Communication encryption system and high-throughput satellite network

Abstract

The invention discloses a communication encryption system and a high-throughput satellite network, and the communication encryption system comprises encryption facing a high-throughput satellite network link layer, and transmits forward link data from a service device connected with a high-throughput satellite network master station to a service device connected with a satellite communication terminal, in the forward link data transmission process, the high-throughput satellite network master station calls the master station encryption module for encryption, and the satellite communication terminal calls the terminal encryption module for decryption; the return link data is transmitted from the service equipment connected with the satellite communication terminal to the service equipment connected with the high-throughput satellite network master station, and in the return link data transmission process, the satellite communication terminal calls a terminal encryption module for encryption and transmits the data to the service equipment connected with the high-throughput satellite network master station. And the high-throughput satellite network master station calls the master station encryption module for decryption. Compared with the existing technical means of information source encryption and network encryption, the data encryption range is expanded, and the network security performance is improved.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a communication encryption system and a high-throughput satellite network. Background Art

[0002] High-throughput satellite networks are an important method of long-distance communication transmission, and play an important role in data transmission in government industries such as emergency, forestry, geology, and water conservancy. These users have an urgent need for secure data transmission based on high-throughput satellite networks.

[0003] Currently, high-throughput satellites use transparent forwarding transponders on board. User service data and management information of satellite communication terminals are forwarded to the signal gateway station through the satellite communication terminal on board the high-throughput satellite to access the user's intranet. The signal space transmission distance is long and may be intercepted by illegal terminals during the transmission process. Criminals can reversely parse the original data through the protocol standard to obtain user service data, location information, etc., posing a security threat to users.

[0004] Currently, high-throughput satellite network data encryption usually adopts the technical methods of source encryption and network encryption.

[0005] Source encryption is to encrypt the user's business data through the source encryption machine, and the encrypted business data is forwarded to the gateway station through the satellite communication terminal and connected to the user's intranet. This method can only encrypt user business data, but cannot encrypt important management information of the satellite communication terminal. There are still security risks of user identity leakage and attack.

[0006] Network encryption is to build an encrypted network transmission link through the network cryptographic machine between the satellite communication terminal and the gateway, which can only encrypt business data. In addition, the existing network encryption equipment cannot adapt well to the characteristics of satellite network bandwidth asymmetry, large communication delay, and large network quality jitter, and the actual application effect is not good. In addition, the existing source encryption and network encryption are mostly point-to-point encryption modes, which are not suitable for the architecture of high-throughput satellite networks.

[0007] The link layer encryption of high-throughput satellite networks needs to be compatible with the satellite communication baseband system protocol. The existing link layer encryption usually involves the modification of satellite communication terminals. This method has poor adaptability, high implementation costs, and is not conducive to promotion and application. Summary of the invention

[0008] The main purpose of the present invention is to provide a communication encryption system and a high-throughput satellite network to overcome the deficiencies in the related art.

[0009] In order to achieve the above-mentioned purpose, according to the first aspect of the present invention, a communication encryption system is provided, characterized in that it is oriented to high-throughput satellite network link layer encryption, comprising: a high-throughput satellite network master station, a service device connected to the high-throughput satellite network master station, a satellite communication terminal, and a service device connected to the satellite communication terminal; forward link data is transmitted from the service device connected to the high-throughput satellite network master station to the service device connected to the satellite communication terminal, wherein during the forward link data transmission process, the high-throughput satellite network master station calls the master station encryption module for encryption, and the satellite communication terminal calls the terminal encryption module for decryption; return link data is transmitted from the service device connected to the satellite communication terminal to the service device connected to the high-throughput satellite network master station, wherein during the return link data transmission process, the satellite communication terminal calls the terminal encryption module for encryption, and the high-throughput satellite network master station calls the master station encryption module for decryption.

[0010] Optionally, during the forward link data transmission process, before the high-throughput satellite network master station calls the master station encryption module for encryption, and before the satellite communication terminal calls the terminal encryption module for encryption: an encryption field is predefined.

[0011] Optionally, when the high-throughput satellite network master station calls the master station encryption module for encryption during the forward link data transmission process, the high-throughput satellite network master station encapsulates the data into forward GSE frames and GSE ciphertext frames; for data in which encryption fields are defined, the master station encryption module is called to use the derived business key to perform encryption and security processing.

[0012] Optionally, during the return link data transmission process, when the satellite communication terminal calls the terminal encryption module for encryption, the satellite communication terminal encapsulates the data into RLE frames and RLE ciphertext frames; for the data in which the encryption field is defined, the terminal encryption module is called to use the derived business key to perform encryption and security processing.

[0013] Optionally, the satellite communication terminal calling the terminal encryption module for decryption includes: after receiving the GSE ciphertext frame, the satellite communication terminal calls the terminal encryption module to perform decryption based on, and restores the decrypted data to an IP data packet.

[0014] Optionally, the high-throughput satellite network master station calls the master station encryption module for decryption, including: after receiving the RLE ciphertext frame, the high-throughput satellite network calls the master station encryption module to perform decryption processing, and decapsulates the RLE frame to restore it to an IP data packet.

[0015] According to a second aspect of the present invention, a high-throughput satellite network suitable for a communication encryption system is provided, comprising: a baseband network management, a cryptographic management service system, a source communication gateway, a source communication gateway cryptographic machine, a destination communication gateway, a destination communication gateway cryptographic machine, a satellite communication terminal, and a terminal encryption module; the baseband network management generates a beam switching instruction and then sends the instruction to an integrated cryptographic management system; after receiving the switching instruction, the integrated cryptographic management system sends a key push message to the destination communication gateway cryptographic machine, wherein the key is encrypted by the source communication gateway and the source communication gateway cryptographic machine before being transmitted to the destination communication gateway cryptographic machine; the destination communication gateway decrypts the encrypted key and updates the key.

[0016] Optionally, the baseband network management generates a beam switching instruction and sends it to a destination gateway; the destination gateway performs link resource preparation after receiving the beam switching instruction.

[0017] Optionally, the baseband network management generates a beam switching instruction, encrypts it through a source information gateway and a source information gateway cipher machine, and sends it to a satellite communication terminal; the satellite communication terminal calls a terminal encryption module to perform decryption and then executes beam switching.

[0018] Optionally, the satellite communication terminal receives link resources of a destination gateway; the satellite communication terminal establishes a communication link with the destination gateway, and transmits data based on an updated key.

[0019] The communication encryption system of this embodiment and the high-throughput satellite network, wherein the communication encryption system includes link layer encryption for the high-throughput satellite network, including: a high-throughput satellite network master station, a service device connected to the high-throughput satellite network master station, a satellite communication terminal, and a service device connected to the satellite communication terminal; forward link data is transmitted from the service device connected to the high-throughput satellite network master station to the service device connected to the satellite communication terminal, wherein during the forward link data transmission process, the high-throughput satellite network master station calls the master station encryption module for encryption, and the satellite communication terminal calls the terminal encryption module for decryption; return link data is transmitted from the service device connected to the satellite communication terminal to the service device connected to the high-throughput satellite network master station, wherein during the return link data transmission process, the satellite communication terminal calls the terminal encryption module for encryption, and the high-throughput satellite network master station calls the master station encryption module for decryption. The encryption module design for the high-throughput satellite network link layer is adapted to the characteristics of the satellite communication network, and the satellite communication link layer frame format is optimized to achieve encryption of business data and important terminal management data; the network architecture adapted to the high-throughput satellite network spot beam is designed to design a key update mechanism under a highly dynamic network topology; the encryption module is connected to the satellite communication terminal through the network port without modifying the existing satellite communication terminal. The encrypted data range is large, and it is adapted to the high-throughput satellite network architecture and network characteristics, and has a good use effect. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0021] Figure 1 It is a schematic diagram of the system architecture of the communication encryption system of the present invention;

[0022] Figure 2 It is a schematic diagram of the architecture of the high-throughput satellite network of the communication encryption system of the present invention. DETAILED DESCRIPTION

[0023] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0024] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so as to describe the embodiments of the present invention described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0025] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features in the embodiments can be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0026] According to an embodiment of the present invention, a communication encryption system is provided. Figure 1As shown, it includes link layer encryption for high-throughput satellite network, including: a high-throughput satellite network main station, a business device connected to the high-throughput satellite network main station, a satellite communication terminal, and a business device connected to the satellite communication terminal; forward link data is transmitted from the business device connected to the high-throughput satellite network main station to the business device connected to the satellite communication terminal, wherein during the forward link data transmission process, the high-throughput satellite network main station calls the main station encryption module for encryption, and the satellite communication terminal calls the terminal encryption module for decryption; return link data is transmitted from the business device connected to the satellite communication terminal to the business device connected to the high-throughput satellite network main station, wherein during the return link data transmission process, the satellite communication terminal calls the terminal encryption module for encryption, and the high-throughput satellite network main station calls the main station encryption module for decryption.

[0027] In this embodiment, the link data may include service data, important management data such as the MAC address, IP address, location information, etc. of the user equipment. Specifically, the service equipment connected to the satellite communication terminal generates service data, and the satellite communication terminal generates management data. The service data and management data are transmitted together through the satellite link. The existing network encryption and channel encryption are connected in series between the service equipment and the satellite communication terminal, and can only encrypt the service data.

[0028] The encryption in this embodiment is achieved by modifying the protocol of the satellite communication link, changing the service data flow, and calling the encryption module for the service data and management data that need to be encrypted, thereby realizing encryption of the service data and management data.

[0029] For users of high-throughput satellite networks, the network security is improved. Government and industry users are the main users of high-throughput satellite networks. The typical application scenario of these users is to connect remote business terminals to the user's intranet through high-throughput satellite networks to transmit monitoring data, production data and other information. The encryption module of the present invention is used to encrypt business data to prevent the leakage of business data in the space link; the important satellite terminal management data is encrypted to prevent the intranet address information from being obtained by criminals in the space link and the intranet is attacked and damaged.

[0030] This embodiment is aimed at the encryption design of the high-throughput satellite network link layer, adapts to the characteristics of the satellite communication network, optimizes the satellite communication link layer frame format, and realizes the encryption of business data and important terminal management data.

[0031] As an optional implementation method of this embodiment, during the forward link data transmission process, before the high-throughput satellite network master station calls the master station encryption module for encryption, and before the satellite communication terminal calls the terminal encryption module for encryption: an encryption field is predefined.

[0032] In this optional implementation, encryption fields are defined in the forward GSE data packets and return RLE data packets of business data and important management data. The satellite communication terminal parses and determines the encryption fields in the GSE data packets and return RLE data packets. If encryption or decryption is required, the encryption module is called for processing to achieve encryption of business data and important management data.

[0033] As an optional implementation method of this embodiment, when the high-throughput satellite network master station calls the master station encryption module for encryption during the forward link data transmission process, the high-throughput satellite network master station encapsulates the data into forward GSE frames and GSE ciphertext frames; for the data in which the encryption field is defined, the master station encryption module is called to use the derived business key to perform encryption and security processing.

[0034] As an optional implementation method of this embodiment, the satellite communication terminal calls the terminal encryption module for decryption, including: after receiving the GSE ciphertext frame, the satellite communication terminal calls the terminal encryption module to perform decryption based on, and restores the decrypted data to an IP data packet.

[0035] In the above optional implementation, refer to Figure 1 The specific process of secure transmission of forward link data includes: the high-throughput satellite network master station system encapsulates the service data into GSE / BBFrame frames, calls the master station encryption module to encrypt the data that needs to be encrypted using the derived service key; sends the service data ciphertext to the satellite communication terminal through the space link; after receiving the BBFrame ciphertext frame, the satellite communication terminal identifies the terminal data, calls the terminal encryption module to decrypt the data to be decrypted using the derived service key, and then sends it to the satellite communication terminal; the satellite communication terminal restores the decrypted data into IP data packets and sends them to the service equipment connected to the satellite communication terminal. The high-throughput satellite network management also follows the above encryption process for the management information of the satellite communication terminal.

[0036] As an optional implementation method of this embodiment, during the return link data transmission process, when the satellite communication terminal calls the terminal encryption module for encryption, the satellite communication terminal encapsulates the data into RLE frames and RLE ciphertext frames; for the data in which the encryption field is defined, the terminal encryption module is called to use the derived business key to perform encryption and security processing.

[0037] As an optional implementation method of this embodiment, the high-throughput satellite network master station calls the master station encryption module for decryption, including: after receiving the RLE ciphertext frame, the high-throughput satellite network calls the master station encryption module to perform decryption processing, and decapsulates the RLE frame to restore it to an IP data packet.

[0038] In the above optional implementation, the specific process of secure transmission of return link data includes: the service equipment connected to the satellite communication terminal sends return service data to the satellite communication terminal; after receiving the service data, the satellite communication terminal encapsulates the RLE frame, calls the terminal data security module for the data to be encrypted and uses the derived service key to perform encryption and security processing, and sends it to the high-throughput satellite master station system through the high-throughput satellite network; after the master station system receives the RLE ciphertext frame, it calls the master station encryption module and uses the derived service key to decrypt and decrypt the security processing; after the master station decapsulates the RLE frame, it restores the IP packet and sends the return service data to the master station service equipment. The terminal status information generated by the satellite communication terminal also follows the above encryption processing flow.

[0039] Furthermore, the encryption is adapted to the network architecture of the high-throughput satellite network spot beam, has a large encrypted data range, is adapted to the high-throughput satellite network architecture and network characteristics, and has a good use effect. A key update mechanism under a highly dynamic network topology is designed; the existing satellite communication terminal is not modified, and the encryption module is connected to the satellite communication terminal through a network port. The network architecture of the high-throughput satellite network spot beam will be explained in detail in the following embodiment, and will not be repeated here.

[0040] This embodiment improves the network security of high-throughput satellite network operators. It encrypts important management data of terminals in the network to prevent criminals from obtaining address information in the high-throughput satellite network through space links and attacking and destroying the high-throughput satellite network. Compared with existing source encryption and network encryption technologies, the encryption module has a wider range of encrypted data and higher network security; it adapts to the characteristics of asymmetry, large latency, and poor stability of high-throughput satellite networks, and has better actual application effects.

[0041] According to an embodiment of the present invention, a high-throughput satellite network of a communication encryption system is also provided, including: a baseband network management, a cryptographic management service system, a source communication gateway, a source communication gateway cryptographic machine, a destination communication gateway, a destination communication gateway cryptographic machine, a satellite communication terminal, and a terminal encryption module; the baseband network management generates a beam switching instruction and then sends the instruction to an integrated cryptographic management system; after receiving the switching instruction, the integrated cryptographic management system sends a key push message to the destination communication gateway cryptographic machine, wherein before transmitting to the destination communication gateway cryptographic machine, encryption processing is performed by the source communication gateway and the source communication gateway cryptographic machine; the destination communication gateway decrypts the encrypted key and updates the key.

[0042] In this embodiment, a key update mechanism under a highly dynamic network topology is designed for the dynamic network topology caused by the high-throughput satellite network spot beam network architecture. When the mobile communication terminal switches the gateway causing the network topology to change, the derived keys are negotiated in advance and the satellite resources are prepared in advance to ensure the continuity and stability of the secure transmission of business data and important management data during the movement.

[0043] Adapt to the network architecture of high-throughput satellite network spot beams, and design a key update mechanism under highly dynamic network topology; do not modify the existing satellite communication terminal, and the encryption module is connected to the satellite communication terminal through the network port.

[0044] As an optional implementation manner of this embodiment, the baseband network management generates a beam switching instruction and sends it to the destination gateway; the destination gateway performs link resource preparation after receiving the beam switching instruction.

[0045] As an optional implementation method of this embodiment, the baseband network management generates a beam switching instruction, encrypts it through the source information gateway and the source information gateway cipher machine and sends it to the satellite communication terminal; the satellite communication terminal calls the terminal encryption module to decrypt and then executes the beam switching.

[0046] As an optional implementation manner of this embodiment, the satellite communication terminal receives link resources of a destination gateway; the satellite communication terminal establishes a communication link with the destination gateway, and transmits data based on an updated key.

[0047] In the above optional implementation, refer to Figure 2 When cross-gateway beam switching is initiated, the baseband network management generates a terminal station beam switching instruction and sends it to the integrated cryptographic management system; after the integrated cryptographic management system receives the terminal station beam switching instruction, the key push information is encrypted by the source gateway system and the source gateway cryptographic machine, and then sent to the destination gateway system through the satellite network; after receiving the ciphertext of the key push information, the destination gateway cryptographic machine uses the original derived business key to decrypt it and performs business key update processing; after the key is updated, a response message is generated, the response message is encrypted with the updated business key, and sent to the integrated cryptographic management system via the satellite network; the integrated cryptographic management system confirms After the key push is successful, a key update success message is returned to the baseband network manager; the baseband network manager generates a terminal station beam switching instruction and sends it to the destination gateway; the destination gateway receives the beam switching process, completes the link resource preparation, and feeds back the result information to the baseband network manager; the baseband network manager generates a terminal beam switching instruction, which is encrypted by the source gateway system and the source gateway encryption machine and sent to the terminal via the satellite network; the terminal calls the terminal encryption module and uses the original derived business key to decrypt, executes beam switching, receives the link resources of the destination gateway, establishes a communication link with the destination gateway, and uses the updated derived key to transmit business data and terminal management data.

[0048] Aiming at the network characteristics of high-throughput satellite network with high dynamic topology, the key update technology under high dynamic network topology is adopted to adapt to the network architecture of high-throughput satellite spot beam to realize continuous, stable and secure data transmission during movement.

[0049] Adapt to the network architecture of high-throughput satellite network spot beams, design a key update mechanism under high-dynamic network topology; do not modify the existing satellite communication terminal, the encryption module is connected to the satellite communication terminal through the network port. The encrypted data range is large, adapted to the high-throughput satellite network architecture and network characteristics, and has a good use effect.

[0050] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may occur depending on design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A communication encryption system, characterized in that: Link layer encryption for high-throughput satellite networks, including: high-throughput satellite network master stations, service equipment connected to high-throughput satellite network master stations, satellite communication terminals, and service equipment connected to satellite communication terminals; Transmitting forward link data from the service equipment connected to the high-throughput satellite network master station to the service equipment connected to the satellite communication terminal, wherein during the forward link data transmission process, the high-throughput satellite network master station calls the master station encryption module for encryption, and the satellite communication terminal calls the terminal encryption module for decryption; Return link data is transmitted from the business equipment connected to the satellite communication terminal to the business equipment connected to the high-throughput satellite network master station, wherein during the return link data transmission process, the satellite communication terminal calls the terminal encryption module for encryption, and the high-throughput satellite network master station calls the master station encryption module for decryption.

2. The communication encryption system according to claim 1, characterized in that: During the forward link data transmission process, before the high-throughput satellite network master station calls the master station encryption module for encryption, and before the satellite communication terminal calls the terminal encryption module for encryption: an encryption field is predefined.

3. The communication encryption system according to claim 2, characterized in that: During the forward link data transmission process, when the high-throughput satellite network master station calls the master station encryption module for encryption, the high-throughput satellite network master station encapsulates the data into forward GSE frames and GSE ciphertext frames; for data with encryption fields defined therein, the master station encryption module is called to use the derived business key for encryption and security processing.

4. The communication encryption system according to claim 2, characterized in that: During the return link data transmission process, when the satellite communication terminal calls the terminal encryption module for encryption, the satellite communication terminal encapsulates the data into RLE frames and RLE ciphertext frames; for the data in which the encryption field is defined, the terminal encryption module is called to use the derived business key to encrypt and complete the security processing.

5. The communication encryption system according to claim 3, characterized in that: The satellite communication terminal calls the terminal encryption module to perform decryption, including: after receiving the GSE ciphertext frame, the satellite communication terminal calls the terminal encryption module to perform decryption, and restores the decrypted data to an IP data packet.

6. The communication encryption system according to claim 4, characterized in that: The high-throughput satellite network master station calls the master station encryption module for decryption, including: after receiving the RLE ciphertext frame, the high-throughput satellite network calls the master station encryption module to perform decryption processing, decapsulates the RLE frame, and restores it to an IP data packet.

7. A high-throughput satellite network applicable to any communication encryption system of 1-6, characterized in that: include: Baseband network management, cryptographic management service system, source gateway, source gateway cryptographic machine, destination gateway, destination gateway cryptographic machine, satellite communication terminal, terminal encryption module; The baseband network management generates a beam switching instruction and then sends the instruction to the integrated password management system; After receiving the switching instruction, the integrated password management system sends the key push message to the destination gateway cipher machine, wherein the key push message is encrypted by the source gateway and the source gateway cipher machine before being transmitted to the destination gateway cipher machine; The destination gateway decrypts the encrypted key and updates the key.

8. The high-throughput satellite network according to claim 7, characterized in that: The baseband network management generates a beam switching instruction and sends it to a destination gateway; the destination gateway performs link resource preparation after receiving the beam switching instruction.

9. The high-throughput satellite network according to claim 8, characterized in that: The baseband network management generates a beam switching instruction, which is encrypted by the source signal gateway and the source signal gateway cipher machine and then sent to the satellite communication terminal; The satellite communication terminal calls the terminal encryption module to perform decryption and then executes beam switching.

10. The high-throughput satellite network according to claim 9, characterized in that: The satellite communication terminal receives link resources of a destination gateway; the satellite communication terminal establishes a communication link with the destination gateway, and transmits data based on an updated key.

Images