Satellite link data transmission method and device, equipment and storage medium

Abstract

The invention discloses a satellite link data transmission method and device, equipment and a storage medium, and relates to the technical field of satellite communication, and the method comprises the steps: receiving an initial message through an internal network port of a preset encryption center, and carrying out the routing query of a target message meeting a preset IP legal condition; performing strategy matching and data encryption packaging on the data stream in the target message based on an Internet security protocol stack; establishing a TCP connection with a destination IP corresponding to an IP head in the encapsulation security load message by using the first TCP proxy center so as to encapsulate the encapsulation security load message; and recursively processing the packaged message by using a second TCP proxy center of a preset decryption center, decrypting the processed message through an Internet security protocol stack, and sending a target message to a service terminal to complete satellite link data transmission operation. A destination message is packaged twice based on an internet security protocol stack and a TCP proxy center, so that the confidentiality and integrity of transmission data are ensured.

Description

Technical Field

[0001] The present invention relates to the field of satellite communication technology, and in particular to a satellite link data transmission method, device, equipment and storage medium. Background Art

[0002] At present, traditional IPSec VPN (IPSec, Internet Protocol Security; VPN, Virtual Private Network) is deployed on communication links. Although this method ensures the confidentiality and integrity of data transmission and can be independent of user services, after IPSec VPN encrypts and encapsulates the data, it will add ESP (Encapsulate Security Payload) headers and / or UDP (User Datagram Protocol) headers to the outside of the original TCP (Transmission Control Protocol) message, which causes the TCP acceleration mechanism on the link to fail and causes a serious decline in service quality.

[0003] As can be seen from the above, how to ensure the confidentiality and integrity of data transmission without reducing the TCP communication performance of the satellite link is an urgent problem to be solved. Summary of the invention

[0004] In view of this, the purpose of the present invention is to provide a satellite link data transmission method, device, equipment and storage medium, which can ensure the confidentiality and integrity of data transmission without reducing the satellite link TCP communication performance. The specific scheme is as follows:

[0005] In a first aspect, the present application provides a satellite link data transmission method, comprising:

[0006] Receive the initial message through the internal network port of the preset encryption center, perform route query on the target message that meets the preset IP legal conditions, and send the target message to the Internet security protocol stack based on the route query result;

[0007] Based on the Internet security protocol stack, policy matching and data encryption encapsulation are performed on the data flow in the target message to obtain an encapsulated security payload message;

[0008] Using the first TCP proxy center of the preset encryption center to establish a TCP connection with the destination IP corresponding to the IP header in the Encapsulating Security Payload message, and encapsulating the Encapsulating Security Payload message through the TCP connection to obtain an encapsulated message;

[0009] The encapsulated message is recursively processed by the second TCP proxy center of the preset decryption center, and the processed message is decrypted through the Internet security protocol stack, and the obtained target message is sent to the service terminal to complete the corresponding satellite link data transmission operation.

[0010] Optionally, receiving the initial message through the internal network port of the preset encryption center, performing a route query on the target message that meets the preset IP legal condition, and sending the target message to the Internet security protocol stack based on the route query result, includes:

[0011] Receive the initial message through the internal network port of the preset encryption center, and perform IP legitimacy verification on the initial message based on the preset cryptographic algorithm;

[0012] The target message that meets the preset IP legal conditions is obtained through the verification result, and a route query is performed on the target message to obtain a corresponding route query result, and the target message is sent to the Internet security protocol stack based on the route query result.

[0013] Optionally, performing policy matching and data encryption encapsulation on the data flow in the target message based on the Internet security protocol stack to obtain an encapsulated security payload message includes:

[0014] Parsing the target message based on the Internet security protocol stack to obtain a corresponding message selector;

[0015] The message selector performs policy matching and data encryption encapsulation on the data flow in the target message to obtain a corresponding encapsulation security payload message.

[0016] Optionally, also include:

[0017] Before the Encapsulating Security Payload message is sent out through the external network port, the first TCP proxy center is used to intercept the Encapsulating Security Payload message to obtain the Encapsulating Security Payload message.

