CN114827998B - Satellite terminal network access authentication device based on encryption chip - Google Patents

Satellite terminal network access authentication device based on encryption chip Download PDF

Info

Publication number
CN114827998B
CN114827998B CN202210267333.5A CN202210267333A CN114827998B CN 114827998 B CN114827998 B CN 114827998B CN 202210267333 A CN202210267333 A CN 202210267333A CN 114827998 B CN114827998 B CN 114827998B
Authority
CN
China
Prior art keywords
encryption chip
random number
satellite terminal
mac
data scheduling
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN202210267333.5A
Other languages
Chinese (zh)
Other versions
CN114827998A (en
Inventor
高颂
黄曜明
曹天洋
姬天相
张超
冯帅
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Beijing Aerospace Science & Industry Century Satellite Hi Tech Co ltd
Original Assignee
Beijing Aerospace Science & Industry Century Satellite Hi Tech Co ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Beijing Aerospace Science & Industry Century Satellite Hi Tech Co ltd filed Critical Beijing Aerospace Science & Industry Century Satellite Hi Tech Co ltd
Priority to CN202210267333.5A priority Critical patent/CN114827998B/en
Publication of CN114827998A publication Critical patent/CN114827998A/en
Application granted granted Critical
Publication of CN114827998B publication Critical patent/CN114827998B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04WWIRELESS COMMUNICATION NETWORKS
    • H04W12/00Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06Authentication
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/06Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
    • H04L9/0643Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H04L9/3228One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04WWIRELESS COMMUNICATION NETWORKS
    • H04W84/00Network topologies
    • H04W84/02Hierarchically pre-organised networks, e.g. paging networks, cellular networks, WLAN [Wireless Local Area Network] or WLL [Wireless Local Loop]
    • H04W84/04Large scale networks; Deep hierarchical networks
    • H04W84/06Airborne or Satellite Networks

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Power Engineering (AREA)
  • Physics & Mathematics (AREA)
  • Astronomy & Astrophysics (AREA)
  • General Physics & Mathematics (AREA)
  • Radio Relay Systems (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

The invention discloses a satellite terminal network access authentication device based on an encryption chip, wherein the encryption chip is adopted in a satellite terminal of a satellite communication system; the encryption chip calculates and obtains a temporary key tempkey according to the first random number of 24 bytes, and then generates a second random number of 32 bytes and sends the second random number to a data scheduling center of the satellite communication system. The encryption chip obtains a first mac information verification code according to temporary key calculation and sends the first mac information verification code to the data scheduling center; and the data scheduling center calculates and obtains a second mac information verification code according to the second random number of 32 bytes, compares the second mac information verification code with the first mac information verification code, allows the satellite terminal to access the network if the second mac information verification code is equal to the first mac information verification code, and refuses the satellite terminal to access the network if the second mac information verification code is not equal to the first mac information verification code. The device provided by the invention can simply and rapidly authenticate, improves the network access efficiency, and improves the information security level.

Description

Satellite terminal network access authentication device based on encryption chip
Technical Field
The invention relates to the technical field of satellite communication, in particular to a satellite terminal network access authentication device based on an encryption chip.
Background
In a mobile satellite communication system, a user segment needs to access a mobile satellite communication network through a ground segment for mobile communication. The communication terminal representing the user section can have different expression forms, such as a handheld terminal, a vehicle-mounted terminal, a ship-mounted terminal and the like, and the user terminal is used for realizing the setting and acquisition of the communication state of a terminal user by installing a wireless receiving and transmitting antenna so as to complete communication.
In the current authentication scheme of satellite communication, authentication is performed by adopting an authentication mechanism of LTE through a sim card, the authentication scheme is complex, and the satellite communication field is not used. In addition, the scheme of using flash to keep the root key at the terminal side is used for authentication, the scheme is too simple, the root key is not well protected, and information security accidents are easily caused.
Disclosure of Invention
In view of the above, the invention provides a satellite terminal network access authentication device based on an encryption chip, which can simply and rapidly authenticate, improves network access efficiency and improves information security level.
The invention adopts the following specific technical scheme:
an encryption chip-based satellite terminal network access authentication device adopts an encryption chip at a satellite terminal of a satellite communication system; the encryption chip calculates and obtains a temporary key tempkey according to a first random number of 24 bytes, and then the encryption chip generates a second random number of 32 bytes and sends the second random number to a data scheduling center of the satellite communication system;
the encryption chip obtains a first mac information verification code according to the temporary key calculation and sends the first mac information verification code to the data scheduling center; and the data scheduling center calculates and obtains a second mac according to the second random number of 32 bytes and compares the second mac with the first mac, if the second mac is equal to the first mac, the satellite terminal is allowed to access the network, and otherwise, the satellite terminal is refused to access the network.
Further, the first random number is generated by the data scheduling center, the data scheduling center firstly transmits the first random number to a satellite terminal, and the satellite terminal transmits the first random number to an encryption chip.
Further, the process of sending the second random number to the data scheduling center is as follows: the encryption chip generates a second random number of 32 bytes and sends the second random number to the satellite terminal, and then the satellite terminal sends the second random number to the data scheduling center.
Further, the process that the encryption chip obtains the first mac according to the temporary key tempkey calculation and sends the first mac to the data scheduling center is as follows: the encryption chip calculates and obtains a derivative key according to the tempkey and the root key, and then the encryption chip calculates and obtains the first mac according to the tempkey and the derivative key;
the encryption chip firstly transmits the first mac to a satellite terminal, and then the satellite terminal transmits the first mac to the data scheduling center.
Further, the root key is prestored in a data area of the encryption chip and a core network of a satellite communication system, and the data area cannot be read and written.
Further, the data scheduling center calculates a second mac according to the second random number of 32 bytes, where the second mac is:
the data scheduling center calculates and obtains a second mac according to the second random number of 32 bytes and a root key;
the process of the data scheduling center obtaining the root key is as follows: the satellite terminal sends a sequence SN number and a network access request signal to the data scheduling center, the data scheduling center sends the SN number to a core network of a satellite communication system and requests to acquire a root key, and the core network sends the root key to the data scheduling center.
Further, the encryption chip and the satellite terminal communicate by adopting an icc communication protocol.
Further, the encryption chip is an ATSHA204A encryption chip.
The beneficial effects are that:
(1) The satellite terminal network access authentication device based on the encryption chip improves the information security level of a satellite communication system by adopting the encryption chip; the encryption chip calculates and obtains the temporary key tempkey according to the first random number of 24 bytes, then the encryption chip generates the second random number of 32 bytes and sends the second random number to the data scheduling center of the satellite communication system, and compared with the traditional authentication device, the device using the random number is simpler and more convenient, and the network access efficiency is improved.
(2) When the first mac is calculated, the derivative key is calculated first, then the root tempkey and the derivative key are calculated to obtain the first mac, so that the occurrence of brute force cracking can be prevented, and the information security level of the satellite communication system is further improved.
(3) The data area of the ATSHA204A encryption chip is set to be incapable of reading and writing, so that the root key can be prevented from being cracked, and the safety of a satellite communication system is ensured.
Drawings
Fig. 1 is a schematic diagram of a satellite communication network framework of a satellite terminal network access authentication device based on an encryption chip.
Fig. 2 is a schematic view of a satellite terminal architecture according to the present invention.
Fig. 3 is a network access authentication flow chart of the satellite terminal network access authentication device based on the encryption chip.
Detailed Description
An encryption chip-based satellite terminal network access authentication device adopts an encryption chip at a satellite terminal of a satellite communication system; the encryption chip calculates and obtains a temporary key tempkey according to the first random number of 24 bytes, and then generates a second random number of 32 bytes and sends the second random number to a data scheduling center of the satellite communication system. The encryption chip obtains a first mac information verification code according to temporary key calculation and sends the first mac information verification code to the data scheduling center; and the data scheduling center calculates and obtains a second mac and the first mac information verification code according to the second random number of 32 bytes, compares the second mac with the first mac information verification code, allows the satellite terminal to access the network if the second mac and the first mac information verification code are equal, and refuses the satellite terminal to access the network if the second mac and the first mac information verification code are equal. The device provided by the invention can simply and rapidly authenticate, improves the network access efficiency, and improves the information security level. Where mac is an abbreviation for Message Authentication Codes information verification code.
The invention will now be described in detail by way of example with reference to the accompanying drawings.
The encryption chip used in the invention is an ATSHA204A encryption chip, and firstly, the ATSHA204A encryption chip and an algorithm thereof are introduced:
the ATSHA204A encryption chip is a high-security and functional encryption IC developed by ATMEL company, encryption operation is carried out by using an SHA-256 algorithm, a slot (EEPROM) with 16 x 32 bytes is built in and can store user data and a secret key, a unique 9-byte serial number is used for distinguishing other chips, and an OTP area with 512bits is used for storing some fixed information. The chip has 2 communication modes, namely a single bus mode and an I2C mode, and the I2C mode is used in the invention.
