Satellite network zero-trust security protection method and system

Abstract

The invention discloses a satellite network zero-trust security protection method and system, and the method comprises the steps: building a unified identity management platform, and collecting and storing the identity information of all devices and users in a satellite network; implementing multi-factor identity authentication, and carrying out identity authentication on all the devices accessing the satellite network and the identity information of the access user; executing dynamic authorization management processing based on the identity information of the user and a feedback result of multi-factor identity authentication; a cross-domain identity joint authentication mechanism is constructed, and trust transfer between different management domains is realized; according to the method, trust transfer among different management domains is realized, refined dynamic authorization management is realized, cross-domain identity joint authentication and authorization are further realized, and trust barriers among different management domains are broken through.

Description

Technical Field

[0001] The present invention relates to the field of communication security, and in particular to a zero-trust security protection method and system for satellite networks. Background Art

[0002] Satellite network or satellite Internet, as the "new infrastructure", is an important part of my country's future information infrastructure construction, and its security is of great importance. At present, many institutions have conducted research on zero trust and zero trust security protection architecture. Based on the typical architecture of satellite Internet system, they analyze the security risks faced by satellite platform control, satellite data transmission and satellite communication. In response to the above risks, they propose a satellite Internet security protection architecture based on zero trust.

[0003] Zero trust represents a new generation of network security protection concept. Its key lies in breaking the default "trust". To sum it up in a popular phrase, it is "continuous verification, never trust". By default, no one, device or system inside or outside the enterprise network is trusted. The trust foundation of access control is rebuilt based on identity authentication and authorization to ensure that the identity, device, application and link are trusted. Based on the principle of zero trust, the three "security" of the office system can be guaranteed: terminal security, link security and access control security. Traditional network security is based on the physical boundary defense of firewalls, which is the "intranet" known to the public.

[0004] However, with the continuous rise of emerging technologies such as cloud computing, big data, and the Internet of Things, enterprise IT architecture is changing from "bounded" to "borderless", and traditional security boundaries are gradually disintegrating. With the continuous advancement of new infrastructure represented by 5G and industrial Internet, the evolution of "borderless" will be further accelerated. At the same time, zero-trust security has gradually entered people's field of vision and become a new concept and new architecture for solving network security problems in the new era.

[0005] However, the existing satellite Internet trust security system still has the following problems: Identity authentication management is complex: The satellite Internet system involves a variety of heterogeneous devices and systems, spanning different management domains, which brings great challenges to identity authentication and access control. How to ensure the credibility of identity and the refinement of authorization becomes the key. In particular, identity recognition is also crucial. Summary of the invention

[0006] The purpose of the present invention is to provide a satellite network zero-trust security protection method and system to solve the above-mentioned technical problems pointed out in the prior art.

[0007] The present invention provides a satellite network zero-trust security protection method, comprising the following steps:

[0008] Establish a unified identity management platform to collect and store the identity information of all devices and users in the satellite network;

[0009] Implement multi-factor identity authentication to authenticate the identity information of all devices and users accessing the satellite network;

[0010] Perform dynamic authorization management based on the user's identity information and the feedback results of multi-factor identity authentication;

[0011] Build a cross-domain identity federation authentication mechanism to achieve trust transfer between different management domains.

[0012] Preferably, as an implementable embodiment, the multi-factor identity authentication includes:

[0013] Obtaining a request from a user to be accessed, obtaining identity information of the user to be accessed, and collecting biometric data of the user; the biometric data includes fingerprint, facial features or iris information;

[0014] Obtain the unique device identifier in real time and generate device key information within a preset time period;

[0015] Collecting historical geographic location information of the current device, and determining whether the historical geographic location information of the current device is consistent with the physical location of the user to be accessed according to the historical geographic location information and the physical location of the user to be accessed;

[0016] If it is determined to be consistent, the user to be accessed is further allowed to send the decryption key of the input device key information to the current device within the preset time period; if the decryption is not successful within the current preset period, the current user to be accessed is prompted as a risky user.