[0018] Optionally, the using the first TCP proxy center of the preset encryption center to establish a TCP connection with a destination IP corresponding to the IP header in the Encapsulating Security Payload message, and encapsulating the Encapsulating Security Payload message through the TCP connection to obtain an encapsulated message includes:

[0019] Utilize the first TCP proxy center to parse the IP header of the encapsulation security payload message to obtain the destination IP;

[0020] Establishing a connection relationship between the first TCP proxy center and the destination IP through the TCP protocol;

[0021] The Encapsulation Security Payload message is encapsulated based on the connection relationship, a checksum of the encapsulated IP header is calculated to obtain a new IP header, and an encapsulated message is obtained based on the new IP header.

[0022] Optionally, the recursive processing of the encapsulated message by the second TCP proxy center of the preset decryption center includes:

[0023] After receiving the encapsulated message, the second TCP proxy center verifies the legitimacy of the encapsulated message, and strips the encapsulated message based on the verification result to obtain a corresponding encapsulation security payload message;

[0024] The encapsulated security payload message is recursively processed based on a preset kernel protocol stack, a routing query result, and a preset message protocol, and the processed message is sent to an Internet security protocol stack.

[0025] Optionally, decrypting the processed message through the Internet security protocol stack and sending the obtained target message to the service terminal to complete the corresponding satellite link data transmission operation includes:

[0026] Performing a corresponding security alliance search on the triplet in the processed message through the Internet security protocol stack; decrypting the processed message based on the search result to obtain the corresponding target message;

[0027] The target message is sent to the service terminal through the preset intranet port to complete the corresponding satellite link data transmission operation.

[0028] In a second aspect, the present application provides a satellite link data transmission device, comprising:

[0029] A routing query module is used to receive the initial message through the internal network port of the preset encryption center, perform routing query on the target message that meets the preset IP legal conditions, and send the target message to the Internet security protocol stack based on the routing query result;

[0030] An encryption and encapsulation module, used for performing policy matching and data encryption and encapsulation on the data flow in the target message based on the Internet security protocol stack to obtain an encapsulated security payload message;

[0031] A message encapsulation module, used to establish a TCP connection with a destination IP corresponding to the IP header in the encapsulation security payload message by using the first TCP proxy center of the preset encryption center, and encapsulate the encapsulation security payload message through the TCP connection to obtain an encapsulated message;

[0032] The recursive processing module is used to recursively process the encapsulated message using the second TCP proxy center of the preset decryption center, decrypt the processed message through the Internet security protocol stack, and send the obtained target message to the service terminal to complete the corresponding satellite link data transmission operation.

[0033] In a third aspect, the present application provides an electronic device, including:

[0034] Memory, used to store computer programs;

[0035] The processor is used to execute the computer program to implement the aforementioned satellite link data transmission method.

[0036] In a fourth aspect, the present application provides a computer-readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the aforementioned satellite link data transmission method.

[0037] The present application receives an initial message through an intranet port of a preset encryption center, performs a route query on a target message that meets a preset IP legal condition, and sends the target message to an Internet security protocol stack based on the route query result; performs policy matching and data encryption encapsulation on a data stream in the target message based on the Internet security protocol stack to obtain an encapsulated security payload message; uses a first TCP proxy center of the preset encryption center to establish a TCP connection with a destination IP corresponding to an IP header in the encapsulated security payload message, and encapsulates the encapsulated security payload message through the TCP connection to obtain an encapsulated message; uses a second TCP proxy center of a preset decryption center to recursively process the encapsulated message, decrypts the processed message through the Internet security protocol stack, and sends the obtained target message to a service terminal to complete a corresponding satellite link data transmission operation. As can be seen from the above, the present application first receives the initial message through the intranet port of the preset encryption center, performs a route query on the target message that meets the preset IP legal conditions, and sends the target message to the Internet security protocol stack based on the route query result, and then encapsulates the target message for the first time through the Internet security protocol stack to obtain an encapsulated security payload message, and then uses the first TCP proxy center of the preset encryption center to establish a TCP connection with the destination IP corresponding to the IP header in the encapsulated security payload message, and completes secondary encapsulation based on the TCP connection to obtain an encapsulated message. After the preset decryption center receives the encapsulated message, the TCP proxy center and the Internet security protocol stack in the preset decryption center are used to recursively process and decrypt the encapsulated message to obtain the target message, and finally the target message is sent to the service terminal to complete the corresponding satellite link data transmission operation. Based on the Internet security protocol stack and the TCP proxy center, the destination message is encapsulated twice without destroying the original TCP business characteristics, ensuring that the link throughput in the TCP acceleration environment and the advanced flow control strategy of the link exit are not affected by encryption. While adapting to the TCP acceleration link, the confidentiality and integrity of the transmitted data are also guaranteed. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0039] Figure 1 This is a flow chart of a satellite link data transmission method disclosed in this application;

[0040] Figure 2A data processing flow chart provided for this application;

[0041] Figure 3 This is a schematic diagram of the structure of a satellite link data transmission device disclosed in this application;

[0042] Figure 4 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0043] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0044] At present, the method of deploying traditional IPSec VPN on the communication link can not only ensure the confidentiality and integrity of data transmission, but also be independent of user services. However, after IPSec VPN encrypts and encapsulates the data, it will add an ESP header and / or a UDP header outside the original TCP message, which causes the TCP acceleration mechanism on the link to fail and cause a serious decline in service quality. To this end, the present application provides a satellite link data transmission method, which encapsulates the destination message twice based on the Internet security protocol stack and the TCP proxy center, does not destroy the original TCP service characteristics, ensures that the link throughput in the TCP acceleration environment and the advanced flow control strategy of the link exit are not affected by encryption, and while adapting to the TCP acceleration link, it also ensures the confidentiality and integrity of the transmitted data.

[0045] See also Figure 1 As shown, an embodiment of the present invention discloses a satellite link data transmission method, comprising:

[0046] Step S11, receiving the initial message through the internal network port of the preset encryption center, performing a route query on the target message that meets the preset IP legal conditions, and sending the target message to the Internet security protocol stack based on the route query result.

[0047] In this embodiment, a domestic cryptographic algorithm is used to perform identity authentication and integrity verification on the received initial message to obtain the corresponding target message, and a route query is performed on the target message, and the target message is sent to the Internet security protocol stack based on the transmission path queried by the route query result, so that the target message is processed by the Internet security protocol stack. Specifically, the initial message is received through the intranet port of the preset encryption center, the route query is performed on the target message that meets the preset IP legal conditions, and the target message is sent to the Internet security protocol stack based on the route query result, including: receiving the initial message through the intranet port of the preset encryption center, and performing IP legality verification on the initial message based on the preset cryptographic algorithm; obtaining the target message that meets the preset IP legal conditions through the verification result, and performing a route query on the target message to obtain the corresponding route query result, and sending the target message to the Internet security protocol stack based on the route query result. It is worth mentioning that the domestic cryptographic algorithm can be one of SM2 / 3 / 4 (SM2, i.e., an asymmetric encryption algorithm; SM3, i.e., a hash algorithm; SM4, i.e., a symmetric encryption algorithm), and no specific limitation is made here.

[0048] Step S12: performing policy matching and data encryption encapsulation on the data flow in the target message based on the Internet security protocol stack to obtain an encapsulated security payload message.

[0049] In this embodiment, after the Internet security protocol stack receives the target message, the target message is parsed by the Internet security protocol stack to obtain the selector of the target message (i.e., the message selector), and the data stream in the target message is subjected to policy matching and data encryption encapsulation based on the message selector to obtain an ESP message (i.e., an encapsulated security payload message). Specifically, the policy matching and data encryption encapsulation of the data stream in the target message based on the Internet security protocol stack to obtain an encapsulated security payload message includes: parsing the target message based on the Internet security protocol stack to obtain a corresponding message selector; and the policy matching and data encryption encapsulation of the data stream in the target message through the message selector to obtain a corresponding encapsulated security payload message. It is worth mentioning that the data encryption encapsulation is to encrypt and encapsulate the target message using an ESP tunnel.

[0050] Step S13, using the first TCP proxy center of the preset encryption center to establish a TCP connection with the destination IP corresponding to the IP header in the encapsulation security payload message, and encapsulate the encapsulation security payload message through the TCP connection to obtain an encapsulated message.

[0051] In this embodiment, before the Encapsulating Security Payload message is sent to the external network, the first TCP proxy center of the preset encryption center captures the Encapsulating Security Payload message at the POSTROUTING (i.e., export conversion) point. Specifically, before the Encapsulating Security Payload message is sent through the external network port, the first TCP proxy center is used to intercept the Encapsulating Security Payload message to obtain the Encapsulating Security Payload message.

[0052] It can be understood that after the first TCP proxy center obtains the encapsulated security payload message, the IP header of the encapsulated security payload message is parsed to obtain the destination IP, and a TCP connection is established with the destination IP through the first TCP proxy center, and based on the IP header of the encapsulated security payload message, the encapsulated security payload message is encapsulated into a new TCP message, and the IP checksum is recalculated to obtain the encapsulated message. Specifically, the first TCP proxy center using the preset encryption center establishes a TCP connection with the destination IP corresponding to the IP header in the encapsulated security payload message, and encapsulates the encapsulated security payload message through the TCP connection to obtain the encapsulated message, including: parsing the IP header of the encapsulated security payload message using the first TCP proxy center to obtain the destination IP; establishing a connection relationship between the first TCP proxy center and the destination IP through the TCP protocol; encapsulating the encapsulated security payload message based on the connection relationship, calculating the checksum of the encapsulated IP header to obtain a new IP header, and obtaining the encapsulated message based on the new IP header.

[0053] Step S14: recursively process the encapsulated message using the second TCP proxy center of the preset decryption center, decrypt the processed message through the Internet security protocol stack, and send the obtained target message to the service terminal to complete the corresponding satellite link data transmission operation.

[0054] In this embodiment, after the second TCP proxy center of the preset decryption center receives the encapsulated message, it first performs a validity check on the encapsulated message, then strips the IP header and TCP header of the encapsulated message to obtain the encapsulated security payload message, reassembles the IP header and the encapsulated security payload message to obtain an IP message, and sends the IP message to the preset kernel protocol stack, recursively processes the IP message using the preset kernel protocol stack, and submits the processed message to the Internet security protocol stack. Specifically, the recursive processing of the encapsulated message by the second TCP proxy center of the preset decryption center includes: after the second TCP proxy center receives the encapsulated message, it verifies the validity of the encapsulated message, and strips the encapsulated message based on the verification result to obtain the corresponding encapsulated security payload message; recursively processes the encapsulated security payload message based on the preset kernel protocol stack, the routing query result, and the preset message protocol, and sends the processed message to the Internet security protocol stack.

[0055] It can be understood that the processed message is searched for a security alliance and decrypted using the Internet security protocol stack and the triplet (i.e., the destination address, the protocol, and the SPI (Service Provider Interface)) to obtain the original data packet (i.e., the target message), and the target message is sent to the service terminal through the intranet port. Specifically, the decryption of the processed message through the Internet security protocol stack and the sending of the obtained target message to the service terminal to complete the corresponding satellite link data transmission operation include: searching for the corresponding security alliance for the triplet in the processed message through the Internet security protocol stack; decrypting the processed message based on the search result to obtain the corresponding target message; and sending the target message to the service terminal through the preset intranet port to complete the corresponding satellite link data transmission operation.

[0056] As can be seen from the above, the present application first receives the initial message through the intranet port of the preset encryption center, performs a route query on the target message that meets the preset IP legal conditions, and sends the target message to the Internet security protocol stack based on the route query result, and then encapsulates the target message for the first time through the Internet security protocol stack to obtain an encapsulated security payload message, and then uses the first TCP proxy center of the preset encryption center to establish a TCP connection with the destination IP corresponding to the IP header in the encapsulated security payload message, and completes secondary encapsulation based on the TCP connection to obtain an encapsulated message. After the preset decryption center receives the encapsulated message, the TCP proxy center and the Internet security protocol stack in the preset decryption center are used to recursively process and decrypt the encapsulated message to obtain the target message, and finally the target message is sent to the service terminal to complete the corresponding satellite link data transmission operation. Based on the Internet security protocol stack and the TCP proxy center, the destination message is encapsulated twice without destroying the original TCP business characteristics, ensuring that the link throughput in the TCP acceleration environment and the advanced flow control strategy of the link exit are not affected by encryption. While adapting to the TCP acceleration link, the confidentiality and integrity of the transmitted data are also guaranteed.

[0057] It can be seen from the above embodiments that the present application performs double encapsulation of the destination message based on the Internet security protocol stack and the TCP proxy center to perform data transmission on the satellite link. Therefore, the data processing process during data transmission is described.

[0058] For further information, see Figure 2 As shown, an embodiment of the present invention provides a data processing flow chart, including:

[0059] First, the initial message of the TCP Client (i.e., the TCP client) is obtained through the intranet port of the preset encryption center, wherein the initial message includes payload data, a TCP header, and an IP header, and the initial message is sent to the IPSec protocol stack (i.e., the Internet Security Protocol Stack), and the IPSec protocol stack is used to perform the first message encapsulation on the target message that meets the preset IP legal conditions to obtain the ESP message (i.e., the Encapsulated Security Payload Message); then, the ESP message is intercepted and encapsulated for the second time by the first TCP proxy center to obtain the encapsulated message, and the encapsulated message is sent to the TCP acceleration channel through the external network port to receive the encapsulated message through the second TCP proxy center of the preset decryption center, and the processed message is subjected to legality verification and recursive processing by the second TCP proxy center, and the processed message is subjected to recursive and decryption processing by the IPSec protocol stack to obtain the processed message, and the processed message is restored to the original data packet and sent to the TCP Server (i.e., the TCP server) through the intranet port.

[0060] As can be seen from the above, the TCP proxy technology is used to encapsulate the message twice, hiding the IP of the real communication device at the back end, without destroying the original TCP service characteristics, ensuring the reliability of the identities of both parties in communication, the confidentiality and integrity of the communication data, and ensuring the security of satellite link communication. IPSec VPN is used to protect data transmission on the satellite link without any adjustment to the user's business, achieving business-insensitive encryption, which can be applied to other wireless environments with large delays and high bit error rates.

[0061] Accordingly, see Figure 3 As shown, the present application also provides a satellite link data transmission device, comprising:

[0062] The routing query module 11 is used to receive the initial message through the internal network port of the preset encryption center, perform routing query on the target message that meets the preset IP legal conditions, and send the target message to the Internet security protocol stack based on the routing query result;

[0063] The encryption and encapsulation module 12 is used to perform policy matching and data encryption and encapsulation on the data flow in the target message based on the Internet security protocol stack to obtain an encapsulated security payload message;

[0064] The message encapsulation module 13 is used to establish a TCP connection with the destination IP corresponding to the IP header in the encapsulation security payload message by using the first TCP proxy center of the preset encryption center, and encapsulate the encapsulation security payload message through the TCP connection to obtain an encapsulated message;

[0065] The recursive processing module 14 is used to recursively process the encapsulated message using the second TCP proxy center of the preset decryption center, decrypt the processed message through the Internet security protocol stack, and send the obtained target message to the service terminal to complete the corresponding satellite link data transmission operation.

[0066] As can be seen from the above, the present application first receives the initial message through the intranet port of the preset encryption center, performs a route query on the target message that meets the preset IP legal conditions, and sends the target message to the Internet security protocol stack based on the route query result, and then encapsulates the target message for the first time through the Internet security protocol stack to obtain an encapsulated security payload message, and then uses the first TCP proxy center of the preset encryption center to establish a TCP connection with the destination IP corresponding to the IP header in the encapsulated security payload message, and completes secondary encapsulation based on the TCP connection to obtain an encapsulated message. After the preset decryption center receives the encapsulated message, the TCP proxy center and the Internet security protocol stack in the preset decryption center are used to recursively process and decrypt the encapsulated message to obtain the target message, and finally the target message is sent to the service terminal to complete the corresponding satellite link data transmission operation. Based on the Internet security protocol stack and the TCP proxy center, the destination message is encapsulated twice without destroying the original TCP business characteristics, ensuring that the link throughput in the TCP acceleration environment and the advanced flow control strategy of the link exit are not affected by encryption. While adapting to the TCP acceleration link, the confidentiality and integrity of the transmitted data are also guaranteed.

[0067] In some specific implementations, the routing query module 11 may specifically include:

[0068] A legitimacy verification unit, used to receive an initial message through an intranet port of a preset encryption center, and perform an IP legitimacy verification on the initial message based on a preset cryptographic algorithm;

[0069] The routing query unit is used to obtain a target message that meets the preset IP legal conditions through the verification result, and perform a routing query on the target message to obtain a corresponding routing query result, and send the target message to the Internet security protocol stack based on the routing query result.

[0070] In some specific implementations, the encryption encapsulation module 12 may specifically include:

[0071] A message parsing unit, used for parsing the target message based on the Internet security protocol stack to obtain a corresponding message selector;

[0072] The data encryption unit is used to perform policy matching and data encryption encapsulation on the data flow in the target message through the message selector to obtain a corresponding encapsulated security payload message.

[0073] In some specific implementations, the satellite link data transmission device may further include:

[0074] The message interception unit is used to intercept the encapsulation security payload message by using the first TCP proxy center before the encapsulation security payload message is sent out through the external network port to obtain the encapsulation security payload message.

[0075] In some specific implementations, the message encapsulation module 13 may specifically include:

[0076] An IP header parsing unit, configured to parse the IP header of the encapsulation security payload message using the first TCP proxy center to obtain a destination IP;

[0077] A connection relationship establishing unit, used to establish a connection relationship between the first TCP proxy center and the destination IP through the TCP protocol;

[0078] The message encapsulation completion unit is used to encapsulate the encapsulation security payload message based on the connection relationship, calculate the checksum of the encapsulated IP header to obtain a new IP header, and obtain the encapsulated message based on the new IP header.

[0079] In some specific implementations, the recursive processing module 14 may specifically include:

[0080] A message stripping unit, configured to verify the legitimacy of the encapsulated message after the second TCP proxy center receives the encapsulated message, and perform a stripping operation on the encapsulated message based on the verification result to obtain a corresponding encapsulation security payload message;

[0081] The message recursion unit is used to recursively process the encapsulated security payload message based on a preset kernel protocol stack, a routing query result and a preset message protocol, and send the processed message to the Internet security protocol stack.

[0082] In some specific implementations, the recursive processing module 14 may specifically include:

[0083] A triplet search unit is used to search for a corresponding security alliance for a triplet in the processed message through an Internet security protocol stack; and decrypt the processed message based on the search result to obtain a corresponding target message;

[0084] The message sending unit is used to send the target message to the service terminal through a preset internal network port to complete the corresponding satellite link data transmission operation.

[0085] Furthermore, the present application also discloses an electronic device. Figure 41 is a structural diagram of an electronic device 20 according to an exemplary embodiment, and the content of the diagram cannot be regarded as any limitation on the scope of use of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, and the computer program is loaded and executed by the processor 21 to implement the relevant steps in the satellite link data transmission method disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0086] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0087] In addition, the memory 22 as a carrier for resource storage may be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon may include an operating system 221, a computer program 222, etc., and the storage method may be temporary storage or permanent storage.

[0088] The operating system 221 is used to manage and control the hardware devices and computer program 222 on the electronic device 20, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the satellite link data transmission method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks.

[0089] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein the computer program, when executed by a processor, implements the satellite link data transmission method disclosed above. For the specific steps of the method, reference may be made to the corresponding contents disclosed in the above embodiments, and no further description will be given here.

[0090] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0091] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0092] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0093] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0094] The technical solution provided by the present application is introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for general technicians in this field, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A satellite link data transmission method, characterized in that: include: Receive the initial message through the internal network port of the preset encryption center, perform route query on the target message that meets the preset IP legal conditions, and send the target message to the Internet security protocol stack based on the route query result; Based on the Internet security protocol stack, policy matching and data encryption encapsulation are performed on the data flow in the target message to obtain an encapsulated security payload message; Using the first TCP proxy center of the preset encryption center to establish a TCP connection with the destination IP corresponding to the IP header in the Encapsulating Security Payload message, and encapsulating the Encapsulating Security Payload message through the TCP connection to obtain an encapsulated message; The encapsulated message is recursively processed by the second TCP proxy center of the preset decryption center, and the processed message is decrypted through the Internet security protocol stack, and the obtained target message is sent to the service terminal to complete the corresponding satellite link data transmission operation.

2. The satellite link data transmission method according to claim 1, characterized in that: The method of receiving the initial message through the internal network port of the preset encryption center, performing a route query on the target message that meets the preset IP legal conditions, and sending the target message to the Internet security protocol stack based on the route query result includes: Receive the initial message through the internal network port of the preset encryption center, and perform IP legitimacy verification on the initial message based on the preset cryptographic algorithm; The target message that meets the preset IP legal conditions is obtained through the verification result, and a route query is performed on the target message to obtain a corresponding route query result, and the target message is sent to the Internet security protocol stack based on the route query result.

3. The satellite link data transmission method according to claim 1, characterized in that: The performing policy matching and data encryption encapsulation on the data flow in the target message based on the Internet security protocol stack to obtain an encapsulated security payload message includes: Parsing the target message based on the Internet security protocol stack to obtain a corresponding message selector; The message selector performs policy matching and data encryption encapsulation on the data flow in the target message to obtain a corresponding encapsulation security payload message.

4. The satellite link data transmission method according to claim 1, characterized in that: Also includes: Before the Encapsulating Security Payload message is sent out through the external network port, the first TCP proxy center is used to intercept the Encapsulating Security Payload message to obtain the Encapsulating Security Payload message.

5. The satellite link data transmission method according to claim 1, characterized in that: The first TCP proxy center using the preset encryption center establishes a TCP connection with the destination IP corresponding to the IP header in the encapsulation security payload message, and encapsulates the encapsulation security payload message through the TCP connection to obtain an encapsulated message, including: Utilize the first TCP proxy center to parse the IP header of the encapsulation security payload message to obtain the destination IP; Establishing a connection relationship between the first TCP proxy center and the destination IP through the TCP protocol; The Encapsulation Security Payload message is encapsulated based on the connection relationship, a checksum of the encapsulated IP header is calculated to obtain a new IP header, and an encapsulated message is obtained based on the new IP header.

6. The satellite link data transmission method according to claim 1, characterized in that: The second TCP proxy center using the preset decryption center performs recursive processing on the encapsulated message, including: After receiving the encapsulated message, the second TCP proxy center verifies the legitimacy of the encapsulated message, and strips the encapsulated message based on the verification result to obtain a corresponding encapsulation security payload message; The encapsulated security payload message is recursively processed based on a preset kernel protocol stack, a routing query result, and a preset message protocol, and the processed message is sent to an Internet security protocol stack.

7. The satellite link data transmission method according to claim 1, characterized in that: The method of decrypting the processed message through the Internet security protocol stack and sending the obtained target message to the service terminal to complete the corresponding satellite link data transmission operation includes: Performing a corresponding security alliance search on the triplet in the processed message through the Internet security protocol stack; decrypting the processed message based on the search result to obtain the corresponding target message; The target message is sent to the service terminal through the preset intranet port to complete the corresponding satellite link data transmission operation.

8. A satellite link data transmission device, characterized in that: include: A routing query module is used to receive the initial message through the internal network port of the preset encryption center, perform routing query on the target message that meets the preset IP legal conditions, and send the target message to the Internet security protocol stack based on the routing query result; An encryption and encapsulation module, used for performing policy matching and data encryption and encapsulation on the data flow in the target message based on the Internet security protocol stack to obtain an encapsulated security payload message; A message encapsulation module, used to establish a TCP connection with a destination IP corresponding to the IP header in the encapsulation security payload message by using the first TCP proxy center of the preset encryption center, and encapsulate the encapsulation security payload message through the TCP connection to obtain an encapsulated message; The recursive processing module is used to recursively process the encapsulated message using the second TCP proxy center of the preset decryption center, decrypt the processed message through the Internet security protocol stack, and send the obtained target message to the service terminal to complete the corresponding satellite link data transmission operation.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the satellite link data transmission method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store a computer program, wherein when the computer program is executed by a processor, the satellite link data transmission method according to any one of claims 1 to 7 is implemented.

Images