EDHOC-NTN: a lightweight authentication and satellite-terrestrial integrated backhaul security protocol design based on CL-PKC

The 3GPP-standardized non-terrestrial network (NTN) serves as a critical enabler for 6G integrated space-air-ground architectures, providing global coverage, low-latency connectivity, and multi-scenario adaptability through satellite-based base stations. However, due to the characteristics of intermittent connectivity, high propagation delay, and dynamic changes in network topology of the NTN satellite-ground backhaul links, the current Internet protocol security (IPSec) solution adopted by 3GPP terrestrial networks, which has defected such as multiple interaction rounds, high latency, and severe reliance on IP addresses for identity authentication, is not suitable for the current satellite high-speed mobile scenarios. To address this issue, this paper introduces EDHOC-NTN, a key exchange and authentication protocol that integrates certificateless public-key cryptography (CL-PKC) with the lightweight authenticated key agreement protocol EDHOC (ephemeral Diffie-Hellman over COSE). Our proposed protocol, while ensuring the security of the return link, achieves the integration of low overhead, low latency and strong security. Heuristic analysis and formal security verification confirm that the protocol resists replay, man-in-the-middle, and impersonation attacks. Performance evaluation and simulation results show that our proposed protocol can save 41.7% of the bandwidth consumption and 26.4% of the computing cost compared to the standard IPSec protocol, making it more suitable for resource-constrained satellite-ground integrated network environments.