[0017] Preferably, as an implementable solution, the dynamic authorization management process is performed based on the user's identity information and the feedback result of the multi-factor identity authentication, including:

[0018] If the current user to be connected is indicated as a risky user, then further obtain the historical normal behavior baseline of the current user to be connected;

[0019] Monitor the user's current operations in real time and compare them with the behavior baseline;

[0020] If the current detection finds that the comparison result between the current operation and the behavior baseline is that the current operation is abnormal, the authorization level of the current user to be connected is dynamically adjusted to be lowered;

[0021] Each user to be connected has three or five different authorization levels.

[0022] Preferably, as an implementable solution, the construction of a cross-domain identity joint authentication mechanism includes:

[0023] Establish a cross-domain identity mapping table to record the identity correspondence between different management domains;

[0024] When performing cross-domain identity authentication, first determine whether the devices in the two different management domains have established a mutually trusted identity correspondence in the current cross-domain identity mapping table; if so, when the current user to be accessed logs in to a device in any management domain, the current device implements the identity assertion service and generates a security token containing the user's identity information;

[0025] The security token generated by the device in the current management domain is sent to the device in another management domain. The device in the other management domain directly verifies the security token. After the verification is successful, the current user to be accessed can confirm to implement single sign-on with the device in the other management domain.

[0026] Update the identity mapping table regularly.

[0027] Preferably, as an implementable method, the real-time monitoring of the user's current operation and the comparison with the behavior baseline specifically include:

[0028] For monitoring multiple behavior features in the current operation performed by the user, calculate the absolute value of the difference between the current value and the baseline value of the behavior baseline;

[0029] The absolute value of the current difference is multiplied by the weight of the behavior feature, and the weighted difference values ​​of all current behavior features are summed to obtain the total value;

[0030] Divide the sum by the number of behavioral features to obtain a security risk score R of the behavioral baseline;

[0031] The security risk score of the above behavior baseline is R = Σ(wi*|ai-bi|) / n;

[0032] Where: R is the security risk score of the behavior baseline;

[0033] wi is the weight of the i-th behavior feature;

[0034] ai is the i-th characteristic value of the user’s current behavior;

[0035] bi is the expected value of the i-th feature in the behavioral baseline;

[0036] n is the total number of behavioral features considered;

[0037] || indicates an absolute value.

[0038] Preferably, as an implementable solution, the behavioral characteristics include the frequency of command sending per hour, the number of times sensitive data is accessed, and the login time deviation.

[0039] Preferably, as an implementable solution; if the current detection finds that the comparison result between the current execution operation and the behavior baseline is that the current execution operation is abnormal, it specifically includes: calling the scoring threshold of the current execution operation; if the security risk score of the behavior baseline is greater than the set scoring threshold, it is determined that the current execution operation is abnormal.

[0040] Accordingly, the present invention provides a satellite network zero-trust security protection system, comprising: a plurality of heterogeneous devices and a main server;

[0041] The main server includes an identity collection module, an access authentication module, an execution authentication processing module, and a cross-domain transmission module;

[0042] The identity collection module is used to establish a unified identity management platform to collect and store the identity information of all devices and users in the satellite network;

[0043] Access authentication module, used to implement multi-factor identity authentication and authenticate the identity information of all devices and users accessing the satellite network;

[0044] An authentication processing module is used to perform dynamic authorization management processing based on the user's identity information and the feedback results of multi-factor identity authentication;

[0045] The cross-domain transmission module is used to build a cross-domain identity joint authentication mechanism to achieve trust transmission between different management domains.

[0046] Preferably, as an implementable solution, the heterogeneous devices include: any two or more of fixed satellite terminals, mobile satellite terminals, vehicle-mounted terminals, satellite Internet of Things devices, high-throughput satellites, ground stations and user terminal devices.

[0047] Preferably, as an implementable solution, the devices in the different management domains are high-throughput satellites deployed across countries.

[0048] Correspondingly, the present application also relates to a storage medium, in which a computer program is stored. When the computer program is executed by a processor, a zero-trust security protection method for a satellite network is implemented.

[0049] Compared with the prior art, the embodiments of the present invention have at least the following technical advantages:

[0050] From the analysis of the above-mentioned zero-trust security protection method for satellite networks provided by the present invention, it can be known that in specific applications, a unified identity management platform is first established to collect and store the identity information of all devices and users in the satellite network; multi-factor identity authentication is implemented to authenticate the identity information of all devices and users connected to the satellite network; based on the user's identity information and the feedback results of the multi-factor identity authentication, dynamic authorization management processing is performed; and a cross-domain identity joint authentication mechanism is constructed to realize trust transfer between different management domains.

[0051] In view of the complexity of heterogeneous devices and different management domains, the present invention provides a zero-trust security protection method for satellite networks; the satellite network zero-trust security protection method is used to implement multi-factor identity authentication and refined authorization processing operations: multi-factor identity authentication technology, such as biometrics, device fingerprints, location, etc., is used to improve the credibility of the identity. Then, based on the user's identity information and the feedback results of the multi-factor identity authentication, dynamic authorization management processing is performed; finally, a cross-domain identity joint authentication mechanism is constructed to realize trust transfer between different management domains to realize refined dynamic authorization management and achieve on-demand access. Differentiated identity authentication and authorization strategies are adopted for different types of users and devices.

[0052] At the same time, the present invention proposes a zero-trust security protection method for satellite networks to achieve cross-domain and cross-system identity joint authentication and authorization, breaking through the trust barriers between different management domains. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0054] Figure 1 An overall flow chart of a satellite network zero-trust security protection method provided in Embodiment 1 of the present invention;

[0055] Figure 2 A specific process flow chart of a satellite network zero-trust security protection method provided in Embodiment 1 of the present invention;

[0056] Figure 3 Another specific process flow chart of a satellite network zero-trust security protection method provided in Embodiment 1 of the present invention;

[0057] Figure 4 A further specific process flow chart of a satellite network zero-trust security protection method provided in the first embodiment of the present invention;

[0058] Figure 5 A schematic diagram of a satellite network zero-trust security protection system provided in Embodiment 2 of the present invention;

[0059] Figure 6 This is a schematic diagram of the structure of a storage medium using the above-mentioned satellite network zero-trust security protection method in Example 3;

[0060] Labels: heterogeneous device 10; main server 20; identity collection module 21; access authentication module 22; execution authentication processing module 23; cross-domain transmission module 24; processor 1110; communication interface 1120; memory 1130; computer storage medium 1140. DETAILED DESCRIPTION

[0061] The technical solution of the present invention will be described clearly and completely below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0062] The present invention is further described in detail below through specific embodiments in conjunction with the accompanying drawings.

[0063] The existing satellite Internet trust security system has the problem of complex identity authentication management: the satellite Internet system involves a variety of heterogeneous devices and systems, spanning different management domains, which brings great challenges to identity authentication and access control. How to ensure the credibility of identity and the refinement of authorization becomes the key. In particular, identity recognition is also crucial.

[0064] Among them, the "heterogeneous devices" in the satellite Internet system mainly include various satellite terminal devices, such as fixed terminals, mobile terminals, vehicle-mounted terminals, etc., as well as ground stations and user equipment related to satellite communications. These devices may be produced by different manufacturers and have different technical specifications and communication protocols, so they are more complicated to manage. "Different management domains" involve the deployment and operation of satellite Internet in different countries and regions, while also taking into account international regulations and standards to ensure that devices in different countries and regions can be interconnected. The following is a detailed explanation of the satellite network zero-trust security protection method and system provided in an embodiment of the present invention.

[0065] Embodiment 1

[0066] like Figure 1 As shown, Embodiment 1 of the present invention proposes a zero-trust security protection method for satellite networks, and the specific operation steps are as follows:

[0067] S1. Establish a unified identity management platform to collect and store the identity information of all devices and users in the satellite network;

[0068] S2. Implement multi-factor identity authentication to authenticate the identity information of all devices and users accessing the satellite network;

[0069] S3, based on the user's identity information and the feedback results of multi-factor identity authentication, perform dynamic authorization management processing;

[0070] S4. Build a cross-domain identity joint authentication mechanism to achieve trust transfer between different management domains.

[0071] The present invention provides a zero-trust security protection method for satellite networks; the satellite network zero-trust security protection method is used to implement multi-factor identity authentication and refined authorization processing operations: multi-factor identity authentication technology, such as biometrics, device fingerprints, location, etc., is used to improve the credibility of the identity. Then, based on the user's identity information and the feedback results of the multi-factor identity authentication, dynamic authorization management processing is performed; finally, a cross-domain identity joint authentication mechanism is constructed to realize trust transfer between different management domains to realize refined dynamic authorization management and achieve on-demand access. Differentiated identity authentication and authorization strategies are adopted for different types of users and devices.

[0072] At the same time, the present invention proposes a zero-trust security protection method for satellite networks to achieve cross-domain and cross-system identity joint authentication and authorization, breaking through the trust barriers between different management domains.

[0073] Preferably, as an implementable embodiment, the multi-factor identity authentication in step S2 includes:

[0074] S21, obtaining a request from a user to be accessed, obtaining identity information of the user to be accessed, and collecting biometric data of the user; the biometric data includes but is not limited to fingerprint, facial features or iris information;

[0075] S22, obtaining a unique device identifier in real time and generating device key information within a preset time period;

[0076] S23, collecting historical geographic location information of the current device, and determining whether the historical geographic location information of the current device is consistent with the physical location of the user according to the historical geographic location information and the physical location of the user to be currently accessed;

[0077] S24. If it is determined to be consistent, the user to be accessed is further allowed to send the decryption key of the input device key information to the current device within the preset time period; if the decryption is not successful within the current preset period, the current user to be accessed is prompted as a risky user.

[0078] In order to reduce the risk of identity fraud, the enhanced system of this embodiment is adaptable to different types of biometric features to provide basic identity information for subsequent authentication steps; at the same time, a temporary but unique identity is provided for the device, and then the location consistency verification between the user and the device is analyzed. The location consistency verification is used to improve the detection capability of abnormal access patterns and enhance defense against physical location deception, thereby providing data support in the geographic dimension for user behavior analysis.

[0079] The above-mentioned zero-trust security protection for satellite networks combines biometrics, device information and geographic location to build a multi-level, hard-to-crack authentication system. Through time-sensitive keys and location verification, the authentication process is made dynamic and relevant. This multi-factor identity authentication solution significantly improves the security and reliability of the system while ensuring user convenience by comprehensively utilizing multiple verification methods, providing a solid foundation for zero-trust security protection for satellite networks.

[0080] Preferably, as an implementable solution, the step S3 of "performing dynamic authorization management processing based on the user's identity information and the feedback result of the multi-factor identity authentication" includes:

[0081] S31. If the current user to be connected is indicated as a risky user, further obtaining a historical normal behavior baseline of the current user to be connected;

[0082] S32, monitoring the user's current operation in real time and comparing it with the behavior baseline;

[0083] S33: If the current detection finds that the comparison result between the current execution operation and the behavior baseline is that the current execution operation is abnormal, dynamically adjust and reduce the authorization level of the current user to be accessed;

[0084] Each user to be connected has three or five different authorization levels.

[0085] Preferably, as an implementable solution, the cross-domain identity joint authentication mechanism in step S4 includes:

[0086] S41, establish a cross-domain identity mapping table to record the identity correspondence between different management domains;

[0087] S42, when performing cross-domain identity authentication, first determine whether the devices of the two different management domains have established a mutually trusted identity correspondence in the current cross-domain identity mapping table; if so, when the current user to be accessed logs in to a device in any management domain, the current device implements an identity assertion service and generates a security token containing the user's identity information;

[0088] S43, sending the security token generated by the device in the current management domain to the device in another management domain (to implement identity assertion between different management domains), the device in the other management domain directly verifies the security token, and after successful verification, the current user to be accessed determines to implement single sign-on with the device in the other management domain;

[0089] S44. Update the identity mapping table regularly.

[0090] During the processing of step S41 above, a cross-domain identity mapping table is established:

[0091] This step creates a data structure to record the correspondence between user identities in different management domains. Example: Assume there are two management domains: Company A's satellite communication system and Company B's ground station system. User Alice's ID in Company A's system is "A001" and her ID in Company B's system is "B789". The identity mapping table will record this correspondence: A001 (Company A) <-> B789 (Company B).

[0092] In the above step S42, the identity assertion service is implemented:

[0093] This service is responsible for generating a security token containing user identity information, commonly known as identity assertion. Example: When Alice successfully logs into Company A's system, the identity assertion service generates an encrypted security token containing Alice's identity information, permissions, and other data, such as:

[0094] {"user":"A001",

[0095] "name":"Alice",

[0096] "role":"engineer",

[0097] "exp":"2023-07-15T18:00:00Z"}

[0098] In the above step S43, identity assertion is passed to achieve single sign-on:

[0099] This step allows users to access other trusted systems after authenticating in one system without having to log in again. Example: After Alice logs in to Company A's system, she wants to access Company B's ground station data. The system passes Alice's identity assertion to Company B's system. Company B's system verifies the assertion, then queries the identity mapping table, confirms that "A001" corresponds to "B789", and allows Alice to access the data as "B789" without having to log in again.

[0100] During the processing of step S44 above, the identity mapping table is updated regularly:

[0101] This step ensures that cross-domain identity information remains up-to-date and consistent. Example: Suppose Alice's role in Company B's system changes from "Engineer" to "Project Manager". Company B will update its own user information and notify Company A to update the relevant information in the identity mapping table. In this way, the next time Alice accesses Company B's resources through Company A's system, she will obtain permissions consistent with her new role. The advantages of this mechanism include: Improved user experience: Users only need to log in once to access multiple systems. Enhanced security: Identity information is centrally managed, reducing the risks brought by multiple storage locations. Simplified management: Administrators can manage user permissions in a centralized system.

[0102] Preferably, as an implementable method, the real-time monitoring of the user's current operation and the comparison with the behavior baseline specifically include:

[0103] S321, for monitoring multiple behavior features in the current operation performed by the user, calculating the absolute value of the difference between the current value and the baseline value of the behavior baseline;

[0104] S322, multiplying the absolute value of the current difference by the weight of the behavior feature, and summing the weighted differences of all current behavior features to obtain a total value;

[0105] S323, dividing the total value by the number of behavioral features to obtain a security risk score R of the behavioral baseline;

[0106] The security risk score of the behavior baseline is R = Σ(wi*|ai-bi|) / n;

[0107] Where: R is the security risk score of the behavior baseline;

[0108] wi is the weight of the i-th behavior feature;

[0109] ai is the i-th characteristic value of the user’s current behavior;

[0110] bi is the expected value of the i-th feature in the behavioral baseline;

[0111] n is the total number of behavioral features considered;

[0112] || indicates an absolute value.

[0113] Preferably, as an implementable solution, the behavioral characteristics include the frequency of command sending per hour, the number of times sensitive data is accessed, and the login time deviation.

