Satellite communication encryption method based on double-channel network management modem

Abstract

A satellite communication encryption method based on double-channel network management modems, a satellite network management channel is established between a master station network management modem (3) and a remote station network management modem (6) for transmitting network management signaling, a satellite encryption control channel is established between a master station encryption control modem (5) and the remote station network management modem (6) for transmitting encryption control information and IP data; bidirectional encryption satellite communication is carried out between the master station and the remote station by using a master station encryption machine and a remote station encryption machine on the satellite network management channel and the satellite encryption control channel. The application can still carry out real-time key negotiation when service network communication is carried out. VoIP telephone real-time online can also be realized by using the encryption control channel, and the application does not depend on service network.

Description

Technical Field

[0001] This invention relates to the field of satellite encrypted communication technology, and in particular to a satellite communication encryption method based on a dual-channel network-managed modem, which can improve the security of satellite communication links for non-IP reachable satellite communication links or unidirectional transmission links. Technical Background In a satellite communication network, the master station is the core of the entire network. It can transmit network management signaling through the network management channel to monitor and manage the status of remote stations and terminal equipment within the station. To ensure the security and reliability of the satellite communication network and prevent the transmission of plaintext network management signaling in free space, which could lead to malicious interception or forgery, the network management channel needs to be encrypted.

[0002] Considering the practical application requirements such as the carrying capacity and communication efficiency of network management channels, simplified signaling in non-standard IP formats is transmitted through these channels, thereby significantly increasing the channel's carrying capacity. Currently, domestic commercial cryptographic encryption is based on building encrypted tunnels using IPsec, and network management channels do not meet the basic encryption condition of IP link reachability.

[0003] Most existing satellite modems are single-channel, meaning they can only transmit and receive one radio frequency signal. A few satellite modems support dual channels, where the service channel can support commercial cryptographic encryption, but the network management channel does not support channel encryption or, under the same bandwidth conditions, its channel capacity is only N1 (generally less than 50) stations. This cannot meet the actual application needs of medium and large-scale satellite communication networks and affects the efficiency of satellite communication resource utilization. Summary of the Invention

[0004] To address the shortcomings of existing network management modem encryption methods, this invention provides a satellite communication encryption method based on a dual-channel network management modem. It utilizes an IP link established through an encrypted control channel to resolve the key negotiation problem for network management channel encryption. After establishing an encrypted tunnel, encrypted transmission of network management signaling is performed, enabling the network management channel to be encrypted using national commercial cryptographic equipment, thus solving the security issues of satellite network management channels. Similarly, this encryption method can also be used to resolve the key negotiation problem for the unidirectional transmission link established by the service modem, allowing real-time key negotiation during multicast and other communication modes on the service network. Furthermore, the encrypted control channel can be used to achieve real-time online VoIP telephony, independent of the service network.

[0005] This invention proposes a satellite communication encryption method based on a dual-channel network-managed modem. The master station equipment for satellite communication includes a master station encryption machine, a master station network-managed modem, and a master station encryption control modem; the remote station equipment includes a remote station network-managed modem and a remote station encryption machine; wherein, A satellite network management channel is established between the master station network management modem and the remote station network management modem for transmitting network management signaling; a satellite encrypted control channel is established between the master station encrypted control modem and the remote station network management modem for transmitting encrypted control information and IP data. The master station encryption machine is interactively connected to the master station network management modem and the master station encryption control modem, respectively. The master station encryption machine encrypts or decrypts the transmitted messages. The remote station encryption device is interactively connected to the remote station network management modem, and the remote station encryption device encrypts or decrypts the transmitted messages. Two-way encrypted satellite communication is conducted between the master station and the remote station using satellite network management channels and satellite encrypted control channels.

