Data element encryption method and system for satellite communication

Abstract

The invention discloses a satellite communication-oriented data element encryption method and system, and the method comprises the steps: generating an initial key for current to-be-encrypted data through a random number generator after a current demand satellite terminal device transmits an encrypted data collection request; packaging the generated initial key in key box information, and encrypting the key box information by using a secondary encryption key to obtain key box encryption information; establishing a key box distribution list, and recording a unique identifier of each satellite terminal device and a key box decryption key corresponding to each satellite terminal device; grouping and splitting the key box encryption information into a plurality of pieces of first encryption standard data, and sending the first encryption standard data to a plurality of pieces of target satellite terminal equipment through a parallel processing mechanism; and the current demand satellite terminal equipment carries out secondary decryption on the decrypted data of the first encryption standard data based on the decryption information of the initial key to obtain the original data to be encrypted. The encryption method is provided.

Description

Technical Field

[0001] The present invention relates to the field of communication security, and in particular to a data element encryption method and system for satellite communications. Background Art

[0002] Features of Satellite Communication Data Encryption Satellite communication systems have the characteristics of wide coverage and strong anti-interference, and play an important role in emergency communications, remote monitoring and other scenarios. However, satellite communication links are vulnerable to eavesdropping and tampering, so data encryption is particularly critical. Satellite communication data encryption needs to consider factors such as limited link bandwidth and limited terminal computing resources. The encryption algorithm and key management solution need to be efficient and lightweight. At the same time, it is also necessary to meet the needs of data real-time and broken link retransmission.

[0003] The currently used satellite communication encryption method may have the following potential technical defects: For example, algorithm efficiency and computing resource limitations: Although it is mentioned that a lightweight and efficient encryption algorithm should be designed, there may be room for further optimization in the actual implementation to better adapt to the limited computing resources of satellite terminal equipment. Summary of the invention

[0004] The purpose of the present invention is to provide a data element encryption method and system for satellite communications, which solves the above-mentioned technical problems pointed out in the prior art.

[0005] The present invention provides a data element encryption method for satellite communication, comprising the following steps:

[0006] After the current satellite terminal device sends a request for receiving encrypted data, a random number generator is used to generate an initial key for the current data to be encrypted; and at the same time, the decryption information of the initial key is sent to the current satellite terminal device;

[0007] Encapsulating the generated initial key in key box information, and encrypting the key box information using a secondary encryption key to obtain key box encrypted information;

[0008] Establish a key box distribution list to record the unique identifier of each satellite terminal device and the corresponding key box decryption key;

[0009] The key box encrypted information is grouped and split into a plurality of first encryption standard data, a plurality of satellite terminal devices located in the same local area network segment are selected from the key distribution list as target satellite terminal devices, and their unique identifiers are determined; the first encryption standard data are respectively sent to the plurality of target satellite terminal devices through a parallel processing mechanism;

[0010] A plurality of target satellite terminal devices receive a plurality of first encrypted standard data in parallel, and decrypt the first encrypted standard data using the respective key box decryption keys, and send the decrypted data to the current demand satellite terminal device;

[0011] The current demand is that the satellite terminal equipment performs secondary decryption on the data decrypted by the first encryption standard data based on the decryption information of the initial key to obtain the original data to be encrypted.

[0012] Preferably, as an implementable embodiment, the secondary encryption key includes a master key or a KSK-key signing key, etc.

[0013] Preferably, as an implementable method, before sending the first encrypted standard data to multiple target satellite terminal devices respectively through a parallel processing mechanism, it also includes compressing the current first encrypted standard data, and then distributing the compressed data to the target satellite terminal devices; it should be noted that the above-mentioned compression of the first encrypted standard data can reduce the amount of data to be sent, thereby reducing the data reception and calculation burden.

[0014] It should be noted that the implementation of a parallel processing mechanism on the satellite terminal device allows multiple data packets to be processed simultaneously, thereby improving encryption efficiency.

[0015] Preferably, as an implementable method, when the execution processing module performs "sending the decrypted data to the currently required satellite terminal device" between two satellite terminal devices, data transmission is implemented based on the 802.1x port.

[0016] Use secure transmission protocols: Use secure data transmission protocols (such as Transport Layer Security (TLS), a widely recognized security protocol) to protect the security of keys during transmission. This application solution can establish a TLS transmission protocol in a local area network, and then implement secure data transmission between terminal devices based on the TLS transmission protocol.