[0114] Specific case explanation:

[0115] Suppose we monitor the following three behavioral characteristics:

[0116] Frequency of command sending per hour (w1=0.4);

[0117] The number of times sensitive data was accessed (w2 = 0.3);

[0118] Login time deviation (hours) (w3=0.3);

[0119] Behavioral Baseline:

[0120] b1=50 (50 commands are normally sent per hour);

[0121] b2=5 (normal access to sensitive data 5 times a day);

[0122] b3=0 (usually log in during standard working hours);

[0123] Now, suppose the user's current behavior is detected:

[0124] a1=80 (80 commands sent per hour);

[0125] a2=8 (sensitive data was accessed 8 times today);

[0126] a3=2 (login 2 hours later than usual);

[0127] Calculation process: R = (0.4*|80-50|+0.3*|8-5|+0.3*|2-0|) / 3

[0128] =(0.4*30+0.3*3+0.3*2) / 3

[0129] =(12+0.9+0.6) / 3

[0130] ≈4.5

[0131] In the specific scheme of the above embodiment, the security risk score is 4.5. This value itself does not directly indicate a specific risk level, but can be used to evaluate security, that is, setting a score threshold of 5: For example, if the score (i.e., the security risk score of the behavior baseline) exceeds 5, an alarm is triggered.

[0132] It should be noted that the technical solution adopted in the embodiment of the present invention involves a dynamic risk assessment function, which implements dynamic risk assessment by monitoring user behavior in real time and comparing it with a preset behavior baseline. This enables the system to detect potential security threats in a timely manner, rather than relying on static security rules.

[0133] By using multiple weighted behavioral features (such as command sending frequency, sensitive data access times, login time deviation, etc.), the system can capture user behavior anomalies more comprehensively and accurately. This multi-dimensional analysis improves the accuracy of anomaly detection and reduces the possibility of false positives and false negatives.

[0134] Quantitative risk scoring, that is, using a mathematical model to calculate the security risk score (R = Σ(wi*|ai-bi|) / n), converts abstract security risks into specific values. This quantitative method makes risk assessment more objective and facilitates setting thresholds and conducting comparative analysis.

[0135] Preferably, as an implementable solution, if the current detection finds that the comparison result between the current execution operation and the behavior baseline is that the current execution operation is abnormal, it specifically includes: calling the score threshold of the current execution operation; if the security risk score of the behavior baseline is greater than the set score threshold, it is determined that the current execution operation is abnormal. For example, if the score exceeds 5, an alarm is triggered.

[0136] By setting scoring thresholds (such as triggering an alarm when the score exceeds 5), the system establishes an effective early warning mechanism. This enables security managers to intervene in time to deal with potential security incidents.

[0137] The dynamic authorization management solution based on behavior analysis adopted in the embodiment of the present invention has significant technical effects in improving system security, reducing potential risks, and realizing refined management. It can not only effectively cope with current security challenges, but also has good adaptability and scalability, and can meet the ever-changing security needs in the future.

[0138] Embodiment 2

[0139] See also Figure 5 , Embodiment 2 of the present invention also proposes a satellite network zero-trust security protection system, including: a plurality of heterogeneous devices 10 and a main server 20;

[0140] The main server 20 includes an identity collection module 21, an access authentication module 22, an execution authentication processing module 23, and a cross-domain transmission module 24;

[0141] The identity collection module 21 is used to establish a unified identity management platform to collect and store the identity information of all devices and users in the satellite network;

[0142] The access authentication module 22 is used to implement multi-factor identity authentication and authenticate the identity information of all devices accessing the satellite network and the access users;

[0143] An authentication processing module 23 is used to perform dynamic authorization management processing based on the user's identity information and the feedback result of the multi-factor identity authentication;

[0144] The cross-domain transmission module 24 is used to build a cross-domain identity joint authentication mechanism to achieve trust transmission between different management domains.

[0145] The above-mentioned identity collection module 21 realizes unified identity management, simplifies the maintenance and update process of identity information, improves the accuracy and consistency of identity information, reduces the complexity of identity management, and provides a reliable data basis for subsequent identity authentication and authorization management.

