Information security interconnection method of hybrid space network

Abstract

The invention provides an information security interconnection method of a hybrid space network. The method comprises the steps of obtaining a communication connection demand requested by a user; based on the communication connection demand, querying a plurality of space network nodes matched with the communication connection demand in a pre-established space network node set, and generating initial routing paths corresponding to the plurality of space network nodes; performing optimization processing on the initial routing paths corresponding to the plurality of space network nodes to generate target routing paths of the plurality of space network nodes; and performing encryption operation on the target routing path of the selected space network node by using a pre-created security policy, and applying the encryption operation to the target routing paths of the remaining plurality of space network nodes in batches. According to the technical scheme provided by the invention, the time delay of data transmission can be remarkably reduced, and the overall efficiency of space network communication is improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of information security technology, and in particular to an information security interconnection method for a hybrid space network. Background Art

[0002] With the development of space technology and the increasing abundance of space resources, space networks have become an important infrastructure connecting the earth and space. Hybrid space networks refer to the combination of ground networks and space networks to form a network architecture that can efficiently and securely transmit information. This network architecture can support various space activities and services, such as satellite communications, space station data exchange, deep space exploration, etc.

[0003] In space networks, traditional routing algorithms based on the shortest path are usually used to plan data transmission paths. This algorithm takes into account the physical distance between nodes and attempts to find the shortest path from the source node to the destination node. It also uses fixed encryption keys and encryption algorithms to protect the security of data during transmission. Although this method can provide a certain degree of security, it has low flexibility.

[0004] In summary, the existing space network information security interconnection methods have problems such as high data transmission time delay, poor overall communication efficiency and insufficient security when facing the growing data transmission demand. Therefore, developing a secure interconnection method that can dynamically optimize routing paths and strengthen data encryption is of great significance to improving the overall performance and security of space networks. Summary of the invention

[0005] The embodiment of the present application provides a method for information security interconnection of a hybrid space network, which is used to solve the problems of high data transmission time delay and poor overall communication efficiency in the prior art.

[0006] In a first aspect, an embodiment of the present application provides a method for information security interconnection of a hybrid space network, including:

[0007] Obtain the communication connection requirements requested by the user;

[0008] Based on the communication connection requirement, multiple space network nodes matching the communication connection requirement are searched in a pre-established space network node set, and initial routing paths corresponding to the multiple space network nodes are generated;

[0009] Optimizing the initial routing paths corresponding to the plurality of space network nodes to generate target routing paths for the plurality of space network nodes;

[0010] The target routing path of the selected space network node is encrypted using a pre-created security policy, and the encryption operation is applied in batches to the target routing paths of the remaining plurality of space network nodes.

[0011] Optionally, the optimizing the initial routing paths corresponding to the plurality of space network nodes to generate target routing paths of the plurality of space network nodes includes:

[0012] Calculating the transmission delay between the space network nodes according to the initial routing path corresponding to each of the space network nodes;

[0013] The initial routing paths corresponding to the multiple space network nodes, the transmission delays between the multiple space network nodes, and the acquired location information of the multiple space network nodes are input as input information into a pre-trained routing optimization model to obtain the target routing paths of the multiple space network nodes output by the routing optimization model.

[0014] Optionally, the optimizing the initial routing paths corresponding to the plurality of space network nodes to generate target routing paths of the plurality of space network nodes includes:

[0015] Obtaining the bandwidth occupancy rate corresponding to the initial routing path of each of the space network nodes, and filtering out routing paths with bandwidth occupancy rates higher than a preset occupancy rate, so as to generate a target routing path;

[0016] And / or, calculating the number of nodes involved in the initial routing path of each of the space network nodes, and filtering out routing paths with the number of nodes exceeding a preset number, so as to generate a target routing path.

[0017] Optionally, before inputting the initial routing paths corresponding to the plurality of space network nodes, the transmission delays between the plurality of space network nodes, and the acquired location information of the plurality of space network nodes as input information into a pre-trained routing optimization model to obtain the target routing paths of the plurality of space network nodes output by the routing optimization model, the method further includes:

[0018] The location information of the multiple space network nodes is input into a pre-trained location prediction model to obtain the predicted locations of the multiple space network nodes output by the location prediction model, and the step of inputting the initial routing paths corresponding to the multiple space network nodes, the transmission delays between the multiple space network nodes and the obtained location information of the multiple space network nodes as input information into the pre-trained routing optimization model to obtain the target routing paths of the multiple space network nodes output by the routing optimization model is continued.