[0006] Furthermore, the bidirectional satellite encrypted communication between the master station and the remote station using the satellite network management channel and the satellite encryption control channel includes: using the satellite network management channel to perform forward channel encryption or decryption between the master station and the remote station, specifically including: The remote station equipment further includes a remote service modem and a remote station network management unit; The master station encryption machine performs encryption operations on the message payload sent to the remote station to obtain ciphertext, then adds UDP and IP protocol headers to the ciphertext and sends it to the master station network management modem. The master station network management modem extracts the ciphertext of the UDP protocol from the received message, adds a check bit, forwards it to the air interface, and then forwards it to the remote station via the communication satellite transponder. After receiving the ciphertext through the air interface, the remote station network management modem verifies it, then encapsulates the ciphertext into a UDP packet and sends it to the remote station encryption machine. The remote station encryption device receives the ciphertext sent by the remote station network management modem and performs decryption operation on its message payload to obtain the UDP plaintext; The remote station encryption device encapsulates plaintext UDP data into standard UDP packets and sends them to the remote station network management unit. After receiving a message, the remote station network management unit first determines whether it is a message from this station. If not, the message is discarded; if it is, it is forwarded to the remote station network management modem. According to the message content, the remote station network management modem sends a control message to the remote service modem and the remote station network management unit via the remote station encryption device. The remote station encryption device then transmits the message transparently according to the destination address and port number.

[0007] Furthermore, the bidirectional satellite encrypted communication between the master station and the remote station using the satellite network management channel and the satellite encryption control channel includes: performing reverse channel encryption or decryption between the master station and the remote station using the satellite network management channel, specifically including: The master station equipment further includes a network management server, a remote station service modem, and a remote station network management unit that sends a return message to the remote station network management modem; The remote station network management modem encapsulates the received return message and sends it to the remote station network management unit; The remote station network management unit modifies the destination address of the received message to the address of the network management server and forwards it to the remote station encryption machine; The remote station encryption device performs encryption operations on the message payload returned by the remote station network management unit to obtain the message ciphertext; The remote encryption device forwards the encrypted message to the remote network management modem; The remote station network management modem extracts the ciphertext from the received message, adds a check bit, forwards it to the air interface, and then forwards it to the main station via the communication satellite transponder. After receiving the ciphertext through the air interface, the main station network management modem verifies it, then encapsulates the ciphertext into a standard UDP packet and sends it to the main station encryption machine. The main station encryption machine receives the ciphertext of the message sent by the main station network management modem, and performs decryption operation on the message payload to obtain the message text. The main encryption machine forwards the decrypted message to the network management server.

[0008] Furthermore, the bidirectional satellite encrypted communication between the master station and the remote station using the satellite network management channel and the satellite encryption control channel includes: using the satellite encryption control channel to perform forward channel encryption or decryption between the master station and the remote station, specifically including: The master station equipment further includes a SIP server and a key management server, and the remote station further includes a VoIP server. The key management server sends encrypted control signaling messages to the master station and the remote station via the master station encryption device, and the SIP server sends voice information messages to the remote station via the master station encryption device. The master station encryption machine performs encryption operations on the message payload sent to the remote station to obtain the ciphertext; The master encryption machine adds TCP and IP protocol headers to the encrypted ciphertext and forwards it to the master encryption control modem. The master station encryption control modem extracts the TCP ciphertext from the received message, adds a check bit, forwards it to the air interface, and then forwards it to the remote station via the communication satellite transponder. After receiving the ciphertext over the air interface, the remote station's network management modem verifies it, then encapsulates the ciphertext into a TCP packet, which is then sent to the remote station's VoIP server via the remote station's encryption device.

[0009] Furthermore, the bidirectional satellite encrypted communication between the master station and the remote station using the satellite network management channel and the satellite encryption control channel includes: performing reverse channel encryption or decryption between the master station and the remote station using the satellite encryption control channel, specifically including: The VoIP server sends the voice information returned to the master station in plaintext to the remote station's network management modem via the remote station's encryption device. The remote station encryption device performs encryption operations on the encrypted control signaling payload returned by the remote station encryption device and the voice information payload returned by the VoIP server to obtain ciphertext. The remote station encryption device sends the encrypted message to the remote station network management modem; The remote station network management modem extracts the ciphertext from the received message, adds a CRC check, forwards it to the air interface, and then forwards it to the main station via the communication satellite transponder. The master station encryption control modem receives the ciphertext through the air interface, verifies it, and then encapsulates the ciphertext into a standard TCP packet and sends it to the master station encryption machine. The main station encryption machine performs decryption operations on the ciphertext to obtain the encrypted control signaling and voice information in plaintext; The master station encryption machine forwards the decrypted encryption control signaling to the master station's key management server and the voice information to the master station's SIP server. The key management server processes the encryption control signaling, and the SIP server processes the voice information.