[0146] The main function of the access authentication module 22 is to implement multi-factor identity authentication, authenticate the identity information of all devices accessing the satellite network and the access users, reduce the risk of identity fraud and unauthorized access, and significantly improve the security and reliability of identity authentication;

[0147] The execution authentication processing module 23 and the cross-domain transmission module 24 provide differentiated authorization strategies for different users and devices, meet the needs of complex scenarios, simplify the authentication process of cross-domain access, and enhance the collaboration capabilities between different management domains. The above-mentioned satellite network zero-trust security protection system integrates a variety of advanced security technologies to effectively solve the security challenges brought by heterogeneous devices and different management domains, and provides strong protection for the safe operation of satellite networks.

[0148] Preferably, as an implementable solution, the heterogeneous devices include: any two or more of fixed satellite terminals, mobile satellite terminals, vehicle-mounted terminals, satellite Internet of Things devices, high-throughput satellites, ground stations and user terminal devices.

[0149] Preferably, as an implementable solution, the devices in the different management domains are high-throughput satellites deployed across countries.

[0150] Specifically, the heterogeneous devices of satellite Internet include but are not limited to the following: Fixed satellite terminal: a device installed on a roof or in an open area to stably connect to satellite signals. Mobile satellite terminal: can be handheld or vehicle-mounted, providing satellite communication capabilities on the move. Satellite IoT device: used to achieve remote monitoring and management of IoT devices. High-throughput satellite: provides higher data transmission rates than traditional satellites.

[0151] Different regulatory domains may include: International Telecommunication Union (ITU) regulations: involving the international coordination and allocation of satellite frequencies and orbital resources. Regulation of commercial operations and private use: commercial service providers and private users need to comply with different operating rules.

[0152] Embodiment 3

[0153] like Figure 6As shown, on the other hand, this embodiment three is based on a satellite network zero-trust security protection method provided in the invention embodiment one, and further provides a computer storage medium 1140 (referred to as storage medium). It is a schematic diagram of the computer storage medium structure framework provided in the invention embodiment three, which includes:

[0154] A memory 1130, used for storing computer programs;

[0155] The communication interface 1120 is used to connect the memory 1130 to the processor 1110;

[0156] Processor 1110 is used to execute a computer program to implement a satellite network zero-trust security protection method involved in Example 1 disclosed in combination with any of the above-mentioned implementation methods.

[0157] It is understood that the embodiments described herein can be implemented in hardware, software, firmware, middleware, microcode, or a combination thereof. For hardware implementation, the processing unit can be implemented in one or more application specific integrated circuits, digital signal processors, digital signal processing devices, programmable logic devices, field programmable gate arrays, general purpose processors, controllers, microcontrollers, microprocessors, other electronic units for performing the functions described in the present application, or a combination thereof.

[0158] For software implementation, the technology described herein can be implemented by a unit that performs the functions described herein. The software code can be stored in a memory and executed by a processor. The memory can be implemented in the processor or outside the processor.

[0159] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0160] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0161] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. A person skilled in the art may modify the technical solutions described in the above embodiments, or replace part or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A satellite network zero-trust security protection method, characterized in that: The steps are as follows: Establish a unified identity management platform to collect and store the identity information of all devices and users in the satellite network; Implement multi-factor identity authentication to authenticate the identity information of all devices and users accessing the satellite network; Perform dynamic authorization management based on the user's identity information and the feedback results of multi-factor identity authentication; Build a cross-domain identity federation authentication mechanism to achieve trust transfer between different management domains.

2. According to claim 1, a satellite network zero-trust security protection method is characterized in that: The multi-factor identity authentication includes: Obtaining a request from a user to be accessed, obtaining identity information of the user to be accessed, and collecting biometric data of the user; the biometric data includes fingerprint, facial features or iris information; Obtain the unique device identifier in real time and generate device key information within a preset time period; Collecting historical geographic location information of the current device, and determining whether the historical geographic location information of the current device is consistent with the physical location of the user to be accessed according to the historical geographic location information and the physical location of the user to be accessed; If it is determined to be consistent, the user to be accessed is further allowed to send the decryption key of the input device key information to the current device within the preset time period; if the decryption is not successful within the current preset period, the current user to be accessed is prompted as a risky user.

3. The satellite network zero-trust security protection method according to claim 2, characterized in that: The dynamic authorization management process is performed based on the user's identity information and the feedback result of the multi-factor identity authentication, including: If the current user to be connected is indicated as a risky user, then further obtain the historical normal behavior baseline of the current user to be connected; Monitor the user's current operations in real time and compare them with the behavior baseline; If the current detection finds that the comparison result between the current operation and the behavior baseline is that the current operation is abnormal, the authorization level of the current user to be connected is dynamically adjusted to be lowered; Each user to be connected has three or five different authorization levels.

4. The satellite network zero-trust security protection method according to claim 3, characterized in that: The construction of the cross-domain identity joint authentication mechanism includes: Establish a cross-domain identity mapping table to record the identity correspondence between different management domains; When performing cross-domain identity authentication, first determine whether the devices in the two different management domains have established a mutually trusted identity correspondence in the current cross-domain identity mapping table; if so, when the current user to be accessed logs in to a device in any management domain, the current device implements the identity assertion service and generates a security token containing the user's identity information; The security token generated by the device in the current management domain is sent to the device in another management domain. The device in the other management domain directly verifies the security token. After the verification is successful, the current user to be accessed can confirm to implement single sign-on with the device in the other management domain. Update the identity mapping table regularly.

5. The satellite network zero-trust security protection method according to claim 4, characterized in that: The real-time monitoring of the user's current operation and comparing it with the behavior baseline specifically includes: For monitoring multiple behavior features in the current operation performed by the user, calculate the absolute value of the difference between the current value and the baseline value of the behavior baseline; The absolute value of the current difference is multiplied by the weight of the behavior feature, and the weighted difference values ​​of all current behavior features are summed to obtain the total value; Divide the sum by the number of behavioral features to obtain a security risk score R of the behavioral baseline; The security risk score of the above behavior baseline is R = Σ(wi*|ai-bi|) / n; Where: R is the security risk score of the behavior baseline; wi is the weight of the i-th behavior feature; ai is the i-th characteristic value of the user’s current behavior; bi is the expected value of the i-th feature in the behavioral baseline; n is the total number of behavioral features considered; || indicates an absolute value.

6. The satellite network zero-trust security protection method according to claim 5, characterized in that: The behavioral characteristics include the frequency of command sending per hour, the number of times sensitive data is accessed, and the login time deviation.

7. The satellite network zero-trust security protection method according to claim 6, characterized in that: If the current detection finds that the comparison result between the current execution operation and the behavior baseline is that the current execution operation is abnormal, specifically including: calling the scoring threshold of the current execution operation; if the security risk score of the behavior baseline is greater than the set scoring threshold, it is determined that the current execution operation is abnormal.

8. A satellite network zero-trust security protection system, characterized in that: A protection processing operation is implemented using the satellite network zero-trust security protection method according to any one of claims 1 to 7, wherein the satellite network zero-trust security protection system includes: a plurality of heterogeneous devices and a main server; The main server includes an identity collection module, an access authentication module, an execution authentication processing module, and a cross-domain transmission module; The identity collection module is used to establish a unified identity management platform to collect and store the identity information of all devices and users in the satellite network; Access authentication module, used to implement multi-factor identity authentication and authenticate the identity information of all devices and users accessing the satellite network; An authentication processing module is used to perform dynamic authorization management processing based on the user's identity information and the feedback results of multi-factor identity authentication; The cross-domain transmission module is used to build a cross-domain identity joint authentication mechanism to achieve trust transmission between different management domains.

9. A satellite network zero-trust security protection system according to claim 8, characterized in that: The heterogeneous devices include: any two or more of fixed satellite terminals, mobile satellite terminals, vehicle-mounted terminals, satellite Internet of Things devices, high-throughput satellites, ground stations and user terminal devices.

10. A satellite network zero-trust security protection system according to claim 8, characterized in that: The devices in the different management domains are high-throughput satellites deployed across countries.

Images