[0019] Optionally, based on the communication connection requirement, querying a plurality of space network nodes matching the communication connection requirement in a pre-established space network node set, and generating initial routing paths corresponding to the plurality of space network nodes, includes:

[0020] Inputting the communication connection requirement and the pre-established space network node set into a pre-trained matching retrieval model, so as to query the space network nodes matching the communication connection requirement through the matching retrieval model, and generate initial routing paths corresponding to a plurality of the space network nodes;

[0021] The initial routing path is generated based on:

[0022]

[0023] Among them, P i represents the initial routing path of the i-th space network node; w j represents the jth weight factor; d j (P) represents the distance of path P calculated according to the jth weight factor; α is the balance factor; s k (P) represents the impact of the kth safety index on path P; n and m represent the distance and the number of safety indicators, respectively.

[0024] Optionally, the pre-created security policy includes at least: a data encryption algorithm, a key distribution mechanism, an identity authentication protocol, and an access control policy.

[0025] Optionally, the data encryption algorithm, the key distribution mechanism, the identity authentication protocol and the access control policy include an encryption mode and an authentication mode, wherein the encryption mode is used to encrypt data in the target routing path according to the corresponding encryption strength, and the authentication mode is used to perform identity authentication in the target routing path;

[0026] The encryption strength of the encryption mode is based on:

[0027] S enc =f(k,l,t,βlog(λ+1))

[0028] Among them, S enc represents encryption strength; k represents key length; l represents data packet length; t represents transmission time; β is a constant factor; λ represents the integrity measure of the data packet.

[0029] Optionally, the location information of the space network node is the spatial location of the space network node.

[0030] In a second aspect, an embodiment of the present application provides an information security interconnection device for a hybrid space network, including:

[0031] An acquisition module, used to obtain the communication connection requirements requested by the user;

[0032] A generation module is used to query multiple space network nodes matching the communication connection requirements in a pre-established space network node set based on the communication connection requirements, and generate initial routing paths corresponding to the multiple space network nodes; optimize the initial routing paths corresponding to the multiple space network nodes to generate target routing paths for the multiple space network nodes;

[0033] The encryption module is used to perform encryption operations on the target routing paths of the selected space network nodes using a pre-created security policy, and apply the encryption operations in batches to the target routing paths of the remaining multiple space network nodes.

[0034] In a third aspect, an embodiment of the present application provides a computing device, comprising a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component to implement the information security interconnection method of the hybrid space network as described in the first aspect above.

[0035] In a fourth aspect, an embodiment of the present application provides a computer storage medium storing a computer program. When the computer program is executed by a computer, the information security interconnection method of the hybrid space network as described in the first aspect above is implemented.

[0036] In an embodiment of the present application, a communication connection requirement requested by a user is obtained; based on the communication connection requirement, multiple space network nodes matching the communication connection requirement are queried in a pre-established space network node set, and initial routing paths corresponding to multiple space network nodes are generated; the initial routing paths corresponding to the multiple space network nodes are optimized to generate target routing paths for multiple space network nodes; an encryption operation is performed on the target routing path of the selected space network node using a pre-created security policy, and the encryption operation is applied in batches to the target routing paths of the remaining multiple space network nodes.

[0037] The method provided in the embodiment of the present application has the following beneficial effects:

[0038] Improve communication efficiency: By optimizing the initial routing path, the time delay of data transmission can be significantly reduced and the overall efficiency of space network communications can be improved.

[0039] Enhanced security: Encrypting the target routing path through pre-created security policies can effectively prevent data from being eavesdropped or tampered with during transmission, ensuring the security of communication content.

[0040] Simplified management process: By applying encryption operations in batches to all target routing paths, the security management process can be simplified and operating costs can be reduced.

[0041] Strong adaptability: This method can dynamically adjust routing paths and encryption strategies according to different communication connection requirements, and has high flexibility and adaptability.

[0042] Resource optimization: The optimized routing path can make more efficient use of space network resources and reduce unnecessary waste of resources.

[0043] These and other aspects of the present application will become more clearly understood in the description of the following embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0045] Figure 1 A flowchart of a method for information security interconnection of a hybrid space network provided in an embodiment of the present application;

[0046] Figure 2 A schematic diagram of the structure of an information security interconnection device for a hybrid space network provided in an embodiment of the present application;

[0047] Figure 3 A schematic diagram of the structure of a computing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0048] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0049] In some of the processes described in the specification and claims of this application and the above-mentioned figures, multiple operations that appear in a specific order are included, but it should be clearly understood that these operations may not be executed in the order in which they appear in this article or executed in parallel. The serial numbers of the operations, such as 101, 102, etc., are only used to distinguish between different operations, and the serial numbers themselves do not represent any execution order. In addition, these processes may include more or fewer operations, and these operations may be executed in sequence or in parallel. It should be noted that the descriptions of "first", "second", etc. in this article are used to distinguish different messages, devices, modules, etc., do not represent the order of precedence, and do not limit the "first" and "second" to be different types.