[0017] TLS is also suitable for end devices within a local area network (LAN) because it can be used over any underlying transport protocol, including the protocol within the LAN1. The latest version of TLS, TLS1.3, provides further performance and security improvements, such as reducing handshake latency, supporting forward-only secure mode, and defining new cipher suites.

[0018] Within the LAN, you can also use 802.1x port access control to enhance security, which is a port-based network access control standard that combines port authentication for identity verification.

[0019] The above TLS protocol is the preferred protocol for achieving secure data transmission between two terminal devices, especially in situations where encryption and identity authentication are required. For security within the LAN, VLAN technology and 802.1x port access control can be used in combination to further enhance security.

[0020] Preferably, as an implementable method, after sending the first encryption standard data to a plurality of target satellite terminal devices respectively through a parallel processing mechanism, the method further includes:

[0021] Select the current target satellite terminal device from the key box distribution list and determine the unique identifier; send the key box distribution list and the unique identifier of the current target satellite terminal device to the current target satellite terminal device; the target satellite terminal device caches the unique identifier of the current target satellite terminal device itself and the key box decryption key corresponding to the queried key box distribution list.

[0022] Accordingly, the present invention also proposes a data element encryption system for satellite communication, comprising: a plurality of satellite terminal devices and a main controller;

[0023] The main controller includes a key generation module, a key encapsulation module, a key distribution list processing module, and a key data grouping module; the satellite terminal device includes an execution processing module;

[0024] The key generation module is used to generate an initial key for the current data to be encrypted using a random number generator after the current demand satellite terminal device sends a request to receive encrypted data; and at the same time, send the decryption information of the initial key to the current demand satellite terminal device;

[0025] A key encapsulation module, used to encapsulate the generated initial key in key box information, and encrypt the key box information using a secondary encryption key to obtain key box encrypted information;

[0026] The key distribution list processing module is used to establish a key box distribution list to record the unique identifier of each satellite terminal device and the corresponding key box decryption key;

[0027] The key data grouping module is used to group and split the key box encryption information into multiple first encryption standard data, select multiple satellite terminal devices located in the same local area network segment from the key distribution list as target satellite terminal devices, and determine their unique identifiers; send the first encryption standard data to the multiple target satellite terminal devices respectively through a parallel processing mechanism;

[0028] An execution processing module is used for multiple target satellite terminal devices to receive multiple first encrypted standard data in parallel, and decrypt the first encrypted standard data using the respective key box decryption keys, and send the decrypted data to the current required satellite terminal device;

[0029] There is currently a demand for a satellite terminal device, which is used to perform secondary decryption on the data decrypted by the first encryption standard data based on the decryption information of the initial key to obtain the original data to be encrypted.

[0030] Preferably, as an implementable embodiment, the secondary encryption key includes a master key or a KSK-key signing key, etc.

[0031] Preferably, as an implementable method, it also includes a compression processing module, and the compression processing module is used to compress the current first encryption standard data and then distribute the compressed data to the target satellite terminal device.

[0032] Preferably, as an implementable method, it also includes a cache processing module; the cache processing module is used to cache the unique identifier of the current target satellite terminal device and the key box decryption key corresponding to the queried key box distribution list. That is, the cache processing module is used to store the unique identifier of the current satellite terminal device and its own key box decryption key. Explanation: Implement an efficient cache mechanism on the satellite terminal device to store commonly used key box decryption keys and reduce repeated calculations.

[0033] Preferably, as an implementable embodiment, the main controller is an encryption chip or an FPGA chip.

[0034] The system of this embodiment adopts a hardware acceleration method, that is, a hardware acceleration module is used, such as a dedicated encryption chip or FPGA. In particular, FPGA has a fast operation speed and can reduce the calculation time in the encryption process.

[0035] The encrypted key is securely transmitted to each satellite terminal device. A point-to-point communication method can be used, or through a trusted key distribution center. The embodiment of the present application selects multiple secure terminals (i.e., multiple target satellite terminal devices) as a trusted key distribution center, and then multiple target satellite terminal devices perform key box information decryption to achieve end-to-end transmission to the required satellite terminal devices, thereby improving the security of data encryption through secondary encryption, and also realizing efficient encrypted data transmission processing through a distribution mechanism, thereby achieving lightweight blowing.

[0036] Correspondingly, the present application also relates to a storage medium, in which a computer program is stored. When the computer program is executed by a processor, a data element encryption method for satellite communication is implemented.