[0010] Furthermore, the forward channel encryption or decryption between the master station and the remote station using the satellite network management channel further includes: the master station equipment further includes a service modem; before the master station encryption machine performs encryption operation on the packet payload sent to the remote station, the master station encryption machine determines the destination address of the packet sent by the network management server or the master station service modem; if the destination address is in the same network segment as the master station, the packet is directly transparently transmitted.

[0011] Furthermore, the forward channel encryption or decryption between the master station and the remote station using the satellite network management channel further includes: the master station encryption machine performs encryption operations on the payload of the message sent to the remote station to obtain ciphertext, and then adds multiple bytes of encryption information; the destination address of the encrypted or decrypted message is set to a specific IP address and a corresponding receiving port is set to receive the message.

[0012] Furthermore, the reverse channel encryption or decryption between the master station and the remote station using the satellite network management channel further includes: setting the destination address of the encrypted or decrypted message to a specific IP address and setting a corresponding receiving port for receiving the message.

[0013] Furthermore, the method of using the satellite encrypted control channel to perform forward channel encryption or decryption between the master station and the remote station further includes: setting the destination IP address for receiving the encrypted or decrypted message.

[0014] Furthermore, the reverse channel encryption or decryption between the master station and the remote station using the satellite encryption control channel further includes: setting the destination IP address for receiving the encrypted or decrypted message.

[0015] The advantages of this invention compared to the prior art are: (1) The present invention establishes two channels in the network management modem device, namely the network management channel and the encryption control channel. Without changing the physical size, the network management modem is reused, thereby improving the utilization rate of the device.

[0016] (2) This invention first constructs an encrypted tunnel for the network management channel by means of an encrypted control channel, and then forwards the network management signaling ciphertext through this encrypted tunnel to realize the national commercial cryptographic encryption of the network management channel.

[0017] (3) This invention uses the encrypted control channel to achieve national commercial cryptographic encryption of the network management channel without affecting the original load capacity N2 of the network management modem.

[0018] (4) This invention uses an encrypted control channel to build an encrypted tunnel for a one-way transmission link of the service channel (such as a multicast application mode), so that the service channel can still be encrypted using national commercial cryptographic equipment when it is a one-way link.

[0019] (5) The present invention uses an encrypted control channel to transmit VoIP calls, and does not require the establishment of a separate service channel, so as to keep VoIP calls online in real time.

[0020] (6) This invention uses an encrypted control channel to transmit VoIP calls. The phone numbers are fixed and unique after unified planning, and there is no need to reconfigure the parameters even if the business network communication site is changed. Attached Figure Description

[0021] Figure 1 This is a diagram of the satellite communication network topology. Figure 2 This is a schematic diagram of the encryption / decryption process for the satellite network management forward channel; Figure 3 This is a schematic diagram of the reverse channel encryption / decryption process for satellite network management. Figure 4 A schematic diagram of the encryption / decryption process of the satellite encryption control forward channel; Figure 5 This is a schematic diagram of the encryption / decryption process for the reverse channel of satellite encryption control. Detailed Implementation

[0022] This invention proposes a satellite communication encryption method based on a dual-channel network-managed modem, avoiding the transmission of plaintext signaling in free space. The method establishes a network management channel and an encryption control channel within the modem. The encryption control channel is used to construct an IP-linkable encrypted tunnel, resolving the key negotiation problem for the network management channel encryption. After establishing the encrypted tunnel, encrypted transmission of network management signaling is performed, solving the commercial cryptographic encryption problem for the network management channel. Similarly, this encryption method can also solve the key negotiation problem for the unidirectional transmission link established by the service modem, addressing the commercial cryptographic encryption problem in multicast and other modes of the service channel. Furthermore, the encryption control channel can also transmit VoIP voice and other information, enabling remote VoIP calls to be online in real-time with unique numbers, achieving telephone communication without consuming additional satellite bandwidth.

[0023] The present invention will now be described in detail with reference to the accompanying drawings, such as... Figure 1 The satellite communication network management topology shown includes the following: Master station equipment: management server 1, SIP server 13, key management server 15, master station encryption machine 2, master station management modem 3, master station service modem 4, and master station encryption control modem 5; Remote station equipment: remote station management modem 6, remote station service modem 7, management switch 8, remote station encryption machine 9, remote station management unit 10, station control equipment 11, VoIP server 12, and service equipment 14; Antenna feeder system.

[0024] Network management server 1 manages and schedules the frequency resources of the satellite communication network and all earth stations in the network in a unified manner. It controls equipment such as the main station service modem 4 and the remote station network management modem 6 by issuing network management commands. All messages must be encrypted, decrypted or transparently transmitted by the main station encryption machine 2 before being forwarded.

[0025] SIP server 13 is connected to the main encryption machine 2 and processes the registration information of remote station VoIP 12. After VoIP 12 registers with SIP server 13, it can make voice calls at any time without establishing an additional channel.

[0026] The key management server 15 issues encryption control signals to the master station encryption machine 2 and the remote station encryption machine 9.

[0027] The master station encryption machine 2 is connected to the network management server 1, SIP server 13, key management server 15, master station network management modem 3, master station encryption control modem 5, and master station service modem 4 via network cables. It directly transmits messages sent from the network management server 1 to the local machine, encrypts and decrypts network management signaling sent from the network management server 1 to remote stations and returned from remote stations to the network management server 1, and encrypts and decrypts encryption control signaling and VoIP voice information sent from the SIP server 13 to remote stations and returned from remote stations to the SIP server 13. The encryption control signaling of the master station encryption machine 2 is issued by the key management server 15.

[0028] The network management signaling transmitted between the master station network management modem 3 and the remote station network management modem 6 is modulated into radio frequency signals by their respective modems and then transmitted and received through their respective site's antenna feeder system.

[0029] The VoIP voice information transmitted by the main station encryption control modem 5 and the remote station network management modem 6 is modulated into radio frequency signals by their respective modems and then transmitted and received through the antenna feeder system.

[0030] The remote station network management modem 6 has two bidirectional channels: a network management channel and an encrypted control channel. The network management channel operates in TDM / TDMA mode, using a non-standard IP protocol for transmission, transmitting network management signaling to enable the master station to monitor and control the remote station's radio frequency, channel, and terminal equipment, forming a star network structure with the master station as the center and the remote stations as terminals. The encrypted control channel operates in TDM / TDMA mode, using a standard IP protocol for transmission, transmitting encrypted control signaling and VoIP voice information to ensure encrypted communication between the master station and remote stations, also forming a star network structure with the master station as the center and the remote stations as terminals. Since the network management forward channel is a broadcast channel, network management signaling is sent wirelessly via broadcast. Different remote stations need to use the same key for decryption, therefore, the key distribution for the network management channel must be broadcast.

[0031] The network management switch 8 is connected to the remote station network management modem 6, the remote station service modem 7, and the remote station encryption machine 9 via network cables, and is used to transmit network management signaling and network management information.

[0032] The remote station encryption device 9 is connected to the remote station network management modem 6, network management switch 8, remote station service modem 7, and service device 14 via network cables, and is used for encrypting and decrypting network management signaling. The encryption control signaling of the remote station encryption device 9 is issued by the key management server 15.

[0033] The remote station network management unit 10 is connected to the station control equipment 11 via a network cable. Through the above-mentioned equipment, it can ultimately realize the interaction of network management commands with the network management server 1, and can monitor, configure and manage the equipment in the remote station. It can also enable the network management server 1 to indirectly monitor, configure and manage the equipment in the station.

[0034] The specific implementation method of satellite communication encryption based on dual-channel network management modem mainly consists of two steps: Step 1: Satellite network management forward channel encryption / decryption: The master station sends network management signaling to the remote station (i.e., forward); Step 2: Satellite network management reverse channel encryption / decryption: The remote station sends network management signaling back to the master station (i.e., reverse).

[0035] Encryption of the satellite encrypted control channel mainly consists of two steps. Step 3: Forward encryption / decryption of the satellite encrypted control channel: The master station sends encrypted control signaling and VoIP voice information to the remote station (i.e., forward). Step 4: Reverse encryption / decryption of the satellite encrypted control channel: The remote station sends encrypted control signaling and VoIP voice information back to the master station (i.e., reverse).

[0036] Step 1: Satellite network management forward channel encryption / decryption process, such as... Figure 2 As shown.

[0037] Step 1.1: The main station encryption machine 2 directly transmits messages whose target address is in the same network segment to the network management server 1 or the main station service modem 4 in plaintext without any other processing; Step 1.2: Network management server 1 sends a plaintext message to the remote station. The destination address of the message is the IP address of the main station network management modem 3, and the port number is arbitrarily set to 4600. Step 1.3: The main station encryption machine 2 performs encryption operation on the message payload sent to the remote station to obtain ciphertext. After the encryption machine performs encryption operation on the original information, it will also add M (M is generally 30-70) bytes of specific encryption information. The effective byte length of the original control signaling needs to be taken into account to ensure that the encrypted message can still be transmitted normally in the network management channel. Step 1.4: The master encryption machine 2 adds UDP and IP protocol headers to the encrypted ciphertext and sends it to the master network management modem 3. The destination address of the message is the IP address of the master network management modem 3, and the port number is 4600. Step 1.5: The main station network management modem 3 extracts the UDP ciphertext from the received message, adds a CRC check bit, forwards it to the air interface, and then forwards it to the remote station via the communication satellite transponder. Step 1.6: After receiving the ciphertext through the air interface, the remote station network management modem 6 performs CRC verification, then encapsulates the ciphertext into a UDP packet, and sends it to the remote station network management unit 10 via the remote station encryption device 9. The destination address of the packet is the IP address of the remote station network management unit 10, and the port number is 4700. Step 1.7: The remote station encryption machine 9 receives the ciphertext sent by the remote station network management modem 6, performs decryption operation on the message payload, and obtains the plaintext; Step 1.8: The remote station encryption device 9 encapsulates the UDP plaintext into a standard UDP packet and sends it to the remote station network management unit 10. The destination address of the packet is the IP address of the remote station network management unit 10, and the port number is 4700. Step 1.9: After receiving the plaintext message, the remote station network management unit 10 first determines whether it is a local message based on the network management modem ID. If it is not, the message is discarded directly. If it is, it is forwarded to the remote station network management modem 6. The destination address of the message is the IP address of the remote station network management modem 6, and the port number is 4800. At this time, the remote station encryption machine 9 selects the appropriate strategy to pass through the message according to the destination address and port number. Step 1.10: The remote station network management modem 6 sends a control message to the remote service modem 7 and the remote station network management unit 10 according to the message content. The destination address of the message is the IP address of the remote service modem 7 and the remote station network management unit 10, and the port number is 4600. At this time, the remote station encryption machine 9 selects the corresponding strategy to transparently transmit the message according to the destination address and port number. Step 2: Satellite network management reverse channel encryption / decryption process, such as... Figure 3 As shown.

[0038] Step 2.1: The remote station service modem 7 and the remote station network management unit 10 send a return message to the remote station network management modem 6. At this time, the remote station encryption machine 9 selects the appropriate strategy to pass through the message according to the destination address. Step 2.2: The remote station network management modem 6 encapsulates the received return message and sends it to the remote station network management unit 10. The destination address of the message is the IP address of the remote station network management unit 10, and the port number is 4100. At this time, the remote station encryption machine 9 selects the appropriate strategy to pass through the message according to the destination address. Step 2.3: The remote station network management unit 10 modifies the destination address of the received message to the address of the network management server 1, with port number 4200, and sends it to the encryption machine; Step 2.4: The remote station encryption device 9 performs encryption operation on the message payload returned by the remote station network management unit 10 to obtain ciphertext. After the encryption operation on the original information, the encryption device will also add M (M is generally 30-70) bytes of specific encryption information. The effective byte length of the original control signaling needs to be taken into account to ensure that the encrypted message can still be transmitted normally in the network management channel. Step 2.5: The remote station encryption machine 9 forwards the encrypted message to the remote station network management modem 6. The destination address of the message is the IP address of the remote station network management modem 6, and the port number is 4200. Step 2.6: The remote station network management modem 6 extracts the ciphertext from the received message, adds a CRC check bit, forwards it to the air interface, and then forwards it to the main station via the communication satellite transponder; Step 2.7: After receiving the ciphertext through the air interface, the main station network management modem 3 performs CRC verification, then encapsulates the ciphertext into a standard UDP packet and sends it to the network management server 1. The destination address of the packet is the IP address of the network management server 1, and the port number is 4500. Step 2.8: The master station encryption machine 2 receives the ciphertext of the message sent by the master station network management modem 3, performs decryption operation on the message payload, and obtains the plaintext; Step 2.9: The main station encryption machine 2 forwards the decrypted message to the network management server 1. The destination address of the message is the IP address of the network management server 1, and the port number is 4500.

[0039] Step 3: Satellite encryption control channel forward channel encryption / decryption process, such as... Figure 4 As shown.

[0040] Step 3.1: The key management server 15 sends encrypted control signaling plaintext messages to the master station and the remote station, and the SIP server 13 sends voice information plaintext messages to the remote station. The destination address of the messages is the IP address of the master station's encrypted control modem 5. Step 3.2: The main station encryption machine 2 performs encryption operations on the message payload sent to the remote station to obtain the ciphertext; Step 3.3: The master encryption machine 2 adds TCP and IP protocol headers to the encrypted ciphertext and forwards it to the master encryption control modem 5. The destination address of this message is the IP address of the master encryption control modem 5. Step 3.4: The master station encryption control modem 5 extracts the TCP ciphertext from the received message, adds a CRC check bit, forwards it to the air interface, and then forwards it to the remote station via the communication satellite transponder; Step 3.5: After receiving the ciphertext through the air interface, the remote station network management modem 6 performs CRC verification, then encapsulates the ciphertext into a TCP packet, and sends it to VoIP12 via the remote station encryption device 9. The destination address of this packet is the IP address of VoIP12. Step 3.6: The remote station encryption machine 9 receives the ciphertext sent by the remote station network management modem 6, performs decryption operation on the message payload, and obtains the plaintext; Step 3.7: The remote station encryption device 9 encapsulates the TCP plaintext into a standard TCP packet and sends it to VoIP12. The destination address of the packet is the IP address of VoIP12. VoIP12 processes the received voice information.

[0041] Step 4: Satellite encrypted control channel reverse channel encryption / decryption process, such as... Figure 5 As shown.

[0042] Step 4.1: VoIP12 sends the voice information returned to the master station in plaintext to the remote station's network management modem 6; Step 4.2: The remote station encryption device 9 performs encryption operations on the encrypted control signaling payload returned by the remote station encryption device 9 and the voice information payload returned by VoIP12 to obtain ciphertext; Step 4.3: The remote station encryption device 9 sends the encrypted message to the remote station network management modem 6. The destination address of the message is the IP address of the remote station network management modem 6. Step 4.4: The remote station network management modem 6 extracts the ciphertext from the received message, adds a CRC check bit, forwards it to the air interface, and then forwards it to the main station via the communication satellite transponder; Step 4.5: The main station encryption control modem 5 receives the ciphertext through the air interface, performs CRC verification, and then encapsulates the ciphertext into a standard TCP packet and sends it to the key management server 15 and the SIP server 13. Step 4.6: The main station encryption machine 2 performs decryption operations on the ciphertext to obtain the encrypted control signaling and voice information of the plaintext; Step 4.7: The main station encryption machine 2 forwards the decrypted encryption control signaling to the key management server 15 and the voice information to the SIP server 13 according to the destination address. The key management server 15 processes the encryption control signaling and the SIP server 13 processes the voice information.

[0043] The contents not described in detail in this specification are common knowledge to those skilled in the art.

Claims

1. A satellite communication encryption method based on a dual-channel network-managed modem, characterized in that, Configure master station equipment and remote station equipment for satellite communication, wherein the master station equipment includes a master station encryption machine (2), a master station network management modem (3), and a master station encryption control modem (5); the remote station equipment includes a remote station network management modem (6) and a remote station encryption machine (9). A satellite network management channel is established between the main station network management modem (3) and the remote station network management modem (6) for transmitting network management signaling. A satellite encrypted control channel is established between the main station encrypted control modem (5) and the remote station network management modem (6) for transmitting encrypted control information and IP data. The main station encryption machine (2) is interactively connected to the main station network management modem (3) and the main station encryption control modem (5) respectively. The main station encryption machine (2) encrypts or decrypts the transmitted messages. The remote station encryption machine (9) is interactively connected to the remote station network management modem (6), and the remote station encryption machine (9) encrypts or decrypts the transmitted messages; Two-way encrypted satellite communication is conducted between the master station and the remote station using satellite network management channels and satellite encrypted control channels. The bidirectional satellite encrypted communication between the master station and the remote station using the satellite network management channel and the satellite encryption control channel includes: using the satellite encryption control channel to encrypt or decrypt the forward channel between the master station and the remote station, specifically including: The master station is further configured with a SIP server (13) and a key management server (15), and the remote station is further configured with a VoIP server (12). The key management server (15) sends encrypted control signaling messages to the master station and the remote station via the master station encryption machine (2), and the SIP server (13) sends voice information messages to the remote station via the master station encryption machine (2). The main station encryption machine (2) performs encryption operations on the message payload sent to the remote station to obtain ciphertext; The main station encryption machine (2) adds TCP and IP protocol headers to the encrypted ciphertext and forwards it to the main station encryption control modem (5). The main station encryption control modem (5) extracts the TCP ciphertext from the received message, adds a check bit, forwards it to the air interface, and then forwards it to the remote station via the communication satellite transponder. After receiving the ciphertext through the air interface, the remote station network management modem (6) verifies it and then encapsulates the ciphertext into a TCP packet, which is then sent to the remote station's VoIP server (12) via the remote station encryption machine (9). The bidirectional satellite encrypted communication between the master station and the remote station using the satellite network management channel and the satellite encryption control channel includes: using the satellite encryption control channel to perform reverse channel encryption or decryption between the master station and the remote station, specifically including: The VoIP server (12) sends the voice information returned to the master station in plaintext to the remote station network management modem (6) via the remote station encryption machine (9). The remote station encryption machine (9) performs encryption operations on the encrypted control signaling message payload returned by the remote station encryption machine (9) and the voice information message payload returned by the VoIP server (12) to obtain ciphertext; The remote station encryption machine (9) sends the encrypted message to the remote station network management modem (6). The remote station network management modem (6) extracts the ciphertext from the received message, adds CRC check, forwards it to the air interface, and then forwards it to the main station via the communication satellite transponder; The main station encryption control modem (5) receives the ciphertext through the air interface, verifies it, and then encapsulates the ciphertext into a standard TCP packet and sends it to the main station encryption machine (2). The main station encryption machine (2) performs decryption operations on the ciphertext to obtain the encrypted control signaling and voice information of the plaintext; The main station encryption machine (2) forwards the decrypted encryption control signaling to the main station's key management server (15) and forwards the voice information to the main station's SIP server (13). The key management server (15) processes the encryption control signaling, and the SIP server (13) processes the voice information.

2. The method according to claim 1, characterized in that, The bidirectional satellite encrypted communication between the master station and the remote station using the satellite network management channel and the satellite encryption control channel includes: using the satellite network management channel to perform forward channel encryption or decryption between the master station and the remote station, specifically including: Further configure the remote station service modem (7) and remote station network management unit (10) at the remote station. The main station encryption machine (2) performs encryption operation on the message payload sent to the remote station to obtain ciphertext, and then adds UDP and IP protocol headers to the ciphertext and sends it to the main station network management modem (3). The main station network management modem (3) extracts the ciphertext of the UDP protocol from the received message and adds a check bit, then forwards it to the air interface and then forwards it to the remote station via the communication satellite transponder; After receiving the ciphertext through the air interface, the remote station network management modem (6) verifies it, then encapsulates the ciphertext into a UDP packet and sends it to the remote station encryption machine (9). The remote station encryption machine (9) receives the ciphertext sent by the remote station network management modem (6) and performs decryption operation on its message payload to obtain UDP plaintext; The remote station encryption machine (9) encapsulates the UDP plaintext into a standard UDP packet and sends it to the remote station network management unit (10). After receiving the message, the remote station network management unit (10) first determines whether it is a local station message. If not, it discards the message; if so, it forwards it to the remote station network management modem (6). According to the content of the message, the remote station network management modem (6) sends a control message to the remote station service modem (7) and the remote station network management unit (10) via the remote station encryption machine (9). The remote station encryption machine (9) transmits the message according to the destination address and port number.

3. The method according to claim 1, characterized in that, The bidirectional satellite encrypted communication between the master station and the remote station using the satellite network management channel and the satellite encryption control channel includes: using the satellite network management channel for reverse channel encryption or decryption between the master station and the remote station, specifically including: Further configure the network management server on the main site (1); The remote station service modem (7) and the remote station network management unit (10) send a return message to the remote station network management modem (6). The remote station network management modem (6) encapsulates the received return message and sends it to the remote station network management unit (10). The remote station network management unit (10) modifies the destination address of the received message to the address of the network management server (1) and forwards it to the remote station encryption machine (9). The remote station encryption machine (9) performs encryption operations on the message payload returned by the remote station network management unit (10) to obtain the message ciphertext; The remote station encryption machine (9) forwards the encrypted message to the remote station network management modem (6); The remote station network management modem (6) extracts the ciphertext from the received message and adds a check bit, then forwards it to the air interface and then forwards it to the main station via the communication satellite transponder; After receiving the ciphertext through the air interface, the main station network management modem (3) verifies it, then encapsulates the ciphertext into a standard UDP packet and sends it to the main station encryption machine (2). The main station encryption machine (2) receives the ciphertext of the message sent by the main station network management modem (3), and performs decryption operation on the message payload to obtain the message text; The main station encryption machine (2) forwards the decrypted message to the network management server (1).

4. The method according to claim 2, characterized in that, The method of using satellite network management channels to perform forward channel encryption or decryption between the master station and the remote station further includes: To further configure the service modem (4) for the main station, before the main station encryption machine (2) performs encryption operation on the message payload sent to the remote station, the main station encryption machine (2) judges the target address of the message sent by the network management server (1) or the main station service modem (4). If the target address is the same network segment as the main station, the message is directly transmitted.

5. The method according to claim 2, characterized in that, The method of using satellite network management channels to perform forward channel encryption or decryption between the master station and the remote station further includes: The master station encryption machine (2) performs encryption operations on the message payload sent to the remote station to obtain ciphertext, and then adds multiple bytes of encryption information. Set the destination address for encrypted or decrypted messages to a specific IP address and configure the corresponding receiving port for receiving messages.

6. The method according to claim 3, characterized in that, The method of using satellite network management channels to perform reverse channel encryption or decryption between the master station and the remote station further includes: Set the destination address for encrypted or decrypted messages to a specific IP address and configure the corresponding receiving port for receiving messages.

7. The method according to claim 1, characterized in that, The method of using a satellite encrypted control channel to perform forward channel encryption or decryption between the master station and the remote station further includes: Set the destination IP address for receiving encrypted or decrypted messages.

8. The method according to claim 1, characterized in that, The method of using a satellite encrypted control channel to perform reverse channel encryption or decryption between the master station and the remote station further includes: Set the destination IP address for receiving encrypted or decrypted messages.

Images