[0050] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0051] Figure 1 A flowchart of a method for information security interconnection of a hybrid space network is provided for an embodiment of the present application, such as Figure 1 As shown, the method includes:

[0052] 101. Obtaining the communication connection requirement requested by the user;

[0053] In this step, the communication connection requirements requested by the user are obtained: This step involves the communication request initiated by the user, including but not limited to the requirements for services such as data transmission, voice calls or video conferencing. The communication connection requirements usually include information such as the starting node (source node), the destination node (destination), the required bandwidth, and the quality of service (QoS) requirements.

[0054] In the embodiment of the present application, it is assumed that a user wants to send a set of high-definition video data from a certain point on the earth (source node A) to a space station in low-Earth orbit (destination node B). The user submits a communication connection requirement through a dedicated application or interface, which includes:

[0055] Source node A: located at a fixed location on the earth, such as a data center or communication center.

[0056] Destination Node B: A space station located in low earth orbit, serving as the destination for receiving high-definition video data.

[0057] Required bandwidth: Based on the data volume and transmission rate of HD video, the user specifies the minimum required bandwidth, such as 100Mbps.

[0058] Quality of Service (QoS) requirements: Users also specify minimum quality of service standards, such as requiring packet loss rate to be less than 1% and latency to not exceed 500 milliseconds.

[0059] After the user submits these detailed requirements, the system will start subsequent processing steps, including querying multiple space network nodes that match the communication connection requirements in the pre-established space network node set, and generating initial routing paths corresponding to multiple space network nodes.

[0060] In this embodiment, the communication connection requirements submitted by the user will trigger a series of automated processes to ensure that data can be efficiently and securely transmitted from the source node to the destination node.

[0061] 102. Based on the communication connection requirement, query a plurality of space network nodes matching the communication connection requirement in a pre-established space network node set, and generate initial routing paths corresponding to the plurality of space network nodes;

[0062] Optionally, in the embodiment of the present application, step 102 may specifically include: inputting the communication connection requirement and the pre-established space network node set into a pre-trained matching retrieval model, so as to query the space network node matching the communication connection requirement through the matching retrieval model, and generate a plurality of initial routing paths corresponding to the space network nodes;

[0063] The initial routing path is generated based on:

[0064]

[0065] Among them, P i represents the initial routing path of the i-th space network node; w j represents the jth weight factor; d j (P) represents the distance of path P calculated according to the jth weight factor; α is the balance factor; s k (P) represents the impact of the kth safety index on path P; n and m represent the distance and the number of safety indicators, respectively.

[0066] In this step, based on the communication connection requirement, multiple space network nodes matching the communication connection requirement are queried from the pre-established space network node set, and initial routing paths corresponding to multiple space network nodes are generated: This step is to find multiple space network nodes that can meet the requirements from the pre-established space network node set according to the user's communication connection requirements, and generate corresponding initial routing paths for these nodes. The key concepts here include communication connection requirements, space network node set, matching retrieval model, initial routing path, weight factor, distance, balance factor and security index.

[0067] Communication connection requirements: including information such as source node, destination node, required bandwidth and service quality requirements.

[0068] Space network node set: refers to the set of all pre-established nodes that can be used to build space network communication links.

[0069] Matching retrieval model: A pre-trained model used to find suitable nodes in the space network node set based on communication connection requirements.

[0070] Initial routing path: A preliminary path generated for each space network node based on the results of the matching retrieval model.

[0071] Weight factor: used to measure the importance of different path attributes.

[0072] Distance: A measure of the length of a path.

[0073] Balance factor: used to balance the relationship between path distance and safety index.

[0074] Security indicators: indicators that measure the security of the path, such as the degree of signal interference, data leakage risk, etc.

[0075] In the embodiment of the present application, it is assumed that the user wants to send high-definition video data from a data center on Earth (source node A) to a space station in low-Earth orbit (destination node B), the required bandwidth is 100Mbps, and the quality of service requirements are a packet loss rate of less than 1% and a delay of no more than 500 milliseconds. Based on this information, the system uses a pre-trained matching retrieval model to query multiple space network nodes that match the communication connection requirements, and generates initial routing paths for these nodes.

[0076] Communication connection requirements: User specifies source node A, destination node B, required bandwidth 100Mbps, packet loss rate less than 1%, and delay no more than 500 milliseconds.

[0077] Matching retrieval model: The system uses a pre-trained matching retrieval model to find space network nodes that match the above requirements. These nodes include ground stations, satellite nodes, and space stations.

[0078] Initial routing path: The system generates an initial routing path for each matching space network node. Assume that the system finds three candidate nodes C, D, and E. For node C, the initial routing path is from A to C and then to B; for node D, the path is from A to D and then to B; for node E, the path is from A to E and then to B.

[0079] Next, the system will optimize these initial routing paths based on the distance and safety metrics of the paths.

[0080] Distance: The distances of paths ACB, ADB and AEB are 5000km, 6000km and 4500km respectively.

[0081] Safety index: Assume that the safety index of path ACB is 0.8 (high), the safety index of path ADB is 0.6 (average), and the safety index of path AEB is 0.9 (highest).

[0082] Weighting factors: Assume that the weighting factor of distance is 0.7 and the weighting factor of safety index is 0.3.

[0083] Balance factor: set to 0.5 to balance the impact of distance and safety indicators.

[0084] The comprehensive score of each path is calculated according to the above formula:

[0085] For path ACB: P C = arg min P (0.7×5000+0.5×0.3×0.8);

[0086] For path ADB:P D = arg min P (0.7×6000+0.5×0.3×0.6);

[0087] For Path AEB: P E = arg min P (0.7×4500+0.5×0.3×0.9);

[0088] By comparing the above calculation results, the optimal initial routing path is selected. In this example, path AEB is selected as the optimal path because of its shortest distance and highest safety.

[0089] 103. Optimizing the initial routing paths corresponding to the plurality of space network nodes to generate target routing paths for the plurality of space network nodes;

[0090] Optionally, in an embodiment of the present application, as a possible implementation scheme, step 103 may specifically include: calculating the transmission delay between the space network nodes according to the initial routing path corresponding to each of the space network nodes; taking the initial routing paths corresponding to multiple space network nodes, the transmission delays between multiple space network nodes, and the acquired location information of multiple space network nodes as input information, and inputting them into a pre-trained routing optimization model to obtain the target routing paths of the multiple space network nodes output by the routing optimization model.

[0091] As another possible implementation scheme, step 103 may specifically include: obtaining the bandwidth occupancy rate corresponding to the initial routing path of each of the space network nodes, and filtering out the routing paths with bandwidth occupancy rates higher than a preset occupancy rate to generate a target routing path.

[0092] As another possible implementation scheme, step 103 may specifically include: calculating the number of nodes involved in the initial routing path of each of the space network nodes, and filtering out routing paths with the number of nodes exceeding a preset number to generate a target routing path.

[0093] In this step, the initial routing paths corresponding to the plurality of space network nodes are optimized to generate the target routing paths of the plurality of space network nodes: this step aims to further optimize the initial routing paths to obtain the final target routing paths. The optimization process will take into account factors such as transmission delay, bandwidth occupancy, and the number of nodes involved.

[0094] Transmission delay: The time it takes for a data packet to travel from one node to another.

[0095] Location information: The geographical or spatial location of the space network node, including but not limited to longitude, latitude, and altitude.

[0096] Route optimization model: A pre-trained model used to optimize the initial routing path based on transmission delay and location information.

[0097] Bandwidth utilization: The usage of bandwidth resources on a specific path, usually expressed as a percentage.

[0098] Default utilization: The bandwidth utilization threshold set by the system. Paths exceeding this threshold will be considered unfeasible.

[0099] Preset number: The node number threshold set by the system. If the number of nodes involved in a path exceeds this threshold, it is considered a suboptimal path.

[0100] In the embodiment of the present application, the first possible implementation scheme corresponds to the embodiment: Assume that we have three space network nodes C, D and E, each of which has an initial routing path. We need to determine the target routing path through optimization. The system first calculates the transmission delay between each node, and inputs the initial routing path, transmission delay and location information into the pre-trained routing optimization model.

[0101] Transmission delay: Assume that the transmission delay of path CD is 100 ms, path CE is 80 ms, and path DE is 120 ms.

[0102] Location information: Assume that node C is located at 30°N, 120°E, and 300km above sea level; node D is located at 35°N, 115°E, and 400km above sea level; and node E is located at 32°N, 125°E, and 350km above sea level.

[0103] Initial routing path: The initial routing path from node C to destination node B is CEB, the initial routing path from node D to destination node B is DEB, and the initial routing path from node E to destination node B is EB.

[0104] Route optimization model: The system uses a pre-trained route optimization model to optimize the initial route path based on the transmission delay and location information. After optimization, we get the target route path: the target route path of node C is CEB, the target route path of node D is DEB, and the target route path of node E is EB.

[0105] The second possible implementation scheme corresponds to the following embodiment: Assume that we have three space network nodes C, D, and E, each of which has an initial routing path. We need to determine the target routing path through optimization. The system first obtains the bandwidth occupancy rate corresponding to the initial routing path of each node, and filters out the paths whose bandwidth occupancy rate is higher than the preset occupancy rate.

[0106] Bandwidth occupancy: Assume that the bandwidth occupancy of path CEB is 70%, the bandwidth occupancy of path DEB is 80%, and the bandwidth occupancy of path EB is 60%.

[0107] Default occupancy: Assume the default occupancy of the system is 75%.

[0108] Target routing path: According to the bandwidth utilization, the bandwidth utilization of path DEB exceeds the preset utilization of 75%, so it is filtered out. The remaining paths CEB and EB become the target routing paths.

[0109] The third possible implementation scheme corresponds to the following example: Assume that we have three space network nodes C, D, and E, each of which has an initial routing path. We need to determine the target routing path through optimization. The system first calculates the number of nodes involved in the initial routing path of each node, and filters out the paths with more than a preset number of nodes.

[0110] Number of nodes: Assume that path CEB involves 3 nodes, path DEB also involves 3 nodes, and path EB involves only 2 nodes.

[0111] Preset quantity: Assume the preset quantity of the system is 3.

[0112] Target routing path: According to the number of nodes, the number of nodes involved in paths CEB and DEB is exactly equal to the preset number 3, so they are retained. Path EB only involves 2 nodes and is also retained. Therefore, all initial routing paths are retained as target routing paths.

[0113] The above is a detailed introduction to different implementation schemes and embodiments of step 103.

[0114] 104. Use a pre-created security policy to perform an encryption operation on the target routing path of the selected space network node, and apply the encryption operation in batches to the target routing paths of the remaining multiple space network nodes.

[0115] Optionally, in an embodiment of the present application, before step 104, it also includes: inputting the location information of the multiple space network nodes into a pre-trained location prediction model to obtain the predicted locations of the multiple space network nodes output by the location prediction model, and continuing to execute step 104.

[0116] In this step, the pre-created security policy refers to a set of pre-defined rules or algorithms used to guide the security protection measures for communications between space network nodes, such as encryption methods, key management, etc.

[0117] Encryption operation: The process of encrypting data on the target routing path of the space network node to protect the security of the data during transmission.

[0118] Location information: refers to the geographical location information of the space network node, including but not limited to latitude, longitude, altitude, etc.

[0119] Location prediction model: A machine learning model that predicts the location of a node at a certain point in the future based on historical location information.

[0120] Predicted location: The expected location of a space network node at a certain moment in the future output by the location prediction model.

[0121] In the embodiment of the present application, it is assumed that we have three space network nodes A, B and C, each of which has a target routing path. We need to protect the data security on these paths through encryption operations and apply the encryption operations to all nodes in batches. In addition, before performing encryption operations, we also need to predict the future movement locations of these nodes.

[0122] Location information: Node A is currently located at 30°N, 120°E, and 300km above sea level; Node B is located at 35°N, 115°E, and 400km above sea level; Node C is located at 32°N, 125°E, and 350km above sea level.

[0123] Location prediction model: The system uses a pre-trained location prediction model to predict the future movement location of a node based on historical location information.

[0124] Predicted position: Node A is predicted to be at 30.5°N, 120.5°E, and 310km above sea level in 1 hour; Node B is predicted to be at 35.5°N, 115.5°E, and 410km above sea level in 1 hour; Node C is predicted to be at 32.5°N, 125.5°E, and 360km above sea level in 1 hour.

[0125] Encryption operation: Based on the predicted location, the target routing path of nodes A, B, and C is encrypted using the pre-created security policy. It is assumed here that the security policy includes the use of the AES-256 encryption algorithm and the key is changed every 24 hours.

[0126] Batch Apply: Batch apply encryption operations to all nodes on the target routing path. This means that once the encryption operation is completed on node A, the same encryption policy and settings will be automatically applied to nodes B and C.

[0127] Here is a specific example:

[0128] Step 1: Collect location information. The system records the current location information of nodes A, B, and C.

[0129] Step 2: Predict location. Use the location prediction model to predict the location of the node in 1 hour.

[0130] Step 3: Develop a security strategy. Determine the encryption strategy based on the predicted location, such as selecting the encryption algorithm, key length, key update cycle, etc.

[0131] Step 4: Encryption operation. Encrypt the target routing path of node A. Here, it is assumed that the AES-256 encryption algorithm is used and the key is changed every 24 hours.

[0132] Step 5: Batch Apply. Extend the encryption operation to nodes B and C, ensuring that all destination routing paths are protected to the same level.

[0133] Through the above embodiments, we can see how to combine location prediction and encryption operations to improve the security of space network communications. This not only ensures the security of data transmission, but also takes into account the mobility characteristics of space network nodes, thereby improving the overall security and reliability of the system.

[0134] Furthermore, the pre-created security policy includes at least: a data encryption algorithm, a key distribution mechanism, an identity authentication protocol, and an access control policy.

[0135] Wherein, the data encryption algorithm, the key distribution mechanism, the identity authentication protocol and the access control policy include an encryption mode and an authentication mode, wherein the encryption mode is used to encrypt data in the target routing path according to the corresponding encryption strength, and the authentication mode is used to perform identity authentication in the target routing path;

[0136] The encryption strength of the encryption mode is based on:

[0137] S enc =f(k,l,t,βlog(λ+1))

[0138] Among them, S enc represents encryption strength; k represents key length; l represents data packet length; t represents transmission time; β is a constant factor; λ represents the integrity measure of the data packet.

[0139] In this step, the pre-created security policy refers to a set of pre-defined rules or algorithms used to guide the security protection measures for communications between space network nodes, such as data encryption algorithms, key distribution mechanisms, authentication protocols, and access control policies.

[0140] Data encryption algorithm: used to encrypt data to protect its security during transmission.

[0141] Key distribution mechanism: ensures that the keys used in the encryption and decryption process can be securely transmitted between space network nodes.

[0142] Authentication protocol: used to verify the identities of both communicating parties to ensure that only legitimate users can access the network.

[0143] Access control policy: Specifies which users can access specific data or services.

[0144] Encryption mode: The working mode of the encryption algorithm determines how the key is used to encrypt data.

[0145] Authentication mode: used to verify the authenticity and integrity of data and ensure that the data has not been tampered with during transmission.

[0146] Cryptographic strength: A measure of the security of an encryption algorithm, usually related to factors such as key length, packet length, transmission time, and packet integrity measures.

[0147] Key length: The number of bits of the key used in the encryption algorithm. The longer the key length, the more difficult it is to crack.

[0148] Packet length: The size of the transmitted packet.

[0149] Transmission time: The time required for data to travel from the sender to the receiver.

[0150] Constant factor: used to adjust the relative importance of each term in the encryption strength calculation formula.

[0151] Data packet integrity measurement: an indicator that measures whether the data packet remains intact and has not been tampered with during transmission.

[0152] In this embodiment of the application, assume that we have a space network node A, which needs to communicate securely with another space network node B. We need to use a pre-created security policy to protect the communication between the two nodes. The specific steps are as follows:

[0153] Data encryption algorithm: Select AES-256 encryption algorithm as the data encryption algorithm.

[0154] Key distribution mechanism: Use the Diffie-Hellman key exchange protocol to securely distribute keys.

[0155] Authentication protocol: Digital certificates and public key infrastructure (PKI) are used for authentication.

[0156] Access control policy: Set an access control list (ACL) to allow only nodes with specific IP addresses to access the network.

[0157] Encryption strength calculation: Determine the encryption strength according to the encryption strength calculation formula.

[0158] Key length: 256 bits.

[0159] Packet length: Assume the average packet length is 1024 bytes.

[0160] Transfer time: Assume an average transfer time of 200 milliseconds.

[0161] Constant factor: set to 2.

[0162] Integrity metric of the data packet: Assume that the integrity metric is 0.95 (indicating that the integrity of the data packet is high).

[0163] Encryption strength calculation:

[0164] Encryption mode and authentication mode: According to the calculated encryption strength, select the appropriate encryption mode and authentication mode to protect data.

[0165] Encryption mode: Use CBC (Cipher Block Chaining) mode for encryption.

[0166] Authentication mode: Use HMAC (Hash Message Authentication Code) for data integrity check.

[0167] Here is a specific example:

[0168] Step 1: Determine the encryption algorithm. Select AES-256 as the encryption algorithm.

[0169] Step 2: Key distribution: Use the Diffie-Hellman key exchange protocol to distribute keys.

[0170] Step 3: Authentication. Authentication is performed through digital certificates and PKI.

[0171] Step 4: Access control. Set up ACL to restrict access to nodes with specific IP addresses.

[0172] Step 5: Encryption strength calculation: Calculate the encryption strength according to the formula.

[0173] Step 6: Encryption mode and authentication mode. Select the encryption mode (CBC) and authentication mode (HMAC) according to the encryption strength.

[0174] Step 7: Data encryption and authentication: Use the selected encryption mode and authentication mode to encrypt and authenticate the data.

[0175] Step 8: Data transmission: The encrypted data is sent to the destination node through the target routing path.

[0176] Through the above embodiments, we can see how to combine encryption algorithms, key distribution, identity authentication and access control to protect the communication security in the space network, and dynamically adjust the encryption strategy through the encryption strength calculation formula to ensure the security and integrity of data during transmission.

[0177] Figure 2 A structural diagram of an information security interconnection device for a hybrid space network is provided for an embodiment of the present application, such as Figure 2 As shown, the device comprises:

[0178] An acquisition module 21 is used to acquire a communication connection requirement requested by a user;

[0179] A generating module 22 is used to query a plurality of space network nodes matching the communication connection requirement in a pre-established space network node set based on the communication connection requirement, and generate initial routing paths corresponding to the plurality of space network nodes; optimize the initial routing paths corresponding to the plurality of space network nodes to generate target routing paths for the plurality of space network nodes;

[0180] The encryption module 23 is used to perform encryption operation on the target routing path of the selected space network node using a pre-created security policy, and apply the encryption operation in batches to the target routing paths of the remaining multiple space network nodes.

[0181] Optionally, in an embodiment of the present application, the generation module 22 is specifically used to calculate the transmission delay between the space network nodes according to the initial routing path corresponding to each of the space network nodes; the initial routing paths corresponding to the multiple space network nodes, the transmission delay between the multiple space network nodes, and the acquired location information of the multiple space network nodes are used as input information, and input into a pre-trained routing optimization model to obtain the target routing paths of the multiple space network nodes output by the routing optimization model.

[0182] Optionally, in the embodiment of the present application, the generating module 22 is specifically used to obtain the bandwidth occupancy rate corresponding to the initial routing path of each of the space network nodes, and filter out the routing paths with bandwidth occupancy rates higher than the preset occupancy rate, so as to generate the target routing path;

[0183] And / or, calculating the number of nodes involved in the initial routing path of each of the space network nodes, and filtering out routing paths with the number of nodes exceeding a preset number, so as to generate a target routing path.

[0184] Optionally, in an embodiment of the present application, the acquisition module 21 is also used to input the location information of the multiple space network nodes into a pre-trained location prediction model to obtain the predicted locations of the multiple space network nodes output by the location prediction model. The acquisition module 21 continues to execute the initial routing paths corresponding to the multiple space network nodes, the transmission delays between the multiple space network nodes, and the acquired location information of the multiple space network nodes as input information, and inputs them into the pre-trained routing optimization model to obtain the target routing paths of the multiple space network nodes output by the routing optimization model.

[0185] Optionally, in the embodiment of the present application, the generation module 22 is specifically used to input the communication connection requirement and the pre-established space network node set into a pre-trained matching retrieval model, so as to query the space network node matching the communication connection requirement through the matching retrieval model, and generate a plurality of initial routing paths corresponding to the space network nodes;

[0186] The initial routing path is generated based on:

[0187]

[0188] Among them, P i represents the initial routing path of the i-th space network node; w j represents the jth weight factor; d j (P) represents the distance of path P calculated according to the jth weight factor; α is the balance factor; s k(P) represents the impact of the kth safety index on path P; n and m represent the distance and the number of safety indicators, respectively.

[0189] Optionally, in an embodiment of the present application, the pre-created security policy includes at least: a data encryption algorithm, a key distribution mechanism, an identity authentication protocol, and an access control policy.

[0190] Optionally, in an embodiment of the present application, the data encryption algorithm, the key distribution mechanism, the identity authentication protocol, and the access control policy include an encryption mode and an authentication mode, wherein the encryption mode is used to encrypt data in the target routing path according to the corresponding encryption strength, and the authentication mode is used to perform identity authentication in the target routing path;

[0191] The encryption strength of the encryption mode is based on:

[0192] S enc =f(k,l,t,βlog(λ+1))

[0193] Among them, S enc represents encryption strength; k represents key length; l represents data packet length; t represents transmission time; β is a constant factor; λ represents the integrity measure of the data packet.

[0194] Figure 2 The information security interconnection device of the hybrid space network can perform Figure 1 The implementation principle and technical effect of the information security interconnection method of the hybrid space network described in the illustrated embodiment will not be described in detail. The specific manner in which each module and unit performs operations in the information security interconnection device of the hybrid space network in the above embodiment has been described in detail in the embodiment of the method, and will not be described in detail here.

[0195] In one possible design, Figure 2 The information security interconnection device of the hybrid space network of the embodiment shown can be implemented as a computing device, such as Figure 3 As shown, the computing device may include a storage component 31 and a processing component 32;

[0196] The storage component 31 stores one or more computer instructions, wherein the one or more computer instructions are called and executed by the processing component 32 .

[0197] The processing component 32 is used to: obtain the communication connection requirements requested by the user; based on the communication connection requirements, query multiple space network nodes that match the communication connection requirements in a pre-established space network node set, and generate initial routing paths corresponding to multiple space network nodes; optimize the initial routing paths corresponding to multiple space network nodes to generate target routing paths of multiple space network nodes; use a pre-created security policy to encrypt the target routing path of the selected space network node, and apply the encryption operation in batches to the target routing paths of the remaining multiple space network nodes.

[0198] The processing component 32 may include one or more processors to execute computer instructions to complete all or part of the steps in the above method. Of course, the processing component may also be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors or other electronic components to perform the above method.

[0199] The storage component 31 is configured to store various types of data to support operations at the terminal. The storage component can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0200] Of course, the computing device may also include other components, such as input / output interfaces, display components, communication components, etc.

[0201] The input / output interface provides an interface between the processing component and the peripheral interface module, which may be an output device, an input device, etc.

[0202] The communication component is configured to facilitate, among other things, wired or wireless communications between the computing device and other devices.

[0203] Among them, the computing device can be a physical device or an elastic computing host provided by a cloud computing platform, etc. At this time, the computing device can refer to a cloud server, the above-mentioned processing components, storage components, etc., or it can be a basic server resource rented or purchased from a cloud computing platform.

[0204] The present application also provides a computer storage medium storing a computer program, wherein the computer program can achieve the above-mentioned Figure 1The information security interconnection method of the hybrid space network of the illustrated embodiment.

[0205] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0206] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0207] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0208] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for information security interconnection of a hybrid space network, characterized in that: include: Obtain the communication connection requirements requested by the user; Based on the communication connection requirement, multiple space network nodes matching the communication connection requirement are searched in a pre-established space network node set, and initial routing paths corresponding to the multiple space network nodes are generated; Optimizing the initial routing paths corresponding to the plurality of space network nodes to generate target routing paths for the plurality of space network nodes; The target routing path of the selected space network node is encrypted using a pre-created security policy, and the encryption operation is applied in batches to the target routing paths of the remaining plurality of space network nodes.

2. The method according to claim 1, characterized in that The optimizing the initial routing paths corresponding to the plurality of space network nodes to generate the target routing paths of the plurality of space network nodes includes: Calculating the transmission delay between the space network nodes according to the initial routing path corresponding to each of the space network nodes; The initial routing paths corresponding to the multiple space network nodes, the transmission delays between the multiple space network nodes, and the acquired location information of the multiple space network nodes are input as input information into a pre-trained routing optimization model to obtain the target routing paths of the multiple space network nodes output by the routing optimization model.

3. The method according to claim 1, characterized in that The optimizing the initial routing paths corresponding to the plurality of space network nodes to generate the target routing paths of the plurality of space network nodes includes: Obtaining the bandwidth occupancy rate corresponding to the initial routing path of each of the space network nodes, and filtering out routing paths with bandwidth occupancy rates higher than a preset occupancy rate, so as to generate a target routing path; And / or, calculating the number of nodes involved in the initial routing path of each of the space network nodes, and filtering out routing paths with the number of nodes exceeding a preset number, so as to generate a target routing path.

4. The method according to claim 2, characterized in that: Before inputting the initial routing paths corresponding to the plurality of space network nodes, the transmission delays between the plurality of space network nodes, and the acquired location information of the plurality of space network nodes as input information into a pre-trained routing optimization model to obtain the target routing paths of the plurality of space network nodes output by the routing optimization model, the method further includes: The location information of the multiple space network nodes is input into a pre-trained location prediction model to obtain the predicted locations of the multiple space network nodes output by the location prediction model, and the step of inputting the initial routing paths corresponding to the multiple space network nodes, the transmission delays between the multiple space network nodes and the obtained location information of the multiple space network nodes as input information into the pre-trained routing optimization model to obtain the target routing paths of the multiple space network nodes output by the routing optimization model is continued.

5. The method according to claim 1, characterized in that Based on the communication connection requirement, searching for multiple space network nodes matching the communication connection requirement in a pre-established space network node set, and generating initial routing paths corresponding to the multiple space network nodes, includes: Inputting the communication connection requirement and the pre-established space network node set into a pre-trained matching retrieval model, so as to query the space network nodes matching the communication connection requirement through the matching retrieval model, and generate initial routing paths corresponding to a plurality of the space network nodes; The initial routing path is generated based on: Among them, P i represents the initial routing path of the i-th space network node; w j represents the jth weight factor; d j (P) represents the distance of path P calculated according to the jth weight factor; α is the balance factor; s k (P) represents the impact of the kth safety index on path P; n and m represent the distance and the number of safety indicators, respectively.

6. The method according to any one of claims 1 to 4, characterized in that: The pre-created security policy includes at least: a data encryption algorithm, a key distribution mechanism, an identity authentication protocol, and an access control policy.

7. The method according to claim 6, characterized in that The data encryption algorithm, the key distribution mechanism, the identity authentication protocol and the access control policy include an encryption mode and an authentication mode, wherein the encryption mode is used to encrypt data in the target routing path according to the corresponding encryption strength, and the authentication mode is used to perform identity authentication in the target routing path; The encryption strength of the encryption mode is based on: S enc =f(k,l,t,βlog(λ+1)) Among them, S enc represents encryption strength; k represents key length; l represents data packet length; t represents transmission time; β is a constant factor; λ represents the integrity measure of the data packet.

8. The method according to claim 7, characterized in that The location information of the space network node is the spatial location of the space network node.

Images