The ATSHA204A encrypts the chip internal rom into three areas, one is a config zone, one is a slot zone, and the other is an OTP zone. Once the config area and the data area of the chip are locked, there is no way to unlock, and the locked device can only be locked by lock command. The config area may use write command to perform a write operation when not locked. The data region (including the slot region and the OTP region) is neither writable nor readable until config is locked. After config locking, the data area can only be written and not read before locking, and after locking, the data area can be written and read according to the configuration in config.
The ATSHA204 supports a standard challenge-response protocol to simplify programming. In the most basic case, the host system sends a challenge to the device in the client, which combines the challenge with the key of the MAC command from the system. The device pair in combination uses a cryptographic hash algorithm that prevents an observer on the bus from deriving the value of the key, but allows the recipient to verify that the response is correct by performing the same calculation (combining the challenge with the secret) with the stored copy of the secret.
The secure hash algorithm SHA (Secure Hash Algorithm) is a series of cryptographic hash functions issued by the National Security Agency (NSA) design, the National Institute of Standards and Technology (NIST), including variants of SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, and the like. Digital signature algorithm (Digital Signature Algorithm DSA) mainly applicable to definition in digital signature standard (DigitalSignature Standard DSS)
The SHA algorithm is mainly characterized in that an input with any length can generate an output with a fixed length, the content of the input cannot be restored from the output result, and the situation that the same output is caused by two different inputs is found out cannot be realized computationally.
The satellite communication system consists of a satellite end, a ground end and a user end. The satellite end plays a role of a relay station in the air, namely, electromagnetic waves sent by the ground station are amplified and then returned to another ground station, and the satellite comprises two subsystems: a satellite-borne device and a satellite precursor. The ground station is the interface between the satellite system and the ground public network, and the ground user can enter and exit the satellite system through the ground station to form a link, and the ground station also comprises a ground satellite control center and tracking, telemetering and instruction stations thereof. The user terminal is various satellite user terminals.
As shown in fig. 1, the satellite communication network architecture adopted by the invention is composed of a satellite terminal, a satellite, a line card, a data scheduling center and a core network, wherein the satellite terminal is a user terminal.
Security is critical for any communication system. The common copy card and the pseudo base station face the threat to the communication system and the threat to the information security. Authentication is to identify the authenticity of a terminal or a network, and ensure the safety of communication data (without interception, falsification and falsification). Compared with the complicated authentication mechanism based on sim cards of LTE and 5G, the invention provides an authentication scheme different from sim cards in the field of satellite communication. The invention adopts the sha204 encryption chip to encrypt and authenticate, and provides a relatively simple and convenient authentication flow, thereby greatly improving the network access efficiency. As shown in fig. 2, the terminal architecture of the present invention uses a cryptographic chip to communicate with a satellite terminal through iic.
The SHA256 algorithm used by the ATSHA204 can output a fixed length output of 32 bytes (256 bits), and based on the characteristics of the SHA algorithm, the key verification of program start or the key verification of the server and the client can be completely achieved to protect the product.
There are four principals involved in authentication and key agreement: the ATSHA204A encryption chip, a satellite terminal, a data scheduling management center and a core network. Firstly, the root key is required to be programmed into the data area of the ATSHA204A encryption chip, and the data area is set to be unreadable or unwritable, so that the root key cannot be cracked; then, a root key of the corresponding terminal is also stored on the core network side. The specific authentication flow is shown in fig. 3, and comprises the following steps:
the first step: the satellite terminal sends the sequence SN number and the network access request signal to the data dispatching center.
And a second step of: the data scheduling center sends the SN number to the core network to request the root key of the SN number.
And a third step of: the core network sends the root key to the data scheduling center.
Fourth step: the data scheduling center generates a20 byte random number, i.e., a first random number, to the satellite terminal.
Fifth step: the satellite terminal uses the 20byte random number to control the sha204 chip, namely the ATSHA204A encryption chip, to generate a tempkey through the iic interface.
Sixth step: the ATSHA204A encryption chip generates a 32byte random number, i.e., a second random number, and transmits the second random number to the satellite terminal.
Seventh step: the satellite terminal sends the 32byte random number generated by the sha204 chip to the data scheduling center.
Eighth step: the satellite terminal sends a command to the ATSHA204A encryption chip to calculate the devivekey using the temp key and the root key.
Ninth step: the satellite terminal sends a command to the ATSHA204A encryption chip to calculate the first mac information verification code using the tempkey and the devivekey.
Tenth step: the ATSHA204A encryption chip transmits the generated first mac information verification code of 32 bytes to the satellite terminal.
Eleventh step: the satellite terminal sends the first mac information verification code of 32 bytes to the data scheduling center.
Twelfth step: the data scheduling center calculates and obtains a second mac information verification code according to the second random number of 32 bytes and the root key; and comparing the second mac information verification code with the first mac information verification code by the data scheduling center, and allowing the satellite terminal to access the network if the second mac information verification code is equal to the first mac information verification code, otherwise, refusing the satellite terminal to access the network.
The invention provides a satellite terminal network access authentication device based on an encryption chip, which is complex in authentication flow compared with a sim card authentication mode of LTE, and sim cards are generally used in public networks, and a private network cannot access an account from an operator to obtain the sim cards; therefore, if the root key is put on the flash, the probability of cracking the root key is greatly increased. The invention puts the root key on the encryption chip, and calculates the derivative key by using the root key, so that the derivative key is obtained by continuously changing the key, namely calculating the root key, and the air interface transmission only transmits the mac information verification code and the random number, thereby ensuring that the satellite terminal cannot be cracked.
The above specific embodiments merely describe the design principle of the present invention, and the shapes of the components in the description may be different, and the names are not limited. Therefore, the technical scheme described in the foregoing embodiments can be modified or replaced equivalently by those skilled in the art; such modifications and substitutions do not depart from the spirit and technical scope of the invention, and all of them should be considered to fall within the scope of the invention.

Claims (8)

1. The satellite terminal network access authentication device based on the encryption chip is characterized in that the encryption chip is adopted in a satellite terminal of a satellite communication system; the encryption chip calculates and obtains a temporary key tempkey according to a first random number of 24 bytes, and then the encryption chip generates a second random number of 32 bytes and sends the second random number to a data scheduling center of the satellite communication system;
the encryption chip obtains a first mac information verification code according to the temporary key calculation and sends the first mac information verification code to the data scheduling center; and the data scheduling center calculates and obtains a second mac according to the second random number of 32 bytes and compares the second mac with the first mac, if the second mac is equal to the first mac, the satellite terminal is allowed to access the network, and otherwise, the satellite terminal is refused to access the network.
2. The apparatus of claim 1, wherein the first random number is generated by the data scheduling center, the data scheduling center first transmits the first random number to a satellite terminal, and the satellite terminal then transmits the first random number to an encryption chip.
3. The apparatus for authenticating a satellite terminal to access the network as set forth in claim 1, wherein the process of sending the second random number to the data scheduling center is: the encryption chip generates a second random number of 32 bytes and sends the second random number to the satellite terminal, and then the satellite terminal sends the second random number to the data scheduling center.
4. The apparatus for authenticating a satellite terminal to the network as set forth in claim 1, wherein the process that the encryption chip obtains the first mac according to the temporary key tempkey calculation and sends the first mac to the data scheduling center is: the encryption chip calculates and obtains a derivative key according to the tempkey and the root key, and then the encryption chip calculates and obtains the first mac according to the tempkey and the derivative key;
the encryption chip firstly transmits the first mac to a satellite terminal, and then the satellite terminal transmits the first mac to the data scheduling center.
5. The apparatus of claim 4, wherein the root key is pre-stored in a data area of the encryption chip and a core network of a satellite communication system, and the data area cannot be read and written.
6. The apparatus for authenticating a satellite terminal to network as recited in claim 4, wherein the data scheduling center calculates a second mac from the second random number of 32 bytes as:
the data scheduling center calculates and obtains a second mac according to the second random number of 32 bytes and a root key;
the process of the data scheduling center obtaining the root key is as follows: the satellite terminal sends a sequence SN number and a network access request signal to the data scheduling center, the data scheduling center sends the SN number to a core network of a satellite communication system and requests to acquire a root key, and the core network sends the root key to the data scheduling center.
7. The apparatus of claim 1, wherein the encryption chip communicates with the satellite terminal using an icc communication protocol.
8. The apparatus for authenticating satellite terminal access according to any one of claims 1 to 7, wherein the encryption chip is an ATSHA204A encryption chip.
CN202210267333.5A 2022-03-17 2022-03-17 Satellite terminal network access authentication device based on encryption chip Active CN114827998B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202210267333.5A CN114827998B (en) 2022-03-17 2022-03-17 Satellite terminal network access authentication device based on encryption chip

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202210267333.5A CN114827998B (en) 2022-03-17 2022-03-17 Satellite terminal network access authentication device based on encryption chip

Publications (2)

Publication Number Publication Date
CN114827998A CN114827998A (en) 2022-07-29
CN114827998B true CN114827998B (en) 2023-11-17

Family

ID=82528079

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202210267333.5A Active CN114827998B (en) 2022-03-17 2022-03-17 Satellite terminal network access authentication device based on encryption chip

Country Status (1)

Country Link
CN (1) CN114827998B (en)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116886404A (en) * 2023-08-04 2023-10-13 中国电子信息产业集团有限公司第六研究所 Satellite internet key management system and method

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108008420A (en) * 2017-11-30 2018-05-08 北京卫星信息工程研究所 Beidou navigation text authentication method based on Big Dipper short message
CN110971415A (en) * 2019-12-13 2020-04-07 重庆邮电大学 Space-ground integrated space information network anonymous access authentication method and system
CN111431586A (en) * 2020-04-17 2020-07-17 中国电子科技集团公司第三十八研究所 Satellite network safety communication method

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111885602B (en) * 2020-07-27 2021-04-27 西南交通大学 Heterogeneous network-oriented batch switching authentication and key agreement method

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108008420A (en) * 2017-11-30 2018-05-08 北京卫星信息工程研究所 Beidou navigation text authentication method based on Big Dipper short message
CN110971415A (en) * 2019-12-13 2020-04-07 重庆邮电大学 Space-ground integrated space information network anonymous access authentication method and system
CN111431586A (en) * 2020-04-17 2020-07-17 中国电子科技集团公司第三十八研究所 Satellite network safety communication method

Also Published As

Publication number Publication date
CN114827998A (en) 2022-07-29

Similar Documents

Publication Publication Date Title
US9003516B2 (en) System and method for encrypted smart card pin entry
US8386794B2 (en) Apparatus and method for protecting RFID data
CN101583124B (en) Authentication method and system of subscriber identity module and terminal
US8526606B2 (en) On-demand secure key generation in a vehicle-to-vehicle communication network
US7362869B2 (en) Method of distributing a public key
CN100374971C (en) Securing access to an application service based on a proximity token
CN101527911B (en) Communication device and communication method
US20110113241A1 (en) Ic card, ic card system, and method thereof
US20030236983A1 (en) Secure data transfer in mobile terminals and methods therefor
US7000117B2 (en) Method and device for authenticating locally-stored program code
CN110990827A (en) Identity information verification method, server and storage medium
CN101777978A (en) Method and system based on wireless terminal for applying digital certificate and wireless terminal
CN105162596A (en) A strong authentication token generating one-time passwords and signatures upon server credential verification
US9143323B2 (en) Securing a link between two devices
CA2417770A1 (en) Trusted authentication digital signature (tads) system
CN102215221A (en) Methods and systems for secure remote wake, boot, and login to a computer from a mobile device
CN100421372C (en) Method of safety transmitting key
CN101216923A (en) A system and method to enhance the data security of e-bank dealings
US11546163B2 (en) System for performing service by using biometric information, and control method therefor
CN104868998A (en) System, Device, And Method Of Provisioning Cryptographic Data To Electronic Devices
CN111583482A (en) Access control system based on two-dimensional code and control method thereof
CN114827998B (en) Satellite terminal network access authentication device based on encryption chip
CN109302442B (en) Data storage proving method and related equipment
CN1848725B (en) Method and apparatus for securing a communicaton link between a first and a second device
KR20150005788A (en) Method for authenticating by using user's key value

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant