A satellite link layer security processing device based on software radio technology

Abstract

The present invention relates to the field of satellite communication, and discloses a satellite link layer security processing device based on software radio technology, comprising: a red edge data interface module extracts unencrypted data of a red edge bus and sends it to a link layer security algorithm deployment module; the link layer security algorithm deployment module receives red edge data and sends encrypted data to a black edge data interface module; the black edge data interface module encapsulates the encrypted data and sends it to a black edge bus; a software radio platform management module configures the fields of the black edge data interface module and the red edge data interface module, and runs the software in the software radio software storage module; the link layer security algorithm storage module stores the security algorithm; the DDR provides the running memory of the software radio platform management module; and the log storage module stores the log of the device operation. While meeting the requirement of flexible loading of security software, the present invention redesigns the device workflow, introduces a trusted boot component, and ensures the security of the software.

Description

Technical Field

[0001] The invention relates to the field of satellite communications, and in particular to a satellite link layer security processing device based on software radio technology. Background Art

[0002] With the continuous advancement of satellite communication technology, the available space satellite resources GEO, MEO, and LEO are also becoming more abundant. The expansion of application scenarios and the development of software radio technology are driving satellite communication terminals from the traditional single, tightly coupled hardware and software mode to a multi-mode, loosely coupled hardware and software mode. The hardware can load different satellite network system waveforms according to the requirements of different application scenarios, thereby improving the adaptability of satellite communication terminals in different scenarios.

[0003] In order to support the multi-mode application scenarios of satellite communication terminals, the design of satellite link layer security devices also needs to adapt to the development trend of software loadability and software and hardware decoupling, so that security software can be loaded on demand, supporting the satellite communication terminal to access different networks and reconstruct the security software requirements. In addition, the introduction of software radio technology has achieved software and hardware decoupling. This architectural change, while releasing flexibility, also takes into account the completeness and security of software and data, and prevents them from being reduced or tampered with. It is necessary to design the workflow of the link layer security device to further improve the completeness and security of software and data. Summary of the invention

[0004] Different from traditional satellite link layer security processing devices, the MHAL interface and software radio software introduced in the present invention can load different security software on demand with standard interfaces and processes to meet the needs of flexible encryption. While achieving flexibility, redesigning the device workflow can ensure the integrity and security of software and data.

[0005] The technical solution adopted by the present invention is:

[0006] A satellite link layer security processing device based on software radio technology, characterized in that it includes a red edge data interface module 211, a link layer security algorithm deployment module 212, a software radio platform management module 214, a black edge data interface module 213, a software radio software storage module 215, a link layer security algorithm storage module 216, a DDR 217 and a log storage module 218;

[0007] The red edge data interface module 211 is used to extract the unencrypted data of the red edge bus and send it to the link layer security algorithm deployment module 212;

[0008] The link layer security algorithm deployment module 212 is used to receive the red edge data, perform link layer data encryption, and send the encrypted data to the black edge data interface module 213;

[0009] The black-side data interface module 213 is used to encapsulate the data encrypted by the link layer security algorithm deployment module and send it to the black-side bus;

[0010] The software radio platform management module 214 is used to configure the fields of the black edge data interface module 213 and the red edge data interface module 211, and store the log of the device operation in the storage module 218, and is also used to call the software stored in the software radio software storage module 215, call the security algorithm of the link layer full algorithm storage module 216 after the software is run, and deploy the security algorithm to the link layer security algorithm deployment module 212;

[0011] The software radio software storage module 215 is used to store the software required for the software radio platform management module 214 to run;

[0012] Link layer security algorithm storage software 216, used to store security algorithms and called by the software radio platform management module 214;

[0013] DDR217, used to provide the operating memory of the software radio platform management module 214;

[0014] The log storage module 218 is used to store the log of the device operation, and is read and written by the software radio platform management module 214 .

[0015] Furthermore, the red edge data interface module 211 and the black edge data interface module 213 use the standard software radio modem hardware abstraction layer standard format MHAL for data encapsulation.

[0016] Furthermore, the software stored in the software radio software storage module 215 includes a storage core framework 224, a CORBA middleware 225, an embedded operating system 226 and a trusted boot component 227; after the device is powered on, the software radio platform management module 214 reads the software stored in the software radio software storage module 215, and after reading, runs the trusted boot component 227 to verify the embedded operating system 226. If the verification fails, the process ends; if the verification is correct, runs the CORBA middleware 225, and then the trusted boot component 227 verifies the core framework 224. If the verification fails, the process ends; if the verification is correct, the core framework 224 reads the security algorithm in the link layer security algorithm storage module 216, and deploys it to the link layer security algorithm deployment module 212.

[0017] Compared with the prior art, the present invention has the following advantages:

[0018] The MHAL data format standard and software radio software introduced in the present invention can realize the interaction of the device with external data and the loading of different security software on demand through a standard protocol interface. While meeting the flexible loading of security software, the device workflow is redesigned and a trusted boot component is introduced to ensure the security of the software. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 The present invention is a logic block diagram of a satellite link layer data security processing device based on software radio technology.

[0020] Figure 2 This is the MHAL data format standard of the present invention.

[0021] Figure 3 This is a basic software block diagram of the software wireless platform management module of the present invention.

[0022] Figure 4 This is the workflow of the software wireless platform management module of the present invention. DETAILED DESCRIPTION

[0023] Below, the present invention is further described in conjunction with the accompanying drawings.

[0024] Reference Figure 1 , a satellite link layer data security processing device 210 based on software radio technology, including a red edge data interface module 211, a link layer security algorithm deployment module 212, a black edge data interface module 213, a software radio platform management module 214, a software radio software storage module 215, a link layer security algorithm storage module 216, a DDR 217 and a log storage module 218;

[0025] The red-edge data interface module 211 receives the red-edge data and sends it to the link layer security software deployment module 212 to implement the encryption function of the link layer data. After the encryption is completed, the link layer data is sent to the black-edge data interface module 213 and sent to the black-edge bus; the basic software running in the software radio platform management module 214 is used to configure the fields of the red-edge data interface module 211 and the black-edge data interface module 213, deploy the algorithm and store the operation log.

[0026] Specifically include:

[0027] The red edge data interface module 211 is used to receive the red edge data, extract the data payload in the standard MHAL format, and send it to the link layer security software deployment module 212;

[0028] Among them, the MHAL data standard format described is as follows Figure 2The LD field is used to indicate the destination address to which the link layer data should be delivered; the IU field is used to indicate whether the link layer data processing has been completed. This field should be set before the message processing is completed to declare that the link layer data is still being processed; the Length field indicates the length of the MHAL data; the PayLoad field is the data payload.

[0029] The link layer security algorithm deployment module 212 is used to receive the red edge MHAL data and implement the encryption function of the link layer data;

[0030] The black-side data interface module 213 is used to encapsulate the data encrypted by the link layer security algorithm deployment module 212 and send it to the black-side bus;

[0031] Among them, the MHAL data standard format described is as follows Figure 2 The LD field is used to indicate the destination address to which the link layer data should be delivered; the IU field is used to indicate whether the link layer data processing has been completed. This field should be set before the message processing is completed to declare that the link layer data is still being processed; the Length field indicates the length of the MHAL data; the PayLoad field is the data payload.

[0032] The software radio platform management module 214 is used to configure the fields of the black edge data interface module 213 and the red edge data interface module 211, and store the log of the device operation in the storage module 218, and is also used to call the software stored in the software radio software storage module 215, and after the software is run, call the security algorithm of the link layer full algorithm storage module 216, and deploy it to the link layer security algorithm deployment module 212;

[0033] The software radio platform management module 214 has the following working procedures: Figure 4 After the device is powered on, the software radio platform management module 214 reads the software stored in the software radio software storage module 215, including the storage core framework 224, CORBA middleware 225, embedded operating system 226 and trusted boot component 227. After reading, the trusted boot component 227 is run, and then the embedded operating system 226 is verified. If the verification fails, the process ends; if the verification is correct, the CORBA middleware 225 is run, and then the trusted boot component 227 verifies the core framework 224. If the verification fails, the process ends; if the verification is correct, the core framework 224 reads the security algorithm in the link layer security algorithm storage module 216 and deploys it to the link layer security algorithm deployment module 212.

[0034] Among them, the basic software block diagram running in the software wireless platform management module is as follows: Figure 3 .

[0035] The core framework 224 provides a unified loading / unloading interface to complete the algorithm software call in the link layer security algorithm storage module 216; the CORBA middleware 225 completes the decoupling function with the core framework 224 and the embedded operating system 226; the embedded operating system 226, as the basic platform of the software radio platform management module 214, realizes the configuration and operation of the interface module and the basic environment; the trusted boot component 227 completes the trusted boot of the CORBA middleware 225 and the embedded operating system 226 and completes the verification function.

[0036] A software radio software storage module 215 implements the storage function of the software radio software;

[0037] The link layer security algorithm storage module 216 is used to store the security algorithm and is called by the software radio platform management module 214;

[0038] DDR217, used to provide the operating memory of the software radio platform management module 214;

[0039] The log storage module 218 is used to store the log of the device operation, and is read and written by the software radio platform management module 214 .

Claims

1. A satellite link layer security processing device based on software radio technology, characterized in that The invention is characterized in that it comprises a red edge data interface module (211), a link layer security algorithm deployment module (212), a black edge data interface module (213), a software radio platform management module (214), a software radio software storage module (215), a link layer security algorithm storage module (216), DDR (217) and a log storage module (218); A red edge data interface module (211), used to extract unencrypted data from the red edge bus and send it to a link layer security algorithm deployment module (212); A link layer security algorithm deployment module (212), used for receiving red edge data, performing link layer data encryption, and sending the encrypted data to a black edge data interface module (213); A black-side data interface module (213), used to encapsulate the data encrypted by the link layer security algorithm deployment module and send it to the black-side bus; A software radio platform management module (214) is used to configure the fields of the black edge data interface module (213) and the red edge data interface module (211), and to store the log of the device operation in the log storage module (218), and is also used to call the software stored in the software radio software storage module (215), call the security algorithm of the link layer security algorithm storage module (216) after the software is running, and deploy the security algorithm to the link layer security algorithm deployment module (212); A software radio software storage module (215) is used to store software required for the software radio platform management module (214) to run; A link layer security algorithm storage module (216), used for storing security algorithms and being called by the software radio platform management module (214); DDR (217), used for providing the operating memory of the software radio platform management module (214); A log storage module (218), used for storing the log of the device operation, and read and write by the software radio platform management module (214); The red edge data interface module (211) and the black edge data interface module (213) use the standard software radio modulation and demodulation hardware abstraction layer standard format MHAL for data encapsulation.

2. The satellite link layer security processing device based on software radio technology according to claim 1, characterized in that: The software stored in the software radio software storage module (215) includes a storage core framework (224), CORBA middleware (225), an embedded operating system (226) and a trusted boot component (227); after the device is powered on, the software radio platform management module (214) reads the software stored in the software radio software storage module (215), and after reading, runs the trusted boot component (227) to verify the embedded operating system (226), and ends if the verification fails; If the verification is correct, the CORBA middleware (225) is run, and then the trusted boot component (227) verifies the core framework (224). If the verification fails, the process ends; If the verification is correct, the core framework (224) reads the security algorithm in the link layer security algorithm storage module (216) and deploys it to the link layer security algorithm deployment module (212).

Images