side. The specific authentication process is shown in fig. 3, and includes the following steps:
the first step is as follows: and the satellite terminal sends the SN number and the network access request signal to the data scheduling center.
The second step is that: and the data scheduling center sends the SN number to a core network to request for acquiring the root key of the SN number.
The third step: and the core network sends the root key to the data scheduling center.
The fourth step: the data scheduling center generates a20 byte random number, i.e., a first random number, to the satellite terminal.
The fifth step: the satellite terminal uses the 20byte random number to control the sha204 chip, namely the ATSHA204A encryption chip, to generate tempkey through the ic interface.
And a sixth step: the ATSHA204A encryption chip generates a 32byte random number, i.e. a second random number, and sends the second random number to the satellite terminal.
The seventh step: and the satellite terminal sends the 32byte random number generated by the sha204 chip to the data scheduling center.
Eighth step: the satellite terminal sends a command to make the ATSHA204A encryption chip calculate a drive key using the tempkey and the root key.
The ninth step: the satellite terminal sends a command to enable the ATSHA204A encryption chip to calculate the first mac information verification code by using tempkey and derivekey.
The tenth step: the ATSHA204A cryptographic chip sends the generated first mac info validation code of 32 bytes to the satellite terminal.
The eleventh step: the satellite terminal sends the 32byte first mac info validation code to the data dispatch center.
The twelfth step: the data scheduling center calculates and obtains a second mac information verification code according to the second random number of 32 bytes and the root key; and comparing the second mac information verification code with the first mac information verification code, if the second mac information verification code is equal to the first mac information verification code, allowing the satellite terminal to access the network, and otherwise, refusing the satellite terminal to access the network.
The invention provides a satellite terminal network access authentication device based on an encryption chip, which has a complex authentication flow compared with a sim card authentication mode of LTE (Long term evolution), wherein the sim card is generally used in a public network, and a private network cannot open an account to obtain the sim card while an operator; therefore, if the root key is put on the flash, the probability of the root key being cracked is greatly increased. The invention puts the root key on the encryption chip, and uses the root key to calculate the drive key, so that the continuous change of the key, namely the root key is calculated to obtain the drive key, and the air interface transmission only transmits the mac information verification code and the random number, thereby ensuring that the satellite terminal cannot be cracked.
The above embodiments only describe the design principle of the present invention, and the shapes and names of the components in the description may be different without limitation. Therefore, a person skilled in the art of the present invention can modify or substitute the technical solutions described in the foregoing embodiments; such modifications and substitutions do not depart from the spirit and scope of the present invention.

Claims (8)

1. A satellite terminal network access authentication device based on an encryption chip is characterized in that the encryption chip is adopted in a satellite terminal of a satellite communication system; the encryption chip calculates and obtains a temporary key tempkey according to the first random number of 24 bytes, and then the encryption chip generates a second random number of 32 bytes and sends the second random number to a data dispatching center of the satellite communication system;
the encryption chip calculates and obtains a first mac information verification code according to the temporary key tempkey and sends the first mac information verification code to the data scheduling center; and the data scheduling center calculates and obtains a second mac according to the 32-byte second random number and compares the second mac with the first mac, if the second mac is equal to the first mac, the satellite terminal is allowed to access the network, and otherwise, the satellite terminal is refused to access the network.
2. The satellite terminal network access authentication device according to claim 1, wherein the first random number is generated by the data scheduling center, the data scheduling center first sends the first random number to the satellite terminal, and the satellite terminal then sends the first random number to the encryption chip.
3. The satellite terminal network access authentication device of claim 1, wherein the second random number is sent to the data scheduling center by: the encryption chip generates a 32-byte second random number and sends the second random number to the satellite terminal, and then the satellite terminal sends the second random number to the data dispatching center.
4. The satellite terminal network access authentication device of claim 1, wherein the process of the encryption chip obtaining the first mac according to the temporary key tempkey calculation and sending the first mac to the data scheduling center is as follows: the encryption chip calculates according to the tempkey and the root key to obtain a derivative key, and then the encryption chip calculates according to the tempkey and the derivative key to obtain the first mac;
the encryption chip firstly sends the first mac to a satellite terminal, and then the satellite terminal sends the first mac to the data scheduling center.
5. The satellite terminal network access authentication device of claim 4, wherein the root key is pre-stored in a data area of the encryption chip and a core network of a satellite communication system, and the data area cannot be read and written.
6. The satellite terminal network-accessing authentication device according to claim 4, wherein the data scheduling center calculates, according to the 32-byte second random number, a second mac as:
the data scheduling center calculates and obtains a second mac according to the 32-byte second random number and the root key;
the process of the data scheduling center for acquiring the root key is as follows: the satellite terminal sends a sequence SN number and a network access request signal to the data scheduling center, the data scheduling center sends the SN number to a core network of a satellite communication system and requests to acquire a root key, and the core network sends the root key to the data scheduling center.
7. The satellite terminal network access authentication device of claim 1, wherein the encryption chip and the satellite terminal communicate using an icc communication protocol.
8. The satellite terminal network access authentication device according to any one of claims 1 to 7, wherein the encryption chip is an ATSHA204A encryption chip.
CN202210267333.5A 2022-03-17 2022-03-17 Satellite terminal network access authentication device based on encryption chip Active CN114827998B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202210267333.5A CN114827998B (en) 2022-03-17 2022-03-17 Satellite terminal network access authentication device based on encryption chip

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202210267333.5A CN114827998B (en) 2022-03-17 2022-03-17 Satellite terminal network access authentication device based on encryption chip

Publications (2)

Publication Number Publication Date
CN114827998A true CN114827998A (en) 2022-07-29
CN114827998B CN114827998B (en) 2023-11-17

Family

ID=82528079

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202210267333.5A Active CN114827998B (en) 2022-03-17 2022-03-17 Satellite terminal network access authentication device based on encryption chip

Country Status (1)

Country Link
CN (1) CN114827998B (en)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116886404A (en) * 2023-08-04 2023-10-13 中国电子信息产业集团有限公司第六研究所 Satellite internet key management system and method

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108008420A (en) * 2017-11-30 2018-05-08 北京卫星信息工程研究所 Beidou navigation text authentication method based on Big Dipper short message
CN110971415A (en) * 2019-12-13 2020-04-07 重庆邮电大学 Space-ground integrated space information network anonymous access authentication method and system
CN111431586A (en) * 2020-04-17 2020-07-17 中国电子科技集团公司第三十八研究所 Satellite network safety communication method
US20220030473A1 (en) * 2020-07-27 2022-01-27 Southwest Jiaotong University Method for batch handover authentication and key agreement oriented to heterogeneous network

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108008420A (en) * 2017-11-30 2018-05-08 北京卫星信息工程研究所 Beidou navigation text authentication method based on Big Dipper short message
CN110971415A (en) * 2019-12-13 2020-04-07 重庆邮电大学 Space-ground integrated space information network anonymous access authentication method and system
CN111431586A (en) * 2020-04-17 2020-07-17 中国电子科技集团公司第三十八研究所 Satellite network safety communication method
US20220030473A1 (en) * 2020-07-27 2022-01-27 Southwest Jiaotong University Method for batch handover authentication and key agreement oriented to heterogeneous network

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116886404A (en) * 2023-08-04 2023-10-13 中国电子信息产业集团有限公司第六研究所 Satellite internet key management system and method

Also Published As

Publication number Publication date
CN114827998B (en) 2023-11-17

Similar Documents

Publication Publication Date Title
US9003516B2 (en) System and method for encrypted smart card pin entry
CN102546155B (en) On-demand safe key generates method and system
CN101583124B (en) Authentication method and system of subscriber identity module and terminal
RU2258324C2 (en) Method for activation of pki functions on intellectual card
US7362869B2 (en) Method of distributing a public key
CN100555933C (en) Portable data storage device with encryption system
US8386794B2 (en) Apparatus and method for protecting RFID data
CN100590639C (en) System and method for managing multiple smart card sessions
US20060231623A1 (en) Controlling connectivity of a wireless smart card reader
US7000117B2 (en) Method and device for authenticating locally-stored program code
US20030236983A1 (en) Secure data transfer in mobile terminals and methods therefor
CN101777978A (en) Method and system based on wireless terminal for applying digital certificate and wireless terminal
CN1910531B (en) Method and system used for key control of data resource, related network
US11546163B2 (en) System for performing service by using biometric information, and control method therefor
CN106912046A (en) One-pass key card and vehicle pairs
CN101990201B (en) Method, system and device for generating general bootstrapping architecture (GBA) secret key
CN115396121A (en) Security authentication method for security chip OTA data packet and security chip device
CN103731266A (en) Method and system for authenticating electronic certificate
CN106027457A (en) Identity card information transmission method and system
CN114827998B (en) Satellite terminal network access authentication device based on encryption chip
CN1612522B (en) Challenge-based authentication without requiring knowledge of secret authentication data
CN101860850A (en) Method for realizing mobile terminal to lock network or card by utilizing driver
CN107609878A (en) A kind of safety certifying method and system of shared automobile
KR20210108420A (en) Location information providing system and method of providing location information
CN105490814A (en) Ticket real name authentication method and system based on three-dimensional code

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant