WO2023011376A1 - 一种北斗通信系统中密钥更新方法、系统及相关装置 - Google Patents

一种北斗通信系统中密钥更新方法、系统及相关装置 Download PDF

Info

Publication number
WO2023011376A1
WO2023011376A1 PCT/CN2022/109253 CN2022109253W WO2023011376A1 WO 2023011376 A1 WO2023011376 A1 WO 2023011376A1 CN 2022109253 W CN2022109253 W CN 2022109253W WO 2023011376 A1 WO2023011376 A1 WO 2023011376A1
Authority
WO
WIPO (PCT)
Prior art keywords
application layer
terminal
network device
beidou
key
Prior art date
Application number
PCT/CN2022/109253
Other languages
English (en)
French (fr)
Inventor
李振洲
钱锋
朱旭东
连海
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2023011376A1 publication Critical patent/WO2023011376A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04B—TRANSMISSION
    • H04B7/00—Radio transmission systems, i.e. using radiation field
    • H04B7/14—Relay systems
    • H04B7/15—Active relay systems
    • H04B7/185—Space-based or airborne stations; Stations for satellite systems
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0433—Key management protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/12—Messaging; Mailboxes; Announcements
    • H04W4/14—Short messaging services, e.g. short message services [SMS] or unstructured supplementary service data [USSD]

Definitions

  • the present application relates to the field of satellite communication, and in particular to a key update method, system and related devices in the Beidou communication system.
  • the Beidou satellite navigation system is a major infrastructure integrating positioning, timing and communication.
  • the Beidou short message communication service is one of the characteristics of the Beidou satellite navigation system that distinguishes it from other global navigation systems such as GPS, GLONASS, and GALILEO.
  • the Beidou short message communication service is especially suitable for communication in areas where mobile communication is not covered, or cannot be covered, or the communication system is damaged, such as oceans, deserts, grasslands, and uninhabited areas.
  • the short message system of the Beidou-3 satellite has upgraded the short message technical system and opened some necessary resources of the communication system of the Beidou short message service to civilian use. According to the civilian business and equipment characteristics, it needs to be based on the Beidou short message service.
  • the characteristics of the communication system design the communication protocol.
  • the types of services provided by the Beidou communication system include: message communication, position reporting and emergency rescue.
  • message communication can communicate with other devices.
  • Location reporting can be used to share location information.
  • Emergency Rescue can be used to connect directly with the emergency rescue center and obtain emergency rescue services. Since the two services of message communication and location reporting need to be forwarded through the operator's short message center, mutual authentication needs to be performed between the terminal and the operator to ensure information security.
  • the communication system of the Beidou short message service does not provide an authentication and encryption mechanism for civilian terminals.
  • the present application provides a key update method, system and related device in the Beidou communication system, which realizes the key update of data transmission between terminals and Beidou network equipment in the Beidou communication system, and ensures the security of data transmission.
  • the present application provides a key update method in the Beidou communication system, including: the terminal generates a first key based on a user identification code IMSI, an identity key Ki, and a sending time of a first application layer message.
  • the terminal encrypts the first original data by using the first key to obtain the first encrypted data.
  • the terminal adds packet header information to the first encrypted data to obtain a first application layer packet.
  • the message header information includes a time indication field and an encryption indication field, the encryption indication field is used to indicate the preset encryption algorithm used when encrypting the first original data, and the time indication field is used to indicate the sending time of the first application layer message information.
  • the terminal sends the first application layer message to the Beidou network device.
  • the terminal can update the key used for encrypting data based on time.
  • the terminal and Beidou network equipment can encrypt and decrypt the data through the key updated over time, and the generation of the key does not require additional signaling interaction steps, which not only saves the resources of the Beidou communication system, but also ensures data security. safety.
  • the sending time of the first application layer message is the first time point or the second time point; wherein, the first time point is the time point when the terminal obtains the first original data, and the second time point The time point obtained when the first key is generated for the terminal.
  • the terminal generates the first key based on the user identification code IMSI, the identity identification key Ki, and the sending time of the first application layer message, which specifically includes: the terminal generates the first key based on the sending time of the first application layer message
  • the time and IMSI get the random number RAND.
  • the terminal obtains the encryption key Kc through the preset key algorithm 1 based on the RAND and the preset Ki, and obtains the authentication symbol response SRES through the preset key algorithm 2.
  • the terminal obtains the first key through preset key algorithm 3 based on Kc and SRES.
  • the method further includes: the terminal may further compress the first original data.
  • the method further includes: the terminal receives the first application layer receipt sent by the Beidou network device, and the first application layer receipt is used to indicate Beidou network equipment successfully decrypted the first application layer message.
  • the method further includes: the terminal generates a third key based on IMSI, Ki and the sending time of the second application layer message; the terminal Use the third key to encrypt the second original data to obtain the second encrypted data; the terminal adds message header information to the second encrypted data to obtain the second application layer message; wherein, the message header information includes a time indication field and An encryption indication field, the encryption indication field is used to indicate the preset encryption algorithm used when encrypting the second original data, and the time indication field is used to indicate the sending time information of the second application layer message; the terminal sends the second application layer to the Beidou network device layer message; the terminal receives the second application layer receipt sent by the Beidou network equipment, and the second application layer receipt is used to indicate that the Beidou network equipment fails to decrypt the second application layer message.
  • the message header information includes a time indication field and An encryption indication field, the encryption indication field is used to indicate the preset encryption algorithm used when encrypting the second original data, and the time indication field is used to indicate the sending time information
  • the terminal determines that the sending time of the first application layer message is the same as the sending time of the second application layer message, and the terminal directly uses the first key to encrypt the second original data to obtain the second encrypted post data.
  • the terminal directly uses the time indication field of the first application layer packet as the time indication field of the second application layer packet.
  • the method further includes: the terminal retransmits the second application layer message.
  • the method further includes: the terminal displays failure prompt information, and the failure prompt information is used to instruct the Beidou network equipment to decrypt the second application layer receipt. Text failed.
  • the value of the time indication field is used to indicate the parity value of the sending time of the first application layer packet.
  • the present application provides another key update method in the Beidou communication system, including: the Beidou network equipment receives the first application layer message sent by the terminal.
  • the first application layer message includes the first encrypted data and message header information
  • the message header information includes a time indication field and an encryption indication field
  • the encryption indication field is used to indicate the preset data used when encrypting the first original data
  • An encryption algorithm the time indication field is used to indicate the sending time information of the first application layer message.
  • the Beidou network device generates the second key through the cellular network device based on the time indication field and the receiving time of the first application layer message.
  • the Beidou network device uses the second key to successfully decrypt the encrypted data to obtain the first original data.
  • the Beidou network device generates the second key through the cellular network device based on the time indication field and the receiving time of the first application layer message, specifically including: the Beidou network device generates the second key based on the time indication field and the first application layer message
  • the receiving time of the first application layer message determines the sending time of the first application layer message; the Beidou network device obtains the random number RAND based on the sending time of the first application layer message and the user identification code IMSI obtained from the cellular network device; the Beidou network device will The RAND is sent to the cellular network device; the Beidou network device obtains the encryption key Kc and the authentication symbol response SRES fed back by the cellular network device; the terminal obtains the second key through the preset key algorithm 3 based on Kc and SRES.
  • the receiving time of the first application layer message is a specified time point between the third time point and the fourth time point, and the unit of the receiving time of the first application layer message is hour; wherein , the third time point is the time point when the Beidou network equipment receives the first satellite link control layer protocol data unit SLC PDU of the first application layer message, and the fourth time point is obtained when the Beidou network equipment generates the second key point in time.
  • the value of the time indication field is used to indicate the parity value of the sending time of the first application layer message.
  • the Beidou network device determines the sending time of the first application layer message based on the time indication field and the receiving time of the first application layer message, specifically including: when the value of the time indication field indicates the first When the parity value of the sending time of the application layer message is the same as the parity value of the receiving time of the first application layer message, the Beidou network device determines the sending time of the first application layer message and the receiving time of the first application layer message same;
  • the Beidou network device determines the receiving time of the first application layer message The difference with the sending time of the first application layer message is 1.
  • the method further includes: the Beidou network device generates a first application layer receipt, and the first The application layer receipt is used to indicate that the Beidou network device has successfully decrypted the first application layer message; the Beidou network device sends the first application layer receipt to the terminal.
  • the method further includes: the Beidou network device receives the second application layer report sent by the terminal Text; wherein, the second application layer message includes the second encrypted data and message header information, the message header information includes a time indication field and an encryption indication field, and the encryption indication field is used to indicate the second original data encrypted.
  • the time indication field is used to indicate the sending time information of the second application layer message; the Beidou network device generates the fourth key through the cellular network device based on the time indication field and the receiving time of the second application layer message; Beidou The network device fails to decrypt the second encrypted data using the fourth key, and the Beidou network device generates a second application layer receipt, which is used to indicate that the Beidou network device fails to decrypt the second application layer message; the Beidou network device sends a message to the terminal Send the second application layer receipt.
  • the Beidou network device determines that the receiving time of the first application layer message is the same as the receiving time of the second application layer message, and the Beidou network device directly uses the first key to decrypt the second encrypted data .
  • the present application provides a Beidou communication system, including: terminals and Beidou network equipment; wherein,
  • the terminal is configured to generate the first key based on the user identification code IMSI, the identity identification key Ki, and the sending time of the first application layer message.
  • the terminal is further configured to use the first key to encrypt the first original data to obtain the first encrypted data.
  • the terminal is further configured to add packet header information to the first encrypted data to obtain a first application layer packet.
  • the message header information includes a time indication field and an encryption indication field
  • the encryption indication field is used to indicate the preset encryption algorithm used when encrypting the first original data
  • the time indication field is used to indicate the sending time of the first application layer message information.
  • the terminal is also used to send the first application layer message to the Beidou network equipment.
  • the Beidou network device is used to receive the first application layer message sent by the terminal.
  • the Beidou network device is further configured to generate a second key through the cellular network device based on the time indication field and the receiving time of the first application layer message.
  • the Beidou network device is further configured to use the second key to successfully decrypt the first encrypted data to obtain the first original data.
  • the terminal may also execute the method in any possible implementation manner of the foregoing first aspect.
  • the Beidou network device may also execute the method in any possible implementation manner of the second aspect above.
  • the present application provides a communication device, including one or more processors, one or more memories, and a transceiver.
  • the transceiver, the one or more memories are coupled to the one or more processors, the one or more memories are used to store computer program codes, the computer program codes include computer instructions, and when the one or more processors execute the computer instructions, the The communication device executes the method in any possible implementation manner of the foregoing first aspect.
  • the communication device may be a terminal or other product form equipment.
  • the present application provides a communication device, including one or more processors, one or more memories, and a transceiver.
  • the transceiver, the one or more memories are coupled to the one or more processors, the one or more memories are used to store computer program codes, the computer program codes include computer instructions, and when the one or more processors execute the computer instructions, the The communication device executes the method in any possible implementation manner of the second aspect above.
  • the communication device may be Beidou network equipment, or any network element or a combination of multiple network elements in the Beidou network equipment.
  • the present application provides a computer storage medium, including computer instructions.
  • the computer instructions When the computer instructions are run on the computer, the computer is made to execute the method in any possible implementation manner of the first aspect above.
  • the present application provides a computer storage medium, including computer instructions.
  • the computer instructions When the computer instructions are run on the computer, the computer is made to execute the method in any possible implementation manner of the second aspect above.
  • the present application provides a computer program product, which, when the computer program product is run on a computer, causes the computer to execute the method in any possible implementation manner of the first aspect above.
  • the present application provides a computer program product, which, when the computer program product is run on a computer, causes the computer to execute the method in any possible implementation manner of the second aspect above.
  • the present application provides a chip or a chip system, which is applied to a terminal, and includes a processing circuit and an interface circuit, the interface circuit is used to receive code instructions and transmit them to the processing circuit, and the processing circuit is used to run the code instructions To execute the method in any possible implementation manner of the first aspect above.
  • FIG. 1 is a schematic flow diagram of authentication encryption in a cellular network provided by an embodiment of the present application
  • FIG. 2 is a schematic structural diagram of a Beidou communication system provided by an embodiment of the present application.
  • FIG. 3A is a schematic diagram of a protocol encapsulation architecture of inbound data of a Beidou communication system provided by an embodiment of the present application;
  • FIG. 3B is a schematic diagram of a protocol analysis framework for inbound data of a Beidou communication system provided by an embodiment of the present application;
  • FIG. 4A is a schematic diagram of a protocol encapsulation framework for outbound data of a Beidou communication system provided by an embodiment of the present application;
  • FIG. 4B is a schematic diagram of a protocol analysis framework for outbound data of a Beidou communication system provided by an embodiment of the present application;
  • FIG. 5 is a schematic flow diagram of a key update method during inbound transmission in the Beidou communication system provided by an embodiment of the present application;
  • FIG. 6 is a schematic structural diagram of a terminal provided in an embodiment of the present application.
  • FIG. 7 is a schematic diagram of an application layer message provided by an embodiment of the present application.
  • FIG. 8 is a schematic flowchart of a method for updating keys during outbound transmission in the Beidou communication system provided by an embodiment of the present application.
  • FIG. 9 is a schematic diagram of a hardware structure provided by an embodiment of the present application.
  • FIG. 10 is a schematic flow diagram of a key update method in a Beidou communication system provided by an embodiment of the present application.
  • FIG. 11 is a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • FIG. 12 is a schematic structural diagram of another communication device provided by an embodiment of the present application.
  • FIG. 13 is a schematic structural diagram of another communication device provided by an embodiment of the present application.
  • FIG. 14 is a schematic structural diagram of another communication device provided by an embodiment of the present application.
  • first and second are used for descriptive purposes only, and cannot be understood as implying or implying relative importance or implicitly specifying the quantity of indicated technical features. Therefore, the features defined as “first” and “second” may explicitly or implicitly include one or more of these features. In the description of the embodiments of the present application, unless otherwise specified, the “multiple” The meaning is two or more.
  • the terminal and the network element device (also called cellular network device) in the cellular network may first perform a step of mutual authentication, and only after the identities of both parties are confirmed through authentication can the data be authenticated. Encrypted transmission steps.
  • the cellular network equipment may include but not limited to mobile switching center (mobile switching center, MSC)/visiting location register (visiting location register, VLR), home location register (home location register, HLR)/authentication center (authentication center, AuC).
  • MSC mobile switching center
  • VLR visitor location register
  • HLR home location register
  • AuC authentication center
  • the steps of terminal and cellular network device authentication and key generation are as follows:
  • the terminal sends a service request to the MSC/VLR.
  • the service request may include a user identification (identity, ID) number of the terminal.
  • the MSC/VLR sends the terminal's international mobile subscriber identity (IMSI) to the HLR/AuC.
  • IMSI international mobile subscriber identity
  • the MSC/VLR After receiving the service request from the terminal, the MSC/VLR can search for the corresponding IMSI of the terminal based on the ID number of the terminal. MSC/VLR can send IMSI to HLR/AuC.
  • the HLR/AuC can generate a random number (random, RAND), obtain the corresponding identification key (key identifier, Ki) through the IMSI, and generate an authentication symbol response (signed response, SRES) through the RAND and Ki (1), Encryption key (ciphering key, Kc) (1).
  • RAND random number
  • Ki identification key
  • SRES signed response
  • Kc Encryption key
  • the HLR/AuC can generate authentication parameters after receiving the IMSI.
  • the authentication parameters may include but not limited to RAND, SRES, and Kc.
  • HLR/AuC can generate RAND through random number generator.
  • HLR/AuC can obtain the corresponding Ki through IMSI.
  • HLR/AuC can calculate SRES(1) and Kc(1) based on Ki and RAND through preset key algorithm.
  • Ki is the identification key, which is stored in the subscriber identity module (SIM) card and the network element device in the cellular network, and can be used to calculate the encryption key and the authentication symbol response.
  • SIM subscriber identity module
  • SRES can be used for authentication.
  • Kc is used to encrypt data. After successful authentication, the terminal and the cellular network device can use Kc to encrypt and decrypt data to ensure data security.
  • HLR/AuC can send RAND, SRES(1) and Kc(1) to MSC/VLR.
  • the MSC/VLR may send an authentication request to the terminal, where the authentication request includes RAND.
  • the MSC/VLR After receiving the authentication parameters fed back by the HLR/AuC, the MSC/VLR can send an authentication request to the terminal.
  • the authentication request may include RAND.
  • the terminal may generate SRES(2) and Kc(2) through the SIM card based on the received RAND.
  • the terminal After receiving the authentication request, the terminal can transfer RAND to the SIM card. Ki obtained when the terminal opens an account in the cellular network is stored in the SIM card. The terminal can calculate SRES(2) and Kc(2) through the SIM card based on the RAND and the preset Ki through the preset key algorithm. Wherein, the Ki and the preset key algorithm in the SIM card are the same as the Ki and the preset key algorithm in the HLR/AuC.
  • the terminal sends an authentication response to the MSC/VLR, where the authentication response includes SRES(2).
  • the terminal After calculating the SRES(2), the terminal can reply an authentication response to the MSC/VLR, and the authentication response includes the SRES(2).
  • the MSC/VLR can determine whether SRES(1) and SRES(2) are the same.
  • the terminal may use the Kc of the terminal to encrypt the data, and then send the encrypted data to the cellular network device.
  • the cellular network device can decrypt the data using the Kc of the cellular network device.
  • the cellular network device may use the Kc of the cellular network device to encrypt the data, and then send the encrypted data to the terminal.
  • the terminal can use the Kc of the terminal to decrypt the data.
  • both the terminal and the cellular network device must perform an authentication operation before data transmission.
  • the authentication steps of the cellular network are complicated, and many air interface resources are required for interactive signaling. Due to the time extension of the Beidou communication system and the lack of air interface resources, it cannot support the authentication and encryption mechanism of the cellular network.
  • An embodiment of the present application provides a key update method in the Beidou communication system.
  • the sending device can generate a key based on the time of sending.
  • the sending device can use the key to encrypt the original data, and add the header information including the time indication field before the encrypted original data to obtain the application layer message.
  • the time indication field may be used to indicate the sending time.
  • the sending device can send the application layer packet including the time indication field to the receiving device.
  • the receiving device can determine the sending time based on the receiving time and the time indication field, and obtain the key based on the sending time.
  • the receiving device can use the key to decrypt the application layer message to obtain the original data. In this way, the sending device and the receiving device can encrypt the data with the key updated over time when transmitting data, which not only saves the resources of the Beidou communication system, but also ensures the security of the data.
  • a Beidou communication system 10 provided in the embodiment of the present application is introduced below.
  • Beidou communication system 10 may include but not limited to terminal 100 , Beidou short message satellite 21 , Beidou network equipment 200 , cellular network equipment 400 , terminal 300 and so on.
  • the terminal 100 of the Beidou network can send a Beidou short message to the terminal 300 of the cellular network.
  • the terminal 100 can first send the Beidou short message to the Beidou short message satellite 21, and the Beidou short message satellite 21 only relays, and can directly forward the Beidou short message sent by the terminal 100 to the Beidou network device 200 on the ground.
  • the Beidou network device 200 can analyze the Beidou short message forwarded by the satellite according to the Beidou communication protocol, and forward the message content parsed from the Beidou short message to the cellular network device 400 .
  • the cellular network device 400 can forward the content of the message to the terminal 300 through a traditional cellular communication network.
  • the terminal 300 of the cellular network may also send a Beidou short message to the terminal 100 of the Beidou network.
  • the terminal 300 can send the short message to the short message center 25 through a traditional cellular communication network.
  • the short message center 25 can forward the short message of the terminal 300 to the Beidou network device 200 .
  • the Beidou network device 200 can relay the short message of the terminal 300 to the terminal 100 through the Beidou short message satellite 21 .
  • the Beidou communication system 10 may also include an emergency rescue platform and an emergency rescue center.
  • the Beidou network device 200 can send the emergency rescue message sent by the terminal 100 to the emergency rescue center through the emergency rescue platform.
  • the above-mentioned Beidou network equipment 200 may include, but not limited to, the Beidou ground transceiver station 22 , the Beidou central station 23 and the Beidou short message integrated communication platform 24 .
  • the Beidou ground transceiver station 22 may include one or more devices with a sending function and one or more devices with a receiving function, or may include one or more devices with a sending function and a receiving function, which is not limited herein .
  • the Beidou ground transceiver station 22 can be used for the data processing function of the Beidou network equipment 200 in the physical layer (physical layer protocol, PHY).
  • the Beidou central station 23 can be used for the Beidou network device 200 to process data at the satellite link control layer (satellite link control protocol, SLC) layer and the message data convergence layer (message data convergence protocol, MDCP).
  • the Beidou short message fusion communication platform 24 can be used to process data at the application layer (application layer protocol, APP).
  • the above-mentioned cellular network device 400 may include but not limited to a short message center (short message service center, SMSC) 25, a home location register (HLR) 28 and a telecommunications business operation support system (business & operation support system, BOSS) 29.
  • SMSC short message service center
  • HLR home location register
  • BOSS business & operation support system
  • the short message center 25 can be used to forward the data sent by the Beidou network device 200 to the terminal under the cellular network, and can also be used to forward the data of the cellular network to the Beidou network device 200 .
  • the telecommunications service operation support system 29 can be used for terminal account opening.
  • the telecommunications service operation support system 29 may store data such as the ID number and IMSI of the terminal (such as the terminal 100 ) when opening an account.
  • the ID number may be a mobile phone number of the terminal.
  • the IMSI can also be used to calculate the key.
  • the home location register 28 pre-stores the Ki corresponding to the ID number and the preset key algorithm.
  • the home location register 28 can calculate SRES and Kc based on Ki and RAND through a preset key algorithm.
  • the Ki in the SIM card and the cellular network device 400 is the same as the preset key algorithm (such as A3, A8 algorithm). Among them, SRES and Kc can be used to calculate the key.
  • the process of sending data from the terminal 100 to the Beidou network device 200 is inbound.
  • the process of the Beidou network device 200 sending data to the terminal 100 is outbound.
  • FIG. 3A shows a schematic diagram of a protocol encapsulation architecture of inbound data of the Beidou communication system 10 provided in the embodiment of the present application.
  • the Beidou message transmission protocol layer on the terminal 100 can be divided into an application layer, a message data aggregation layer, a satellite link control layer and a physical layer.
  • the workflow of the Beidou message transmission protocol on the terminal 100 can be as follows:
  • the terminal 100 may generate a key based on the sending time (also referred to as sending time) of the application layer message, and use the key to encrypt the original data to obtain encrypted data. And adding message header information before the encrypted data to obtain an application layer message.
  • the original data may include but not limited to data (such as text data, image data, audio data, video data, etc.) input by the calling user (such as the user of the terminal 100), the called user (such as the number of users), the ID of the called user, the location information of the terminal 100, and the like.
  • the sending time of the application layer message may be a specified time point between the first time point and the second time point (including the first time point and the second time point), which is not limited in this application.
  • the first time point is the time point when the terminal 100 obtains the original data.
  • the time point at which the terminal 100 acquires the original data may be the time point at which the terminal 100 receives an input of sending a Beidou short message from the calling user.
  • the original data includes the data input by the calling user.
  • the second time point is a time point obtained when the terminal 100 generates the key.
  • the second time point may be the current time point obtained by executing a program statement for obtaining the sending time of the application layer message (for example, by obtaining the current time function getCurrentTime()) when the terminal 100 calculates the key.
  • the unit of the sending time of the application layer message is hour. It should be noted that the terminal 100 must obtain the specified time point before encrypting the original data.
  • the message header information may include, but not limited to, an encryption indication field, a time indication field, and the like.
  • the encryption indication field is used to indicate the encryption algorithm type used by the terminal 100 to encrypt data.
  • the time indication field may be used to indicate sending time information. Specifically, the value of the time indication field may indicate the parity value of the sending time T.
  • the terminal 100 may first compress the original data.
  • the packet header may also include a compression indication field.
  • the compression indication field may be used to indicate the type of compression algorithm used by the terminal 100 to compress data.
  • the terminal 100 may compress the original data to obtain compressed data.
  • the terminal 100 may add the above-mentioned compression indication field before the compressed data. Then use the key to encrypt the compressed data added with the compression indication field to obtain the encrypted data.
  • the terminal 100 can obtain the application layer message sent by the APP layer through the interlayer interface, and use the application layer message as an MDCP SDU.
  • the terminal 100 can add padding to a specified length at the end of the MDCP SDU, and add a redundant length indication field to the MDCP SDU.
  • the redundant length indication field may be used to indicate the length of the padding data.
  • the terminal 100 can split the padding data and the MDCP SDU after adding the redundant length indication field into one or more fixed-length MDCP segment data (M_segment), and add a follow-up indication to the header of each MDCP segment data field to get the MDCP PDU. That is, the MDCP PDU includes M_segment and successor indication fields. Among them, the successor indication field can be used to indicate the order of the current MDCP PDU in multiple MDCP PDUs in the same MDCP SDU, or the current MDCP PDU is the only MDCP PDU of the MDCP SDU.
  • M_segment fixed-length MDCP segment data
  • the terminal 100 can obtain the MDCP PDU sent by the MDCP layer through the interlayer interface as the SLC SDU.
  • the terminal 100 can segment the SLC SDU into one or more (for example, 4) fixed-length SLC segment data (S_segment), and add frame header information (also known as frame header) to each S_segment header. Format indication information) to get the SLC PDU.
  • the frame header information may include but not limited to a user ID field, a frame total number field and a frame sequence number field.
  • the user ID field can be used to indicate the terminal (for example, terminal 100) that generates the SLC PDU.
  • the total number of frames field can be used to indicate the total number of SLC PDUs included in the SLC SDU to which the SLC PDU belongs.
  • the frame sequence number field can be used to indicate the sequence number of the SLC PDU in the SLC SDU to which it belongs.
  • the terminal 100 can obtain the SLC PDU delivered by the SLC layer through the interlayer interface.
  • the terminal 100 may perform physical layer processing (for example, operations such as encoding, pilot insertion, modulation, and spectrum spreading) on it to obtain inbound data.
  • the terminal 100 can send the inbound data to the Beidou short message satellite 21 , and forward it to the Beidou network device 200 via the Beidou short message satellite 21 .
  • FIG. 3B shows a schematic diagram of a protocol analysis architecture of inbound data of the Beidou communication system 10 provided in the embodiment of the present application.
  • the Beidou message transmission protocol layer on the Beidou network device 200 can be divided into an application layer, a message data aggregation layer, a satellite link control layer and a physical layer.
  • the Beidou network device 200 may include, but not limited to, the Beidou ground transceiver station 22 , the Beidou central station 23 and the Beidou short message integrated communication platform 24 .
  • the Beidou ground transceiver station 22 can be used to be responsible for the protocol processing of the PHY layer.
  • the Beidou central station 23 can be used to be responsible for the protocol processing of the SLC layer and the MDCP layer.
  • the Beidou short message fusion communication platform 24 can be used to be responsible for the protocol processing of the APP layer.
  • the workflow of the Beidou message transmission protocol on the terminal 100 can be as follows:
  • the Beidou network device 200 can obtain the inbound data sent by the terminal 100 .
  • the Beidou network device 200 performs physical layer processing (such as despreading, demodulation, depiloting, decoding, etc.) on the inbound data and presents it to the SLC layer through the interlayer interface as the SLC PDU of the SLC layer.
  • physical layer processing such as despreading, demodulation, depiloting, decoding, etc.
  • the Beidou network device 200 can splice the SLC PDUs of the same SLC SDU belonging to the same terminal into one SLC SDU based on the frame header information of the SLC PDU.
  • the Beidou network device 200 can present the SLC SDU to the MDCP layer through the interlayer interface as the MDCP PDU of the MDCP layer.
  • the Beidou network device 200 can splice together all MDCP PDUs belonging to the same MDCP SDU according to the receiving time, and remove the padding data and redundant length indication fields of the spliced MDCP PDUs to obtain the MDCP SDU.
  • the Beidou network device 200 can present the MDCP SDU to the APP layer through the interlayer interface as an application layer message received by the APP layer.
  • the Beidou network device 200 can determine the sending time of the application layer message based on the time indication field in the message header information and the receiving time of the application layer message (also called the receiving time), and based on the application layer message The key is calculated by the sending time.
  • the Beidou network device 200 can decrypt the encrypted data in the application layer message through the key to obtain the original data.
  • the receiving time of the application layer message may be a specified time point between the third time point and the fourth time point (including the third time point and the fourth time point), which is not limited in this embodiment of the present application.
  • the third time point may be the time point when the Beidou network device 200 receives the first SLC PDU of the application layer message sent by the terminal 100.
  • the fourth time point may be a time point obtained when the Beidou network device 200 generates the key.
  • the fourth time point may be the current time point obtained by executing a program statement for obtaining the sending time of the application layer message (for example, by obtaining the current time function getCurrentTime()) when the Beidou network device 200 calculates the key.
  • the unit of the receiving time of the application layer message is hour. It should be noted that the Beidou network device 200 must obtain the specified time point before decrypting the encrypted data.
  • compressed data can be obtained.
  • an authentication code and original data are obtained.
  • FIG. 4A shows a schematic diagram of a protocol encapsulation architecture of outbound data of the Beidou communication system 10 provided in the embodiment of the present application.
  • the Beidou message transmission protocol layer on the Beidou network device 200 can be divided into an application layer, a message data aggregation layer, a satellite link control layer and a physical layer.
  • the workflow of the Beidou message transmission protocol on the Beidou network device 200 can be as follows:
  • Beidou network device 200 can generate a key based on the sending time, and use the key to encrypt the original data to obtain encrypted data. And adding message header information before the encrypted data to obtain an application layer message.
  • the original data may include but not limited to data sent by a third-party server (for example, short message center 25) (for example, data input by the called user), text, semaphore, voice, image, animation, etc.
  • the sending time of the application layer message may be a specified time point between the fifth time point and the sixth time point (including the fifth time point and the sixth time point), which is not limited in this embodiment of the present application.
  • the fifth time point is the time point when the Beidou network device 200 obtains the original data.
  • the time point at which the Beidou network device 200 obtains the original data may be the time point at which the service request information sent by the terminal 100 is received.
  • the service request information may be a request for downloading an application layer message, where the receiving device of the application layer message is the terminal 100 .
  • the original data may be data input by the called user.
  • the time point at which the Beidou network device 200 obtains the original data may be the time point at which the data sent to the terminal 100 by the cellular network device 400 or other third-party servers is received.
  • the sixth time point is the time point obtained when the Beidou network device 200 generates the key.
  • the sixth time point may be the current time point obtained by executing a program statement for obtaining the sending time of the application layer message (for example, by obtaining the current time function getCurrentTime()) when the Beidou network device 200 calculates the key.
  • the unit of the sending time of the application layer message is hour. It should be noted that the Beidou network device 200 must obtain the specified time point before encrypting the original data.
  • the message header information may include, but not limited to, an encryption indication field, a time indication field, and the like.
  • the encryption indication field is used to indicate the type of encryption algorithm used by Beidou network device 200 to encrypt data.
  • the time indication field may be used to indicate sending time information. Specifically, the value of the time indication field may indicate the parity value of the sending time T.
  • the Beidou network device 200 may first compress the original data.
  • the packet header may also include a compression indication field.
  • the compression indication field may be used to indicate the type of compression algorithm used by the Beidou network device 200 to compress data.
  • the Beidou network device 200 may compress the original data to obtain compressed data.
  • the Beidou network device 200 may add the above-mentioned compression indication field before compressing data. Then use the key to encrypt the compressed data added with the compression indication field to obtain the encrypted data.
  • the Beidou network device 200 can obtain the application layer message sent by the APP layer through the interlayer interface, and use the application layer message as an MDCP SDU.
  • the Beidou network device 200 can split the MDCP SDU into one or more fixed-length MDCP segment data (M_segment), and add a follow-up indication field to the header of each MDCP segment data to obtain the MDCP PDU, that is, the MDCP PDU includes M_segment and successor indication fields.
  • the follow-up indication field can be used to indicate the order of the current MDCP PDU in the same MDCP SDU.
  • the Beidou network device 200 can obtain the MDCP PDU sent by the MDCP layer through the interlayer interface as the SLC SDU.
  • the Beidou network device 200 can segment the SLC SDU into one or more (for example, 4) fixed-length SLC segment data (S_segment), and add frame header information to the header of each S_segment to obtain the SLC PDU.
  • the frame header information may include but not limited to a user ID field, a frame total number field, and a frame sequence number field.
  • the user ID field may be used to identify the receiving device (such as the terminal 100), and the value of the user ID field is the ID number of the receiving device.
  • the detailed description of the frame total number field and the frame sequence number field can refer to the above-mentioned embodiment in 3A, which will not be repeated here.
  • the Beidou network device 200 can obtain the SLC PDU delivered by the SLC layer through the interlayer interface as a user frame.
  • the Beidou network device 200 can stitch user frames (also called data frames) of multiple users or one user together, and add a frame header (such as a version number) and a check digit to obtain a physical frame.
  • the Beidou network device 200 can perform physical layer processing on the physical frame (eg, encoding, pilot insertion, modulation, spectrum spreading, etc.) to obtain encoded data of the message branch (S2C-d branch).
  • the Beidou network device 200 can combine the coded data of the S2C-d branch and the pilot data (also called secondary code) of the pilot branch (S2C-p branch) to form pilot coded data, that is, outbound data. And the outbound data is sent to the Beidou short message satellite 21, and relayed to one or more terminals via the Beidou short message satellite 21.
  • the pilot data of the S2C-p branch is related to the satellite beam. When the satellite beam is known information, the pilot data of the S2C-p branch is also known without decoding. The coded data of the S2C-d branch needs to be decoded.
  • FIG. 4B shows a schematic diagram of a protocol analysis framework for outbound data of the Beidou communication system 10 provided in the embodiment of the present application.
  • the Beidou message transmission protocol layer on the terminal 100 can be divided into an application layer, a message data aggregation layer, a satellite link control layer and a physical layer.
  • the terminal 100 can capture the coded data of the S2C-d branch based on the secondary code of the S2C-p branch sent by the Beidou network device 200 . After capturing the coded data of the S2C-d branch, the terminal 100 can perform physical layer processing (for example, despreading, demodulation, de-pilot, decoding, etc.) on the coded data of the S2C-d branch to obtain the physical frame . The terminal 100 may extract user frames belonging to the terminal 100 from the physical frames. The terminal 100 can present the user frame to the SLC layer through the interlayer interface as an SLC PDU of the SLC layer.
  • physical layer processing for example, despreading, demodulation, de-pilot, decoding, etc.
  • the terminal 100 can splice the SLC PDUs belonging to the same SLC SDU into one SLC SDU.
  • the terminal 100 can present the SLC SDU to the MDCP layer through the interlayer interface as the MDCP PDU of the MDCP layer.
  • the terminal 100 can retransmit data/send the next SLC SDU/stop sending data to the Beidou network device 200.
  • the terminal 100 can splice one or more MDCP PDUs into one MDCP SDU.
  • the terminal 100 can present the MDCP SDU to the APP layer through the interlayer interface as an application layer message received by the APP layer.
  • the terminal 100 can determine the sending time based on the time indication field in the packet header and the receiving time, and calculate the key based on information such as the sending time.
  • the Beidou network device 200 can obtain the original data after successfully decrypting the encrypted data of the application layer message through the key.
  • the receiving time of the application layer message may be a specified time point between the seventh time point and the eighth time point (including the seventh time point and the eighth time point), which is not limited in this embodiment of the present application.
  • the seventh time point may be the time point when the terminal 100 receives the first SLC PDU of the application layer message sent by the Beidou network device 200.
  • the eighth time point may be a time point obtained when the terminal 100 generates the key.
  • the eighth time point may be the current time point obtained by executing a program statement for obtaining the sending time of the application layer message (for example, by obtaining the current time function getCurrentTime()) when the terminal 100 calculates the key.
  • the unit of the receiving time of the application layer message is hour. It should be noted that the terminal 100 must obtain the specified time point before decrypting the encrypted data of the application layer message.
  • a key update method in the Beidou communication system provided in the embodiment of the present application is introduced below.
  • Fig. 5 shows a schematic flowchart of a method for updating a key during inbound transmission in the Beidou communication system provided in an embodiment of the present application.
  • the key update method during inbound transmission includes the following steps:
  • the terminal 100 acquires raw data.
  • the original data may include but not limited to the data input by the calling user (such as text data, image data, audio data, video data, etc.), the number indication of the called user, the ID of the called user, the location information of the terminal 100, etc. .
  • the terminal 100 may obtain the original data and send the original data to the Beidou network device 200 after receiving the first input from the calling user.
  • the input may include but not limited to: gesture, voice and so on.
  • the gesture includes a gesture of directly touching the display screen of the terminal 100 and a hovering gesture of not directly touching the display screen.
  • the terminal 100 generates a key A.
  • the terminal 100 may generate the key A based on the sending time T. Among them, key A can be used to encrypt original data.
  • the sending time T may be a specified time point between the first time point and the second time point.
  • the unit of sending time is hour.
  • the sending time T may be the time point when the above-mentioned first input is received. For example, when the time when the terminal 100 receives the first input is 08:58 Beijing time (24-hour clock), the value of the clock is 8, and the value of the sending time T is 8.
  • the terminal 100 may generate the key A based on the sending time T, Ki in the SIM card, and IMSI.
  • the terminal 100 can obtain the IMSI stored in the SIM card, and obtain the RAND based on the IMSI and the sending time T.
  • the terminal 100 can obtain Kc through preset key algorithm 1 based on RAND and Ki stored in the SIM card.
  • the terminal 100 may also obtain the SRES through the preset key algorithm 2 based on RAND and Ki.
  • terminal 100 can obtain key A based on SRES and Kc.
  • the application processor (application processor, AP) of the terminal 100 can obtain the IMSI from the SIM card, and then splicing the IMSI and the sending time T together to obtain RAND.
  • IMSI is the number assigned to identify the only mobile user in the world.
  • IMSI can be composed of mobile country code (mobile country code, MCC), mobile network code (mobile network code, MNC) and mobile communication user identification code (mobile subscriber identification number, MSIN/MIN).
  • MCC mobile country code
  • MNC mobile network code
  • MSIN/MIN mobile subscriber identification number
  • IMSI MCC
  • MCC is the code name of the country to which the mobile user belongs, including 3 digits (for example, the MCC of China is 460).
  • MNC is the number of the mobile network, which can be used to identify the home mobile communication network of the mobile user (for example, China Unicom Network is 03), including two digits.
  • MSIN can be used to identify a user of a mobile communication network, including 10 digits, provided by the network operator. Among them,
  • the resulting IMSI has a length of 15 decimal digits and can be represented by a 15-byte string.
  • the length of the sending time T may be 2 decimal numbers, such as 08.
  • the sending time T can be represented by a 1-byte character string.
  • RAND is obtained by concatenating IMSI and sending time T, and the length of RAND can be 16 bytes.
  • the IMSI is 460030912121001 and the sending time T is 08,
  • the AP of the terminal 100 may send the RAND to the SIM card.
  • the SIM card of terminal 100 can obtain Kc through preset key algorithm 1 based on Ki and RAND, and generate SRES through preset key algorithm 2.
  • the preset key algorithm 1 may be an A8 algorithm
  • the preset key algorithm 2 may be an A3 algorithm.
  • the calculation formulas of Kc and SRES are as follows:
  • the length of Kc may be 4 bytes, and the length of SRES may be 8 bytes.
  • the SIM card can send Kc and SRES to the AP.
  • the AP of terminal 100 can obtain key A based on Kc and SRES.
  • terminal 100 may concatenate Kc and SRES to obtain key A.
  • terminal 100 may obtain key A through preset key algorithm 3 based on Kc and SRES.
  • the preset key algorithm 3 may be a hash-based message authentication code (hash-based message authentication code, HMAC) algorithm based on SM3 in the national secret algorithm.
  • the terminal 100 can obtain the key A through the following formula:
  • the formula F is an operation formula for intercepting the first 16byte characters of the input value.
  • the terminal 100 may use the key A to encrypt the original data to obtain encrypted data.
  • the terminal 100 may use the key A and the original data as the input of the encryption algorithm, and obtain the encrypted data through the calculation of the encryption algorithm.
  • the terminal 100 may add a packet header before the encrypted data to obtain an application layer packet.
  • the packet header may include a time indication field.
  • the application layer message may include a message header and encrypted data.
  • the packet header may include but not limited to an encryption indication field, a time indication field, and a compression indication field.
  • the length of the encryption indication field may be 2 bits.
  • the encryption indication field may be used to indicate the type of encryption algorithm. For example, when the value of the encryption indication field is 00, the encryption algorithm is not used; when the value of the encryption indication field is 01, encryption algorithm 1 (such as the national secret algorithm SM4 algorithm) can be used for encryption.
  • the length of the time indication field may be 1 bit.
  • the time indication field is used to indicate the sending time information of the application layer message.
  • the value of the time indication field may indicate the parity value of the sending time T. Specifically, when the value of T is even, the value of the time indication field is 1; when the value of T is odd, the value of the time indication field is 0. For example, when the value of the sending time is 8, the value of the time indication field is 1. When the value of the sending time is 17, the value of the time indication field is 0.
  • the terminal 100 sends the application layer packet to the Beidou network device 200.
  • the specific flow description of the terminal 100 sending data to the Beidou network device 200 can refer to the above embodiment described in FIG. 3A , which will not be repeated here.
  • the frame header information added by the terminal 100 at the SLC layer may include a user ID field.
  • the user ID field may be used to identify the terminal 100 .
  • the value of the user ID field is the ID number of the terminal 100 .
  • the ID number of the terminal 100 may be used to indicate key-related parameters corresponding to the terminal 100 .
  • the ID number of the terminal 100 may include, but not limited to, a mobile phone number, a unique identification number of the terminal 100 negotiated between the terminal 100 and a third-party communication server (for example, a server of instant messaging software such as Changlian).
  • the Beidou network device 200 records the receiving time T1.
  • the receiving time T1 may be a specified time point between the third time point and the fourth time point, and the unit is hour.
  • the third time point and the fourth time point reference may be made to the embodiment shown in FIG. 3B above, which will not be repeated here.
  • the receiving time T1 may be the time point when the first SLC PDU sent by the Beidou network device 100 is received. Specifically, at the SLC layer, when the Beidou network device 200 receives the first SLC PDU corresponding to the application layer message sent by the terminal 100, the Beidou network device 200 can record the time of receiving the SLC PDU as the receiving time T1.
  • the Beidou network device 200 when the Beidou network device 200 receives the first SLC PDU sent by the terminal 100 at 08:59 (24-hour clock), the Beidou network device 200 can obtain the value of the receiving time T1 as 8.
  • the Beidou network device 200 when the Beidou network device 200 receives the first SLC PDU sent by the terminal 100 at 09:00 (24-hour clock), the Beidou network device 200 can obtain the value of the receiving time T1 as 9.
  • the specific process description of the Beidou network device 200 receiving data from the terminal 100 can refer to the above-mentioned embodiment in FIG. 3B , which will not be repeated here.
  • the Beidou network device 200 sends an IMSI request to the cellular network device 400.
  • the Beidou network device 200 may send an IMSI request to the cellular network device 150 (for example, the telecommunications service operation support system 29).
  • the IMSI request may include the ID number of the terminal 100 .
  • the IMSI request may be used to instruct the cellular network device 400 to feed back the IMSI corresponding to the ID number.
  • the cellular network device 400 sends the IMSI of the terminal 100 to the Beidou network device 200 .
  • the telecommunications service operation support system 29 may return the corresponding IMSI to the Beidou network device 200 according to the ID number.
  • the Beidou network device 200 obtains the RAND based on information such as the time indication field, the receiving time, and the IMSI.
  • the Beidou network device 200 can determine the sending time T according to the time indication field and the receiving time T1.
  • the value of the time indication field may indicate the parity value of the sending time T.
  • the sending time T is equal to the receiving time T1.
  • the parity value of the sending time T indicated by the value of the time indication field is different from the parity value of the receiving time T1
  • the difference between the receiving time T1 and the sending time T is 1. specific:
  • T T1
  • T T1-1
  • T T1-1;
  • T T1
  • the sending time T is equal to 8.
  • the sending time T is equal to 8.
  • the Beidou network device 200 can obtain the RAND based on the IMSI and the sending time T.
  • the Beidou network device 200 obtaining the RAND reference may be made to the embodiment described in the above step S502, which will not be repeated here.
  • the Beidou network device 200 may send the RAND to the cellular network device 400.
  • the Beidou network device 200 may send the random number RAND to the home location register 28 .
  • the cellular network device 400 calculates the SRES and Kc based on information such as RAND.
  • the home location register 28 may store information such as Ki of terminals that have opened accounts.
  • the home location register 28 may determine the Ki of the terminal 100 based on the ID number of the terminal 100 .
  • the HLR 28 can also obtain Kc through the preset key algorithm 1 based on Ki and RAND.
  • the preset key algorithm 1 may be the A8 algorithm.
  • the HLR 28 may generate the SRES through the preset key algorithm 2 based on Ki and RAND.
  • the preset key algorithm 2 may be the A3 algorithm.
  • the calculation method of the home location register 28 to generate the SRES and Kc based on RAND and Ki is the same as that of the terminal 100.
  • the cellular network device 400 may send the SRES and Kc to the Beidou network device 200.
  • the home location register 28 may send the calculated SRES and Kc to the Beidou network device 200 .
  • the Beidou network device 200 generates a key B based on the SRES and Kc.
  • Beidou network device 200 can generate key B based on SRES and Kc.
  • key B can be obtained by splicing SRES and Kc.
  • the Beidou network device 200 may calculate the key B based on the SRES and Kc through the above preset key algorithm 3.
  • the algorithm used by the Beidou network device 200 to generate the key B is the same as the algorithm used by the terminal 100 to generate the key A.
  • the Beidou network device 200 uses the key B to decrypt the application layer message.
  • the Beidou network device 200 can determine the encryption algorithm used by the terminal 100 through the value of the encryption indication field.
  • the terminal 100 may use the decryption algorithm corresponding to the key B and the encryption algorithm to decrypt the encrypted data of the application layer message.
  • the Beidou network device 200 When the Beidou network device 200 successfully decrypts the encrypted data of the application layer message, if the original data is a service request message, the Beidou network device 200 can send the service data corresponding to the service request message to the terminal 100 after decrypting the original data. If the original data is data sent to the terminal 300 under the cellular network, the Beidou network device 200 may execute step S515. Further, the Beidou network device 200 may also execute step S516 after the decryption is successful.
  • the Beidou network device 200 fails to decrypt the encrypted data of the application layer message, the Beidou network device 200 cannot obtain the original data. Further, the Beidou network device 200 may execute step S517.
  • the Beidou network device 200 may send the original data to the cellular network device 400 .
  • the Beidou network device 200 can forward the original data to the short message center 25, and the short message center 25 can forward the original data to the called user's terminal (such as the terminal 300) in a specified format (for example, a short message).
  • the called user's terminal such as the terminal 300
  • a specified format for example, a short message
  • the Beidou network device 200 may generate a corresponding application layer receipt based on a result of parsing the application layer message.
  • the Beidou network device 200 may send the application layer receipt to the terminal 100 .
  • the terminal 100 can determine the result of the Beidou network device 200 parsing the application layer message through the application layer receipt.
  • the Beidou network device 200 may send the first application layer receipt to the terminal 100.
  • the Beidou network device 200 may send a first application layer receipt to the terminal 100 .
  • the first application layer receipt may be used to indicate that the Beidou network device 200 successfully parses the application layer message.
  • the terminal 100 may display a success prompt message after receiving the first application layer receipt.
  • the success prompt information may include but not limited to text prompt information, voice prompt information, animation prompt information and the like.
  • the success prompt information is used to indicate that the Beidou network device 200 has successfully decrypted.
  • the success prompt information may be text prompt information "Send successfully”.
  • the Beidou network device 200 may send the second application layer receipt to the terminal 100.
  • the Beidou network device 200 may send a second application layer receipt to the terminal 100 after the decryption fails.
  • the second application layer receipt may indicate that the Beidou network device 200 fails to decrypt the application layer message.
  • the terminal 100 may retransmit the application layer packet after receiving the second application layer receipt.
  • the terminal 100 may display failure prompt information after receiving the second application layer receipt.
  • the failure prompt information may include but not limited to text prompt information, voice prompt information, animation prompt information and the like.
  • the failure prompt information is used to indicate that the Beidou network device 200 fails to decrypt.
  • the failure prompt information may be text prompt information "send failed, please resend".
  • the terminal 100 and the Beidou network device 200 enter the station, they can encrypt the transmitted data with the key updated over time. It not only saves the air interface resources of the Beidou communication system, reduces the signaling and steps to ensure the safe use of data, but also ensures the security of the transmitted data when transmitting data.
  • Fig. 8 shows a schematic flowchart of a method for updating keys during outbound transmission in the Beidou communication system provided in the embodiment of the present application.
  • the key update method during outbound transmission includes the following steps:
  • the Beidou network device 200 receives the original data sent by the cellular network device 400 .
  • the Beidou network device 200 receives the original data sent by the short message center 25 .
  • the original data is the original data (including but not limited to text data entered by the calling user) sent by the calling user (such as the user of terminal 300) under the cellular network to the called user (user of terminal 100) under the Beidou network , image data, etc.).
  • the cellular network device 400 forwards the data sent by the terminal 300 to the terminal 100 to the Beidou network device 200, it can also simultaneously forward the ID number of the called user (for example, the ID number of the terminal 100) to the Beidou network Device 200.
  • the raw data acquired by the Beidou network device 200 may be data stored in a memory of the Beidou network device 200 .
  • the original data may be the map data stored by the Beidou network device 200 .
  • the original data received by the Beidou network device 200 may be data sent to the Beidou network device 200 by a third-party server (for example, text data, image data, audio data, video data, etc.).
  • a third-party server for example, text data, image data, audio data, video data, etc.
  • the Beidou network device 200 receives the service request sent by the terminal 100.
  • the service request may be a request for downloading original data
  • the receiving device of the original data is the terminal 100 .
  • the Beidou network device 200 may execute step S803-step 812.
  • the Beidou network device 200 sends an IMSI request to the cellular network device 400 .
  • the Beidou network device 200 may send an IMSI request to the cellular network device 150 (for example, the telecom service operation support system 29).
  • the IMSI request may include the ID number of the terminal 100 .
  • the IMSI request may be used to instruct the cellular network device 400 to feed back the IMSI corresponding to the ID number.
  • the ID number of the terminal 100 may include, but not limited to, a mobile phone number, a unique identification number negotiated between the terminal 100 and a third-party communication server (for example, a server of instant messaging software such as Changlian).
  • the cellular network device 400 sends the IMSI of the terminal 100 to the Beidou network device 200 .
  • the telecommunication service operation support system 29 may send the IMSI corresponding to the ID number to the Beidou network device 200 after receiving the IMSI request.
  • the Beidou network device 200 obtains the RAND based on the sending time T, IMSI and other information.
  • the sending time T may be a specified time point between the fifth time point and the sixth time point, and the unit is hour.
  • the Beidou network device 200 may use the time point when the Beidou network device 200 receives the service request of the terminal 100 as the sending time T. Specifically, when the time when the Beidou network device 200 receives the service request is 08:58 Beijing time (24-hour system), the value of the clock is 8, and the value of the sending time T is 8.
  • the Beidou network device 200 may concatenate the IMSI and the sending time T to obtain the RAND.
  • the detailed description of the Beidou network device 200 obtaining the RAND may refer to the embodiment described in FIG. 5 , which will not be repeated here.
  • the Beidou network device 200 may send the RAND to the cellular network device 400.
  • the Beidou network device 200 may send the random number RAND to the home location register 28 .
  • the cellular network device 400 calculates the SRES and Kc based on information such as RAND.
  • the home location register 28 stores information such as Ki of terminals that have opened accounts.
  • Home location register 28 may determine Ki of terminal 100 and generate SRES and Kc based on RAND and Ki.
  • the home location register 28 may determine the Ki of the terminal 100 based on the ID number of the terminal 100 .
  • the detailed description of obtaining the SRES and Kc by the home location register 28 may refer to the above-mentioned embodiment in FIG. 5 , which will not be repeated here.
  • the cellular network device 400 may send the SRES and Kc to the Beidou network device 200 .
  • the home location register 28 may send the calculated SRES and Kc to the Beidou network device 200 .
  • the Beidou network device 200 may generate a key B based on the SRES and Kc.
  • Beidou network device 200 generating the key B based on the SRES and Kc can refer to the above-mentioned embodiment in FIG. 5 , which will not be repeated here.
  • the Beidou network device 200 may use the key B to encrypt the original data to obtain encrypted data.
  • the Beidou network device 200 may add a packet header before the encrypted data to obtain an application layer packet.
  • the packet header may include a time indication field.
  • the Beidou network device 200 may send the application layer packet to the terminal 100.
  • Beidou network device 200 sending the application layer message to the terminal 100 can refer to the above-mentioned embodiment in FIG. 4A , which will not be repeated here.
  • the terminal 100 generates the key A based on information such as the time indication field and the receiving time T1.
  • the detailed description of the terminal 100 receiving the data sent by the Beidou network device 200 may refer to the above-mentioned embodiment in FIG. 4B , which will not be repeated here.
  • the receiving time T1 may be a specified time point between the seventh time point and the eighth time point, and the unit is hour. Wherein, for the specific description of the seventh time point and the eighth time point, reference may be made to the embodiment shown in FIG. 4B above, and details are not repeated here.
  • the receiving time may be the time point when the first SLC PDU sent by the Beidou network device 100 is received.
  • the terminal 100 may determine the sending time T based on the receiving time T1 and the time indication field. For details, refer to the above-mentioned embodiment in FIG. 5 , which will not be repeated here.
  • the terminal 100 may calculate the key A based on the sending time T and other parameters.
  • the terminal 100 acquiring the key A based on the sending time reference may be made to the embodiment shown in FIG. 6 , which will not be repeated here.
  • the terminal 100 may use the key A to decrypt the application layer message.
  • the terminal 100 may execute step S814. Further, after the decryption succeeds, the terminal 100 may also perform step S815; if the decryption fails, the terminal 100 cannot obtain the original data. Further, the terminal 100 may execute step S816.
  • the terminal 100 may display the receiving prompt information.
  • the terminal 100 may display receiving prompt information on the display screen, and the receiving prompt information may be used to indicate that the terminal 100 has received a Beidou short message.
  • the receiving prompt information may include but not limited to text prompt information, picture prompt information, animation prompt information, and the like.
  • the receiving prompt information is text prompt information, for example, the receiving prompt information may be "received a Beidou short message from terminal 300".
  • the terminal 100 may generate a corresponding application layer receipt based on a result of parsing the application layer message.
  • the terminal 100 can send the application layer receipt to the Beidou network device 200 .
  • the Beidou network device 200 may determine the result of the terminal 100 parsing the application layer message based on the application layer receipt.
  • the terminal 100 may send the first application layer receipt to the Beidou network device 200 .
  • the terminal 100 may send a first application layer receipt to the Beidou network device 200 .
  • the first application layer receipt may be used to indicate that the terminal 100 has successfully parsed the application layer message.
  • the terminal 100 may send the second application layer receipt to the Beidou network device 200.
  • the terminal 100 may send a second application layer receipt to the Beidou network device 200 after the decryption fails.
  • the second application layer receipt may indicate that the terminal 100 fails to decrypt the application layer message.
  • the Beidou network device 200 may retransmit the application layer message after receiving the second application layer receipt.
  • the Beidou network device 200 and the terminal 100 can encrypt the transmitted data with the key updated with time when going outbound. It not only saves the air interface resources of the Beidou communication system, reduces the signaling and steps to ensure the safe use of data, but also ensures the security of the transmitted data when transmitting data.
  • the sending device may send the second application layer packet to the receiving device after sending the first application layer packet to the receiving device.
  • the sending time of the second application layer message is the same as the sending time of the first application layer message
  • the sending device can directly use the first key generated based on the sending time of the first application layer message to encrypt the second original data to obtain the second encrypted data.
  • the sending device may add message header information before the second encrypted data to obtain a second application layer message.
  • the time indication field in the header information of the second application layer message is the same as the time indication field of the first application layer message. In this way, the time for the sending device to calculate the key of the second application layer message can be saved, and the second application layer message can be obtained faster.
  • the receiving device after receiving the first application layer packet of the sending device, receives the second application layer packet of the sending device.
  • the receiving device determines that the receiving time of the second application layer message is the same as the receiving time of the first application layer message, and the receiving device may use the second key obtained based on information such as the receiving time of the first application layer message to encrypt the second
  • the second encrypted data of the application layer packet is used to obtain the second original data. In this way, the time for the receiving device to calculate the key of the second application layer message can be saved, and the second original data of the second application layer message can be obtained faster.
  • the terminal 100 provided in the embodiment of the present application is introduced below.
  • the terminal 100 may be a mobile phone, a tablet computer, a desktop computer, a laptop computer, a handheld computer, a notebook computer, an ultra-mobile personal computer (UMPC), a netbook, as well as a cellular phone, a personal digital assistant (personal digital assistant) assistant, PDA), augmented reality (augmented reality, AR) device, virtual reality (virtual reality, VR) device, artificial intelligence (artificial intelligence, AI) device, wearable device, vehicle-mounted device, smart home device and/or smart For urban equipment, the embodiment of the present application does not specifically limit the specific type of the electronic equipment.
  • FIG. 9 shows a schematic diagram of a hardware structure provided by an embodiment of the present application.
  • the terminal 100 shown in FIG. 9 is only an example, and the terminal 100 may have more or fewer components than those shown in FIG. 9, may combine two or more components, or may have Different component configurations.
  • the various components shown in Figure 9 may be implemented in hardware, software, or a combination of hardware and software including one or more signal processing and/or application specific integrated circuits.
  • the terminal 100 may include: a processor 110, an external memory interface 120, an internal memory 121, a universal serial bus (universal serial bus, USB) interface 130, a charging management module 140, a power management module 141, a battery 142, an antenna 1, and an antenna 2 , mobile communication module 150, wireless communication module 160, audio module 170, speaker 170A, receiver 170B, microphone 170C, earphone jack 170D, sensor module 180, button 190, motor 191, indicator 192, camera 193, display screen 194, and A subscriber identification module (subscriber identification module, SIM) card interface 195 and the like.
  • SIM subscriber identification module
  • the sensor module 180 may include a pressure sensor 180A, a gyroscope sensor 180B, an air pressure sensor 180C, a magnetic sensor 180D, an acceleration sensor 180E, a distance sensor 180F, a proximity light sensor 180G, a fingerprint sensor 180H, a temperature sensor 180J, a touch sensor 180K, an ambient light sensor 180L, bone conduction sensor 180M, etc.
  • the structure illustrated in the embodiment of the present invention does not constitute a specific limitation on the terminal 100 .
  • the terminal 100 may include more or fewer components than shown in the figure, or combine certain components, or separate certain components, or arrange different components.
  • the illustrated components can be realized in hardware, software or a combination of software and hardware.
  • the processor 110 may include one or more processing units, for example: the processor 110 may include an application processor (application processor, AP), a modem processor, a graphics processing unit (graphics processing unit, GPU), an image signal processor (image signal processor, ISP), controller, memory, video codec, digital signal processor (digital signal processor, DSP), baseband processor, and/or neural network processor (neural-network processing unit, NPU) wait. Wherein, different processing units may be independent devices, or may be integrated in one or more processors.
  • application processor application processor, AP
  • modem processor graphics processing unit
  • GPU graphics processing unit
  • image signal processor image signal processor
  • ISP image signal processor
  • controller memory
  • video codec digital signal processor
  • DSP digital signal processor
  • baseband processor baseband processor
  • neural network processor neural-network processing unit, NPU
  • the controller may be the nerve center and command center of the terminal 100 .
  • the controller can generate an operation control signal according to the instruction opcode and timing signal, and complete the control of fetching and executing the instruction.
  • a memory may also be provided in the processor 110 for storing instructions and data.
  • the memory in processor 110 is a cache memory.
  • the memory may hold instructions or data that the processor 110 has just used or recycled. If the processor 110 needs to use the instruction or data again, it can be called directly from the memory. Repeated access is avoided, and the waiting time of the processor 110 is reduced, thus improving the efficiency of the system.
  • processor 110 may include one or more interfaces.
  • the interface may include an integrated circuit (inter-integrated circuit, I2C) interface, an integrated circuit built-in audio (inter-integrated circuit sound, I2S) interface, a pulse code modulation (pulse code modulation, PCM) interface, a universal asynchronous transmitter (universal asynchronous receiver/transmitter, UART) interface, mobile industry processor interface (mobile industry processor interface, MIPI), general-purpose input and output (general-purpose input/output, GPIO) interface, subscriber identity module (subscriber identity module, SIM) interface, and /or universal serial bus (universal serial bus, USB) interface, etc.
  • I2C integrated circuit
  • I2S integrated circuit built-in audio
  • PCM pulse code modulation
  • PCM pulse code modulation
  • UART universal asynchronous transmitter
  • MIPI mobile industry processor interface
  • GPIO general-purpose input and output
  • subscriber identity module subscriber identity module
  • SIM subscriber identity module
  • USB universal serial bus
  • the I2C interface is a bidirectional synchronous serial bus, including a serial data line (serial data line, SDA) and a serial clock line (derail clock line, SCL).
  • processor 110 may include multiple sets of I2C buses.
  • the processor 110 can be respectively coupled to the touch sensor 180K, the charger, the flashlight, the camera 193 and the like through different I2C bus interfaces.
  • the processor 110 may be coupled to the touch sensor 180K through the I2C interface, so that the processor 110 and the touch sensor 180K communicate through the I2C bus interface to realize the touch function of the terminal 100 .
  • the I2S interface can be used for audio communication.
  • processor 110 may include multiple sets of I2S buses.
  • the processor 110 may be coupled to the audio module 170 through an I2S bus to implement communication between the processor 110 and the audio module 170 .
  • the audio module 170 can transmit audio signals to the wireless communication module 160 through the I2S interface, so as to realize the function of answering calls through the Bluetooth headset.
  • the PCM interface can also be used for audio communication, sampling, quantizing and encoding the analog signal.
  • the audio module 170 and the wireless communication module 160 may be coupled through a PCM bus interface.
  • the audio module 170 can also transmit audio signals to the wireless communication module 160 through the PCM interface, so as to realize the function of answering calls through the Bluetooth headset. Both the I2S interface and the PCM interface can be used for audio communication.
  • the UART interface is a universal serial data bus used for asynchronous communication.
  • the bus can be a bidirectional communication bus. It converts the data to be transmitted between serial communication and parallel communication.
  • a UART interface is generally used to connect the processor 110 and the wireless communication module 160 .
  • the processor 110 communicates with the Bluetooth module in the wireless communication module 160 through the UART interface to realize the Bluetooth function.
  • the audio module 170 can transmit audio signals to the wireless communication module 160 through the UART interface, so as to realize the function of playing music through the Bluetooth headset.
  • the MIPI interface can be used to connect the processor 110 with peripheral devices such as the display screen 194 and the camera 193 .
  • MIPI interface includes camera serial interface (camera serial interface, CSI), display serial interface (display serial interface, DSI), etc.
  • the processor 110 communicates with the camera 193 through a CSI interface to realize the shooting function of the terminal 100 .
  • the processor 110 communicates with the display screen 194 through the DSI interface to realize the display function of the terminal 100 .
  • the GPIO interface can be configured by software.
  • the GPIO interface can be configured as a control signal or as a data signal.
  • the GPIO interface can be used to connect the processor 110 with the camera 193 , the display screen 194 , the wireless communication module 160 , the audio module 170 , the sensor module 180 and so on.
  • the GPIO interface can also be configured as an I2C interface, I2S interface, UART interface, MIPI interface, etc.
  • the USB interface 130 is an interface conforming to the USB standard specification, specifically, it can be a Mini USB interface, a Micro USB interface, a USB Type C interface, and the like.
  • the USB interface 130 can be used to connect a charger to charge the terminal 100, and can also be used to transmit data between the terminal 100 and peripheral devices. It can also be used to connect headphones and play audio through them. This interface can also be used to connect other electronic devices, such as AR devices.
  • the interface connection relationship between the modules shown in the embodiment of the present invention is only a schematic illustration, and does not constitute a structural limitation of the terminal 100 .
  • the terminal 100 may also adopt different interface connection modes in the foregoing embodiments, or a combination of multiple interface connection modes.
  • the charging management module 140 is configured to receive a charging input from a charger.
  • the charger may be a wireless charger or a wired charger.
  • the charging management module 140 can receive charging input from the wired charger through the USB interface 130 .
  • the charging management module 140 may receive wireless charging input through the wireless charging coil of the terminal 100 . While the charging management module 140 is charging the battery 142 , it can also provide power for electronic devices through the power management module 141 .
  • the power management module 141 is used for connecting the battery 142 , the charging management module 140 and the processor 110 .
  • the power management module 141 receives the input from the battery 142 and/or the charging management module 140 to provide power for the processor 110 , the internal memory 121 , the external memory, the display screen 194 , the camera 193 , and the wireless communication module 160 .
  • the power management module 141 can also be used to monitor parameters such as battery capacity, battery cycle times, and battery health status (leakage, impedance).
  • the power management module 141 may also be disposed in the processor 110 .
  • the power management module 141 and the charging management module 140 may also be set in the same device.
  • the wireless communication function of the terminal 100 can be realized by the antenna 1, the antenna 2, the mobile communication module 150, the wireless communication module 160, the modem processor and the baseband processor.
  • Antenna 1 and Antenna 2 are used to transmit and receive electromagnetic wave signals.
  • Each antenna in terminal 100 may be used to cover single or multiple communication frequency bands. Different antennas can also be multiplexed to improve the utilization of the antennas.
  • Antenna 1 can be multiplexed as a diversity antenna of a wireless local area network.
  • the antenna may be used in conjunction with a tuning switch.
  • the mobile communication module 150 can provide wireless communication solutions including 2G/3G/4G/5G applied on the terminal 100 .
  • the mobile communication module 150 may include at least one filter, switch, power amplifier, low noise amplifier (low noise amplifier, LNA) and the like.
  • the mobile communication module 150 can receive electromagnetic waves through the antenna 1, filter and amplify the received electromagnetic waves, and send them to the modem processor for demodulation.
  • the mobile communication module 150 can also amplify the signals modulated by the modem processor, and convert them into electromagnetic waves through the antenna 1 for radiation.
  • at least part of the functional modules of the mobile communication module 150 may be set in the processor 110 .
  • at least part of the functional modules of the mobile communication module 150 and at least part of the modules of the processor 110 may be set in the same device.
  • a modem processor may include a modulator and a demodulator.
  • the modulator is used for modulating the low-frequency baseband signal to be transmitted into a medium-high frequency signal.
  • the demodulator is used to demodulate the received electromagnetic wave signal into a low frequency baseband signal. Then the demodulator sends the demodulated low-frequency baseband signal to the baseband processor for processing.
  • the low-frequency baseband signal is passed to the application processor after being processed by the baseband processor.
  • the application processor outputs sound signals through audio equipment (not limited to speaker 170A, receiver 170B, etc.), or displays images or videos through display screen 194 .
  • the modem processor may be a stand-alone device.
  • the modem processor may be independent from the processor 110, and be set in the same device as the mobile communication module 150 or other functional modules.
  • the wireless communication module 160 can provide wireless local area networks (wireless local area networks, WLAN) (such as wireless fidelity (Wi-Fi) network), bluetooth (bluetooth, BT), global navigation satellite system, etc. (global navigation satellite system, GNSS), satellite communication module, frequency modulation (frequency modulation, FM), near field communication technology (near field communication, NFC), infrared technology (infrared, IR) and other wireless communication solutions.
  • the wireless communication module 160 may be one or more devices integrating at least one communication processing module.
  • the wireless communication module 160 receives electromagnetic waves via the antenna 2 , frequency-modulates and filters the electromagnetic wave signals, and sends the processed signals to the processor 110 .
  • the wireless communication module 160 can also receive the signal to be sent from the processor 110 , frequency-modulate it, amplify it, and convert it into electromagnetic waves through the antenna 2 for radiation.
  • the satellite communication module can be used to communicate with satellite network equipment.
  • the satellite communication module can communicate with the Beidou network equipment 200, and the satellite communication module can support short message transmission with the Beidou network equipment 200 .
  • the antenna 1 of the terminal 100 is coupled to the mobile communication module 150, and the antenna 2 is coupled to the wireless communication module 160, so that the terminal 100 can communicate with the network and other devices through wireless communication technology.
  • the wireless communication technology may include global system for mobile communications (GSM), general packet radio service (general packet radio service, GPRS), code division multiple access (code division multiple access, CDMA), broadband Code division multiple access (wideband code division multiple access, WCDMA), time division code division multiple access (time-division code division multiple access, TD-SCDMA), long term evolution (long term evolution, LTE), BT, GNSS, WLAN, NFC , FM, and/or IR techniques, etc.
  • GSM global system for mobile communications
  • GPRS general packet radio service
  • code division multiple access code division multiple access
  • CDMA broadband Code division multiple access
  • WCDMA wideband code division multiple access
  • time division code division multiple access time-division code division multiple access
  • TD-SCDMA time-division code division multiple access
  • LTE long
  • the GNSS may include a global positioning system (global positioning system, GPS), a global navigation satellite system (global navigation satellite system, GLONASS), a Beidou navigation satellite system (beidou navigation satellite system, BDS), a quasi-zenith satellite system (quasi -zenith satellite system (QZSS) and/or satellite based augmentation systems (SBAS).
  • GPS global positioning system
  • GLONASS global navigation satellite system
  • Beidou navigation satellite system beidou navigation satellite system
  • BDS Beidou navigation satellite system
  • QZSS quasi-zenith satellite system
  • SBAS satellite based augmentation systems
  • the terminal 100 realizes the display function through the GPU, the display screen 194, and the application processor.
  • the GPU is a microprocessor for image processing, and is connected to the display screen 194 and the application processor. GPUs are used to perform mathematical and geometric calculations for graphics rendering.
  • Processor 110 may include one or more GPUs that execute program instructions to generate or change display information.
  • the display screen 194 is used to display images, videos and the like.
  • the display screen 194 includes a display panel.
  • the display panel can be a liquid crystal display (LCD), an organic light-emitting diode (OLED), an active matrix organic light emitting diode or an active matrix organic light emitting diode (active-matrix organic light emitting diode, AMOLED), flexible light-emitting diode (flex light-emitting diode, FLED), Miniled, MicroLed, Micro-oLed, quantum dot light emitting diodes (quantum dot light emitting diodes, QLED), etc.
  • the terminal 100 may include 1 or N display screens 194, where N is a positive integer greater than 1.
  • the terminal 100 can realize the shooting function through the ISP, the camera 193 , the video codec, the GPU, the display screen 194 and the application processor.
  • the ISP is used for processing the data fed back by the camera 193 .
  • the light is transmitted to the photosensitive element of the camera through the lens, and the light signal is converted into an electrical signal, and the photosensitive element of the camera transmits the electrical signal to the ISP for processing, and converts it into an image visible to the naked eye.
  • ISP can also optimize the algorithm for image noise and brightness.
  • ISP can also optimize the exposure, color temperature and other parameters of the shooting scene.
  • the ISP may be located in the camera 193 .
  • Camera 193 is used to capture still images or video.
  • the object generates an optical image through the lens and projects it to the photosensitive element.
  • the photosensitive element can be a charge coupled device (CCD) or a complementary metal-oxide-semiconductor (CMOS) phototransistor.
  • CMOS complementary metal-oxide-semiconductor
  • the photosensitive element converts the light signal into an electrical signal, and then transmits the electrical signal to the ISP to convert it into a digital image signal.
  • the ISP outputs the digital image signal to the DSP for processing.
  • DSP converts digital image signals into standard RGB, YUV and other image signals.
  • the terminal 100 may include 1 or N cameras 193, where N is a positive integer greater than 1.
  • Digital signal processors are used to process digital signals. In addition to digital image signals, they can also process other digital signals. For example, when the terminal 100 selects a frequency point, the digital signal processor is used to perform Fourier transform on the energy of the frequency point.
  • Video codecs are used to compress or decompress digital video.
  • Terminal 100 may support one or more video codecs.
  • the terminal 100 can play or record videos in various encoding formats, for example: moving picture experts group (moving picture experts group, MPEG) 1, MPEG2, MPEG3, MPEG4, etc.
  • the NPU is a neural-network (NN) computing processor.
  • NN neural-network
  • Applications such as intelligent cognition of the terminal 100 can be implemented through the NPU, such as image recognition, face recognition, speech recognition, text understanding, and the like.
  • the external memory interface 120 may be used to connect an external memory card, such as a Micro SD card, to expand the storage capacity of the terminal 100.
  • the external memory card communicates with the processor 110 through the external memory interface 120 to implement a data storage function. Such as saving music, video and other files in the external memory card.
  • the internal memory 121 may be used to store computer-executable program codes including instructions.
  • the processor 110 executes various functional applications and data processing of the terminal 100 by executing instructions stored in the internal memory 121 .
  • the internal memory 121 may include an area for storing programs and an area for storing data. Wherein, the stored program area can store an operating system, at least one application program required by a function (such as a sound playing function, an image playing function, etc.) and the like.
  • the data storage area can store data created during the use of the terminal 100 (such as audio data, phonebook, etc.) and the like.
  • the internal memory 121 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one magnetic disk storage device, flash memory device, universal flash storage (universal flash storage, UFS) and the like.
  • the terminal 100 may implement an audio function through an audio module 170 , a speaker 170A, a receiver 170B, a microphone 170C, an earphone interface 170D, and an application processor. Such as music playback, recording, etc.
  • the audio module 170 is used to convert digital audio information into analog audio signal output, and is also used to convert analog audio input into digital audio signal.
  • the audio module 170 may also be used to encode and decode audio signals.
  • the audio module 170 may be set in the processor 110 , or some functional modules of the audio module 170 may be set in the processor 110 .
  • Speaker 170A also referred to as a "horn" is used to convert audio electrical signals into sound signals. Terminal 100 can listen to music through speaker 170A, or listen to hands-free calls.
  • Receiver 170B also called “earpiece” is used to convert audio electrical signals into sound signals.
  • the receiver 170B can be placed close to the human ear to listen to the voice.
  • the microphone 170C also called “microphone” or “microphone” is used to convert sound signals into electrical signals.
  • the user can put his mouth close to the microphone 170C to make a sound, and input the sound signal to the microphone 170C.
  • the terminal 100 may be provided with at least one microphone 170C.
  • the terminal 100 may be provided with two microphones 170C, which may also implement a noise reduction function in addition to collecting sound signals.
  • the terminal 100 can also be equipped with three, four or more microphones 170C to realize sound signal collection, noise reduction, identify sound sources, realize directional recording functions, and the like.
  • the earphone interface 170D is used for connecting wired earphones.
  • the earphone interface 170D can be a USB interface 130, or a 3.5mm open mobile terminal platform (OMTP) standard interface, or a cellular telecommunications industry association of the USA (CTIA) standard interface.
  • OMTP open mobile terminal platform
  • CTIA cellular telecommunications industry association of the USA
  • the pressure sensor 180A is used to sense the pressure signal and convert the pressure signal into an electrical signal.
  • pressure sensor 180A may be disposed on display screen 194 .
  • pressure sensors 180A such as resistive pressure sensors, inductive pressure sensors, and capacitive pressure sensors.
  • a capacitive pressure sensor may be comprised of at least two parallel plates with conductive material.
  • the terminal 100 determines the strength of the pressure from the change in capacitance.
  • the terminal 100 detects the intensity of the touch operation according to the pressure sensor 180A.
  • the terminal 100 may also calculate the touched position according to the detection signal of the pressure sensor 180A.
  • touch operations acting on the same touch position but with different touch operation intensities may correspond to different operation instructions. For example: when a touch operation with a touch operation intensity less than the first pressure threshold acts on the short message application icon, an instruction to view short messages is executed. When a touch operation whose intensity is greater than or equal to the first pressure threshold acts on the icon of the short message application, the instruction of creating a new short message is executed.
  • the gyro sensor 180B can be used to determine the motion posture of the terminal 100 .
  • the angular velocity of the terminal 100 around three axes ie, x, y and z axes
  • the gyro sensor 180B can be used for image stabilization.
  • the gyro sensor 180B detects the shaking angle of the terminal 100, and calculates the distance that the lens module needs to compensate according to the angle, and allows the lens to counteract the shaking of the terminal 100 through reverse movement to achieve anti-shake.
  • the gyro sensor 180B can also be used for navigation and somatosensory game scenes.
  • the air pressure sensor 180C is used to measure air pressure.
  • the terminal 100 calculates the altitude through the air pressure value measured by the air pressure sensor 180C to assist positioning and navigation.
  • the magnetic sensor 180D includes a Hall sensor.
  • the terminal 100 may use the magnetic sensor 180D to detect the opening and closing of the flip holster.
  • the terminal 100 when the terminal 100 is a clamshell machine, the terminal 100 can detect the opening and closing of the clamshell according to the magnetic sensor 180D.
  • features such as automatic unlocking of the flip cover are set.
  • the acceleration sensor 180E can detect the acceleration of the terminal 100 in various directions (generally three axes).
  • the magnitude and direction of gravity can be detected when the terminal 100 is stationary. It can also be used to identify the posture of electronic devices, and can be used in applications such as horizontal and vertical screen switching, pedometers, etc.
  • the distance sensor 180F is used to measure the distance.
  • the terminal 100 can measure the distance by infrared or laser. In some embodiments, when shooting a scene, the terminal 100 may use the distance sensor 180F for distance measurement to achieve fast focusing.
  • Proximity light sensor 180G may include, for example, light emitting diodes (LEDs) and light detectors, such as photodiodes.
  • the light emitting diodes may be infrared light emitting diodes.
  • the terminal 100 emits infrared light through the light emitting diode.
  • the terminal 100 detects infrared reflected light from nearby objects using a photodiode. When sufficient reflected light is detected, it may be determined that there is an object near the terminal 100 . When insufficient reflected light is detected, the terminal 100 may determine that there is no object near the terminal 100 .
  • the terminal 100 can use the proximity light sensor 180G to detect that the user holds the terminal 100 close to the ear to make a call, so as to automatically turn off the screen to save power.
  • the proximity light sensor 180G can also be used in leather case mode, automatic unlock and lock screen in pocket mode.
  • the ambient light sensor 180L is used for sensing ambient light brightness.
  • the terminal 100 may adaptively adjust the brightness of the display screen 194 according to the perceived ambient light brightness.
  • the ambient light sensor 180L can also be used to automatically adjust the white balance when taking pictures.
  • the ambient light sensor 180L can also cooperate with the proximity light sensor 180G to detect whether the terminal 100 is in the pocket, so as to prevent accidental touch.
  • the fingerprint sensor 180H is used to collect fingerprints.
  • the terminal 100 can use the collected fingerprint characteristics to realize fingerprint unlocking, access to the application lock, take pictures with fingerprints, answer incoming calls with fingerprints, and so on.
  • the temperature sensor 180J is used to detect temperature.
  • the terminal 100 uses the temperature detected by the temperature sensor 180J to implement a temperature processing strategy. For example, when the temperature reported by the temperature sensor 180J exceeds the threshold, the terminal 100 executes reducing the performance of a processor located near the temperature sensor 180J, so as to reduce power consumption and implement thermal protection.
  • the terminal 100 when the temperature is lower than another threshold, the terminal 100 heats the battery 142 to avoid abnormal shutdown of the terminal 100 due to low temperature.
  • the terminal 100 boosts the output voltage of the battery 142 to avoid abnormal shutdown caused by low temperature.
  • Touch sensor 180K also known as "touch panel”.
  • the touch sensor 180K can be disposed on the display screen 194, and the touch sensor 180K and the display screen 194 form a touch screen, also called a “touch screen”.
  • the touch sensor 180K is used to detect a touch operation on or near it.
  • the touch sensor can pass the detected touch operation to the application processor to determine the type of touch event.
  • Visual output related to the touch operation can be provided through the display screen 194 .
  • the touch sensor 180K may also be disposed on the surface of the terminal 100 , which is different from the position of the display screen 194 .
  • the bone conduction sensor 180M can acquire vibration signals. In some embodiments, the bone conduction sensor 180M can acquire the vibration signal of the vibrating bone mass of the human voice. The bone conduction sensor 180M can also contact the human pulse and receive the blood pressure beating signal. In some embodiments, the bone conduction sensor 180M can also be disposed in the earphone, combined into a bone conduction earphone.
  • the audio module 170 can analyze the voice signal based on the vibration signal of the vibrating bone mass of the vocal part acquired by the bone conduction sensor 180M, so as to realize the voice function.
  • the application processor can analyze the heart rate information based on the blood pressure beating signal acquired by the bone conduction sensor 180M, so as to realize the heart rate detection function.
  • the keys 190 include a power key, a volume key and the like.
  • the key 190 may be a mechanical key. It can also be a touch button.
  • the terminal 100 may receive key input and generate key signal input related to user settings and function control of the terminal 100 .
  • the motor 191 can generate a vibrating reminder.
  • the motor 191 can be used for incoming call vibration prompts, and can also be used for touch vibration feedback.
  • touch operations applied to different applications may correspond to different vibration feedback effects.
  • the motor 191 may also correspond to different vibration feedback effects for touch operations acting on different areas of the display screen 194 .
  • Different application scenarios for example: time reminder, receiving information, alarm clock, games, etc.
  • the touch vibration feedback effect can also support customization.
  • the indicator 192 can be an indicator light, and can be used to indicate charging status, power change, and can also be used to indicate messages, missed calls, notifications, and the like.
  • the SIM card interface 195 is used for connecting a SIM card.
  • the SIM card can be connected and separated from the terminal 100 by inserting it into the SIM card interface 195 or pulling it out from the SIM card interface 195 .
  • the terminal 100 may support 1 or N SIM card interfaces, where N is a positive integer greater than 1.
  • SIM card interface 195 can support Nano SIM card, Micro SIM card, SIM card etc. Multiple cards can be inserted into the same SIM card interface 195 at the same time. The types of the multiple cards may be the same or different.
  • the SIM card interface 195 is also compatible with different types of SIM cards.
  • the SIM card interface 195 is also compatible with external memory cards.
  • the terminal 100 interacts with the network through the SIM card to implement functions such as calling and data communication.
  • the terminal 100 adopts an eSIM, that is, an embedded SIM card.
  • the eSIM card can be embedded in the terminal 100 and cannot be separated from the terminal 100 .
  • a key update method in the Beidou communication system provided in the embodiment of the present application is introduced below.
  • Fig. 10 shows a schematic flowchart of a key update method in the Beidou communication system provided in the embodiment of the present application.
  • the key update method in the Beidou communication system includes the following steps:
  • the terminal 100 generates a first key based on the user identification code IMSI, the identity identification key Ki, and the sending time of the first application layer message.
  • the terminal 100 encrypts first original data by using the first key to obtain first encrypted data.
  • the terminal 100 adds packet header information to the first encrypted data to obtain a first application layer packet.
  • the message header information includes a time indication field and an encryption indication field
  • the encryption indication field is used to indicate the preset encryption algorithm used when encrypting the first original data
  • the time indication field is used to indicate the sending time of the first application layer message information.
  • the terminal 100 sends the first application layer message to the BeiDou network device 200.
  • the Beidou network device 200 generates a second key through the cellular network device based on the time indication field and the receiving time of the first application layer message.
  • the Beidou network device 200 uses the second key to successfully decrypt the first encrypted data to obtain the first original data.
  • the sending time of the first application layer message is the first time point or the second time point; wherein, the first time point is the time point when the terminal obtains the first original data, and the second time point The time point obtained when the first key is generated for the terminal.
  • the terminal generates the first key based on the user identification code IMSI, the identity identification key Ki, and the sending time of the first application layer message, which specifically includes: the terminal generates the first key based on the sending time of the first application layer message
  • the time and IMSI get the random number RAND.
  • the terminal obtains the encryption key Kc through the preset key algorithm 1 based on the RAND and the preset Ki, and obtains the authentication symbol response SRES through the preset key algorithm 2.
  • the terminal obtains the first key through preset key algorithm 3 based on Kc and SRES.
  • the method further includes: the terminal may further compress the first original data.
  • the method further includes: the terminal receives the first application layer receipt sent by the Beidou network device, and the first application layer receipt is used to indicate Beidou network equipment successfully decrypted the first application layer message.
  • the method further includes: the terminal generates a third key based on IMSI, Ki and the sending time of the second application layer message; the terminal Use the third key to encrypt the second original data to obtain the second encrypted data; the terminal adds message header information to the second encrypted data to obtain the second application layer message; wherein, the message header information includes a time indication field and An encryption indication field, the encryption indication field is used to indicate the preset encryption algorithm used when encrypting the second original data, and the time indication field is used to indicate the sending time information of the second application layer message; the terminal sends the second application layer to the Beidou network device layer message; the terminal receives the second application layer receipt sent by the Beidou network equipment, and the second application layer receipt is used to indicate that the Beidou network equipment fails to decrypt the second application layer message.
  • the message header information includes a time indication field and An encryption indication field, the encryption indication field is used to indicate the preset encryption algorithm used when encrypting the second original data, and the time indication field is used to indicate the sending time information
  • the terminal determines that the sending time of the first application layer message is the same as the sending time of the second application layer message, and the terminal directly uses the first key to encrypt the second original data to obtain the second encrypted post data.
  • the terminal directly uses the time indication field of the first application layer packet as the time indication field of the second application layer packet.
  • the method further includes: the terminal retransmits the second application layer message.
  • the method further includes: the terminal displays failure prompt information, and the failure prompt information is used to instruct the Beidou network equipment to decrypt the second application layer receipt. Text failed.
  • the value of the time indication field is used to indicate the parity value of the sending time of the first application layer message.
  • the Beidou network device generates the second key through the cellular network device based on the time indication field and the receiving time of the first application layer message, specifically including: the Beidou network device generates the second key based on the time indication field and the first application layer message
  • the receiving time of the first application layer message determines the sending time of the first application layer message; the Beidou network device obtains the random number RAND based on the sending time of the first application layer message and the user identification code IMSI obtained from the cellular network device; the Beidou network device will The RAND is sent to the cellular network device; the Beidou network device obtains the encryption key Kc and the authentication symbol response SRES fed back by the cellular network device; the terminal obtains the second key through the preset key algorithm 3 based on Kc and SRES.
  • the receiving time of the first application layer message is a specified time point between the third time point and the fourth time point, and the unit of the receiving time of the first application layer message is hour; wherein , the third time point is the time point when the Beidou network equipment receives the first satellite link control layer protocol data unit SLC PDU of the first application layer message, and the fourth time point is obtained when the Beidou network equipment generates the second key point in time.
  • the value of the time indication field is used to indicate the parity value of the sending time of the first application layer message. Specifically, reference may be made to the embodiment described in FIG. 3B above.
  • the Beidou network device determines the sending time of the first application layer message based on the time indication field and the receiving time of the first application layer message, specifically including: when the value of the time indication field indicates the first When the parity value of the sending time of the application layer message is the same as the parity value of the receiving time of the first application layer message, the Beidou network device determines the sending time of the first application layer message and the receiving time of the first application layer message same;
  • the Beidou network device determines the receiving time of the first application layer message The difference with the sending time of the first application layer message is 1.
  • the method further includes: the Beidou network device generates a first application layer receipt, and the first The application layer receipt is used to indicate that the Beidou network device has successfully decrypted the first application layer message; the Beidou network device sends the first application layer receipt to the terminal.
  • the method further includes: the Beidou network device receives the second application layer report sent by the terminal Text; wherein, the second application layer message includes the second encrypted data and message header information, the message header information includes a time indication field and an encryption indication field, and the encryption indication field is used to indicate the second original data encrypted.
  • the time indication field is used to indicate the sending time information of the second application layer message; the Beidou network device generates the fourth key through the cellular network device based on the time indication field and the receiving time of the second application layer message; Beidou The network device fails to decrypt the second encrypted data using the fourth key, and the Beidou network device generates a second application layer receipt, which is used to indicate that the Beidou network device fails to decrypt the second application layer message; the Beidou network device sends a message to the terminal Send the second application layer receipt.
  • the Beidou network device determines that the receiving time of the first application layer message is the same as the receiving time of the second application layer message, and the Beidou network device directly uses the first key to decrypt the second encrypted data .
  • the above content elaborates the method provided by the present application in detail.
  • the embodiments of the present application also provide corresponding devices or equipment.
  • the embodiment of the present application may divide the terminal 100 into functional modules according to the above method example, for example, each functional module may be divided corresponding to each function, or two or more functions may be integrated into one processing module.
  • the above-mentioned integrated modules can be implemented in the form of hardware or in the form of software function modules. It should be noted that the division of modules in the embodiment of the present application is schematic, and is only a logical function division, and there may be other division methods in actual implementation.
  • FIG. 11 is a schematic structural diagram of a communication device 1100 provided in an embodiment of the present application.
  • the communication device 1100 may be the terminal 100 in the foregoing embodiments.
  • the communication device 1100 may be a chip/chip system, for example, a Beidou communication chip.
  • the communication device 1100 may include a transceiver unit 1110 and a processing unit 1120 .
  • the processing unit 1120 may be configured to generate the first key based on the user identification code IMSI, the identity identification key Ki, and the sending time of the application layer message.
  • the processing unit 1120 is further configured to use the first key to encrypt the first original data to obtain first encrypted data.
  • the processing unit 1120 is further configured to add packet header information to the first encrypted data to obtain a first application layer packet.
  • the message header information includes a time indication field and an encryption indication field
  • the encryption indication field is used to indicate the preset encryption algorithm used when encrypting the first original data
  • the time indication field is used to indicate the sending time of the first application layer message information.
  • the transceiver unit 1110 can be configured to send the first application layer message to the Beidou network device 200 .
  • the transceiver unit 1110 may also be configured to perform the functional steps related to sending and receiving performed by the terminal 100 in the method embodiment shown in FIG. 10 above.
  • processing unit 1120 may also be configured to execute functional steps related to protocol parsing and encapsulation and calculation determination performed by the terminal 100 in the method embodiment shown in FIG. 10 above.
  • the communication device 1100 in this design may correspondingly perform the method steps performed by the terminal 100 in the foregoing embodiments, and details are not repeated here for the sake of brevity.
  • FIG. 12 is a schematic structural diagram of a communication device 1200 provided in an embodiment of the present application.
  • the communication apparatus 1200 may be the Beidou network device 200 in the above-mentioned embodiments.
  • the communication device 1200 can be a specific network element in the Beidou network equipment 200, for example, one or more network elements in the Beidou ground transceiver station 22, the Beidou central station 23, and the Beidou short message fusion communication platform 24 The combination.
  • the communication device 1200 may include a transceiver unit 1210 and a processing unit 1220 .
  • the transceiver unit 1210 may be configured to receive the first application layer packet sent by the terminal 100 .
  • the processing unit 1220 is configured to generate a second key through the cellular network device based on the time indication field and the receiving time of the first application layer message.
  • the processing unit 1220 is further configured to use the second key to successfully decrypt the first encrypted data to obtain the first original data.
  • the transceiver unit 1210 may also be configured to perform the functional steps related to sending and receiving performed by the Beidou network device 200 in the above method embodiment shown in FIG. 10 .
  • the processing unit 1220 may also be configured to perform functional steps related to protocol parsing and encapsulation and calculation determination performed by the Beidou network device 200 in the method embodiment shown in FIG. 10 above.
  • the communication device 1200 in this design can correspondingly perform the method steps performed by the Beidou network device 200 in the foregoing embodiments, and for the sake of brevity, details are not repeated here.
  • the terminal 100 and the Beidou network device 200 of the embodiment of the present application have been introduced above. It should be understood that any product of any form that has the functions of the terminal 100 described above in FIG. Products of any form with functions fall within the scope of protection of the embodiments of the present application.
  • the terminal 100 described in the embodiment of the present application may be implemented by a general bus architecture.
  • FIG. 13 is a schematic structural diagram of a communication device 1300 provided by an embodiment of the present application.
  • the communication device 1300 may be the terminal 100, or a device therein.
  • the communication device 1300 includes a processor 1301 and a transceiver 1302 internally connected and communicating with the processor.
  • the processor 1301 is a general purpose processor or a special purpose processor or the like.
  • it may be a baseband processor or a central processing unit for satellite communications.
  • the baseband processor of satellite communication can be used to process satellite communication protocols and satellite communication data
  • the central processing unit can be used to control communication devices (such as baseband chips, terminals, terminal chips, etc.), execute computer programs, and process computer Program data.
  • the transceiver 1302 may be called a transceiver unit, a transceiver, or a transceiver circuit, etc., and is used to implement a transceiver function.
  • the transceiver 1302 may include a receiver and a transmitter, and the receiver may be called a receiver or a receiving circuit, etc., for realizing a receiving function; the transmitter may be called a transmitter, or a sending circuit, for realizing a sending function.
  • the communication device 1300 may further include an antenna 1303 and/or a radio frequency unit (not shown in the figure).
  • the antenna 1303 and/or the radio frequency unit may be located inside the communication device 1300, or may be separated from the communication device 1300, that is, the antenna 1303 and/or the radio frequency unit may be remote or distributed.
  • the communication device 1300 may include one or more memories 1304, on which instructions may be stored, the instructions may be computer programs, and the computer programs may be run on the communication device 1300, so that the communication device 1300 executes the above-mentioned Methods described in the Methods Examples.
  • data may also be stored in the memory 1304 .
  • the communication device 1300 and the memory 1304 can be set separately or integrated together.
  • the processor 1301, the transceiver 1302, and the memory 1304 may be connected through a communication bus.
  • the communication device 1300 can be used to perform the functions of the terminal 100 in the foregoing embodiments: the processor 1301 can be used to perform the functions related to protocol analysis and encapsulation and operation determination performed by the terminal 100 in the embodiment shown in FIG. 11 Steps and/or other processes used in the technology described herein; the transceiver 1302 may be used to execute the functional steps related to the execution of sending and receiving performed by the terminal 100 in the embodiment shown in FIG. 11 and/or used in this article Other procedures for the techniques described.
  • the processor 1301 may include a transceiver for implementing receiving and sending functions.
  • the transceiver may be a transceiver circuit, or an interface, or an interface circuit.
  • the transceiver circuits, interfaces or interface circuits for realizing the functions of receiving and sending can be separated or integrated together.
  • the above-mentioned transceiver circuit, interface or interface circuit may be used for reading and writing code/data, or the above-mentioned transceiver circuit, interface or interface circuit may be used for signal transmission or transfer.
  • the processor 1301 may store instructions, the instructions may be computer programs, and the computer programs run on the processor 1301 to enable the communication device 1300 to perform the method steps performed by the terminal 100 in the above method embodiments.
  • the computer program may be fixed in the processor 1301, and in this case, the processor 1301 may be implemented by hardware.
  • the communication device 1300 may include a circuit, and the circuit may implement the function of sending or receiving or communicating in the foregoing method embodiments.
  • the processors and transceivers described in this application can be implemented in integrated circuits (integrated circuits, ICs), analog ICs, radio frequency integrated circuits (RFICs), mixed-signal ICs, application specific integrated circuits (ASICs), printed circuit boards ( printed circuit board, PCB), electronic equipment, etc.
  • the processor and transceiver can also be fabricated using various IC process technologies, such as complementary metal oxide semiconductor (CMOS), nMetal-oxide-semiconductor (NMOS), P-type Metal oxide semiconductor (positive channel metal oxide semiconductor, PMOS), bipolar junction transistor (bipolar junction transistor, BJT), bipolar CMOS (BiCMOS), silicon germanium (SiGe), gallium arsenide (GaAs), etc.
  • CMOS complementary metal oxide semiconductor
  • NMOS nMetal-oxide-semiconductor
  • PMOS P-type Metal oxide semiconductor
  • BJT bipolar junction transistor
  • BiCMOS bipolar CMOS
  • SiGe silicon germanium
  • GaAs gallium arsenide
  • Communications apparatus 1300 may be a stand-alone device or may be part of a larger device.
  • the communication device 1300 may be:
  • a set of one or more ICs may also include storage components for storing data and computer programs;
  • ASIC such as modem (Modem);
  • any network element for example, Beidou ground transceiver station 22, Beidou central station 23, Beidou short message fusion communication platform 24
  • Beidou network equipment 200 described in the embodiment of the application can Implemented by a generic bus architecture.
  • FIG. 14 is a schematic structural diagram of a communication device 1400 provided by an embodiment of the present application.
  • the communication device 1400 may be the Beidou network device 200, or a device therein.
  • the communication device 1400 includes a processor 1401 and a transceiver 1402 internally connected and communicating with the processor.
  • the processor 1401 is a general purpose processor or a special purpose processor or the like.
  • it may be a baseband processor or a central processing unit for satellite communications.
  • the baseband processor of satellite communication can be used to process satellite communication protocols and satellite communication data
  • the central processing unit can be used to control communication devices (such as baseband chips, etc.), execute computer programs, and process data of computer programs.
  • the transceiver 1402 may be called a transceiver unit, a transceiver, or a transceiver circuit, etc., and is used to implement a transceiver function.
  • the transceiver 1402 may include a receiver and a transmitter, and the receiver may be called a receiver or a receiving circuit, etc., for realizing a receiving function; the transmitter may be called a transmitter, or a sending circuit, for realizing a sending function.
  • the communication device 1400 may further include an antenna 1403 and/or a radio frequency unit (not shown in the figure).
  • the antenna 1403 and/or the radio frequency unit may be located inside the communication device 1400, or may be separated from the communication device 1400, that is, the antenna 1403 and/or the radio frequency unit may be remote or distributed.
  • the communication device 1400 may include one or more memories 1404, on which instructions may be stored, the instructions may be computer programs, and the computer programs may be run on the communication device 1400, so that the communication device 1400 executes the above-mentioned Methods described in the Methods Examples.
  • data may also be stored in the memory 1404 .
  • the communication device 1400 and the memory 1404 can be set separately or integrated together.
  • the processor 1401, the transceiver 1402, and the memory 1404 may be connected through a communication bus.
  • the communication device 1400 can be used to perform the functions of the Beidou network device 200 in the foregoing embodiments: the processor 1401 can be used to perform the related protocol parsing and encapsulation performed by the Beidou network device 200 in the embodiment shown in FIG. 12 and The functional steps determined by the calculation and/or other processes used in the technology described herein; the transceiver 1402 can be used to execute the functional steps related to the sending and receiving performed by the Beidou network device 200 in the embodiment shown in FIG. 12 and/or other processes for the techniques described herein.
  • the processor 1401 may include a transceiver for implementing receiving and sending functions.
  • the transceiver may be a transceiver circuit, or an interface, or an interface circuit.
  • the transceiver circuits, interfaces or interface circuits for realizing the functions of receiving and sending can be separated or integrated together.
  • the above-mentioned transceiver circuit, interface or interface circuit may be used for reading and writing code/data, or the above-mentioned transceiver circuit, interface or interface circuit may be used for signal transmission or transfer.
  • the processor 1401 may store instructions, which may be computer programs, and the computer programs run on the processor 1401 to enable the communication device 1400 to execute the method performed by the Beidou network device 200 in the above-mentioned method embodiments step.
  • the computer program may be fixed in the processor 1401, and in this case, the processor 1401 may be implemented by hardware.
  • the embodiment of the present application also provides a computer-readable storage medium, where computer program code is stored, and when the above-mentioned processor executes the computer program code, the electronic device executes the method in any one of the above-mentioned embodiments.
  • An embodiment of the present application further provides a computer program product, which, when the computer program product is run on a computer, causes the computer to execute the method in any one of the foregoing embodiments.
  • the embodiment of the present application also provides a communication device, which can exist in the product form of a chip.
  • the structure of the device includes a processor and an interface circuit.
  • the processor is used to communicate with other devices through a receiving circuit, so that the device performs the aforementioned The method in any of the examples.
  • the embodiment of the present application also provides a Beidou communication system, including a terminal 100 and a Beidou network device 200.
  • the terminal 100 and the Beidou network device 200 can execute the method in any of the foregoing embodiments.
  • This application fully introduces the communication function of short messages in the Beidou communication system. It is understandable that there may be communication functions supporting short messages in other satellite systems. Therefore, it is not limited to the Beidou communication system. If other satellite systems also support the short message communication function, the method introduced in this application is also applicable to the communication of other satellite systems.
  • the steps of the methods or algorithms described in conjunction with the disclosure of this application can be implemented in the form of hardware, and can also be implemented in the form of a processor executing software instructions.
  • Software instructions can be composed of corresponding software modules, and software modules can be stored in random access memory (Random Access Memory, RAM), flash memory, erasable programmable read-only memory (Erasable Programmable ROM, EPROM), electrically erasable Programmable read-only memory (Electrically EPROM, EEPROM), registers, hard disk, removable hard disk, CD-ROM, or any other form of storage medium known in the art.
  • An exemplary storage medium is coupled to the processor such the processor can read information from, and write information to, the storage medium.
  • the storage medium may also be a component of the processor.
  • the processor and storage medium can be located in the ASIC.
  • the ASIC may be located in the core network interface device.
  • the processor and the storage medium may also exist in the core network interface device as discrete components.
  • Computer-readable media includes both computer-readable storage media and communication media including any medium that facilitates transfer of a computer program from one place to another.
  • a storage media may be any available media that can be accessed by a general purpose or special purpose computer.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Physics & Mathematics (AREA)
  • Astronomy & Astrophysics (AREA)
  • Aviation & Aerospace Engineering (AREA)
  • General Physics & Mathematics (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请公开了一种北斗通信系统中密钥更新方法、系统及相关装置。本申请涉及卫星通信领域。发送设备可以基于发送时间生成密钥。发送设备可以使用该密钥加密原始数据，并在加密后的原始数据前添加时间指示字段得到应用层报文。其中，时间指示字段可以用于指示发送时间。发送设备可以将包括时间指示字段的应用层报文发送至接收设备。接收设备可以基于接收时间和时间指示字段确定出发送时间，并基于发送时间得到密钥。接收设备可以使用该密钥解密应用层报文，得到原始数据。这样，发送设备和接收设备可以在传输数据时，通过随时间更新的密钥加密数据，既节约了北斗通信系统的资源，又保证了数据的安全性。

Description

一种北斗通信系统中密钥更新方法、系统及相关装置
本申请要求于2021年07月31日提交中国专利局、申请号为202110877001.4、申请名称为“一种北斗通信系统中密钥更新方法、系统及相关装置”的中国专利申请的优先权，以及要求于2021年08月12日提交中国专利局、申请号为202110924080.X、申请名称为“一种北斗通信系统中密钥更新方法、系统及相关装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及卫星通信领域，尤其涉及一种北斗通信系统中密钥更新方法、系统及相关装置。
背景技术
北斗卫星导航系统是集定位、授时、通信于一体的重大基础设施。北斗短报文通信业务是北斗卫星导航系统区别于GPS、GLONASS、GALILEO等其他全球导航系统的特色之一。北斗短报文通信业务特别适用于在海洋、沙漠、草原、无人区等移动通信未覆盖、或覆盖不了、或通信系统被破坏的区域进行通信。北斗三号卫星的短报文系统对短报文技术体制进行了升级将北斗短报文业务的通信系统一些必要的资源开放给民用，针对民用业务和设备特性，需要依据北斗短报文业务的通信系统的特性设计通信协议。
其中，北斗通信系统提供的服务类型包括：报文通信、位置报告和紧急救援。其中，报文通信可以和其他设备进行通信。位置报告可以用于分享定位信息。紧急救援可以用于和紧急救援中心直连，获得紧急救援服务。由于报文通信和位置报告这两种业务需要通过运营商的短消息中心进行转发，所以终端和运营商之间需要进行相互鉴权，以保证信息的安全。但是，目前，北斗短报文业务的通信系统没有提供给民用终端使用的鉴权加密机制。
虽然蜂窝网络中有成熟的鉴权、加密机制。不过，蜂窝网络中的鉴权加密机制的步骤繁杂，交互信令所需空口资源多。由于北斗通信系统时延长、空口资源少，不能支持蜂窝网络鉴权加密机制。
发明内容
本申请提供了一种北斗通信系统中密钥更新方法、系统及相关装置，实现了北斗通信系统中，终端和北斗网络设备间数据传输的密钥更新，确保了数据传输的安全性。
第一方面，本申请提供了一种北斗通信系统中密钥更新方法，包括：终端基于用户识别码IMSI、身份识别密钥Ki和第一应用层报文的发送时间生成第一密钥。终端使用第一密钥加密第一原始数据，得到第一加密后数据。终端给第一加密后数据添加报文头信息，得到第一应用层报文。其中，报文头信息包括时间指示字段和加密指示字段，加密指示字段用于指示对第一原始数据加密时使用的预设加密算法，时间指示字段用于指示第一应用层报文的发送时间信息。终端向北斗网络设备发送第一应用层报文。
通过本申请提供的一种北斗通信系统中密钥更新方法，终端可以基于时间更新加密数据使用的密钥。这样，终端和北斗网络设备可以在传输数据时，通过随时间更新的密钥加解密数据，生成密钥不需要额外的信令交互步骤，既节约了北斗通信系统的资源，又保证了数据的安全性。
在一种可能的实现方式中，第一应用层报文的发送时间为第一时间点或者第二时间点；其中，第一时间点为终端获取第一原始数据的时间点，第二时间点为终端生成第一密钥时获取的时间点。
在一种可能的实现方式中，终端基于用户识别码IMSI、身份识别密钥Ki和第一应用层报文的发送时间生成第一密钥，具体包括：终端基于第一应用层报文的发送时间和IMSI得到随机数RAND。终端基于RAND和预设的Ki通过预设密钥算法1得到加密密钥Kc，通过预设密钥算法2得到鉴权符号响应SRES。终端基于Kc和SRES通过预设密钥算法3得到第一密钥。
在一种可能的实现方式中，在终端使用第一密钥加密第一原始数据之前，方法还包括：终端还可以对第一原始数据进行压缩。
在一种可能的实现方式中，在终端向北斗网络设备发送第一应用层报文之后，方法还包括：终端接收到北斗网络设备发送的第一应用层回执，第一应用层回执用于指示北斗网络设备解密第一应用层报文成功。
在一种可能的实现方式中，在终端向北斗网络设备发送第一应用层报文之后，方法还包括：终端基于IMSI、Ki和第二应用层报文的发送时间生成第三密钥；终端使用第三密钥加密第二原始数据，得到第二加密后数据；终端给第二加密后数据添加报文头信息，得到第二应用层报文；其中，报文头信息包括时间指示字段和加密指示字段，加密指示字段用于指示对第二原始数据加密时使用的预设加密算法，时间指示字段用于指示第二应用层报文的发送时间信息；终端向北斗网络设备发送第二应用层报文；终端接收到北斗网络设备发送的第二应用层回执，第二应用层回执用于指示北斗网络设备解密第二应用层报文失败。
在一种可能的实现方式中，终端确定出第一应用层报文的发送时间和第二应用层报文的发送时间相同，终端直接使用第一密钥加密第二原始数据，得到第二加密后数据。
可选的，终端直接使用第一应用层报文的时间指示字段作为第二应用层报文的时间指示字段。
在一种可能的实现方式中，在终端接收到北斗网络设备发送的第二应用层回执之后，方法还包括：终端重传第二用层报文。
在一种可能的实现方式中，在终端接收到北斗网络设备发送的第二应用层回执之后，方法还包括：终端显示失败提示信息，失败提示信息用于指示北斗网络设备解密第二应用层报文失败。
在一种可能的实现方式中，时间指示字段的值用于指示第一应用层报文的发送时间的奇偶值。
第二方面，本申请提供另了一种北斗通信系统中密钥更新方法，包括：北斗网络设备接收终端发送的第一应用层报文。其中，第一应用层报文包括第一加密后数据和报文头信息， 报文头信息包括时间指示字段和加密指示字段，加密指示字段用于指示对第一原始数据加密时使用的预设加密算法，时间指示字段用于指示第一应用层报文的发送时间信息。北斗网络设备基于时间指示字段和第一应用层报文的接收时间通过蜂窝网络设备生成第二密钥。北斗网络设备使用第二密钥成功解密加密后数据，得到第一原始数据。
在一种可能的实现方式中，北斗网络设备基于时间指示字段和第一应用层报文的接收时间通过蜂窝网络设备生成第二密钥，具体包括：北斗网络设备基于时间指示字段和第一应用层报文的接收时间确定第一应用层报文的发送时间；北斗网络设备基于第一应用层报文的发送时间和从蜂窝网络设备获取的用户识别码IMSI得到随机数RAND；北斗网络设备将RAND发送给蜂窝网络设备；北斗网络设备得到蜂窝网络设备反馈的加密密钥Kc和鉴权符号响应SRES；终端基于Kc和SRES通过预设密钥算法3得到第二密钥。
在一种可能的实现方式中，第一应用层报文的接收时间为第三时间点至第四时间点之间的指定时间点，第一应用层报文的接收时间的单位为小时；其中，第三时间点为北斗网络设备收到第一应用层报文的第1个卫星链路控制层协议数据单元SLC PDU的时间点，第四时间点为北斗网络设备生成第二密钥时获取的时间点。
在一种可能的实现方式中，时间指示字段的值用于指示第一应用层报文的发送时间的奇偶值。
在一种可能的实现方式中，北斗网络设备基于时间指示字段和第一应用层报文的接收时间确定第一应用层报文的发送时间，具体包括：当时间指示字段的值指示的第一应用层报文的发送时间的奇偶值和第一应用层报文的接收时间的奇偶值相同时，北斗网络设备确定出第一应用层报文的发送时间和第一应用层报文的接收时间相同；
当时间指示字段的值指示的第一应用层报文的发送时间的奇偶值和第一应用层报文的接收时间的奇偶值不同时，北斗网络设备确定出第一应用层报文的接收时间和第一应用层报文的发送时间的差值为1。
在一种可能的实现方式中，在北斗网络设备使用第二密钥成功解密第一加密后数据后，得到第一原始数据之后，方法还包括：北斗网络设备生成第一应用层回执，第一应用层回执用于指示北斗网络设备解密第一应用层报文成功；北斗网络设备给终端发送第一应用层回执。
在一种可能的实现方式中，在北斗网络设备使用第二密钥成功解密第一加密后数据，得到第一原始数据之后，方法还包括：北斗网络设备接收到终端发送的第二应用层报文；其中，第二应用层报文包括第二加密后数据和报文头信息，报文头信息包括时间指示字段和加密指示字段，加密指示字段用于指示对第二原始数据加密时使用的预设加密算法，时间指示字段用于指示第二应用层报文的发送时间信息；北斗网络设备基于时间指示字段和第二应用层报文的接收时间通过蜂窝网络设备生成第四密钥；北斗网络设备使用第四密钥解密第二加密后数据失败，北斗网络设备生成第二应用层回执，第二应用层回执用于指示北斗网络设备解密第二应用层报文失败；北斗网络设备给终端发送第二应用层回执。
在一种可能的实现方式中，北斗网络设备确定出第一应用层报文的接收时间和第二应用 层报文的接收时间相同，北斗网络设备直接使用第一密钥解密第二加密后数据。
第三方面，本申请提供了一种北斗通信系统，包括：终端和北斗网络设备；其中，
终端，用于基于用户识别码IMSI、身份识别密钥Ki和第一应用层报文的发送时间生成第一密钥。
终端，还用于使用第一密钥加密第一原始数据，得到第一加密后数据。
终端，还用于给第一加密后数据添加报文头信息，得到第一应用层报文。其中，报文头信息包括时间指示字段和加密指示字段，加密指示字段用于指示对第一原始数据加密时使用的预设加密算法，时间指示字段用于指示第一应用层报文的发送时间信息。
终端，还用于向北斗网络设备发送第一应用层报文。
北斗网络设备，用于接收终端发送的第一应用层报文。
北斗网络设备，还用于基于时间指示字段和第一应用层报文的接收时间通过蜂窝网络设备生成第二密钥。
北斗网络设备，还用于使用第二密钥成功解密第一加密后数据，得到第一原始数据。
在一种可能的实现方式中，终端还可以执行上述第一方面中任一种可能的实现方式中的方法。
在一种可能的实现方式中，北斗网络设备还可以执行上述第二方面中任一种可能的实现方式中的方法。
第四方面，本申请提供了一种通信装置，包括一个或多个处理器、一个或多个存储器和收发器。收发器、该一个或多个存储器与一个或多个处理器耦合，一个或多个存储器用于存储计算机程序代码，计算机程序代码包括计算机指令，当一个或多个处理器执行计算机指令时，使得通信装置执行上述第一方面任一项可能的实现方式中的方法。
其中，该通信装置可以为终端或其他产品形态的设备。
第五方面，本申请提供了一种通信装置，包括一个或多个处理器、一个或多个存储器和收发器。收发器、该一个或多个存储器与一个或多个处理器耦合，一个或多个存储器用于存储计算机程序代码，计算机程序代码包括计算机指令，当一个或多个处理器执行计算机指令时，使得通信装置执行上述第二方面任一项可能的实现方式中的方法。
其中，该通信装置可以为北斗网络设备，或北斗网络设备中的任一网元或多个网元的组合。
第六方面，本申请提供了一种计算机存储介质，包括计算机指令，当计算机指令在计算机上运行时，使得计算机执行上述第一方面任一项可能的实现方式中的方法。
第七方面，本申请提供了一种计算机存储介质，包括计算机指令，当计算机指令在计算机上运行时，使得计算机执行上述第二方面任一项可能的实现方式中的方法。
第八方面，本申请提供了一种计算机程序产品，当计算机程序产品在计算机上运行时，使得计算机执行上述第一方面任一项可能的实现方式中的方法。
第九方面，本申请提供了一种计算机程序产品，当计算机程序产品在计算机上运行时，使得计算机执行上述第二方面任一项可能的实现方式中的方法。
第十方面，本申请提供了一种芯片或芯片系统，应用于终端，包括处理电路和接口电路，接口电路用于接收代码指令并传输至所述处理电路，处理电路用于运行所述代码指令以执行上述第一方面任一项可能的实现方式中的方法。
附图说明
图1为本申请实施例提供的一种蜂窝网络中鉴权加密的流程示意图；
图2为本申请实施例提供的一种北斗通信系统的架构示意图；
图3A为本申请实施例提供的一种北斗通信系统的入站数据的协议封装架构示意图；
图3B为本申请实施例提供的一种北斗通信系统的入站数据的协议解析架构示意图；
图4A为本申请实施例提供的一种北斗通信系统的出站数据的协议封装架构示意图；
图4B为本申请实施例提供的一种北斗通信系统的出站数据的协议解析架构示意图；
图5为本申请实施例提供的一种北斗通信系统中在入站传输时密钥更新方法的流程示意图；
图6为本申请实施例提供的一种终端的结构示意图；
图7为本申请实施例提供的一种应用层报文示意图；
图8为本申请实施例提供的一种北斗通信系统中在出站传输时密钥更新方法的流程示意图；
图9为本申请实施例提供的一种硬件结构示意图；
图10为本申请实施例提供的一种北斗通信系统中密钥更新方法的流程示意图；
图11为本申请实施例提供的一种通信装置的结构示意图；
图12为本申请实施例提供的另一种通信装置的结构示意图；
图13为本申请实施例提供的另一种通信装置的结构示意图；
图14为本申请实施例提供的另一种通信装置的结构示意图。
具体实施方式
下面将结合附图对本申请实施例中的技术方案进行清楚、详尽地描述。其中，在本申请实施例的描述中，除非另有说明，“/”表示或的意思，例如，A/B可以表示A或B；文本中的“和/或”仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。
以下，术语“第一”、“第二”仅用于描述目的，而不能理解为暗示或暗示相对重要性或者隐含指明所指示的技术特征的数量。由此，限定有“第一”、“第二”的特征可以明示或者隐含地包括一个或者更多个该特征，在本申请实施例的描述中，除非另有说明，“多个”的含义是两个或两个以上。
下面介绍本申请实施例提供的一种蜂窝网络中的鉴权加密机制。
示例性的，如图1所示，终端和蜂窝网络中的网元设备(又称为蜂窝网络设备)首先可以执行相互鉴权的步骤，在通过鉴权确认了双方身份后，才能执行数据的加密传输步骤。其 中，蜂窝网络设备可以包括但不限于移动交换中心(mobile switching center，MSC)/访问位置寄存器(visiting location register，VLR)、归属位置寄存器(home location register，HLR)/鉴权中心(authentication center，AuC)。其中，终端和蜂窝网络设备鉴权和生成密钥的步骤如下：
S101，终端向MSC/VLR发送业务请求。
其中，业务请求中可以包括终端的用户识别(identity，ID)号。
S102，MSC/VLR向HLR/AuC发送终端的国际移动用户识别码(international mobile subscriber identity，IMSI)。
MSC/VLR在收到终端的业务请求后，可以基于终端的ID号，查找终端对应的IMSI。MSC/VLR可以将IMSI发送至HLR/AuC。
S103，HLR/AuC可以生成随机数(random，RAND)，通过IMSI获取对应的身份识别密钥(key identifier，Ki)，通过RAND和Ki生成鉴权符号响应(signed response，SRES)(1)、加密密钥(ciphering key，Kc)(1)。
HLR/AuC可以在收到IMSI后，生成鉴权参数。其中，鉴权参数可以包括但不限于RAND、SRES、Kc。其中，HLR/AuC可以通过随机数生成器生成RAND。HLR/AuC可以通过IMSI得到对应的Ki。HLR/AuC可以基于Ki和RAND经过预设密钥算法计算得到SRES(1)和Kc(1)。其中，Ki为身份识别密钥，存储在用户识别(subscriber identity module，SIM)卡和蜂窝网络中的网元设备中，可以用于计算加密密钥和鉴权符号响应。其中，SRES可以用于鉴权。其中，Kc用于加密数据。在鉴权成功后，终端和蜂窝网络设备可以使用Kc加解密数据，保证数据的安全性。
S104，HLR/AuC可以将RAND、SRES(1)和Kc(1)发送至MSC/VLR。
S105，MSC/VLR可以将鉴权请求发送至终端，鉴权请求包括RAND。
MSC/VLR收到HLR/AuC反馈的鉴权参数后，可以向终端发送鉴权请求。其中，鉴权请求可以包括RAND。
S106，终端可以基于收到的RAND通过SIM卡生成SRES(2)、Kc(2)。
终端收到鉴权请求后，可以将RAND传入SIM卡。SIM卡中存储有终端在蜂窝网络中进行开户时得到的Ki。终端可以通过SIM卡基于RAND和预设的Ki通过预设密钥算法计算得到SRES(2)和Kc(2)。其中，SIM卡中的Ki和预设密钥算法和HLR/AuC中的Ki和预设密钥算法相同。
S107，终端向MSC/VLR发送鉴权响应，鉴权响应包括SRES(2)。
终端计算得到SRES(2)后，可以向MSC/VLR回复鉴权响应，鉴权响应包括SRES(2)。
S108，MSC/VLR可以判断SRES(1)和SRES(2)是否相同。
若SRES(1)和SRES(2)相同，鉴权通过，MSC/VLR可以向终端发送基于Kc(1)加密后的业务请求的结果；若SRES(1)和SRES(2)不同，鉴权失败，MSC/VLR不回应终端的业务请求。
具体的，终端可以使用终端的Kc加密数据后，将加密后的数据发送蜂窝网络设备。蜂窝网络设备可以使用蜂窝网络设备的Kc解密数据。蜂窝网络设备可以使用蜂窝网络设备的Kc加密数据后，将加密后的数据发送终端。终端可以使用终端的Kc解密数据。
综上所述，终端和蜂窝网络设备在进行数据传输之前，都必须执行鉴权操作。其中，蜂窝网络鉴权的步骤繁杂，交互信令所需空口资源多。由于北斗通信系统时延长、空口资源少，不能支持蜂窝网络鉴权加密机制。
本申请实施例提供了一种北斗通信系统中密钥更新方法。发送设备可以基于发送时间生成密钥。发送设备可以使用该密钥加密原始数据，并在加密后的原始数据前添加包括有时间指示字段的报文头信息得到应用层报文。其中，时间指示字段可以用于指示发送时间。发送设备可以将包括时间指示字段的应用层报文发送至接收设备。接收设备可以基于接收时间和时间指示字段确定出发送时间，并基于发送时间得到密钥。接收设备可以使用该密钥解密应用层报文，得到原始数据。这样，发送设备和接收设备可以在传输数据时，通过随时间更新的密钥加密数据，既节约了北斗通信系统的资源，又保证了数据的安全性。
下面介绍本申请实施例提供的一种北斗通信系统10。
如图2所示，北斗通信系统10可以包括但不限于终端100、北斗短报文卫星21、北斗网络设备200、蜂窝网络设备400和终端300等等。
其中，北斗网络的终端100可以向蜂窝网络的终端300发送北斗短消息。具体的，终端100可以先发送北斗短消息给北斗短报文卫星21，北斗短报文卫星21只进行中继，可以直接将终端100发送的北斗短消息转发给地面的北斗网络设备200。北斗网络设备200可以根据北斗通信协议解析卫星转发的北斗短消息，并将从北斗短消息中解析出的报文内容转发给蜂窝网络设备400。蜂窝网络设备400可以通过传统的蜂窝通信网络，将报文内容转发给终端300。
蜂窝网络的终端300也可以向北斗网络的终端100发送北斗短消息。终端300可以通过传统的蜂窝通信网络，将短消息发送给短消息中心25。短消息中心25可以将终端300的短消息转发给北斗网络设备200。北斗网络设备200可以将终端300的短消息通过北斗短报文卫星21中继发送给终端100。
可选的，该北斗通信系统10还可以包括紧急救援平台、紧急救援中心。北斗网络设备200可以将终端100发送的紧急救援类型的报文，通过紧急救援平台发送给紧急救援中心。
其中，上述北斗网络设备200可以包括但不限于北斗地面收发站22、北斗中心站23和北斗短报文融合通信平台24。其中，北斗地面收发站22可以包括分别具有发送功能的一个或多个设备和具有接收功能的一个或多个设备，或者可以包括具有发送功能和接收功能的一个或多个设备，此处不作限定。北斗地面收发站22可用于北斗网络设备200在物理层(physical layer protocol，PHY)对数据的处理功能。北斗中心站23可用于北斗网络设备200在卫星链路控制层(satellite link control protocol，SLC)层和消息数据汇聚层(message data convergence protocol，MDCP)对数据的处理功能。北斗短报文融合通信平台24可用于在应用层(application layer protocol，APP)对数据的处理功能。
其中，上述蜂窝网络设备400可以包括但不限于短消息中心(short message service center，SMSC)25、归属位置寄存器(HLR)28和电信业务运营支持系统(business&operation support system，BOSS)29。其中，短消息中心25可以用于将北斗网络设备200发送的数据转发至蜂窝网络下的终端，也可以用于将蜂窝网络的数据转发至北斗网络设备200。
其中。电信业务运营支持系统29可以用于终端的开户。电信业务运营支持系统29可以在开户时，存储终端(例如终端100)的ID号和IMSI等数据。其中，ID号可以为终端的手机号。其中，IMSI还可以用于计算密钥。
其中，归属位置寄存器28预存有ID号对应的Ki和预设密钥算法。归属位置寄存器28可以基于Ki和RAND通过预设密钥算法计算得到SRES和Kc。其中，SIM卡和蜂窝网络 设备400中的Ki和预设密钥算法(例如A3、A8算法)相同。其中，SRES和Kc可以用于计算密钥。
需要说明的是，在北斗通信系统中，终端100向北斗网络设备200发送数据的过程为入站。北斗网络设备200向终端100发送数据的过程为出站。
接下来介绍本申请实施例中提供的一种北斗通信系统10的入站数据的协议架构。
图3A示出了本申请实施例中提供的一种北斗通信系统10的入站数据的协议封装架构示意图。
如图3A所示，终端100上的北斗报文传输协议层可以分为应用层、消息数据汇聚层、卫星链路控制层和物理层。
终端100发送数据给北斗网络设备200时，终端100上的北斗报文传输协议的工作流程可以如下：
终端100可以基于应用层报文的发送时间(又称为发送时间)生成密钥，并使用密钥加密原始数据，得到加密后数据。并在加密后数据前添加报文头信息，得到应用层报文。其中，原始数据可以包括但不限于主叫用户(例如终端100的用户)输入的数据(例如文本数据、图像数据、音频数据、视频数据等)、被叫用户(例如被叫用户可以包括终端300的用户)的数量指示、被叫用户的ID、终端100的位置信息等。
其中，应用层报文的发送时间可以为第一时间点至第二时间点期间(包括第一时间点和第二时间点)的指定时间点，本申请对此不作限定。其中，第一时间点为终端100获取原始数据的时间点。例如，终端100获取原始数据的时间点可以为终端100接收到主叫用户发送北斗短消息的输入的时间点，此时，原始数据包括主叫用户输入的数据。
其中，第二时间点为终端100生成密钥时获取的时间点。具体的，第二时间点可以为终端100计算密钥时运行获取应用层报文的发送时间的程序语句(例如，通过获取当前时间函数getCurrentTime())得到的当前时间点。其中，应用层报文的发送时间的单位为小时。需要说明的是，终端100必须在加密原始数据之前获取该指定时间点。
其中，报文头信息可以包括但不限于加密指示字段、时间指示字段等等。加密指示字段用于指示终端100加密数据使用的加密算法类型。其中，时间指示字段可以用于指示发送时间信息。具体的，时间指示字段的值可以指示发送时间T的奇偶值。
可选的，在终端100加密原始数据之前，终端100可以先压缩原始数据。可以理解的是，报文头中还可以包括压缩指示字段。压缩指示字段可用于指示终端100压缩数据使用的压缩算法类型。
进一步可选的，终端100可以压缩原始数据，得到压缩数据。终端100可以在压缩数据前添加上述压缩指示字段。再使用密钥加密添加了压缩指示字段的压缩数据，得到加密后数据。在MDCP层，终端100可以通过层间接口获取到APP层下发的应用层报文，并将应用层报文作为一个MDCP SDU。在MDCP层，终端100可以在MDCP SDU的尾部添加填充数据(padding)至指定长度，并给MDCP SDU添加冗余长度指示字段。该冗余长度指示字段可用于表示该填充数据的长度。终端100可以将填充数据以及增加冗余长度指示字段之后的MDCP SDU，拆分成一个或多个固定长度的MDCP分段数据(M_segment)，并在每个MDCP分段数据的头部添加后继指示字段，得到MDCP PDU。即MDCP PDU包括M_segment和后继指示字段。其中，后继指示字段可用于表示当前的MDCP PDU在同一个MDCP SDU中的多个MDCP PDU中的顺序，或者当前MDCP PDU为MDCP SDU的唯一一个MDCP PDU。
在SLC层，终端100可以通过层间接口获取到MDCP层下发的MDCP PDU，作为SLC SDU。在SLC层，终端100可以将SLC SDU分段成一个或多个(例如，4个)固定长度的SLC分段数据(S_segment)，并在每个S_segment头部添加帧头信息(又称为帧格式指示信息)，得到SLC PDU。其中，帧头信息中可以包括但不限于用户ID字段、帧总数字段和帧序号字段。其中，用户ID字段可用于表示生成该SLC PDU的终端(例如，终端100)。帧总数字段，可用于表示该SLC PDU所属的SLC SDU中包括SLC PDU的总数量。帧序号字段，可用于表示该SLC PDU在所属的SLC SDU中的序号。
在PHY层，终端100可以通过层间接口获取到SLC层下发的SLC PDU。终端100可以对其进行物理层处理(例如，编码、插导频、调制、扩频等操作)，得到入站数据。然后，终端100可以将入站数据发送给北斗短报文卫星21，经由北斗短报文卫星21中继转发给北斗网络设备200。
图3B示出了本申请实施例中提供的一种北斗通信系统10的入站数据的协议解析架构示意图。
如图3B所示，北斗网络设备200上的北斗报文传输协议层可以分为应用层、消息数据汇聚层、卫星链路控制层和物理层。其中，北斗网络设备200可以包括但不限于北斗地面收发站22、北斗中心站23和北斗短报文融合通信平台24。北斗地面收发站22可用于负责PHY层的协议处理。北斗中心站23可用于负责SLC层和MDCP层的协议处理。北斗短报文融合通信平台24可用于负责APP层的协议处理。
终端100发送数据给北斗网络设备200时，终端100上的北斗报文传输协议的工作流程可以如下：
在PHY层，北斗网络设备200可以获取终端100发送的入站数据。北斗网络设备200针对入站数据进行物理层处理(例如，解扩、解调、去导频、解码等操作)后通过层间接口将其呈递给SLC层，作为SLC层的SLC PDU。
在SLC层，北斗网络设备200可以基于SLC PDU的帧头信息，将属于同一个终端的同一个SLC SDU的SLC PDU拼接成一个SLC SDU。北斗网络设备200可以将SLC SDU通过层间接口呈递给MDCP层，作为MDCP层的MDCP PDU。
在MDCP层，北斗网络设备200可以将属于同一个MDCP SDU的所有MDCP PDU按照接收时间拼接在一起，并将拼接后的MDCP PDU的填充数据和冗余长度指示字段去除得到MDCP SDU。北斗网络设备200可以将MDCP SDU通过层间接口呈递到APP层，作为APP层接收到的应用层报文。
在APP层，北斗网络设备200可以基于报文头信息中的时间指示字段和应用层报文的接收时间(又称为接收时间)确定出应用层报文的发送时间，并基于应用层报文的发送时间计算出密钥。北斗网络设备200可以通过密钥解密应用层报文中的加密后数据，得到原始数据。
其中，应用层报文的接收时间可以为第三时间点至第四时间点之间(包括第三时间点和第四时间点)的指定时间点，本申请实施例对此不作限定。其中，第三时间点可以为北斗网络设备200收到终端100发送的应用层报文的第1个SLC PDU的时间点。第四时间点可以为北斗网络设备200生成密钥时获取的时间点。具体的，第四时间点可以为北斗网络设备200计算密钥时运行获取应用层报文的发送时间的程序语句(例如，通过获取当前时间函数getCurrentTime())得到的当前时间点。其中，应用层报文的接收时间的单位为小时。需要说明的是，北斗网络设备200必须在解密上述加密后数据之前获取该指定时间点。
可选的，北斗网络设备200对加密后数据进行解密后，可以得到压缩数据。北斗网络设备200对压缩数据进行解压缩后，得到鉴权码和原始数据。
本申请实施例中，上述协议处理过程仅为示例说明，本申请对协议处理的具体操作不作限定。
接下来介绍本申请实施例中提供的一种北斗通信系统10的出站数据的协议架构。
图4A示出了本申请实施例中提供的一种北斗通信系统10的出站数据的协议封装架构示意图。
如图4A所示，北斗网络设备200上的北斗报文传输协议层可以分为应用层、消息数据汇聚层、卫星链路控制层和物理层。
北斗网络设备200发送数据给终端100时，北斗网络设备200上的北斗报文传输协议的工作流程可以如下：
在APP层，北斗网络设备200可以基于发送时间生成密钥，并使用密钥加密原始数据，得到加密后数据。并在加密后数据前添加报文头信息，得到应用层报文。其中，原始数据可以包括但不限于第三方服务器(例如，短消息中心25)发送的数据(例如被叫用户输入的数据)、文本、旗语、语音、图像、动画等。
应用层报文的发送时间可以为第五时间点至第六时间点期间(包括第五时间点和第六时间点)的指定时间点，本申请实施例对此不作限定。其中，第五时间点为北斗网络设备200获取原始数据的时间点。例如，北斗网络设备200获取原始数据的时间点可以为接收到终端100发送的业务请求信息的时间点。示例性的，该业务请求信息可以为下载应用层报文的请求，这里的应用层报文的接收设备为终端100。此时，原始数据可以为被叫用户输入的数据。再例如，北斗网络设备200获取原始数据的时间点可以为接收到蜂窝网络设备400或其他第三方服务器发送给终端100的数据的时间点。
其中，第六时间点为北斗网络设备200生成密钥时获取的时间点。具体的，第六时间点可以为北斗网络设备200计算密钥时运行获取应用层报文的发送时间的程序语句(例如，通过获取当前时间函数getCurrentTime())得到的当前时间点。其中，应用层报文的发送时间的单位为小时。需要说明的是，北斗网络设备200必须在加密原始数据之前获取该指定时间点。
其中，报文头信息可以包括但不限于加密指示字段、时间指示字段等等。加密指示字段用于指示北斗网络设备200加密数据使用的加密算法类型。其中，时间指示字段可以用于指示发送时间信息。具体的，时间指示字段的值可以指示发送时间T的奇偶值。
可选的，在北斗网络设备200加密原始数据之前，北斗网络设备200可以先压缩原始数据。可以理解的是，报文头中还可以包括压缩指示字段。压缩指示字段可用于指示北斗网络设备200压缩数据使用的压缩算法类型。
进一步可选的，北斗网络设备200可以压缩原始数据，得到压缩数据。北斗网络设备200可以在压缩数据前添加上述压缩指示字段。再使用密钥加密添加了压缩指示字段的压缩数据，得到加密后数据。
在MDCP层，北斗网络设备200可以通过层间接口获取到APP层下发的应用层报文，并将应用层报文作为一个MDCP SDU。北斗网络设备200可以将MDCP SDU拆分成一个或多个固定长度的MDCP分段数据(M_segment)，并在每个MDCP分段数据的头部添加后继指示字段，得到MDCP PDU，即MDCP PDU包括M_segment和后继指示字段。其中，后继 指示字段可用于表示当前的MDCP PDU在同一个MDCP SDU中的顺序。
在SLC层，北斗网络设备200可以通过层间接口获取到MDCP层下发的MDCP PDU，作为SLC SDU。北斗网络设备200可以将SLC SDU分段成一个或多个(例如，4个)固定长度的SLC分段数据(S_segment)，并在每个S_segment头部添加帧头信息，得到SLC PDU。其中，帧头信息可以包括但不限于用户ID字段、帧总数字段、帧序号字段。其中，用户ID字段可以用于标识接收设备(例如终端100)，用户ID字段的值为接收设备的ID号。其中，帧总数字段和帧序号字段的详细描述可以参见上述3A所述实施例，在此不再赘述。
在PHY层，北斗网络设备200可以通过层间接口获取到SLC层下发的SLC PDU，作为用户帧。北斗网络设备200可以将多个用户或者一个用户的用户帧(又称为数据帧)拼接在一起，再加上帧头(例如版本号)和校验位得到物理帧。北斗网络设备200可以将物理帧进行物理层处理(例如，编码、插导频、调制、扩频等操作)后得到电文支路(S2C-d支路)的编码数据。北斗网络设备200可以将S2C-d支路的编码数据和导频支路(S2C-p支路)的导频数据(又称为副码)组成导频编码数据，即出站数据。并将出站数据发送给北斗短报文卫星21，经由北斗短报文卫星21中继转发给一个或多个终端。可以理解的是，S2C-p支路的导频数据与卫星波束相关。当卫星波束为已知信息时，S2C-p支路的导频数据也是已知的，无需解码。而S2C-d支路的编码数据是需要解码的。
图4B示出了本申请实施例中提供的一种北斗通信系统10的出站数据的协议解析架构示意图。
如图4B所示，终端100上的北斗报文传输协议层可以分为应用层、消息数据汇聚层、卫星链路控制层和物理层。
在PHY层，终端100可以基于北斗网络设备200发送的S2C-p支路的副码，捕获到将S2C-d支路的编码数据。终端100在捕获到S2C-d支路的编码数据后，可以对S2C-d支路的编码数据进行物理层处理(例如，解扩、解调、去导频、解码等操作)，得到物理帧。终端100可以从物理帧中提取出属于终端100的用户帧。终端100可以将用户帧通过层间接口呈递给SLC层，作为SLC层的SLC PDU。
在SLC层，当终端100收到的用户帧为通用数据帧时，终端100可以将属于同一个SLC SDU的SLC PDU拼接成一个SLC SDU。终端100可以将SLC SDU通过层间接口呈递给MDCP层，作为MDCP层的MDCP PDU。当终端100收到的用户帧为ACK帧时，终端100可以重传数据/发送下一个SLC SDU/停止向北斗网络设备200发送数据。
在MDCP层，终端100可以将一个或多个MDCP PDU拼接成一个MDCP SDU。终端100可以将MDCP SDU通过层间接口呈递到APP层，作为APP层接收到的应用层报文。
在APP层，终端100可以基于报文头中的时间指示字段和接收时间确定出发送时间，并基于发送时间等信息计算出密钥。北斗网络设备200可以在通过密钥成功解密应用层报文的加密后数据之后，得到原始数据。
其中，应用层报文的接收时间可以为第七时间点至第八时间点之间(包括第七时间点和第八时间点)的指定时间点，本申请实施例对此不作限定。其中，第七时间点可以为终端100收到北斗网络设备200发送的应用层报文的第1个SLC PDU的时间点。第八时间点可以为终端100生成密钥时获取的时间点。具体的，第八时间点可以为终端100计算密钥时运行获取应用层报文的发送时间的程序语句(例如，通过获取当前时间函数getCurrentTime())得到的当前时间点。其中，应用层报文的接收时间的单位为小时。需要说明的是，终端100必须 在解密应用层报文的加密后数据之前获取该指定时间点。
本申请实施例中，上述协议处理过程仅为示例说明，本申请对协议处理的具体操作不作限定。
下面介绍本申请实施例中提供的一种北斗通信系统中密钥更新方法。
图5示出了本申请实施例中提供的北斗通信系统中在入站传输时密钥更新方法的流程示意图。
如图5所示，入站传输时的密钥更新方法包括如下步骤：
S501，终端100获取原始数据。
其中，原始数据可以包括但不限于主叫用户输入的数据(例如文本数据、图像数据、音频数据、视频数据等)、被叫用户的数量指示、被叫用户的ID、终端100的位置信息等。
在一些实施例中，终端100可以在接收到主叫用户的第一输入后，获取原始数据并向北斗网络设备200发送该原始数据。在本申请实施例中，该输入可以包括但不限于：手势、语音等。手势包括直接触摸终端100的显示屏的手势和不直接触摸显示屏的悬浮手势。
S502，终端100生成密钥A。
终端100在获取原始数据后，可以基于发送时间T生成密钥A。其中，密钥A可以用于加密原始数据。
其中，发送时间T可以为第一时间点至第二时间点期间的指定时间点。其中，发送时间的单位为小时。其中，第一时间点和第二时间点的具体描述可以参见图3A所示实施例，在此不再赘述。例如，发送时间T可以为接收到上述第一输入的时间点。例如，终端100接收到第一输入的时间为北京时间08:58(二十四小时制)时，时钟的数值为8，则发送时间T的值为8。
在一些实施例中，终端100可以基于发送时间T，SIM卡中的Ki、IMSI生成密钥A。终端100可以获取SIM卡中存储的IMSI，并基于IMSI和发送时间T得到RAND。之后，终端100可以基于RAND和存储在SIM卡中的Ki通过预设密钥算法1得到Kc。终端100还可以基于RAND和Ki通过预设密钥算法2得到SRES。最后，终端100可以基于SRES和Kc得到密钥A。
具体的，如图6所示，首先，终端100的应用处理器(application processor，AP)可以从SIM卡中获取IMSI，再将IMSI和发送时间T拼接在一起得到RAND。
其中，IMSI为国际上用于识别唯一一个移动用户分配的号码，IMSI可以由移动国家码(mobile country code，MCC)、移动网络码(mobile network code，MNC)和移动通信的用户识别码(mobile subscriber identification number，MSIN/MIN)构成。IMSI的计算公式如下：
IMSI＝MCC||MNC||MIN/MSIN
其中，MCC为移动用户所属国家的代号，包括3位数字(例如，中国的MCC为460)。MNC为移动网的号码，可以用于标识移动用户的归属移动通信网(例如，联通
Figure PCTCN2022109253-appb-000001
网络为03)，包括两位数字。MSIN可用于标识某个移动通信网的用户，包括10位数字，由网络运营商提供。其中，||为拼接运算符。最终得到的IMSI的长度为15位十进制数字，可以通过15byte的字符串表示。
其中，发送时间T的长度可以为2位十进制数字，例如08。发送时间T可以通过1byte的字符串表示。
其中，RAND由IMSI和发送时间T拼接得到，RAND的长度可以为16byte。示例性的， 当IMSI为460030912121001，发送时间T为08时，
RAND＝IMSI||T＝04 06 00 00 03 00 09 01 02 01 02 01 00 00 01 08
终端100的AP得到RAND后，可以将RAND发送至SIM卡。终端100的SIM卡收到RAND后，可以基于Ki和RAND通过预设密钥算法1得到Kc，通过预设密钥算法2生成SRES。其中，预设密钥算法1可以为A8算法，预设密钥算法2可以为A3算法。其中，Kc和SRES的计算公式如下：
Kc＝A8(Ki，RAND)
SRES＝A3(Ki，RAND)
其中，Kc的长度可以为4byte，SRES的长度可以为8byte。之后，SIM卡可以将Kc和SRES发送给AP。终端100的AP收到Kc和SRES后，可以基于Kc和SRES得到密钥A。例如，终端100可以将Kc和SRES进行拼接得到密钥A。或者，终端100可以基于Kc和SRES通过预设密钥算法3得到密钥A。其中，预设密钥算法3可以为国密算法中的基于SM3的哈希运算消息认证码(hash-based message authentication code，HMAC)算法。
示例性的，终端100可以通过以下公式得到密钥A：
密钥A＝F[SM3HAMC(Kc||SRES,SRES)]
其中，公式F为截取输入值的前16byte字符的运算公式。
S503，终端100可以使用密钥A加密原始数据，得到加密后数据。
其中，终端100可以将密钥A和原始数据作为加密算法的输入，经过加密算法的计算得到加密后数据。
S504，终端100可以在加密后数据前添加报文头得到应用层报文。其中，报文头可以包括时间指示字段。
如图7所示，应用层报文可以包括报文头和加密后数据。其中，报文头可以包括但不限于加密指示字段、时间指示字段、压缩指示字段。
其中，加密指示字段的长度可以为2bit。加密指示字段可以用于指示加密算法的类型。例如，当加密指示字段的值为00时，不使用加密算法；当加密指示字段的值为01时，可以使用加密算法1(例如国密算法SM4算法)进行加密。
其中，时间指示字段的长度可以为1bit。时间指示字段用于指示应用层报文的发送时间信息。具体的，时间指示字段的值可以指示发送时间T的奇偶值。具体的，当T的值为偶数时，时间指示字段的值为1；当T的值为奇数时，时间指示字段的值为0。例如，当发送时间的值为8时，时间指示字段的值为1。当发送时间的值为17时，时间指示字段的值为0。
S505，终端100将应用层报文发送到北斗网络设备200。
具体的，终端100向北斗网络设备200发送数据的具体流程描述可以参见上述图3A所述实施例，在此不再赘述。需要说明的是，终端100将应用层报文发送至北斗网络设备200的过程中，终端100在SLC层添加的帧头信息中可以包括用户ID字段。用户ID字段可以用于标识终端100。用户ID字段的值为终端100的ID号码。终端100的ID号码可以用于指示终端100对应的密钥相关的参数。其中，终端100的ID号可以包括但不限于手机号、终端100和第三方通信服务器(例如，畅联等即时通讯软件的服务器)协商的终端100的唯一标识号码等等。
S506，北斗网络设备200记录接收时间T1。
具体的，接收时间T1可以为第三时间点至第四时间点之间的指定时间点，单位为小时。其中，第三时间点和第四时间点的具体描述可以参见上述图3B所示实施例，在此不再赘述。
在此，接收时间T1可以为收到北斗网络设备100发送的第一个SLC PDU的时间点。具体的，在SLC层，北斗网络设备200接收到终端100发送的应用层报文对应的第1个SLC PDU时，北斗网络设备200可以将收到该SLC PDU的时间记录为接收时间T1。
例如，当北斗网络设备200收到终端100发送的第1个SLC PDU的时间为08:59(二十四小时制)时，北斗网络设备200可以得到接收时间T1的值为8。
再例如，当北斗网络设备200收到终端100发送的第1个SLC PDU的时间为09:00(二十四小时制)时，北斗网络设备200可以得到接收时间T1的值为9。
其中，北斗网络设备200接收来自终端100的数据的具体流程描述可以参见上述图3B所述实施例，在此不再赘述。
S507，北斗网络设备200向蜂窝网络设备400发送IMSI请求。
具体的，北斗网络设备200收到应用层报文的数据后，可以向蜂窝网络设备150(例如，电信业务运营支持系统29)发送IMSI请求。其中，IMSI请求可以包括终端100的ID号。IMSI请求可以用于指示蜂窝网络设备400反馈ID号对应的IMSI。
S508，蜂窝网络设备400向北斗网络设备200发送终端100的IMSI。
具体的，电信业务运营支持系统29可以在收到IMSI请求后，根据ID号返回对应的IMSI给北斗网络设备200。
S509，北斗网络设备200基于时间指示字段、接收时间和IMSI等信息得到RAND。
首先，北斗网络设备200可以根据时间指示字段和接收时间T1确定出发送时间T。其中，时间指示字段的值可以指示发送时间T的奇偶值。当时间指示字段的值指示的发送时间T的奇偶值和接收时间T1的奇偶值相同时，发送时间T等于接收时间T1。当时间指示字段的值指示的发送时间T的奇偶值和接收时间T1的奇偶值不同时，接收时间T1和发送时间T的差值为1。具体的：
当时间指示字段的值为0且T1为奇数时，T＝T1；
当时间指示字段的值为0且T1为偶数时，T＝T1-1；
当时间指示字段的值为1且T1为奇数时，T＝T1-1；
当时间指示字段的值为1且T1为偶数时，T＝T1。
例如，若时间指示字段的值为1，且接收时间T1为9时，发送时间T等于8。再例如，若时间指示字段的值为1，且接收时间T1为8时，发送时间T等于8。
之后，北斗网络设备200可以基于IMSI和发送时间T得到RAND。其中，北斗网络设备200得到RAND的描述可以参见上述步骤S502所述实施例，在此不再赘述。
S510，北斗网络设备200可以将RAND发送至蜂窝网络设备400。
具体的，北斗网络设备200可以将随机数RAND发送至归属位置寄存器28。
S511，蜂窝网络设备400基于RAND等信息计算得到SRES和Kc。
归属位置寄存器28可以存储有已经开户的终端的Ki等信息。归属位置寄存器28可以基于终端100的ID号确定出终端100的Ki。归属位置寄存器28还可以基于Ki和RAND通过预设密钥算法1得到Kc。例如，预设密钥算法1可以为A8算法。归属位置寄存器28可以基于Ki和RAND通过预设密钥算法2生成SRES。例如，预设密钥算法2可以为A3算法。其中，Kc和SRES的计算公式的描述可以参见上述图6所述实施例，在此不再赘述。需要说明 的是，归属位置寄存器28基于RAND和Ki生成SRES和Kc的计算方法和终端100相同。
S512，蜂窝网络设备400可以将SRES和Kc发送至北斗网络设备200。
归属位置寄存器28可以将计算得到的SRES和Kc发送至北斗网络设备200。
S513，北斗网络设备200基于SRES和Kc生成密钥B。
北斗网络设备200可以基于SRES和Kc生成密钥B。其中，密钥B可以由SRES和Kc拼接得到。
可选的，北斗网络设备200可以基于SRES和Kc通过上述基于预设密钥算法3计算得到密钥B。
需要说明的是，北斗网络设备200生成密钥B所使用的算法和终端100生成密钥A使用的算法相同。
S514，北斗网络设备200使用密钥B解密应用层报文。
北斗网络设备200可以通过加密指示字段的值确定出终端100使用的加密算法。终端100可以使用密钥B和加密算法对应的解密算法解密应用层报文的加密后数据。
当北斗网络设备200解密应用层报文的加密后数据成功，如果原始数据为业务请求消息，北斗网络设备200可以在解密得到原始数据后，向终端100发送业务请求消息对应的业务数据。如果原始数据为发送给蜂窝网络下的终端300的数据，北斗网络设备200可以执行步骤S515。进一步的，北斗网络设备200在解密成功后，还可以执行步骤S516。
当北斗网络设备200解密应用层报文的加密后数据失败，北斗网络设备200不能得到原始数据。进一步的，北斗网络设备200可以执行步骤S517。
S515，北斗网络设备200可以将原始数据发送至蜂窝网络设备400。
北斗网络设备200可以将原始数据转发至短消息中心25，短消息中心25可以将原始数据以指定格式(例如，短信)转发至被叫用户的终端(例如终端300)。
在一种可能的实现方式中，北斗网络设备200在解密应用层报文后，可以基于解析应用层报文的结果生成对应的应用层回执。北斗网络设备200可以将应用层回执发送给终端100。终端100可以通过应用层回执确定出北斗网络设备200解析应用层报文的结果。
S516，北斗网络设备200可以向终端100发送第一应用层回执。
北斗网络设备200在解密成功后，可以向终端100发送第一应用层回执。其中，第一应用层回执可以用于指示北斗网络设备200成功解析应用层报文。
可选的，终端100可以在收到第一应应用层回执后，显示成功提示信息。其中，该成功提示信息可以包括但不限于文字提示信息、语音提示信息、动画提示信息等等。该成功提示信息用于指示北斗网络设备200解密成功。例如，该成功提示信息可以为文字提示信息“发送成功”。
S517，北斗网络设备200可以向终端100发送第二应用层回执。
北斗网络设备200可以在解密失败后，向终端100发送第二应用层回执。其中，第二应用层回执可以指示北斗网络设备200解密应用层报文失败。
可选的，终端100可以在收到第二应用层回执后，重传应用层报文。
可选的，终端100可以在收到第二应应用层回执后，显示失败提示信息。其中，该失败提示信息可以包括但不限于文字提示信息、语音提示信息、动画提示信息等等。该失败提示信息用于指示北斗网络设备200解密失败。例如，该失败提示信息可以为文字提示信息“发送失败，请重发”。
这样，终端100和北斗网络设备200在入站时，可以通过随时间更新的密钥加密传输的数据。既节约北斗通信系统的空口资源，减少保证数据安全使用的信令和步骤，还可以在传输数据时，保证传输数据的安全性。
图8示出了本申请实施例中提供的北斗通信系统中在出站传输时密钥更新方法的流程示意图。
如图8所示，出站传输时的密钥更新方法包括如下步骤：
S801，北斗网络设备200接收到蜂窝网络设备400发送的原始数据。
北斗网络设备200接收到短消息中心25发送的原始数据。其中，该原始数据为蜂窝网络下的主叫用户(例如终端300的用户)发送至北斗网络下的被叫用户(终端100的用户)的原始数据(包括但不限于主叫用户输入的文本数据、图片数据等)。需要说明的是，蜂窝网络设备400在将终端300发送给终端100的数据转发至北斗网络设备200时，也可以同时将被叫用户的ID号(例如，终端100的ID号)转发至北斗网络设备200。
在一些实施例中，北斗网络设备200获取的原始数据可以为存储在北斗网络设备200的存储器中的数据。例如，原始数据可以为北斗网络设备200存储的地图数据。
在另一些实施例中，北斗网络设备200接收的原始数据可以为第三方服务器发送到北斗网络设备200的数据(例如，文本数据、图像数据、音频数据、视频数据等等)。
S802，北斗网络设备200接收到终端100发送的业务请求。
其中，该业务请求可以为下载原始数据的请求，在此，该原始数据的接收设备为终端100。北斗网络设备200可以在接收到终端100的业务请求后，执行步骤S803-步骤812。
S803，北斗网络设备200向蜂窝网络设备400发送IMSI请求。
具体的，北斗网络设备200收到发送至终端100的原始数据和ID号后，可以向蜂窝网络设备150(例如，电信业务运营支持系统29)发送IMSI请求。其中，IMSI请求可以包括终端100的ID号。IMSI请求可以用于指示蜂窝网络设备400反馈ID号对应的IMSI。其中，终端100的ID号可以包括但不限于手机号、终端100和第三方通信服务器(例如，畅联等即时通讯软件的服务器)协商的唯一标识号码等等。
S804，蜂窝网络设备400向北斗网络设备200发送终端100的IMSI。
具体的，电信业务运营支持系统29可以在收到IMSI请求后，将ID号对应的IMSI发送至北斗网络设备200。
S805，北斗网络设备200基于发送时间T、IMSI等信息得到RAND。
在此，发送时间T可以为第五时间点至第六时间点之间的指定时间点，单位为小时。其中，第五时间点和第六时间点的具体描述可以参见上述图4A所示实施例，在此不再赘述。例如，北斗网络设备200可以使用北斗网络设备200接收到终端100的业务请求的时间点作为发送时间T。具体的，当北斗网络设备200接收到业务请求的时间为北京时间08:58(二十四小时制)时，时钟的数值为8，则发送时间T的值为8。
其中，北斗网络设备200可以将IMSI和发送时间T拼接在一起得到RAND。其中，北斗网络设备200得到RAND的详细描述可以参见图5所述实施例，在此不再赘述。
S806，北斗网络设备200可以将RAND发送至蜂窝网络设备400。
北斗网络设备200可以将随机数RAND发送至归属位置寄存器28。
S807，蜂窝网络设备400基于RAND等信息计算得到SRES和Kc。
归属位置寄存器28存储有已经开户的终端的Ki等信息。归属位置寄存器28可以确定出 终端100的Ki，并基于RAND和Ki生成SRES和Kc。例如，归属位置寄存器28可以基于终端100的ID号确定出终端100的Ki。其中，归属位置寄存器28得到SRES和Kc的详细描述可以参见上述图5所述实施例，在此不再赘述。
S808，蜂窝网络设备400可以将SRES和Kc发送至北斗网络设备200。
归属位置寄存器28可以将计算得到的SRES和Kc发送至北斗网络设备200。
S809，北斗网络设备200可以基于SRES和Kc生成密钥B。
其中，北斗网络设备200基于SRES和Kc生成密钥B的详细描述可以参见上述图5所述实施例，在此不再赘述。
S810，北斗网络设备200可以使用密钥B加密原始数据，得到加密后数据。
S811，北斗网络设备200可以在加密后数据前添加报文头得到应用层报文。其中，报文头可以包括时间指示字段。
具体的，应用层报文的详细描述可以参见上述图7所述实施例，在此不再赘述。
S812，北斗网络设备200可以将应用层报文发送至终端100。
其中，北斗网络设备200将应用层报文发送至终端100的具体描述可以参见上述图4A所述实施例，在此不再赘述。
S813，终端100基于时间指示字段和接收时间T1等信息生成密钥A。
其中，终端100接收北斗网络设备200发送的数据的详细描述可以参见上述图4B所述实施例，在此不再赘述。
其中，接收时间T1可以为第七时间点至第八时间点之间的指定时间点，单位为小时。其中，第七时间点和第八时间点的具体描述可以参见上述图4B所示实施例，在此不再赘述。在此，接收时间可以为收到北斗网络设备100发送的第一个SLC PDU的时间点。
之后，终端100可以基于接收时间T1和时间指示字段确定出发送时间T，具体的，可以参见上述图5所述实施例，在此不再赘述。
最后，终端100确定出发送时间T后，可以基于发送时间T和其他参数计算得到密钥A。其中，终端100基于发送时间获取密钥A的详细描述可以参见图6所述实施例，在此不再赘述。
S814，终端100可以使用密钥A解密应用层报文。
其中，如果解密成功，终端100可以执行步骤S814。进一步的，解密成功后，终端100还可以执行步骤S815；如果解密失败，终端100不能得到原始数据。进一步的，终端100可以执行步骤S816。
S815，终端100可以显示接收提示信息。
终端100在解密成功后，可以在显示屏上显示接收提示信息，该接收提示信息可以用于指示终端100收到了一条北斗短消息。该接收提示信息可以包括但不限于文字提示信息、图片提示信息、动画提示信息等。当该接收提示信息为文字提示信息时，例如，该接收提示信息可以为“收到一条来自终端300的北斗短消息”。
在一种可能的实现方式中，终端100可以在解密应用层报文后，可以基于解析应用层报文的结果生成对应的应用层回执。终端100可以将应用层回执发送给北斗网络设备200。北斗网络设备200可以基于应用层回执确定出终端100解析应用层报文的结果。
S816，终端100可以向北斗网络设备200发送第一应用层回执。
终端100在解密成功后，可以向北斗网络设备200发送第一应用层回执。其中，第一应 用层回执可以用于指示终端100成功解析应用层报文。
S817，终端100可以向北斗网络设备200发送第二应用层回执。
终端100可以在解密失败后，向北斗网络设备200发送第二应用层回执。其中，第二应用层回执可以指示终端100解密应用层报文失败。
进一步的，北斗网络设备200可以在收到第二应用层回执后，重传应用层报文。
这样，北斗网络设备200和终端100在出站时，可以通过随时间更新的密钥加密传输的数据。既节约北斗通信系统的空口资源，减少保证数据安全使用的信令和步骤，还可以在传输数据时，保证传输数据的安全性。
在一种可能的实现方式中，发送设备可以在向接收设备发送第一应用层报文后，向接收设备发送第二应用层报文。当第二应用层报文的发送时间和第一应用层报文的发送时间相同时，发送设备可以直接使用基于第一应用层报文的发送时间等信息生成的第一密钥加密第二原始数据，得到第二加密后数据。发送设备可以在第二加密后数据前添加报文头信息，得到第二应用层报文。其中，第二应用层报文的报文头信息中的时间指示字段和第一应用层报文的时间指示字段相同。这样，可以节约发送设备计算第二应用层报文的密钥的时间，更快得到第二应用层报文。
在一种可能的实现方式中，接收设备接收到发送设备的第一应用层报文后，接收到发送设备的第二应用层报文。接收设备确定出第二应用层报文的接收时间和第一应用层报文的接收时间相同，接收设备可以使用基于第一应用层报文的接收时间等信息获取的第二密钥加密第二应用层报文的第二加密后数据，得到第二原始数据。这样，可以节约接收设备计算第二应用层报文的密钥的时间，更快得到第二应用层报文的第二原始数据。
下面介绍本申请实施例提供的终端100。
终端100可以是手机、平板电脑、桌面型计算机、膝上型计算机、手持计算机、笔记本电脑、超级移动个人计算机(ultra-mobile personal computer，UMPC)、上网本，以及蜂窝电话、个人数字助理(personal digital assistant，PDA)、增强现实(augmented reality，AR)设备、虚拟现实(virtual reality，VR)设备、人工智能(artificial intelligence,AI)设备、可穿戴式设备、车载设备、智能家居设备和/或智慧城市设备，本申请实施例对该电子设备的具体类型不作特殊限制。
图9示出了本申请实施例提供的一种硬件结构示意图。
下面以终端100为例对实施例进行具体说明。应该理解的是，图9所示终端100仅是一个范例，并且终端100可以具有比图9中所示的更多的或者更少的部件，可以组合两个或多个的部件，或者可以具有不同的部件配置。图9中所示出的各种部件可以在包括一个或多个信号处理和/或专用集成电路在内的硬件、软件、或硬件和软件的组合中实现。
终端100可以包括：处理器110，外部存储器接口120，内部存储器121，通用串行总线(universal serial bus，USB)接口130，充电管理模块140，电源管理模块141，电池142，天线1，天线2，移动通信模块150，无线通信模块160，音频模块170，扬声器170A，受话器170B，麦克风170C，耳机接口170D，传感器模块180，按键190，马达191，指示器192，摄像头193，显示屏194，以及用户标识模块(subscriber identification module，SIM)卡接口195等。其中传感器模块180可以包括压力传感器180A，陀螺仪传感器180B，气压传感器180C，磁传感器180D，加速度传感器180E，距离传感器180F，接近光传感器180G，指纹传感器180H，温度传感器180J，触摸传感器180K，环境光传感器180L，骨传导传感器180M等。
可以理解的是，本发明实施例示意的结构并不构成对终端100的具体限定。在本申请另一些实施例中，终端100可以包括比图示更多或更少的部件，或者组合某些部件，或者拆分某些部件，或者不同的部件布置。图示的部件可以以硬件，软件或软件和硬件的组合实现。
处理器110可以包括一个或多个处理单元，例如：处理器110可以包括应用处理器(application processor，AP)，调制解调处理器，图形处理器(graphics processing unit，GPU)，图像信号处理器(image signal processor，ISP)，控制器，存储器，视频编解码器，数字信号处理器(digital signal processor，DSP)，基带处理器，和/或神经网络处理器(neural-network processing unit，NPU)等。其中，不同的处理单元可以是独立的器件，也可以集成在一个或多个处理器中。
其中，控制器可以是终端100的神经中枢和指挥中心。控制器可以根据指令操作码和时序信号，产生操作控制信号，完成取指令和执行指令的控制。
处理器110中还可以设置存储器，用于存储指令和数据。在一些实施例中，处理器110中的存储器为高速缓冲存储器。该存储器可以保存处理器110刚用过或循环使用的指令或数据。如果处理器110需要再次使用该指令或数据，可从所述存储器中直接调用。避免了重复存取，减少了处理器110的等待时间，因而提高了系统的效率。
在一些实施例中，处理器110可以包括一个或多个接口。接口可以包括集成电路(inter-integrated circuit，I2C)接口，集成电路内置音频(inter-integrated circuit sound，I2S)接口，脉冲编码调制(pulse code modulation，PCM)接口，通用异步收发传输器(universal asynchronous receiver/transmitter，UART)接口，移动产业处理器接口(mobile industry processor interface，MIPI)，通用输入输出(general-purpose input/output，GPIO)接口，用户标识模块(subscriber identity module，SIM)接口，和/或通用串行总线(universal serial bus，USB)接口等。
I2C接口是一种双向同步串行总线，包括一根串行数据线(serial data line，SDA)和一根串行时钟线(derail clock line，SCL)。在一些实施例中，处理器110可以包含多组I2C总线。处理器110可以通过不同的I2C总线接口分别耦合触摸传感器180K，充电器，闪光灯，摄像头193等。例如：处理器110可以通过I2C接口耦合触摸传感器180K，使处理器110与触摸传感器180K通过I2C总线接口通信，实现终端100的触摸功能。
I2S接口可以用于音频通信。在一些实施例中，处理器110可以包含多组I2S总线。处理器110可以通过I2S总线与音频模块170耦合，实现处理器110与音频模块170之间的通信。在一些实施例中，音频模块170可以通过I2S接口向无线通信模块160传递音频信号，实现通过蓝牙耳机接听电话的功能。
PCM接口也可以用于音频通信，将模拟信号抽样，量化和编码。在一些实施例中，音频模块170与无线通信模块160可以通过PCM总线接口耦合。在一些实施例中，音频模块170也可以通过PCM接口向无线通信模块160传递音频信号，实现通过蓝牙耳机接听电话的功能。所述I2S接口和所述PCM接口都可以用于音频通信。
UART接口是一种通用串行数据总线，用于异步通信。该总线可以为双向通信总线。它将要传输的数据在串行通信与并行通信之间转换。在一些实施例中，UART接口通常被用于连接处理器110与无线通信模块160。例如：处理器110通过UART接口与无线通信模块160中的蓝牙模块通信，实现蓝牙功能。在一些实施例中，音频模块170可以通过UART接口向无线通信模块160传递音频信号，实现通过蓝牙耳机播放音乐的功能。
MIPI接口可以被用于连接处理器110与显示屏194，摄像头193等外围器件。MIPI接口包括摄像头串行接口(camera serial interface，CSI)，显示屏串行接口(display serial interface， DSI)等。在一些实施例中，处理器110和摄像头193通过CSI接口通信，实现终端100的拍摄功能。处理器110和显示屏194通过DSI接口通信，实现终端100的显示功能。
GPIO接口可以通过软件配置。GPIO接口可以被配置为控制信号，也可被配置为数据信号。在一些实施例中，GPIO接口可以用于连接处理器110与摄像头193，显示屏194，无线通信模块160，音频模块170，传感器模块180等。GPIO接口还可以被配置为I2C接口，I2S接口，UART接口，MIPI接口等。
USB接口130是符合USB标准规范的接口，具体可以是Mini USB接口，Micro USB接口，USB Type C接口等。USB接口130可以用于连接充电器为终端100充电，也可以用于终端100与外围设备之间传输数据。也可以用于连接耳机，通过耳机播放音频。该接口还可以用于连接其他电子设备，例如AR设备等。
可以理解的是，本发明实施例示意的各模块间的接口连接关系，只是示意性说明，并不构成对终端100的结构限定。在本申请另一些实施例中，终端100也可以采用上述实施例中不同的接口连接方式，或多种接口连接方式的组合。
充电管理模块140用于从充电器接收充电输入。其中，充电器可以是无线充电器，也可以是有线充电器。在一些有线充电的实施例中，充电管理模块140可以通过USB接口130接收有线充电器的充电输入。在一些无线充电的实施例中，充电管理模块140可以通过终端100的无线充电线圈接收无线充电输入。充电管理模块140为电池142充电的同时，还可以通过电源管理模块141为电子设备供电。
电源管理模块141用于连接电池142，充电管理模块140与处理器110。电源管理模块141接收电池142和/或充电管理模块140的输入，为处理器110，内部存储器121，外部存储器，显示屏194，摄像头193，和无线通信模块160等供电。电源管理模块141还可以用于监测电池容量，电池循环次数，电池健康状态(漏电，阻抗)等参数。在其他一些实施例中，电源管理模块141也可以设置于处理器110中。在另一些实施例中，电源管理模块141和充电管理模块140也可以设置于同一个器件中。
终端100的无线通信功能可以通过天线1，天线2，移动通信模块150，无线通信模块160，调制解调处理器以及基带处理器等实现。
天线1和天线2用于发射和接收电磁波信号。终端100中的每个天线可用于覆盖单个或多个通信频带。不同的天线还可以复用，以提高天线的利用率。例如：可以将天线1复用为无线局域网的分集天线。在另外一些实施例中，天线可以和调谐开关结合使用。
移动通信模块150可以提供应用在终端100上的包括2G/3G/4G/5G等无线通信的解决方案。移动通信模块150可以包括至少一个滤波器，开关，功率放大器，低噪声放大器(low noise amplifier，LNA)等。移动通信模块150可以由天线1接收电磁波，并对接收的电磁波进行滤波，放大等处理，传送至调制解调处理器进行解调。移动通信模块150还可以对经调制解调处理器调制后的信号放大，经天线1转为电磁波辐射出去。在一些实施例中，移动通信模块150的至少部分功能模块可以被设置于处理器110中。在一些实施例中，移动通信模块150的至少部分功能模块可以与处理器110的至少部分模块被设置在同一个器件中。
调制解调处理器可以包括调制器和解调器。其中，调制器用于将待发送的低频基带信号调制成中高频信号。解调器用于将接收的电磁波信号解调为低频基带信号。随后解调器将解调得到的低频基带信号传送至基带处理器处理。低频基带信号经基带处理器处理后，被传递给应用处理器。应用处理器通过音频设备(不限于扬声器170A，受话器170B等)输出声音信号，或通过显示屏194显示图像或视频。在一些实施例中，调制解调处理器可以是独立的器 件。在另一些实施例中，调制解调处理器可以独立于处理器110，与移动通信模块150或其他功能模块设置在同一个器件中。
无线通信模块160可以提供应用在终端100上的包括无线局域网(wireless local area networks，WLAN)(如无线保真(wireless fidelity，Wi-Fi)网络)，蓝牙(bluetooth，BT)，全球导航卫星系统(global navigation satellite system，GNSS)，卫星通信模块，调频(frequency modulation，FM)，近距离无线通信技术(near field communication，NFC)，红外技术(infrared，IR)等无线通信的解决方案。无线通信模块160可以是集成至少一个通信处理模块的一个或多个器件。无线通信模块160经由天线2接收电磁波，将电磁波信号调频以及滤波处理，将处理后的信号发送到处理器110。无线通信模块160还可以从处理器110接收待发送的信号，对其进行调频，放大，经天线2转为电磁波辐射出去。
其中，卫星通信模块可用于与卫星网络设备进行通信，例如在北斗通信系统中，卫星通信模块可以与北斗网络设备200通信，卫星通信模块的可支持与北斗网络设备200之间的短报文传输。
在一些实施例中，终端100的天线1和移动通信模块150耦合，天线2和无线通信模块160耦合，使得终端100可以通过无线通信技术与网络以及其他设备通信。所述无线通信技术可以包括全球移动通讯系统(global system for mobile communications，GSM)，通用分组无线服务(general packet radio service，GPRS)，码分多址接入(code division multiple access，CDMA)，宽带码分多址(wideband code division multiple access，WCDMA)，时分码分多址(time-division code division multiple access，TD-SCDMA)，长期演进(long term evolution，LTE)，BT，GNSS，WLAN，NFC，FM，和/或IR技术等。所述GNSS可以包括全球卫星定位系统(global positioning system，GPS)，全球导航卫星系统(global navigation satellite system，GLONASS)，北斗卫星导航系统(beidou navigation satellite system，BDS)，准天顶卫星系统(quasi-zenith satellite system，QZSS)和/或星基增强系统(satellite based augmentation systems，SBAS)。
终端100通过GPU，显示屏194，以及应用处理器等实现显示功能。GPU为图像处理的微处理器，连接显示屏194和应用处理器。GPU用于执行数学和几何计算，用于图形渲染。处理器110可包括一个或多个GPU，其执行程序指令以生成或改变显示信息。
显示屏194用于显示图像，视频等。显示屏194包括显示面板。显示面板可以采用液晶显示屏(liquid crystal display，LCD)，有机发光二极管(organic light-emitting diode，OLED)，有源矩阵有机发光二极体或主动矩阵有机发光二极体(active-matrix organic light emitting diode的，AMOLED)，柔性发光二极管(flex light-emitting diode，FLED)，Miniled，MicroLed，Micro-oLed，量子点发光二极管(quantum dot light emitting diodes，QLED)等。在一些实施例中，终端100可以包括1个或N个显示屏194，N为大于1的正整数。
终端100可以通过ISP，摄像头193，视频编解码器，GPU，显示屏194以及应用处理器等实现拍摄功能。
ISP用于处理摄像头193反馈的数据。例如，拍照时，打开快门，光线通过镜头被传递到摄像头感光元件上，光信号转换为电信号，摄像头感光元件将所述电信号传递给ISP处理，转化为肉眼可见的图像。ISP还可以对图像的噪点，亮度进行算法优化。ISP还可以对拍摄场景的曝光，色温等参数优化。在一些实施例中，ISP可以设置在摄像头193中。
摄像头193用于捕获静态图像或视频。物体通过镜头生成光学图像投射到感光元件。感光元件可以是电荷耦合器件(charge coupled device，CCD)或互补金属氧化物半导体 (complementary metal-oxide-semiconductor，CMOS)光电晶体管。感光元件把光信号转换成电信号，之后将电信号传递给ISP转换成数字图像信号。ISP将数字图像信号输出到DSP加工处理。DSP将数字图像信号转换成标准的RGB，YUV等格式的图像信号。在一些实施例中，终端100可以包括1个或N个摄像头193，N为大于1的正整数。
数字信号处理器用于处理数字信号，除了可以处理数字图像信号，还可以处理其他数字信号。例如，当终端100在频点选择时，数字信号处理器用于对频点能量进行傅里叶变换等。
视频编解码器用于对数字视频压缩或解压缩。终端100可以支持一种或多种视频编解码器。这样，终端100可以播放或录制多种编码格式的视频，例如：动态图像专家组(moving picture experts group，MPEG)1，MPEG2，MPEG3，MPEG4等。
NPU为神经网络(neural-network，NN)计算处理器，通过借鉴生物神经网络结构，例如借鉴人脑神经元之间传递模式，对输入信息快速处理，还可以不断的自学习。通过NPU可以实现终端100的智能认知等应用，例如：图像识别，人脸识别，语音识别，文本理解等。
外部存储器接口120可以用于连接外部存储卡，例如Micro SD卡，实现扩展终端100的存储能力。外部存储卡通过外部存储器接口120与处理器110通信，实现数据存储功能。例如将音乐，视频等文件保存在外部存储卡中。
内部存储器121可以用于存储计算机可执行程序代码，所述可执行程序代码包括指令。处理器110通过运行存储在内部存储器121的指令，从而执行终端100的各种功能应用以及数据处理。内部存储器121可以包括存储程序区和存储数据区。其中，存储程序区可存储操作系统，至少一个功能所需的应用程序(比如声音播放功能，图像播放功能等)等。存储数据区可存储终端100使用过程中所创建的数据(比如音频数据，电话本等)等。此外，内部存储器121可以包括高速随机存取存储器，还可以包括非易失性存储器，例如至少一个磁盘存储器件，闪存器件，通用闪存存储器(universal flash storage，UFS)等。
终端100可以通过音频模块170，扬声器170A，受话器170B，麦克风170C，耳机接口170D，以及应用处理器等实现音频功能。例如音乐播放，录音等。
音频模块170用于将数字音频信息转换成模拟音频信号输出，也用于将模拟音频输入转换为数字音频信号。音频模块170还可以用于对音频信号编码和解码。在一些实施例中，音频模块170可以设置于处理器110中，或将音频模块170的部分功能模块设置于处理器110中。
扬声器170A，也称“喇叭”，用于将音频电信号转换为声音信号。终端100可以通过扬声器170A收听音乐，或收听免提通话。
受话器170B，也称“听筒”，用于将音频电信号转换成声音信号。当终端100接听电话或语音信息时，可以通过将受话器170B靠近人耳接听语音。
麦克风170C，也称“话筒”，“传声器”，用于将声音信号转换为电信号。当拨打电话或发送语音信息时，用户可以通过人嘴靠近麦克风170C发声，将声音信号输入到麦克风170C。终端100可以设置至少一个麦克风170C。在另一些实施例中，终端100可以设置两个麦克风170C，除了采集声音信号，还可以实现降噪功能。在另一些实施例中，终端100还可以设置三个，四个或更多麦克风170C，实现采集声音信号，降噪，还可以识别声音来源，实现定向录音功能等。
耳机接口170D用于连接有线耳机。耳机接口170D可以是USB接口130，也可以是3.5mm的开放移动电子设备平台(open mobile terminal platform，OMTP)标准接口，美国蜂窝电信工业协会(cellular telecommunications industry association of the USA，CTIA)标准接口。
压力传感器180A用于感受压力信号，可以将压力信号转换成电信号。在一些实施例中，压力传感器180A可以设置于显示屏194。压力传感器180A的种类很多，如电阻式压力传感器，电感式压力传感器，电容式压力传感器等。电容式压力传感器可以是包括至少两个具有导电材料的平行板。当有力作用于压力传感器180A，电极之间的电容改变。终端100根据电容的变化确定压力的强度。当有触摸操作作用于显示屏194，终端100根据压力传感器180A检测所述触摸操作强度。终端100也可以根据压力传感器180A的检测信号计算触摸的位置。在一些实施例中，作用于相同触摸位置，但不同触摸操作强度的触摸操作，可以对应不同的操作指令。例如：当有触摸操作强度小于第一压力阈值的触摸操作作用于短消息应用图标时，执行查看短消息的指令。当有触摸操作强度大于或等于第一压力阈值的触摸操作作用于短消息应用图标时，执行新建短消息的指令。
陀螺仪传感器180B可以用于确定终端100的运动姿态。在一些实施例中，可以通过陀螺仪传感器180B确定终端100围绕三个轴(即，x，y和z轴)的角速度。陀螺仪传感器180B可以用于拍摄防抖。示例性的，当按下快门，陀螺仪传感器180B检测终端100抖动的角度，根据角度计算出镜头模组需要补偿的距离，让镜头通过反向运动抵消终端100的抖动，实现防抖。陀螺仪传感器180B还可以用于导航，体感游戏场景。
气压传感器180C用于测量气压。在一些实施例中，终端100通过气压传感器180C测得的气压值计算海拔高度，辅助定位和导航。
磁传感器180D包括霍尔传感器。终端100可以利用磁传感器180D检测翻盖皮套的开合。在一些实施例中，当终端100是翻盖机时，终端100可以根据磁传感器180D检测翻盖的开合。进而根据检测到的皮套的开合状态或翻盖的开合状态，设置翻盖自动解锁等特性。
加速度传感器180E可检测终端100在各个方向上(一般为三轴)加速度的大小。当终端100静止时可检测出重力的大小及方向。还可以用于识别电子设备姿态，应用于横竖屏切换，计步器等应用。
距离传感器180F，用于测量距离。终端100可以通过红外或激光测量距离。在一些实施例中，拍摄场景，终端100可以利用距离传感器180F测距以实现快速对焦。
接近光传感器180G可以包括例如发光二极管(LED)和光检测器，例如光电二极管。发光二极管可以是红外发光二极管。终端100通过发光二极管向外发射红外光。终端100使用光电二极管检测来自附近物体的红外反射光。当检测到充分的反射光时，可以确定终端100附近有物体。当检测到不充分的反射光时，终端100可以确定终端100附近没有物体。终端100可以利用接近光传感器180G检测用户手持终端100贴近耳朵通话，以便自动熄灭屏幕达到省电的目的。接近光传感器180G也可用于皮套模式，口袋模式自动解锁与锁屏。
环境光传感器180L用于感知环境光亮度。终端100可以根据感知的环境光亮度自适应调节显示屏194亮度。环境光传感器180L也可用于拍照时自动调节白平衡。环境光传感器180L还可以与接近光传感器180G配合，检测终端100是否在口袋里，以防误触。
指纹传感器180H用于采集指纹。终端100可以利用采集的指纹特性实现指纹解锁，访问应用锁，指纹拍照，指纹接听来电等。
温度传感器180J用于检测温度。在一些实施例中，终端100利用温度传感器180J检测的温度，执行温度处理策略。例如，当温度传感器180J上报的温度超过阈值，终端100执行降低位于温度传感器180J附近的处理器的性能，以便降低功耗实施热保护。在另一些实施例中，当温度低于另一阈值时，终端100对电池142加热，以避免低温导致终端100异常关机。在其他一些实施例中，当温度低于又一阈值时，终端100对电池142的输出电压执行升压， 以避免低温导致的异常关机。
触摸传感器180K，也称“触控面板”。触摸传感器180K可以设置于显示屏194，由触摸传感器180K与显示屏194组成触摸屏，也称“触控屏”。触摸传感器180K用于检测作用于其上或附近的触摸操作。触摸传感器可以将检测到的触摸操作传递给应用处理器，以确定触摸事件类型。可以通过显示屏194提供与触摸操作相关的视觉输出。在另一些实施例中，触摸传感器180K也可以设置于终端100的表面，与显示屏194所处的位置不同。
骨传导传感器180M可以获取振动信号。在一些实施例中，骨传导传感器180M可以获取人体声部振动骨块的振动信号。骨传导传感器180M也可以接触人体脉搏，接收血压跳动信号。在一些实施例中，骨传导传感器180M也可以设置于耳机中，结合成骨传导耳机。音频模块170可以基于所述骨传导传感器180M获取的声部振动骨块的振动信号，解析出语音信号，实现语音功能。应用处理器可以基于所述骨传导传感器180M获取的血压跳动信号解析心率信息，实现心率检测功能。
按键190包括开机键，音量键等。按键190可以是机械按键。也可以是触摸式按键。终端100可以接收按键输入，产生与终端100的用户设置以及功能控制有关的键信号输入。
马达191可以产生振动提示。马达191可以用于来电振动提示，也可以用于触摸振动反馈。例如，作用于不同应用(例如拍照，音频播放等)的触摸操作，可以对应不同的振动反馈效果。作用于显示屏194不同区域的触摸操作，马达191也可对应不同的振动反馈效果。不同的应用场景(例如：时间提醒，接收信息，闹钟，游戏等)也可以对应不同的振动反馈效果。触摸振动反馈效果还可以支持自定义。
指示器192可以是指示灯，可以用于指示充电状态，电量变化，也可以用于指示消息，未接来电，通知等。
SIM卡接口195用于连接SIM卡。SIM卡可以通过插入SIM卡接口195，或从SIM卡接口195拔出，实现和终端100的接触和分离。终端100可以支持1个或N个SIM卡接口，N为大于1的正整数。SIM卡接口195可以支持Nano SIM卡，Micro SIM卡，SIM卡等。同一个SIM卡接口195可以同时插入多张卡。所述多张卡的类型可以相同，也可以不同。SIM卡接口195也可以兼容不同类型的SIM卡。SIM卡接口195也可以兼容外部存储卡。终端100通过SIM卡和网络交互，实现通话以及数据通信等功能。在一些实施例中，终端100采用eSIM，即：嵌入式SIM卡。eSIM卡可以嵌在终端100中，不能和终端100分离。
下面介绍本申请实施例中提供的一种北斗通信系统中密钥更新方法。
图10示出了本申请实施例中提供的一种北斗通信系统中密钥更新方法的流程示意图。
如图10所示，该北斗通信系统中密钥更新方法包括如下步骤：
S1001、终端100基于用户识别码IMSI、身份识别密钥Ki和第一应用层报文的发送时间生成第一密钥。
S1002、终端100使用第一密钥加密第一原始数据，得到第一加密后数据。
S1003、终端100给第一加密后数据添加报文头信息，得到第一应用层报文。其中，报文头信息包括时间指示字段和加密指示字段，加密指示字段用于指示对第一原始数据加密时使用的预设加密算法，时间指示字段用于指示第一应用层报文的发送时间信息。
S1004、终端100向北斗网络设备200发送第一应用层报文。
S1005、北斗网络设备200基于时间指示字段和第一应用层报文的接收时间通过蜂窝网络设备生成第二密钥。
S1006、北斗网络设备200使用第二密钥成功解密第一加密后数据，得到第一原始数据。
具体涉及终端100，生成第一密钥，加密第一原始数据得到第一应用层报文的详细描述可以参见上述图5所示实施例，在此不再赘述。
具体涉及北斗网络设备200生成第二密钥，解密应用层报文，可以参考前述图5所述实施例，在此不再赘述。
下面介绍终端100执行的一些可能的实现方式。
在一种可能的实现方式中，第一应用层报文的发送时间为第一时间点或者第二时间点；其中，第一时间点为终端获取第一原始数据的时间点，第二时间点为终端生成第一密钥时获取的时间点。
具体的，可以参见上述图3A所述实施例。
在一种可能的实现方式中，终端基于用户识别码IMSI、身份识别密钥Ki和第一应用层报文的发送时间生成第一密钥，具体包括：终端基于第一应用层报文的发送时间和IMSI得到随机数RAND。终端基于RAND和预设的Ki通过预设密钥算法1得到加密密钥Kc，通过预设密钥算法2得到鉴权符号响应SRES。终端基于Kc和SRES通过预设密钥算法3得到第一密钥。
具体的，可以参见上述图6所述实施例。
在一种可能的实现方式中，在终端使用第一密钥加密第一原始数据之前，方法还包括：终端还可以对第一原始数据进行压缩。
具体的，可以参见上述图3A所述实施例。
在一种可能的实现方式中，在终端向北斗网络设备发送第一应用层报文之后，方法还包括：终端接收到北斗网络设备发送的第一应用层回执，第一应用层回执用于指示北斗网络设备解密第一应用层报文成功。
具体的，可以参见上述图5所述实施例。
在一种可能的实现方式中，在终端向北斗网络设备发送第一应用层报文之后，方法还包括：终端基于IMSI、Ki和第二应用层报文的发送时间生成第三密钥；终端使用第三密钥加密第二原始数据，得到第二加密后数据；终端给第二加密后数据添加报文头信息，得到第二应用层报文；其中，报文头信息包括时间指示字段和加密指示字段，加密指示字段用于指示对第二原始数据加密时使用的预设加密算法，时间指示字段用于指示第二应用层报文的发送时间信息；终端向北斗网络设备发送第二应用层报文；终端接收到北斗网络设备发送的第二应用层回执，第二应用层回执用于指示北斗网络设备解密第二应用层报文失败。
具体的，可以参见上述图5所述实施例。
在一种可能的实现方式中，终端确定出第一应用层报文的发送时间和第二应用层报文的发送时间相同，终端直接使用第一密钥加密第二原始数据，得到第二加密后数据。
可选的，终端直接使用第一应用层报文的时间指示字段作为第二应用层报文的时间指示字段。
在一种可能的实现方式中，在终端接收到北斗网络设备发送的第二应用层回执之后，方法还包括：终端重传第二用层报文。
具体的，可以参见上述图5所述实施例。
在一种可能的实现方式中，在终端接收到北斗网络设备发送的第二应用层回执之后，方法还包括：终端显示失败提示信息，失败提示信息用于指示北斗网络设备解密第二应用层报文失败。
具体的，可以参见上述图5所述实施例。
在一种可能的实现方式中，时间指示字段的值用于指示第一应用层报文的发送时间的奇偶值。
具体的，可以参见上述图3A所述实施例。
下面介绍北斗网络设备200执行的一些可能的实现方式。
在一种可能的实现方式中，北斗网络设备基于时间指示字段和第一应用层报文的接收时间通过蜂窝网络设备生成第二密钥，具体包括：北斗网络设备基于时间指示字段和第一应用层报文的接收时间确定第一应用层报文的发送时间；北斗网络设备基于第一应用层报文的发送时间和从蜂窝网络设备获取的用户识别码IMSI得到随机数RAND；北斗网络设备将RAND发送给蜂窝网络设备；北斗网络设备得到蜂窝网络设备反馈的加密密钥Kc和鉴权符号响应SRES；终端基于Kc和SRES通过预设密钥算法3得到第二密钥。
具体的，可以参见上述图5所述实施例。
在一种可能的实现方式中，第一应用层报文的接收时间为第三时间点至第四时间点之间的指定时间点，第一应用层报文的接收时间的单位为小时；其中，第三时间点为北斗网络设备收到第一应用层报文的第1个卫星链路控制层协议数据单元SLC PDU的时间点，第四时间点为北斗网络设备生成第二密钥时获取的时间点。
具体的，可以参见上述图3B所述实施例。
在一种可能的实现方式中，时间指示字段的值用于指示第一应用层报文的发送时间的奇偶值。具体的，可以参见上述图3B所述实施例。
在一种可能的实现方式中，北斗网络设备基于时间指示字段和第一应用层报文的接收时间确定第一应用层报文的发送时间，具体包括：当时间指示字段的值指示的第一应用层报文的发送时间的奇偶值和第一应用层报文的接收时间的奇偶值相同时，北斗网络设备确定出第一应用层报文的发送时间和第一应用层报文的接收时间相同；
当时间指示字段的值指示的第一应用层报文的发送时间的奇偶值和第一应用层报文的接收时间的奇偶值不同时，北斗网络设备确定出第一应用层报文的接收时间和第一应用层报文的发送时间的差值为1。
具体的，可以参见上述图5所述实施例。
在一种可能的实现方式中，在北斗网络设备使用第二密钥成功解密第一加密后数据后， 得到第一原始数据之后，方法还包括：北斗网络设备生成第一应用层回执，第一应用层回执用于指示北斗网络设备解密第一应用层报文成功；北斗网络设备给终端发送第一应用层回执。
具体的，可以参见上述图5所述实施例。
在一种可能的实现方式中，在北斗网络设备使用第二密钥成功解密第一加密后数据，得到第一原始数据之后，方法还包括：北斗网络设备接收到终端发送的第二应用层报文；其中，第二应用层报文包括第二加密后数据和报文头信息，报文头信息包括时间指示字段和加密指示字段，加密指示字段用于指示对第二原始数据加密时使用的预设加密算法，时间指示字段用于指示第二应用层报文的发送时间信息；北斗网络设备基于时间指示字段和第二应用层报文的接收时间通过蜂窝网络设备生成第四密钥；北斗网络设备使用第四密钥解密第二加密后数据失败，北斗网络设备生成第二应用层回执，第二应用层回执用于指示北斗网络设备解密第二应用层报文失败；北斗网络设备给终端发送第二应用层回执。
具体的，可以参见上述图5所述实施例。
在一种可能的实现方式中，北斗网络设备确定出第一应用层报文的接收时间和第二应用层报文的接收时间相同，北斗网络设备直接使用第一密钥解密第二加密后数据。
上述内容详细阐述了本申请提供的方法，为了便于更好地实施本申请实施例的上述方案，本申请实施例还提供了相应的装置或设备。
本申请实施例可以根据上述方法示例对终端100和进行功能模块的划分，例如，可以对应各个功能划分各个功能模块，也可以将两个或两个以上的功能集成在一个处理模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。需要说明的是，本申请实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。
下面将结合图11至图14详细描述本申请实施例的通信装置。
在采用集成的单元的情况下，参见图11，图11是本申请实施例提供的通信装置1100的结构示意图。该通信装置1100可以为上述实施例中的终端100。可选的，通信装置1100可以为一种芯片/芯片系统，例如，北斗通信芯片。如图11所示，该通信装置1100可以包括收发单元1110和处理单元1120。
一种设计中，处理单元1120，可用于基于用户识别码IMSI、身份识别密钥Ki和应用层报文的发送时间生成第一密钥。
处理单元1120，还用于使用第一密钥加密第一原始数据，得到第一加密后数据。
处理单元1120，还用于给第一加密后数据添加报文头信息，得到第一应用层报文。其中，报文头信息包括时间指示字段和加密指示字段，加密指示字段用于指示对第一原始数据加密时使用的预设加密算法，时间指示字段用于指示第一应用层报文的发送时间信息。
收发单元1110，可用于向北斗网络设备200发送第一应用层报文。
可选的，收发单元1110，还可用于执行上述图10所示方法实施例中终端100执行的有关发送和接收的功能步骤。
可选的，处理单元1120，还可用于执行上述图10所示方法实施例中终端100执行的有关协议解析与封装以及运算确定的功能步骤。
应理解，该种设计中的通信装置1100可对应执行前述实施例中终端100执行的方法步骤， 为了简洁，在此不再赘述。
在采用集成的单元的情况下，参见图12，图12是本申请实施例提供的通信装置1200的结构示意图。该通信装置1200可以为上述实施例中的北斗网络设备200。可选的，通信装置1200可以为北斗网络设备200中的具体网元，例如，北斗地面收发站22、北斗中心站23、北斗短报文融合通信平台24中的一个网元或多个网元的组合。如图12所示，该通信装置1200可以包括收发单元1210和处理单元1220。
一种设计中，收发单元1210，可用于接收终端100发送的第一应用层报文。
处理单元1220，可用于基于时间指示字段和第一应用层报文的接收时间通过蜂窝网络设备生成第二密钥。
处理单元1220，还用于使用第二密钥成功解密第一加密后数据后，得到第一原始数据。
可选的，收发单元1210，还可用于执行上述图10所示方法实施例中北斗网络设备200执行的有关发送和接收的功能步骤。
可选的，处理单元1220，还可用于执行上述图10所示方法实施例中北斗网络设备200执行的有关协议解析与封装以及运算确定的功能步骤。
应理解，该种设计中的通信装置1200可对应执行前述实施例中北斗网络设备200执行的方法步骤，为了简洁，在此不再赘述。
以上介绍了本申请实施例的终端100和北斗网络设备200，应理解，但凡具备上述图11所述的终端100的功能的任何形态的产品，但凡具备上述图12所述的北斗网络设备200的功能的任何形态的产品，都落入本申请实施例的保护范围。
作为一种可能的产品形态，本申请实施例所述的终端100，可以由一般性的总线体系结构来实现。
参见图13，图13是本申请实施例提供的通信装置1300的结构示意图。该通信装置1300可以是终端100，或其中的装置。如图13所示，该通信装置1300包括处理器1301和与所述处理器内部连接通信的收发器1302。其中，处理器1301是通用处理器或者专用处理器等。例如可以是卫星通信的基带处理器或中央处理器。卫星通信的基带处理器可以用于对卫星通信协议以及卫星通信数据进行处理，中央处理器可以用于对通信装置(如，基带芯片，终端、终端芯片等)进行控制，执行计算机程序，处理计算机程序的数据。收发器1302可以称为收发单元、收发机、或收发电路等，用于实现收发功能。收发器1302可以包括接收器和发送器，接收器可以称为接收机或接收电路等，用于实现接收功能；发送器可以称为发送机或发送电路等，用于实现发送功能。可选的，通信装置1300还可以包括天线1303和/或射频单元(图未示意)。所述天线1303和/或射频单元可以位于所述通信装置1300内部，也可以与所述通信装置1300分离，即所述天线1303和/或射频单元可以是拉远或分布式部署的。
可选的，通信装置1300中可以包括一个或多个存储器1304，其上可以存有指令，该指令可为计算机程序，所述计算机程序可在通信装置1300上被运行，使得通信装置1300执行上述方法实施例中描述的方法。可选的，所述存储器1304中还可以存储有数据。通信装置1300和存储器1304可以单独设置，也可以集成在一起。
其中，处理器1301、收发器1302、以及存储器1304可以通过通信总线连接。
一种设计中，通信装置1300可以用于执行前述实施例中终端100的功能：处理器1301可以用于执行上述图11所示实施例中终端100执行的有关协议解析与封装以及运算确定的功能步骤和/或用于本文所描述的技术的其它过程；收发器1302可以用于执行上述图11所示实施例中终端100执行的有关执行的有关发送和接收的功能步骤和/或用于本文所描述的技术的其它过程。
在上述任一种设计中，处理器1301中可以包括用于实现接收和发送功能的收发器。例如该收发器可以是收发电路，或者是接口，或者是接口电路。用于实现接收和发送功能的收发电路、接口或接口电路可以是分开的，也可以集成在一起。上述收发电路、接口或接口电路可以用于代码/数据的读写，或者，上述收发电路、接口或接口电路可以用于信号的传输或传递。
在上述任一种设计中，处理器1301可以存有指令，该指令可为计算机程序，计算机程序在处理器1301上运行，可使得通信装置1300执行上述方法实施例中终端100执行的方法步骤。计算机程序可能固化在处理器1301中，该种情况下，处理器1301可能由硬件实现。
在一种实现方式中，通信装置1300可以包括电路，所述电路可以实现前述方法实施例中发送或接收或者通信的功能。本申请中描述的处理器和收发器可实现在集成电路(integrated circuit，IC)、模拟IC、射频集成电路RFIC、混合信号IC、专用集成电路(application specific integrated circuit，ASIC)、印刷电路板(printed circuit board，PCB)、电子设备等上。该处理器和收发器也可以用各种IC工艺技术来制造，例如互补金属氧化物半导体(complementary metal oxide semiconductor，CMOS)、N型金属氧化物半导体(nMetal-oxide-semiconductor，NMOS)、P型金属氧化物半导体(positive channel metal oxide semiconductor，PMOS)、双极结型晶体管(bipolar junction transistor，BJT)、双极CMOS(BiCMOS)、硅锗(SiGe)、砷化镓(GaAs)等。
本申请中描述的通信装置的范围并不限于此，而且通信装置的结构可以不受图13的限制。通信装置1300可以是独立的设备或者可以是较大设备的一部分。例如所述通信装置1300可以是：
(1)独立的集成电路IC，或芯片，或，芯片系统或子系统；
(2)具有一个或多个IC的集合，可选的，该IC集合也可以包括用于存储数据，计算机程序的存储部件；
(3)ASIC，例如调制解调器(Modem)；
(4)可嵌入在其他设备内的模块；
(5)接收机、终端、智能终端、蜂窝电话、无线设备、手持机、移动单元、车载设备、网络设备、云设备、人工智能设备等等；
(6)其他等等。
作为一种可能的产品形态，本申请实施例所述的北斗网络设备200中的任一网元(例如、北斗地面收发站22、北斗中心站23、北斗短报文融合通信平台24)，可以由一般性的总线体系结构来实现。
参见图14，图14是本申请实施例提供的通信装置1400的结构示意图。该通信装置1400可以是北斗网络设备200，或其中的装置。如图14所示，该通信装置1400包括处理器1401和与所述处理器内部连接通信的收发器1402。其中，处理器1401是通用处理器或者专用处理器等。例如可以是卫星通信的基带处理器或中央处理器。卫星通信的基带处理器可以用于 对卫星通信协议以及卫星通信数据进行处理，中央处理器可以用于对通信装置(如，基带芯片等)进行控制，执行计算机程序，处理计算机程序的数据。收发器1402可以称为收发单元、收发机、或收发电路等，用于实现收发功能。收发器1402可以包括接收器和发送器，接收器可以称为接收机或接收电路等，用于实现接收功能；发送器可以称为发送机或发送电路等，用于实现发送功能。可选的，通信装置1400还可以包括天线1403和/或射频单元(图未示意)。所述天线1403和/或射频单元可以位于所述通信装置1400内部，也可以与所述通信装置1400分离，即所述天线1403和/或射频单元可以是拉远或分布式部署的。
可选的，通信装置1400中可以包括一个或多个存储器1404，其上可以存有指令，该指令可为计算机程序，所述计算机程序可在通信装置1400上被运行，使得通信装置1400执行上述方法实施例中描述的方法。可选的，所述存储器1404中还可以存储有数据。通信装置1400和存储器1404可以单独设置，也可以集成在一起。
其中，处理器1401、收发器1402、以及存储器1404可以通过通信总线连接。
一种设计中，通信装置1400可以用于执行前述实施例中北斗网络设备200的功能：处理器1401可以用于执行上述图12所示实施例中北斗网络设备200执行的有关协议解析与封装以及运算确定的功能步骤和/或用于本文所描述的技术的其它过程；收发器1402可以用于执行上述图12所示实施例中北斗网络设备200执行的有关执行的有关发送和接收的功能步骤和/或用于本文所描述的技术的其它过程。
在上述任一种设计中，处理器1401中可以包括用于实现接收和发送功能的收发器。例如该收发器可以是收发电路，或者是接口，或者是接口电路。用于实现接收和发送功能的收发电路、接口或接口电路可以是分开的，也可以集成在一起。上述收发电路、接口或接口电路可以用于代码/数据的读写，或者，上述收发电路、接口或接口电路可以用于信号的传输或传递。
在上述任一种设计中，处理器1401可以存有指令，该指令可为计算机程序，计算机程序在处理器1401上运行，可使得通信装置1400执行上述方法实施例中北斗网络设备200执行的方法步骤。计算机程序可能固化在处理器1401中，该种情况下，处理器1401可能由硬件实现。
本申请实施例还提供一种计算机可读存储介质，该计算机可读存储介质中存储有计算机程序代码，当上述处理器执行该计算机程序代码时，电子设备执行前述任一实施例中的方法。
本申请实施例还提供一种计算机程序产品，当该计算机程序产品在计算机上运行时，使得计算机执行前述任一实施例中的方法。
本申请实施例还提供一种通信装置，该装置可以以芯片的产品形态存在，该装置的结构中包括处理器和接口电路，该处理器用于通过接收电路与其它装置通信，使得该装置执行前述任一实施例中的方法。
本申请实施例还提供一种北斗通信系统，包括终端100和北斗网络设备200，该终端100和北斗网络设备200可以执行前述任一实施例中的方法。
本申请全文介绍了北斗通信系统中短报文的通信功能，可以理解的是，其他卫星系统中也可能存在支持短报文的通信功能。因此，不限制在北斗通信系统中，若有其他卫星系统也支持短报文的通信功能，本申请中介绍的方法，也同样适用于其他卫星系统的通信。
结合本申请公开内容所描述的方法或者算法的步骤可以硬件的方式来实现，也可以是由 处理器执行软件指令的方式来实现。软件指令可以由相应的软件模块组成，软件模块可以被存放于随机存取存储器(Random Access Memory，RAM)、闪存、可擦除可编程只读存储器(Erasable Programmable ROM，EPROM)、电可擦可编程只读存储器(Electrically EPROM，EEPROM)、寄存器、硬盘、移动硬盘、只读光盘(CD-ROM)或者本领域熟知的任何其它形式的存储介质中。一种示例性的存储介质耦合至处理器，从而使处理器能够从该存储介质读取信息，且可向该存储介质写入信息。当然，存储介质也可以是处理器的组成部分。处理器和存储介质可以位于ASIC中。另外，该ASIC可以位于核心网接口设备中。当然，处理器和存储介质也可以作为分立组件存在于核心网接口设备中。
本领域技术人员应该可以意识到，在上述一个或多个示例中，本申请所描述的功能可以用硬件、软件、固件或它们的任意组合来实现。当使用软件实现时，可以将这些功能存储在计算机可读介质中或者作为计算机可读介质上的一个或多个指令或代码进行传输。计算机可读介质包括计算机可读存储介质和通信介质，其中通信介质包括便于从一个地方向另一个地方传送计算机程序的任何介质。存储介质可以是通用或专用计算机能够存取的任何可用介质。
以上所述，以上实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的范围。

Claims (24)

  1. 一种北斗通信系统中密钥更新方法，其特征在于，包括：
    终端基于用户识别码IMSI、身份识别密钥Ki和第一应用层报文的发送时间生成第一密钥；
    所述终端使用所述第一密钥加密第一原始数据，得到第一加密后数据；
    所述终端给所述第一加密后数据添加报文头信息，得到第一应用层报文；其中，所述报文头信息包括时间指示字段和加密指示字段，所述加密指示字段用于指示对所述第一原始数据加密时使用的预设加密算法，所述时间指示字段用于指示所述第一应用层报文的发送时间信息；
    所述终端向北斗网络设备发送所述第一应用层报文。
  2. 根据权利要求1所述的方法，其特征在于，所述第一应用层报文的发送时间为第一时间点或者第二时间点；其中，所述第一时间点为所述终端获取所述第一原始数据的时间点，所述第二时间点为所述终端生成所述第一密钥时获取的时间点。
  3. 根据权利要求1或2所述的方法，其特征在于，所述终端基于用户识别码IMSI、身份识别密钥Ki和第一应用层报文的发送时间生成第一密钥，具体包括：
    所述终端基于所述第一应用层报文的发送时间和IMSI得到随机数RAND；
    所述终端基于所述RAND和预设的Ki通过预设密钥算法1得到加密密钥Kc，通过预设密钥算法2得到鉴权符号响应SRES；
    所述终端基于所述Kc和SRES通过预设密钥算法3得到所述第一密钥。
  4. 根据权利要求1-3中任一项所述的方法，其特征在于，在所述终端使用所述第一密钥加密第一原始数据之前，所述方法还包括：
    所述终端还可以对所述第一原始数据进行压缩。
  5. 根据权利要求1-4中任一项所述的方法，其特征在于，在所述终端向北斗网络设备发送所述第一应用层报文之后，所述方法还包括：
    所述终端接收到所述北斗网络设备发送的第一应用层回执，所述第一应用层回执用于指示所述北斗网络设备解密所述第一应用层报文成功。
  6. 根据权利要求1-5中任一项所述的方法，其特征在于，在所述终端向北斗网络设备发送所述第一应用层报文之后，所述方法还包括：
    所述终端基于IMSI、Ki和第二应用层报文的发送时间生成第三密钥；
    所述终端使用所述第三密钥加密第二原始数据，得到第二加密后数据；
    所述终端给所述第二加密后数据添加报文头信息，得到第二应用层报文；其中，所述报文头信息包括时间指示字段和加密指示字段，所述加密指示字段用于指示对所述第二原始数据加密时使用的预设加密算法，所述时间指示字段用于指示所述第二应用层报文的发送时间信息；
    所述终端向北斗网络设备发送所述第二应用层报文；
    所述终端接收到所述北斗网络设备发送的第二应用层回执，所述第二应用层回执用于指 示所述北斗网络设备解密所述第二应用层报文失败。
  7. 根据权利要求6所述的方法，其特征在于，在所述终端接收到所述北斗网络设备发送的第二应用层回执之后，所述方法还包括：
    所述终端重传所述第二用层报文。
  8. 根据权利要求6或7所述的方法，其特征在于，在所述终端接收到所述北斗网络设备发送的第二应用层回执之后，所述方法还包括：
    所述终端显示失败提示信息，所述失败提示信息用于指示所述北斗网络设备解密所述第二应用层报文失败。
  9. 根据权利要求1-5中任一项所述的方法，其特征在于，所述时间指示字段的值用于指示所述第一应用层报文的发送时间的奇偶值。
  10. 一种北斗通信系统中密钥更新方法，其特征在于，包括：
    所述北斗网络设备接收终端发送的第一应用层报文；其中，所述第一应用层报文包括第一加密后数据和报文头信息，所述报文头信息包括时间指示字段和加密指示字段，所述加密指示字段用于指示对第一原始数据加密时使用的预设加密算法，所述时间指示字段用于指示所述第一应用层报文的发送时间信息；
    所述北斗网络设备基于所述时间指示字段和第一应用层报文的接收时间通过蜂窝网络设备生成第二密钥；
    所述北斗网络设备使用所述第二密钥成功解密所述第一加密后数据，得到所述第一原始数据。
  11. 根据权利要求10所述的方法，其特征在于，所述北斗网络设备基于所述时间指示字段和第一应用层报文的接收时间通过蜂窝网络设备生成第二密钥，具体包括：
    所述北斗网络设备基于所述时间指示字段和所述第一应用层报文的接收时间确定所述第一应用层报文的发送时间；
    所述北斗网络设备基于所述第一应用层报文的发送时间和从蜂窝网络设备获取的用户识别码IMSI得到随机数RAND；
    所述北斗网络设备将所述RAND发送给所述蜂窝网络设备；
    所述北斗网络设备得到所述蜂窝网络设备反馈的加密密钥Kc和鉴权符号响应SRES；
    所述终端基于所述Kc和所述SRES通过预设密钥算法3得到所述第二密钥。
  12. 根据权利要求10或11所述的方法，其特征在于，所述第一应用层报文的接收时间为第三时间点至第四时间点之间的指定时间点，所述第一应用层报文的接收时间的单位为小时；其中，所述第三时间点为所述北斗网络设备收到所述第一应用层报文的第1个卫星链路控制层协议数据单元SLCPDU的时间点，所述第四时间点为所述北斗网络设备生成所述第二密钥时获取的时间点。
  13. 根据权利要求10-12中任一项所述的方法，其特征在于，所述时间指示字段的值用于 指示所述第一应用层报文的发送时间的奇偶值。
  14. 根据权利要求13所述的方法，其特征在于，所述北斗网络设备基于所述时间指示字段和所述第一应用层报文的接收时间确定所述第一应用层报文的发送时间，具体包括：
    当所述时间指示字段的值指示的所述第一应用层报文的发送时间的奇偶值和所述第一应用层报文的接收时间的奇偶值相同时，所述北斗网络设备确定出所述第一应用层报文的发送时间和所述第一应用层报文的接收时间相同；
    当所述时间指示字段的值指示的所述第一应用层报文的发送时间的奇偶值和所述第一应用层报文的接收时间的奇偶值不同时，所述北斗网络设备确定出所述第一应用层报文的接收时间和所述第一应用层报文的发送时间的差值为1。
  15. 根据权利要求10-14中任一项所述的方法，其特征在于，在所述北斗网络设备使用所述第二密钥成功解密所述第一加密后数据后，得到所述第一原始数据之后，所述方法还包括：
    所述北斗网络设备生成第一应用层回执，所述第一应用层回执用于指示所述北斗网络设备解密所述第一应用层报文成功；
    所述北斗网络设备给所述终端发送所述第一应用层回执。
  16. 根据权利要求10-15中任一项所述的方法，其特征在于，在所述北斗网络设备使用所述第二密钥成功解密所述第一加密后数据，得到所述第一原始数据之后，所述方法还包括：
    所述北斗网络设备接收到所述终端发送的第二应用层报文；其中，所述第二应用层报文包括第二加密后数据和报文头信息，所述报文头信息包括时间指示字段和加密指示字段，所述加密指示字段用于指示对第二原始数据加密时使用的预设加密算法，所述时间指示字段用于指示所述第二应用层报文的发送时间信息；
    所述北斗网络设备基于所述时间指示字段和第二应用层报文的接收时间通过蜂窝网络设备生成第四密钥；
    所述北斗网络设备使用所述第四密钥解密所述第二加密后数据失败，所述北斗网络设备生成第二应用层回执，所述第二应用层回执用于指示所述北斗网络设备解密所述第二应用层报文失败；
    所述北斗网络设备给所述终端发送所述第二应用层回执。
  17. 一种北斗通信系统，其特征在于，包括：终端和北斗网络设备；其中，
    所述终端，用于基于用户识别码IMSI、身份识别密钥Ki和第一应用层报文的发送时间生成第一密钥；
    所述终端，还用于使用所述第一密钥加密第一原始数据，得到第一加密后数据；
    所述终端，还用于给所述第一加密后数据添加报文头信息，得到第一应用层报文；其中，所述报文头信息包括时间指示字段和加密指示字段，所述加密指示字段用于指示对所述第一原始数据加密时使用的预设加密算法，所述时间指示字段用于指示所述第一应用层报文的发送时间信息；
    所述终端，还用于向所述北斗网络设备发送所述第一应用层报文；
    所述北斗网络设备，用于接收所述终端发送的所述第一应用层报文；
    所述北斗网络设备，还用于基于所述时间指示字段和第一应用层报文的接收时间通过蜂 窝网络设备生成第二密钥；
    所述北斗网络设备，还用于使用所述第二密钥成功解密所述第一加密后数据，得到所述第一原始数据。
  18. 一种通信装置，其特征在于，包括一个或多个处理器、一个或多个存储器和收发器；其中，所述收发器、所述一个或多个存储器与所述一个或多个处理器耦合，所述一个或多个存储器用于存储计算机程序代码，所述计算机程序代码包括计算机指令，当一个或多个处理器在执行所述计算机指令时，使得所述通信装置执行如权利要求1-9任一项所述的方法。
  19. 根据权利要求18所述的通信装置，其特征在于，所述通信装置为终端。
  20. 一种通信装置，其特征在于，包括一个或多个处理器、一个或多个存储器、收发器；其中，所述收发器、所述一个或多个存储器与所述一个或多个处理器耦合，所述一个或多个存储器用于存储计算机程序代码，所述计算机程序代码包括计算机指令，当一个或多个处理器在执行所述计算机指令时，使得所述通信装置执行如权利要求10-16任一项所述的方法。
  21. 根据权利要求20所述的通信装置，其特征在于，所述通信装置为北斗网络设备。
  22. 一种计算机可读存储介质，所述计算机可读存储介质中存储有指令，当所述指令在计算机上运行时，使得所述计算机执行如权利要求1-9任一项所述的方法。
  23. 一种计算机可读存储介质，所述计算机可读存储介质中存储有指令，当所述指令在计算机上运行时，使得所述计算机执行如权利要求10-16任一项所述的方法。
  24. 一种芯片或芯片系统，应用于终端，其特征在于，包括处理电路和接口电路，所述接口电路用于接收代码指令并传输至所述处理电路，所述处理电路用于运行所述代码指令以执行如权利要求1-9任一项所述的方法。
PCT/CN2022/109253 2021-07-31 2022-07-29 一种北斗通信系统中密钥更新方法、系统及相关装置 WO2023011376A1 (zh)

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
CN202110877001 2021-07-31
CN202110877001.4 2021-07-31
CN202110924080.X 2021-08-12
CN202110924080.XA CN115696322A (zh) 2021-07-31 2021-08-12 一种北斗通信系统中密钥更新方法、系统及相关装置

Publications (1)

Publication Number Publication Date
WO2023011376A1 true WO2023011376A1 (zh) 2023-02-09

Family

ID=85059999

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/109253 WO2023011376A1 (zh) 2021-07-31 2022-07-29 一种北斗通信系统中密钥更新方法、系统及相关装置

Country Status (2)

Country Link
CN (1) CN115696322A (zh)
WO (1) WO2023011376A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116095620A (zh) * 2023-04-11 2023-05-09 北京北斗华大科技有限公司 基于无线网络的rdss短报文功能实现系统及方法
CN116455560A (zh) * 2023-06-16 2023-07-18 北京智芯微电子科技有限公司 数据加密方法、数据解密方法、装置、设备及介质

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116074811B (zh) * 2023-04-06 2023-07-21 深圳华大北斗科技股份有限公司 基于eSim的北斗短报文通信方法、装置及存储介质
CN116866902A (zh) * 2023-07-27 2023-10-10 烟台东方威思顿电气有限公司 一种基于交互数据的数据保护方法

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107359988A (zh) * 2017-07-14 2017-11-17 江苏徐工信息技术股份有限公司 基于北斗rn授时加密的武警抢险设备物联网通讯方法
US20180331830A1 (en) * 2017-05-12 2018-11-15 Alcatel-Lucent Usa Inc. Indicator for determination of key for processing message in communication system

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20180331830A1 (en) * 2017-05-12 2018-11-15 Alcatel-Lucent Usa Inc. Indicator for determination of key for processing message in communication system
CN107359988A (zh) * 2017-07-14 2017-11-17 江苏徐工信息技术股份有限公司 基于北斗rn授时加密的武警抢险设备物联网通讯方法

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116095620A (zh) * 2023-04-11 2023-05-09 北京北斗华大科技有限公司 基于无线网络的rdss短报文功能实现系统及方法
CN116095620B (zh) * 2023-04-11 2023-06-09 北京北斗华大科技有限公司 基于无线网络的rdss短报文功能实现系统及方法
CN116455560A (zh) * 2023-06-16 2023-07-18 北京智芯微电子科技有限公司 数据加密方法、数据解密方法、装置、设备及介质
CN116455560B (zh) * 2023-06-16 2023-08-29 北京智芯微电子科技有限公司 数据加密方法、数据解密方法、装置、设备及介质

Also Published As

Publication number Publication date
CN115696322A (zh) 2023-02-03

Similar Documents

Publication Publication Date Title
WO2023011376A1 (zh) 一种北斗通信系统中密钥更新方法、系统及相关装置
WO2021052178A1 (zh) 一种Wi-Fi连接方法及设备
CN111373713B (zh) 一种消息传输方法及设备
CN112469013B (zh) 一种蓝牙连接方法及相关装置
CN115696237A (zh) 一种北斗通信系统中加密方法、系统及相关装置
CN111083804B (zh) 一种数据传输方法及设备
WO2023011362A1 (zh) 一种北斗通信系统中出站传输控制方法、系统及相关装置
WO2023011379A1 (zh) 一种北斗通信系统中入站传输控制方法、系统及相关装置
EP4358431A1 (en) Multi-frame fusion transmission method in beidou communication system, and related apparatus
WO2021184264A1 (zh) 数据保存方法、数据访问方法及相关装置、设备
WO2023185893A1 (zh) 一种卫星信号捕获方法及相关装置
CN114697955A (zh) 一种加密通话方法、装置、终端及存储介质
EP4358432A1 (en) Mail download and query method in beidou communication system, and system and related apparatus
CN115701016B (zh) 一种卫星通信系统中鉴权校验方法、系统及相关装置
EP4354759A1 (en) Method, system and apparatus for application layer receipt transmission in beidou communication system
WO2023011603A1 (zh) 一种北斗通信系统中位置上报方法、系统及相关装置
WO2023083027A1 (zh) 一种北斗通信系统中的参数更新方法、系统及相关装置
WO2023011329A1 (zh) 一种北斗通信系统中数据传输控制方法、系统及相关装置
WO2023011478A1 (zh) 一种北斗通信系统中的数据压缩方法、系统及相关装置
WO2023011386A1 (zh) 一种北斗通信系统中白名单控制方法及相关装置
CN112996066B (zh) 驻网方法及相关设备
CN115706604A (zh) 一种北斗通信系统中白名单控制方法及相关装置
CN115706602A (zh) 一种北斗通信系统中位置上报方法、系统及相关装置
CN115706603A (zh) 北斗通信系统中紧凑传输方法、系统及相关装置
CN115941016A (zh) 北斗通信系统中紧凑反馈方法、系统及相关装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22852089

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE