Satellite-borne router software security reconstruction method

Abstract

The invention relates to a satellite-borne router software security reconstruction method, aims to solve the problems of transmission monitoring lag, high-delay verification and insufficient isolation, provides an integrity chain verification and firewall double-layer verification cooperation scheme, and is combined with a modular physical isolation design. When the routing module receives the data packet, a hardware write protection lock is activated, unauthorized modification is forbidden, and strategy lock-free update is supported; the platform management module downloads an accumulated verification value in real time, and pays attention to a reconstruction instruction after ground verification; and the program programming module adopts double Bank storage, supports atomization programming and credible verification, and automatically returns a safe version when an exception occurs. Attacks are defended through satellite-ground cooperative double-closed-loop verification (firewall filtering, token bucket current limiting and ground CRC verification), hardware isolation guarantees updating without interrupting routing operation, and intelligent backspacing improves the fault-tolerant capability. The method is suitable for a high-delay and strong-interference satellite-borne routing scene, ensures zero interruption of a reconstruction service during in-orbit maintenance of a transit / overseas satellite, and meets the security requirement of a modern satellite network.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of digital data processing, and particularly relates to a software security reconstruction method of a satellite-borne router. BACKGROUND

[0002] The current on-orbit software reconstruction technology of a spaceborne router faces multiple security challenges, which seriously restricts the reliable operation of space network equipment.

[0003] The traditional router software update method lacks a real-time monitoring mechanism in the transmission process, and an attacker can use protocol vulnerabilities to implement intermediate tampering in the data packet transmission stage, resulting in malicious control code being implanted in the reconstructed system.

[0004] The existing verification mechanism generally adopts a terminal verification mode, and only performs batch verification after the complete reception of data packets. This lagging verification method cannot effectively detect real-time attack behaviors such as bit flipping and data packet injection occurring in the transmission process, especially in scenarios where the space-ground communication link has inherent high delay. The ground control station has difficulty in timely blocking ongoing attack behaviors, and security risks are often exposed after the reconstruction is completed.

[0005] The existing architecture has significant defects at the hardware level, that is, the software reconstruction module and the routing business module share storage and computing resources. Attackers can use vulnerabilities such as memory overflow to penetrate malicious code into the running routing forwarding system, causing critical business data to be hijacked. In terms of storage design, most satellite-borne systems use single-Bank storage systems for software updates. Once the reconstruction image is implanted with hidden backdoors, the system lacks the ability to quickly roll back to a trusted version, and is extremely prone to irreversible out-of-control states. The existing technical improvement scheme is limited to single-point verification at the receiving end, and cannot build a continuous verification mechanism for the transmission link, nor can it realize joint decision-making of space-ground cooperation.

[0006] Therefore, it is urgent to establish a new security reconstruction system that includes real-time rolling verification during transmission, space-ground cooperative decision-making, hardware-level resource isolation, and abnormal rollback mechanisms to cope with increasingly complex network attack threats. SUMMARY

[0007] The present application is to solve the problems of real-time security monitoring absence, multi-level verification system imperfection and system isolation deficiency in the existing on-board router software updating process, and provides an on-board router software security reconstruction method, which realizes end-to-end integrity protection of encrypted firmware / software block transmission between the satellite and the ground through a firewall double-layer verification system and a memory isolation architecture; adopts Content Addressable Memory (CAM) table item fast matching and token bucket flow limiting algorithm to resist flow attacks; realizes atomic switching of storage Bank through a fuse circuit; synchronously calculates a check value when receiving a data packet and transmits it to the ground for verification in real time, so as to ensure that malicious attack codes cannot penetrate into the running system. The whole-chain protection covering real-time rolling verification, hardware policy isolation and abnormal fuse rollback is formed, effectively solving the problem of malicious code penetration and significantly improving the anti-attack ability and task reliability of the spacecraft in orbit reconstruction.

[0008] The present application provides an on-board router software security reconstruction method, comprising the following steps:

[0009] S1, the ground station generates a firewall policy configuration instruction package, the firewall policy configuration instruction package includes an IP address whitelist, a flow threshold and an encryption key, and after being digitally signed using an asymmetric encryption algorithm, the firewall policy configuration instruction package is sent to all nodes in the satellite network; the IP address whitelist includes a ground station IP;

[0010] S2, the platform management module of the on-board router receives the firewall policy configuration instruction package, verifies the validity of the digital signature, and then writes the firewall policy into a protected memory area; a timer is used to complete the firewall policy effectiveness countdown within a first specified time;

[0011] S3, the platform management module configures the firewall policy, the firewall logic unit dynamically updates the stored IP address whitelist and token bucket flow shaping parameters according to the firewall policy, establishes a fast query channel based on CAM table items, and completes the firewall policy matching, and notifies the ground station through telemetry;

[0012] S4, after the telemetry displays that the firewall policy configuration is successful, the ground station divides the to-be-updated firmware / software into blocks, adds a target satellite IP address, and adds a CRC check code in each data block, and then uploads them to the target satellite; for a transit satellite, the data packets are directly sent to the target satellite through a measurement and control link; for an out-of-bound satellite, the data packets are sent to a transit satellite and then relayed to the target satellite;

[0013] S5, when the target satellite receives the data packet, the verification and filtering of the data packet are carried out through the firewall strategy, when it is judged that the data is illegal, the firewall filters and discards; when it is judged that the data is legal, the routing module of the target satellite receives the data packet, the data packet is stored in the annular buffer area according to the serial number, the platform management module carries out the CRC check rolling calculation on the effective load every time a data packet is received, the chain CRC calculation is carried out on the data packet passing the check to obtain the final CRC check value, and the final CRC check value is returned to the ground station in real time through the telemetry channel along with the data packet serial number, and step S6 is entered;

[0014] The data packet passing the check is transferred to the MRAM safe cache area, and step S7 is entered.

[0015] S6, the ground station receives telemetry and compares the consistency of the data packet number with the preset value, and compares the final CRC check value fed back on the satellite with the local pre-calculated reference value.

[0016] When and only when the data packet number error is zero and the final CRC check value is consistent with the reference value, the on-orbit firmware / software reconstruction instruction including the time stamp, the Bank identifier and the signature is generated and uploaded to the target satellite through the measurement and control channel, and step S7 is entered.

[0017] S7, the program burning module of the on-board router verifies the validity of the signature of the on-orbit firmware / software reconstruction instruction, triggers the routing module to enter the maintenance mode and freezes the business forwarding table, and synchronously checks the firewall event log; the program burning module reads data from the MRAM according to byte blocks, writes the data into the Flash Bank1 through DMA, the fuse circuit completes the Bank0 to Bank1 switching within the second specified time, loads the new firmware / software, completes the safety reconstruction of the router, sends the reconstruction success telemetry, and the on-board router software safety reconstruction method is completed.

[0018] As a preferred mode, in step S1, the firewall strategy configuration instruction packet further includes an IP address blacklist, and in step S3, the firewall logic unit dynamically updates the stored IP address blacklist according to the firewall strategy.

[0019] The traffic threshold is a single IP traffic threshold, and the asymmetric encryption algorithm is an SM2 elliptic curve public key cryptography algorithm.

[0020] As a preferred mode, in step S2, after the platform management module receives the firewall strategy configuration instruction packet and verifies the validity of the digital signature, the firewall function enabling state is judged, and when the firewall function is enabled, the firewall strategy is written into the protected memory area.

[0021] The star-borne router software security reconstruction method, as a preferred mode, in step S3, the IP address white list / IP address black list in the firewall logic unit is stored in the CAM table.

[0022] The star-borne router software security reconstruction method, as a preferred mode, in step S4, the ground station divides the to-be-updated firmware / software into blocks, and appends a header check code and a trailer CRC check code in each block.

[0023] The star-borne router software security reconstruction method, as a preferred mode, in step S4, the platform management module of the transit satellite performs double-layer verification: both the consistency of the source IP and the destination IP with the CAM table item is compared, and the inter-satellite link digital certificate is verified, and the legality of the target satellite IP address is checked.

[0024] When the source IP and the destination IP are consistent with the CAM table item, the digital certificate is legal, and the target satellite IP address is legal, the data packet is forwarded to the foreign satellite through the laser communication link.

[0025] The star-borne router software security reconstruction method, as a preferred mode, in step S4, the satellite checks the consistency of the target IP address in the packet header with the local IP address after receiving the data packet, and when the consistency is consistent, step S5 is entered.

[0026] When the consistency is inconsistent, whether the forwarding path exceeds a threshold value is verified, and if the threshold value is not exceeded, relay forwarding is performed, and if the threshold value is exceeded, the data packet is discarded.

[0027] The method for verifying whether the forwarding path exceeds the threshold value is that whether the hop count of the forwarding path is less than the threshold value is verified.

[0028] The star-borne router software security reconstruction method, as a preferred mode, in step S5, when the target satellite receives the data packet, the data packet from the unauthorized ground station or relay satellite is filtered through the IP white list, the firewall automatically activates the traffic monitoring state machine, and when it is detected that the data rate of a single IP address exceeds a set threshold value, the token bucket flow limiting algorithm is started immediately.

[0029] When the data packet is stored in the ring buffer and overflows, the NACK retransmission request is triggered.

[0030] The CRC check rolling calculation is compared with the trailer check code, and the failed packet is marked with an error code; and the final CRC check value is an accumulated check value.

[0031] As a preferred mode, in step S5, the MRAM safe cache area is isolated by the memory protection unit MPU authority, and the access of the routing module is prohibited; when the target satellite is an overseas satellite, the final CRC check value is sent to the transit satellite with the data packet serial number, and the transit satellite is forwarded to the target satellite through the laser link;

[0032] In step S7, when a policy conflict or illegal access record is found, the burning process is terminated, a safety alarm is activated, the system is reset, and the malicious forwarding table items remaining in the cache are cleared.

[0033] After each data block is written into the Flash Bank1, a CRC secondary check is performed, and if the check fails, the process is retried; after all checks are passed, the fuse circuit completes the Bank0 to Bank1 switching within a second specified time.

[0034] As a preferred mode, the on-board router is physically isolated, and the function is decoupled through the hardware bus isolation and independent memory partitioning.

[0035] The platform management module integrates a special monitoring unit, the special monitoring unit allocates a safe cache area, the access of other modules is limited through the memory protection unit, the cumulative check value of the reconstruction data packet is calculated in real time and is downloaded to the ground;

[0036] The routing module runs in an independent kernel, separates the service data stream and the maintenance instruction through a double bus architecture, is responsible for receiving the reconstruction data packet, activates the hardware write protection lock to prohibit unauthorized memory modification during the reconstruction, and performs the non-lock updating of the policy table item.

[0037] The program burning module is built-in with a double Bank Flash controller, the Bank0 solidifies the trusted starting program and the original firmware / software image, the Bank1 is used as an update writing area, and the Bank0 and the Bank1 are switched through the fuse control circuit at the hardware level.

[0038] The application is especially suitable for the on-orbit maintenance scene of the spacecraft on-board routing equipment when the on-board routing equipment is attacked by malicious data packets.

[0039] The application realizes the attack security reconstruction of the on-board router through the hardware architecture isolation and the safety process design, specifically a dynamic reconstruction method of the on-board routing software for the malicious data packet forwarding attack, based on the star-ground cooperative check mechanism and the layered defense architecture, combined with the firewall double-layer verification, the on-board routing software is safely updated when the network is attacked, and the task continuity is ensured.