[0037] Compared with the prior art, the embodiments of the present invention have at least the following technical advantages:

[0038] By analyzing the above-mentioned data element encryption method for satellite communication provided by the present invention, it can be known that in specific applications, in the S100 stage, a random number generator is used to generate an initial key, which improves the randomness and security of the key and avoids predictable keys. In the S200 stage, the initial key is encrypted and packaged twice to form key box information, which further improves the security of the key. In the S300 stage, a key box distribution list is established to record the unique identifier and corresponding decryption key of each satellite terminal device, which facilitates the subsequent accurate and efficient distribution of the key box. In the S400 stage, a group splitting and parallel processing mechanism is adopted to distribute the key box encryption information to multiple target satellite terminal devices in the same local area network segment, which greatly improves the speed and efficiency of key distribution.

[0039] In the S500 stage, multiple target satellite terminal devices decrypt the received first encrypted standard data using their respective decryption keys, thereby ensuring the security of the data during transmission.

[0040] In the S600 stage, the satellite terminal equipment is currently required to perform secondary decryption on the decrypted data based on the initial key to ensure the integrity and confidentiality of the final data.

[0041] To sum up, the technical solution adopted in the embodiment of the present invention makes full use of random number generators, key distribution lists, parallel processing and other means to achieve efficient and secure transmission of encrypted data between satellite terminal devices, greatly improves the security and confidentiality of the overall system, and realizes lightweight security processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0043] Figure 1 An overall flow chart of a data element encryption method for satellite communication provided in Embodiment 1 of the present invention;

[0044] Figure 2 A specific flow chart of a data element encryption method for satellite communication provided in Embodiment 1 of the present invention;

[0045] Figure 3A schematic diagram of a data element encryption system for satellite communications provided in Embodiment 2 of the present invention;

[0046] Figure 4 A schematic diagram of the structure of a storage medium using the above-mentioned satellite communication-oriented data element encryption method according to Embodiment 3;

[0047] Label: satellite terminal device 10; main controller 20; key generation module 21; key encapsulation module 22; key distribution list processing module 23; key data grouping module 24; processor 1110; communication interface 1120; memory 1130; computer storage medium 1140. DETAILED DESCRIPTION

[0048] The technical solution of the present invention will be described clearly and completely below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0049] The present invention is further described in detail below through specific embodiments in conjunction with the accompanying drawings.

[0050] Embodiment 1

[0051] like Figure 1 As shown, the present invention proposes a data element encryption method for satellite communication, and the specific operation steps are as follows:

[0052] S100, after the current demand satellite terminal device sends a request for receiving encrypted data, use a random number generator to generate an initial key for the current data to be encrypted; and at the same time send decryption information of the initial key to the current demand satellite terminal device;

[0053] S200, encapsulating the generated initial key in key box information, and encrypting the key box information using a secondary encryption key to obtain key box encrypted information;

[0054] S300, establishing a key box distribution list, recording the unique identifier of each satellite terminal device and the corresponding key box decryption key;

[0055] S400, grouping and splitting the key box encrypted information into a plurality of first encryption standard data, selecting a plurality of satellite terminal devices located in the same local area network segment as target satellite terminal devices from the key distribution list, and determining their unique identifiers; sending the first encryption standard data to the plurality of target satellite terminal devices respectively through a parallel processing mechanism;

[0056] S500, multiple target satellite terminal devices receive multiple first encrypted standard data in parallel, and decrypt the first encrypted standard data using the respective key box decryption keys, and send the decrypted data to the current demand satellite terminal device;

[0057] S600. The satellite terminal device currently needs to perform secondary decryption on the data decrypted by the first encryption standard data based on the decryption information of the initial key to obtain the original data to be encrypted.

[0058] The present invention proposes a data element encryption method for satellite communications, which improves the security of the key. That is, in the S100 stage, a random number generator is used to generate the initial key, which improves the randomness and security of the key and avoids predictable keys. In the S200 stage, the initial key is encrypted and packaged twice to form key box information, which further improves the security of the key. In the S300 stage, a key box distribution list is established to record the unique identifier and corresponding decryption key of each satellite terminal device, which facilitates the subsequent accurate and efficient distribution of the key box. In the S400 stage, a group splitting and parallel processing mechanism is adopted to distribute the key box encryption information to multiple target satellite terminal devices in the same local area network segment, which greatly improves the speed and efficiency of key distribution.

[0059] In the S500 stage, multiple target satellite terminal devices decrypt the received first encrypted standard data using their respective decryption keys, thereby ensuring the security of the data during transmission.

[0060] In the S600 stage, the satellite terminal equipment is currently required to perform secondary decryption on the decrypted data based on the initial key to ensure the integrity and confidentiality of the final data.

[0061] To sum up, the technical solution adopted in the embodiment of the present invention makes full use of random number generators, key distribution lists, parallel processing and other means to achieve efficient and secure transmission of encrypted data between satellite terminal devices, greatly improves the security and confidentiality of the overall system, and realizes lightweight security processing.

[0062] The key box is a way to re-encrypt and encapsulate the initial key in order to further improve the security of the key. Composition of key box information: The key box information consists of two parts: Initial key: This is the initial key for encrypted data generated by a random number generator. Secondary encrypted key: The encrypted information formed by re-encrypting the initial key with another encryption key. The key box information can ensure the security of the initial key during transmission to prevent it from being stolen or cracked. Only the target device with the corresponding key box decryption key can successfully decrypt the key box information and obtain the initial key.

[0063] Preferably, as an implementable embodiment, the secondary encryption key includes a master key or a KSK-key signing key, etc.

[0064] Preferably, as an implementable method, before sending the first encrypted standard data to multiple target satellite terminal devices respectively through a parallel processing mechanism, it also includes compressing the current first encrypted standard data, and then distributing the compressed data to the target satellite terminal devices; it should be noted that the above-mentioned compression of the first encrypted standard data can reduce the amount of data to be sent, thereby reducing the data reception and calculation burden.

[0065] It should be noted that the implementation of a parallel processing mechanism on the satellite terminal device allows multiple data packets to be processed simultaneously, thereby improving encryption efficiency.

[0066] Preferably, as an implementable method, when the execution processing module performs "sending the decrypted data to the currently required satellite terminal device" between two satellite terminal devices, data transmission is implemented based on the 802.1x port.

[0067] Use secure transmission protocols: Use secure data transmission protocols (such as Transport Layer Security (TLS), a widely recognized security protocol) to protect the security of keys during transmission. This application solution can establish a TLS transmission protocol in a local area network, and then implement secure data transmission between terminal devices based on the TLS transmission protocol.

[0068] TLS is also suitable for end devices within a local area network (LAN) because it can be used over any underlying transport protocol, including the protocol within the LAN1. The latest version of TLS, TLS1.3, provides further performance and security improvements, such as reducing handshake latency, supporting forward-only secure mode, and defining new cipher suites.

[0069] Within the LAN, you can also use 802.1x port access control to enhance security, which is a port-based network access control standard that combines port authentication for identity verification.

[0070] The above TLS protocol is the preferred protocol for achieving secure data transmission between two terminal devices, especially in situations where encryption and identity authentication are required. For security within the LAN, VLAN technology and 802.1x port access control can be used in combination to further enhance security.

[0071] See also Figure 2 , after sending the first encryption standard data to a plurality of target satellite terminal devices respectively through a parallel processing mechanism, it also includes:

[0072] S610, selecting a current target satellite terminal device from the key box distribution list and determining a unique identifier; sending the key box distribution list and the unique identifier of the current target satellite terminal device to the current target satellite terminal device;

[0073] S620: The target satellite terminal device caches the unique identifier of the current target satellite terminal device itself and the key box decryption key corresponding to the queried key box distribution list.

[0074] In the S610 stage, while distributing the first encryption standard data, the key box distribution list and the unique identifier of the current target satellite terminal device are also sent to the target terminal device. This method can ensure that the target terminal device can accurately obtain the decryption key and avoid the problem of being unable to decrypt due to identifier mismatch.

[0075] In the S620 stage, the target satellite terminal device caches its own unique identifier and the corresponding key box decryption key, which can avoid the target terminal device from repeatedly querying the key distribution list and improve the decryption efficiency.

[0076] Through the supplementary measures in stages S610 and S620, it can be ensured that the target satellite terminal device can accurately obtain the correct decryption key and cache it.

[0077] In summary, this technical solution further optimizes the key distribution and data decryption process through the accurate sending of the key distribution list and the cache mechanism of the decryption key, ensuring the security and efficiency of the entire system. While ensuring data security, it greatly improves the transmission efficiency and has strong practicality in application scenarios with high security requirements.

[0078] See also Figure 3 ,The present invention also proposes a data element encryption system for satellite communication, comprising: a plurality of satellite terminal devices 10 and a main controller 20;

[0079] The main controller 20 includes a key generation module 21, a key encapsulation module 22, a key distribution list processing module 23, and a key data grouping module 24; the satellite terminal device 10 includes an execution processing module;

[0080] The key generation module 21 is used to generate an initial key for the current data to be encrypted using a random number generator after the current demand satellite terminal device sends a request for receiving encrypted data; and at the same time, send decryption information of the initial key to the current demand satellite terminal device;

[0081] The key encapsulation module 22 is used to encapsulate the generated initial key in the key box information, and encrypt the key box information using the secondary encryption key to obtain the key box encrypted information;

[0082] The key distribution list processing module 23 is used to establish a key box distribution list to record the unique identifier of each satellite terminal device and the corresponding key box decryption key;

[0083] The key data grouping module 24 is used to group and split the key box encryption information into multiple first encryption standard data, select multiple satellite terminal devices located in the same local area network segment from the key distribution list as target satellite terminal devices, and determine their unique identifiers; send the first encryption standard data to the multiple target satellite terminal devices respectively through a parallel processing mechanism;

[0084] The execution processing module 11 is used for multiple target satellite terminal devices to receive multiple first encrypted standard data in parallel, and decrypt the first encrypted standard data using the respective key box decryption keys, and send the decrypted data to the current required satellite terminal device;

[0085] The current demand is that the satellite terminal equipment performs secondary decryption on the data decrypted by the first encryption standard data based on the decryption information of the initial key to obtain the original data to be encrypted.

[0086] Preferably, as an implementable embodiment, the secondary encryption key includes a master key or a KSK-key signing key, etc.

[0087] Preferably, as an implementable method, it also includes a compression processing module, and the compression processing module is used to compress the current first encryption standard data and then distribute the compressed data to the target satellite terminal device.

[0088] Preferably, as an implementable method, it also includes a cache processing module; the cache processing module is used to cache the unique identifier of the current target satellite terminal device and the key box decryption key corresponding to the queried key box distribution list. That is, the cache processing module is used to store the unique identifier of the current satellite terminal device and its own key box decryption key. Explanation: Implement an efficient cache mechanism on the satellite terminal device to store commonly used key box decryption keys and reduce repeated calculations.

[0089] Preferably, as an implementable embodiment, the main controller is an encryption chip or an FPGA chip.

[0090] The system of this embodiment adopts a hardware acceleration method, that is, a hardware acceleration module is used, such as a dedicated encryption chip or FPGA. In particular, FPGA has a fast operation speed and can reduce the calculation time in the encryption process.

[0091] The encrypted key is securely transmitted to each satellite terminal device. A point-to-point communication method can be used, or through a trusted key distribution center. The embodiment of the present application selects multiple secure terminals (i.e., multiple target satellite terminal devices) as a trusted key distribution center, and then multiple target satellite terminal devices perform key box information decryption to achieve end-to-end transmission to the required satellite terminal devices, thereby improving the security of data encryption through secondary encryption, and also realizing efficient encrypted data transmission processing through a distribution mechanism, thereby achieving lightweight blowing.

[0092] Correspondingly, the present application also relates to a storage medium, in which a computer program is stored. When the computer program is executed by a processor, a data element encryption method for satellite communication is implemented.

[0093] Embodiment 3

[0094] like Figure 4 As shown, on the other hand, this embodiment 3 is based on the data element encryption method for satellite communication provided in the first embodiment of the invention, and also provides a computer storage medium 1140 (storage medium for short). It is a schematic diagram of the computer storage medium structure framework provided in the third embodiment of the invention, which includes:

[0095] A memory 1130, used for storing computer programs;

[0096] The communication interface 1120 is used to connect the memory 1130 to the processor 1110;

[0097] Processor 1110 is used to execute a computer program to implement a data element encryption method for satellite communication involved in Example 1 disclosed in combination with any of the above-mentioned implementation methods.

[0098] It is understood that the embodiments described herein can be implemented in hardware, software, firmware, middleware, microcode, or a combination thereof. For hardware implementation, the processing unit can be implemented in one or more application specific integrated circuits, digital signal processors, digital signal processing devices, programmable logic devices, field programmable gate arrays, general purpose processors, controllers, microcontrollers, microprocessors, other electronic units for performing the functions described in the present application, or a combination thereof.

[0099] For software implementation, the technology described herein can be implemented by a unit that performs the functions described herein. The software code can be stored in a memory and executed by a processor. The memory can be implemented in the processor or outside the processor.

[0100] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0101] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0102] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. A person skilled in the art may modify the technical solutions described in the above embodiments, or replace part or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A data element encryption method for satellite communication, characterized in that: The steps are as follows: After the current satellite terminal device sends a request for receiving encrypted data, a random number generator is used to generate an initial key for the current data to be encrypted; and at the same time, the decryption information of the initial key is sent to the current satellite terminal device; Encapsulating the generated initial key in key box information, and encrypting the key box information using a secondary encryption key to obtain key box encrypted information; Establish a key box distribution list to record the unique identifier of each satellite terminal device and the corresponding key box decryption key; The key box encrypted information is grouped and split into a plurality of first encryption standard data, a plurality of satellite terminal devices located in the same local area network segment are selected from the key distribution list as target satellite terminal devices, and their unique identifiers are determined; the first encryption standard data are respectively sent to the plurality of target satellite terminal devices through a parallel processing mechanism; A plurality of target satellite terminal devices receive a plurality of first encrypted standard data in parallel, and decrypt the first encrypted standard data using the respective key box decryption keys, and send the decrypted data to the current demand satellite terminal device; The current demand is that the satellite terminal equipment performs secondary decryption on the data decrypted by the first encryption standard data based on the decryption information of the initial key to obtain the original data to be encrypted.

2. According to claim 1, a method for encrypting data elements for satellite communication is characterized in that: The secondary encryption key includes a master key or a KSK-key signing key, etc.

3. The method for encrypting data elements for satellite communication according to claim 2, characterized in that: Before sending the first encrypted standard data to a plurality of target satellite terminal devices respectively through a parallel processing mechanism, the method further includes compressing the current first encrypted standard data and then distributing the compressed data to the target satellite terminal devices.

4. The method for encrypting data elements for satellite communication according to claim 3, characterized in that: When the execution processing module performs "sending the decrypted data to the currently required satellite terminal device" between two satellite terminal devices, data transmission is implemented based on the 802.1x port.

5. The method for encrypting data elements for satellite communication according to claim 4, characterized in that: After sending the first encryption standard data to a plurality of target satellite terminal devices respectively through a parallel processing mechanism, the method further includes: Select the current target satellite terminal device from the key box distribution list and determine the unique identifier; send the key box distribution list and the unique identifier of the current target satellite terminal device to the current target satellite terminal device; the target satellite terminal device caches the unique identifier of the current target satellite terminal device itself and the key box decryption key corresponding to the queried key box distribution list.

6. A data element encryption system for satellite communications, characterized in that: include: Multiple satellite terminal equipment and master controller; The main controller includes a key generation module, a key encapsulation module, a key distribution list processing module, and a key data grouping module; The satellite terminal device comprises an execution processing module; The key generation module is used to generate an initial key for the current data to be encrypted using a random number generator after the current demand satellite terminal device sends a request to receive encrypted data; and at the same time, send the decryption information of the initial key to the current demand satellite terminal device; A key encapsulation module, used to encapsulate the generated initial key in key box information, and encrypt the key box information using a secondary encryption key to obtain key box encrypted information; The key distribution list processing module is used to establish a key box distribution list to record the unique identifier of each satellite terminal device and the corresponding key box decryption key; The key data grouping module is used to group and split the key box encryption information into multiple first encryption standard data, select multiple satellite terminal devices located in the same local area network segment from the key distribution list as target satellite terminal devices, and determine their unique identifiers; send the first encryption standard data to the multiple target satellite terminal devices respectively through a parallel processing mechanism; An execution processing module is used for multiple target satellite terminal devices to receive multiple first encrypted standard data in parallel, and decrypt the first encrypted standard data using the respective key box decryption keys, and send the decrypted data to the current required satellite terminal device; There is currently a demand for a satellite terminal device, which is used to perform secondary decryption on the data decrypted by the first encryption standard data based on the decryption information of the initial key to obtain the original data to be encrypted.

7. A data element encryption system for satellite communication according to claim 6, characterized in that: It also includes a compression processing module, which is used to compress the current first encryption standard data and then distribute the compressed data to the target satellite terminal device.

8. A data element encryption system for satellite communication according to claim 7, characterized in that: It also includes a cache processing module; the cache processing module is used to cache the unique identifier of the current target satellite terminal device and the key box decryption key corresponding to the queried key box distribution list. That is, the cache processing module is used to store the unique identifier of the current satellite terminal device and its own key box decryption key.

9. The data element encryption system for satellite communication according to claim 7, characterized in that: The main controller is an encryption chip or an FPGA chip.

10. A storage medium, characterized in that: The storage medium stores a computer program, which, when executed by a processor, implements the steps of a data element encryption method for satellite communications as described in any one of claims 1 to 6.

Images