[0040] The present application aims at the problems of lack of real-time monitoring in the transmission process, lag in high-delay environment verification and insufficient system isolation in the prior art, and proposes a technical solution combining integrity chain verification and firewall double-layer verification system, and physical isolation is realized by dividing platform management module, routing module and program burning module, etc.: the routing module is responsible for receiving the reconstructed data packet, and activates the hardware write protection lock during reconstruction to prohibit unauthorized memory modification, and realizes lock-free update of policy table items; the platform management module calculates the cumulative verification value of the data packet in real time and downloads it to the ground, and the ground station verifies the data integrity and uploads the reconstruction instruction; the program burning module adopts a double-Bank storage structure, performs atomic burning and trusted startup verification, and automatically reverts to the safe version when it fails. The present application realizes safe reconstruction of routing software through the firewall double-layer verification system and the chain verification mechanism, combines star-ground collaborative decision-making and hardware-level memory isolation control, significantly improves the safety of on-orbit maintenance of the spacecraft, ensures zero business interruption during the reconstruction process when subjected to malicious data packet attacks, can be used for transit satellites and overseas satellites, is suitable for high-delay and strong-interference on-board routing scenarios, and meets the safety management needs of modern satellite networks.

[0041] The technical solution of the present application is to provide a kind of on-board router software safe reconstruction method, which realizes the safe reconstruction of on-board router by hardware isolation architecture and safety process design, and supports the safe reconstruction of router software of transit star and overseas star, and the specific technical steps are as follows:

[0042] S1, the ground station generates a firewall policy configuration instruction packet, including IP address whitelist, traffic threshold and encryption key, adopts asymmetric encryption algorithm for digital signature, and sends it to all nodes in the satellite network;

[0043] S2, the platform management module of the on-board router receives the information packet, verifies the validity of the digital signature, analyzes the instruction to determine the firewall function enable state: if enabled, write the black and white list policy into the protected memory area, and complete the policy effective countdown through the timer within a certain time;

[0044] S3, the platform management module completes the firewall policy configuration, the firewall logic unit dynamically updates the stored IP address whitelist and token bucket traffic shaping parameters, establishes a fast query channel based on CAM table items, and realizes microsecond-level policy matching;

[0045] S4, after the telemetry displays the successful firewall policy configuration, the ground station divides the firmware / software to be updated into blocks according to a certain byte, and each block is attached with a header and a trailer CRC check code;

[0046] Packet upload transmission: ①Transit star direct transmission: directly sent to the target satellite through the TT&C link; ②Overseas star relay: send the data packet to the transit star, and the IP address of the target overseas star is contained in the packet header;

[0047] The transit satellite platform management module verifies the execution of double-layer verification: ① consistency of source IP and destination IP with CAM table items; ② verification of inter-satellite link digital certificate, and checking of legality of target satellite IP address, and forwarding of data packets to the foreign satellite through the laser communication link;

[0048] The foreign satellite checks consistency of the target IP address in the packet header with the local IP address, and verifies whether the forwarding path exceeds the threshold, and discards the data packet if the threshold is exceeded;

[0049] S5, the routing module of the target satellite receives the data packet, filters the data packet from the unauthorized ground station or relay satellite through the IP whitelist (when the target satellite enables the receiving port, the firewall automatically activates the traffic monitoring state machine, and when it is detected that the data rate of a single IP address exceeds the set threshold, the token bucket throttling algorithm is immediately started);

[0050] The data packet is stored in the ring buffer according to the sequence number, and the NACK retransmission request is triggered when it overflows;

[0051] CRC verification is performed on the payload rolling calculation for each received data packet, and the error code is marked for the failed packet compared with the tail verification code;

[0052] For the data packet that passes the verification, chain CRC calculation is performed, and the cumulative verification value is returned to the ground station in real time through the telemetry channel along with the data packet sequence number, and enters step S7;

[0053] The data packet that passes the verification is stored in the MRAM safe cache area (accessed by the routing module is prohibited through the memory protection unit MPU permission isolation);

[0054] S6, the ground station receives the telemetry and compares the number of data packets with the preset value, and compares the final CRC verification value fed back by the satellite with the locally pre-calculated reference value;

[0055] Only when the number of data packets is zero and the verification values are consistent, the on-orbit firmware / software reconfiguration instruction containing the timestamp, Bank identification and signature is generated;

[0056] The on-orbit firmware / software reconfiguration instruction is uploaded to the target satellite through the measurement and control channel;

[0057] S7, the program burning module verifies the validity of the instruction signature, triggers the routing module to enter the maintenance mode and freezes the business forwarding table, synchronously checks the firewall event log, and if a policy conflict or illegal access record is found, the burning process is terminated and the security alarm is activated;

[0058] Data is read from the MRAM in byte blocks, written into the Flash Bank1 through direct memory access (DMA), and CRC secondary verification is performed after each block is written (failed retry);

[0059] After all the checks are passed, the fuse circuit completes the Bank0 to Bank1 switching within a certain time;

[0060] If any link fails, immediately back to Bank0, watchdog timer resets the system within a certain time and clears the cache;

[0061] After the system loads new firmware / software, the router security reconstruction is completed, and the successful telemetry is sent.

[0062] The on-board router adopts physical isolation design, including platform management module, routing module and program burning module, etc. The function decoupling is realized through hardware bus isolation and independent memory partition. The platform management module integrates a special monitoring unit, is responsible for allocating a safe cache area (MRAM), limiting access of other modules through a memory protection unit (MPU), calculating a cumulative check value of a reconstruction data packet in real time and downloading to the ground; the routing module runs in an independent kernel, separates service data flow and maintenance instructions through a double bus architecture, and is responsible for receiving the reconstruction data packet, activating a hardware write protection lock to prohibit unauthorized memory modification during reconstruction, and realizing lock-free update of policy table items; the program burning module has a double Bank Flash controller, Bank0 solidifies a trusted startup program and an original firmware / software image, Bank1 is used as an update writing area, and the two Banks are switched through a fuse control circuit.

[0063] The present application has the following advantages:

[0064] (1) Star-ground cooperative attack immunity: the on-board router is configured with a firewall (IP white list filtering and token bucket limiting) and a ground station checks data packet integrity (chain CRC tolerance check) to form a double closed loop verification, further improving reliability, and being suitable for high delay, strong interference communication scenes under malicious data packet attack.

[0065] (2) Hardware level security isolation: the business function and the firmware / software update operation are isolated through independent hardware modules, so that even if an attack is encountered during the update process, the normal operation of the routing system will not be affected.

[0066] (3) Intelligent fault tolerance recovery: if the update fails or an abnormality is detected, the system will automatically back to the original stable version without human intervention, greatly shortening the fault recovery time and ensuring the continuous and reliable operation of the spacecraft.

[0067] (4) Strong adaptability to complex environment: in view of the characteristics of high delay and easy interference of star-ground communication, a star-ground cooperative verification mechanism is adopted, so that even in a long distance communication scene, the attack can still be accurately identified and the security reconstruction is completed. BRIEF DESCRIPTION OF DRAWINGS

[0068] Figure 1 It is a flow chart of a software security reconstruction method for an on-board router.

[0069] Figure 2 A satellite router architecture diagram for a satellite router software security reconstruction method. DETAILED DESCRIPTION

[0070] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments of the present application.

[0071] Embodiment 1

[0072] As shown in the drawings, Figure 1 A satellite router software security reconstruction method, the application environment is: a low-orbit satellite (target satellite IP: 192.168.10.*, * is the last address of the target satellite IP) needs to update the routing software on orbit, the satellite is an overseas satellite, including the following steps:

[0073] S1, the ground station generates a firewall policy configuration instruction package containing its own IP (192.168.1.**, ** is the last address of the ground station IP) white list, sets the single IP traffic threshold to 1000 pps, uses the SM2 elliptic curve public key cryptography algorithm for digital signature, and then sends it to all nodes in the satellite network;

[0074] S2, the platform management module verifies the validity of the signature, writes the policy into the protected memory area, and starts a 5-minute policy effective countdown timer;

[0075] S3, the platform management module completes the firewall policy configuration, updates the newly added IP (192.168.1.**) and QoS parameters in the CAM table, and realizes microsecond-level policy matching;

[0076] S4, the ground station divides the software to be updated (size 2.5M) into 5120 data packets according to 512 bytes, adds a header and a tail CRC32 check code to each block, adds the target IP address (192.168.10.*), and uploads the data packets to the transit satellite through the Ka TT&C link;

[0077] At the same time, the attacker sends a fake update packet to the target satellite, and uploads the data packet to the transit satellite through the Ka TT&C link;

[0078] The platform management module of the transit satellite performs double-layer verification: ①detects that the packet source IP (192.168.0.66) is not in the CAM table, and directly discards it ②the platform management module verifies that the legal data packet digital signature is valid, the target satellite IP is legal, and forwards the data packet to the target satellite through the laser communication link;

[0079] The target satellite checks the consistency of the target IP address (192.168.10.*) in the target satellite packet header with the local IP address, verifies that the forwarding path hop count is less than the 3-hop threshold, receives the data packet and stores it in the buffer area, and intercepts the 4-hop path data packet forged by the attacker;

[0080] When the routing module of the target satellite receives the data packet, the traffic monitoring state machine of the firewall detects that the burst traffic of the attack source IP (10.1.1.33) reaches 5000 pps, and immediately starts the token bucket traffic limiting (token generation speed = 1000 pps)

[0081] The legal data packet is stored in the 4MB ring buffer area according to the sequence number, and when the overflow is triggered after 500ms, the NACK retransmission request is triggered;

[0082] The CRC32 rolling calculation is performed on the valid load of each received data packet, and the error code is marked for the failed packet by comparing with the packet tail check code;

[0083] The global CRC64 check value is accumulated and transmitted to the ground station in real time through the inter-satellite laser link with the data packet sequence number, and the ground station compares and finds that it is consistent with the pre-computed value, confirming the data integrity;

[0084] The data packet that passes the check is transferred to the MRAM safe buffer area, and the MPU sets this area as "only writable module readable" to prevent the routing module from accessing;

[0085] S6, the ground station receives telemetry and verifies the consistency of the received data packet number 5120 with the preset value, confirms that all packets are completely received, and compares the global CRC64 fed back by the satellite with the local pre-computed reference value;

[0086] Generate an on-orbit software reconstruction instruction containing a timestamp (UTC 2025-04-2716:18:30.456), Bank identification (Bank1), and signature;

[0087] The instruction is sent to the transit satellite through the TT&C link, and the transit satellite forwards it to the target satellite through the laser link;

[0088] S7, the program burning module of the target satellite verifies the validity of the instruction signature, triggers the routing module to enter maintenance mode and freezes the forwarding table;

[0089] DMA reads a 512-byte block from MRAM and writes it to Flash Bank1, and all 5120 blocks pass the CRC check (retry count 0);

[0090] The fuse circuit completes the Bank0→Bank1 switching within 50ms, and the routing service interruption rate is 0.1%;

[0091] If any link fails, immediately back to Bank0, watchdog timer resets the system within 300ms and clears the remaining malicious forwarding table items in the cache;

[0092] After the system loads the new software in Bank1, the ground station receives the confirmation signal, completes the router security reconstruction, restores the business forwarding to normal, and successfully resists the coordinated attack.

[0093] As shown in Figure 2 The on-board router adopts physical isolation design and includes a platform management module, a routing module, and a program burning module. The function decoupling is realized by hardware bus isolation and independent memory partitioning. The platform management module integrates a special monitoring unit, is responsible for allocating a secure cache area (MRAM), restricts access of other modules through a memory protection unit (MPU), calculates a cumulative check value of the reconstruction data packet in real time and transmits it to the ground, and runs in an independent kernel. The routing module separates business data flow and maintenance instructions through a double-bus architecture, is responsible for receiving the reconstruction data packet, activates a hardware write protection lock to prohibit unauthorized memory modification during the reconstruction, and realizes lock-free update of the policy table item. The program burning module is built-in with a double-Bank flash controller. Bank0 is solidified with a trusted startup program and an original firmware / software image, Bank1 is used as an update writing area, and the two Banks are switched through a fuse control circuit at the hardware level.

[0094] The embodiment example shows in detail how the application is applied in on-orbit maintenance of the on-board routing equipment of the spacecraft, including specific design of the CPU module of the on-board router and a security reconstruction execution flow under malicious attack data.

[0095] The above describes only the preferred specific implementation of the application, but the protection scope of the application is not limited to this. Any person skilled in the art can make equivalent replacement or change according to the technical solution and the inventive concept of the application within the technical range disclosed by the application, which should be covered in the protection scope of the application.

Claims

1. A method for securely reconfiguring onboard router software, characterized by: The following steps are involved: S1. The ground station generates a firewall policy configuration instruction package, which includes an IP address whitelist, a traffic threshold, and an encryption key. The firewall policy configuration instruction package is digitally signed using an asymmetric encryption algorithm and then sent to all nodes in the satellite network. The IP address whitelist includes the ground station IP address. S2. The platform management module of the onboard router receives the firewall policy configuration instruction packet, verifies the validity of the digital signature, writes the firewall policy into the protected memory area, and completes the firewall policy entry into force countdown within the first specified time through a timer; S3, the platform management module configures the firewall policy, the firewall logic unit dynamically updates the stored IP address whitelist and token bucket traffic shaping parameters according to the firewall policy, establishes a fast query channel based on the CAM table entry, and notifies the ground station through telemetry when the firewall policy is matched; S4. After the telemetry shows that the firewall policy is successfully configured, the ground station divides the firmware / software to be updated into blocks, appends the target satellite's IP address, and appends a CRC checksum to each data block before sending it to the target satellite. For a transiting satellite, the data packet is sent directly to the target satellite via the tracking and control link; for an outbound satellite, the data packet is sent to the transiting satellite and then relayed to the target satellite. S5. When the target satellite receives a data packet, it verifies and filters the data packet through the firewall policy. If the data packet is determined to be illegal, the firewall filters and discards it. If the data packet is determined to be legal, the routing module of the target satellite receives the data packet, and the data packet is stored in a ring buffer according to the sequence number. The platform management module performs a rolling CRC check on the payload for each data packet received. For the data packet that passes the check, a chain CRC calculation is performed to obtain a final CRC check value. The final CRC check value is transmitted back to the ground station in real time through the telemetry channel along with the data packet sequence number, and then the process proceeds to step S6. The data packets that pass the verification are transferred to the MRAM security cache area, and the process goes to step S7; S6. The ground station receives the telemetry and compares the number of data packets with the preset value, and compares the final CRC checksum fed back from the satellite with the locally pre-calculated reference value; If and only if the error in the number of data packets is zero and the final CRC check value is consistent with the reference value, an on-orbit firmware / software reconstruction instruction including a timestamp, a bank identifier, and a signature is generated and injected to the target satellite through the measurement and control channel, and step S7 is entered; S7. The program burning module of the onboard router verifies the validity of the signature of the on-orbit firmware / software reconstruction instruction, triggers the routing module to enter maintenance mode and freeze the service forwarding table, and simultaneously checks the firewall event log; the program burning module reads data from the MRAM in byte blocks, writes it to Flash Bank 1 via DMA, and the fuse circuit completes the switching from Bank 0 to Bank 1 within the second specified time, loads the new firmware / software, completes the router security reconstruction, and sends the reconstruction success telemetry. A method for secure software reconstruction of an onboard router is completed.

2. A satellite router software security reconstruction method according to claim 1, characterized in that: In step S1, the firewall policy configuration instruction packet further includes an IP address blacklist. In step S3, the firewall logic unit dynamically updates the stored IP address blacklist according to the firewall policy. The traffic threshold is a single IP traffic threshold, and the asymmetric encryption algorithm is the SM2 elliptic curve public key cryptography algorithm.

3. The method for securely reconfiguring onboard router software according to claim 1, wherein: In step S2, the platform management module receives the firewall policy configuration instruction package, verifies the validity of the digital signature, and then determines the firewall function enable status. When the firewall function is enabled, the firewall policy is written into the protected memory area.

4. The method for securely reconfiguring onboard router software according to claim 1, wherein: In step S3, the IP address whitelist / IP address blacklist in the firewall logic unit is stored in the CAM table.

5. The method for securely reconfiguring onboard router software according to claim 1, wherein: In step S4, the ground station divides the firmware / software to be updated into blocks, and adds a header check code and a tail CRC check code to each block.

6. The method for securely reconfiguring onboard router software according to claim 1, wherein: In step S4, the platform management module of the transit satellite performs a double-layer verification: it compares the consistency of the source IP and destination IP with the CAM table entry, verifies the inter-satellite link digital certificate, and verifies the legitimacy of the target satellite IP address; When the source IP and destination IP are consistent with the CAM table entry, the digital certificate is valid, and the target satellite IP address is valid, the data packet is forwarded to the overseas satellite via the laser communication link.

7. A satellite-borne router software security reconstruction method according to claim 6, characterized in that: In step S4, after receiving the data packet, the satellite verifies the consistency between the target IP address in the packet header and the local IP address. If they are consistent, the process proceeds to step S5. If there is inconsistency, the forwarding path is verified to see if it exceeds the threshold. If it does not exceed the threshold, the packet is relayed; if it exceeds the threshold, the packet is discarded. A method for verifying whether the forwarding path exceeds the threshold is to verify whether the number of hops in the forwarding path is less than the threshold.

8. The method for securely reconfiguring onboard router software according to claim 1, wherein: In step S5, when the target satellite receives a data packet, it filters the data packets from unauthorized ground stations or relay satellites through the IP whitelist. The firewall automatically activates the traffic monitoring state machine. When it detects that the data rate of a single IP address exceeds the set threshold, it immediately starts the token bucket current limiting algorithm. When the ring buffer overflows, a NACK retransmission request is triggered; After rolling calculation, the CRC checksum is compared with the packet tail checksum, and the failed packet is marked with an error code; the final CRC checksum value is the cumulative checksum value.

9. The method for securely reconfiguring onboard router software according to claim 1, wherein: In step S5, the MRAM secure cache is isolated by the memory protection unit MPU authority, and the routing module is prohibited from accessing it. When the target satellite is an outbound satellite, the final CRC check value is sent to the transit satellite along with the data packet sequence number, and the transit satellite forwards it to the target satellite via the laser link. In step S7, if a policy conflict or illegal access record is found, the burning process is terminated and a security alarm is activated, the system is reset, and the malicious forwarding entries remaining in the cache are cleared; After each data block is written to Flash Bank 1, a CRC secondary check is performed. If it fails, a retry is performed. After all checks pass, the fuse circuit completes the switch from Bank 0 to Bank 1 within the second specified time.

10. The method for securely reconfiguring onboard router software according to claim 1, wherein: The onboard router is physically isolated and functionally decoupled through hardware bus isolation and independent memory partitions; The platform management module integrates a dedicated monitoring unit, which allocates a secure cache area, restricts access by other modules through a memory protection unit, calculates the cumulative checksum of the reconstructed data packet in real time and transmits it to the ground; The routing module runs on an independent kernel, separates service data flows from maintenance instructions through a dual-bus architecture, and is responsible for receiving reconstructed data packets. During the reconstruction period, the hardware write protection lock is activated to prohibit unauthorized memory modifications and perform lock-free updates of policy table entries. The program burning module has a built-in dual-Bank Flash controller, in which Bank0 is used to solidify the trusted boot program and the original firmware / software image, and Bank1 is used as the update writing area. Hardware-level switching is performed between Bank0 and Bank1 through a fuse control circuit.

Images