Dual-computer hot-standby satellite-borne cryptographic equipment, main-standby switching method, satellite and communication system

Abstract

The invention relates to a dual-computer hot-standby satellite-borne cryptographic device, a main-standby switching method, a satellite and a communication system, and the dual-computer hot-standby satellite-borne cryptographic device adopts a single-board dual-computer hot-standby hardware architecture; comprising a cryptographic module A and a cryptographic module B which are mutually active and standby, and an RAM chip which is used as a shared memory of the cryptographic module A and the cryptographic module B, two one-way signal lines are connected between the password module A and the password module B, one signal line transmits main and standby signals of the password module A from the password module A to the password module B, the other signal line transmits main and standby signals of the password module B from the password module B to the password module A, and the main and standby signals are used for autonomous switching of dual-computer hot standby; and the RAM chip is used for storing state information required by main / standby switching. According to the invention, the reliability of satellite load service password processing is improved.

Description

Technical Field

[0001] The present invention belongs to the field of low-orbit satellite mobile communications, and in particular relates to a dual-machine hot standby on-board cryptographic device, a master-standby switching method, a satellite and a communication system. Background Art

[0002] The reliability of onboard cryptographic equipment directly affects the service performance and stability of satellite payloads. At present, the industry generally adopts dual-machine hot standby or dual-machine cold standby working mode to improve the reliability of onboard cryptographic equipment, but both methods have certain shortcomings.

[0003] In the dual-machine hot standby mode, the two onboard cryptographic devices work independently and provide cryptographic services to the outside world at the same time. The satellite payload needs to judge the master and standby machines according to the working status of the onboard cryptographic devices and select one output as the processing result. This design not only requires the satellite payload to maintain the master and standby states of the onboard cryptographic devices, but also requires the satellite payload to send the business data to be encrypted and decrypted to the two onboard cryptographic devices at the same time, and select the two outputs of encryption and decryption processing, which increases the complexity and power consumption of the satellite payload.

[0004] In the dual-machine cold standby mode, only the main machine of the onboard cryptographic equipment provides cryptographic services to the outside world, and the backup machine of the onboard cryptographic equipment is not powered on. When the main machine fails, the satellite payload powers on the backup machine, and the backup machine replaces the main machine to provide cryptographic services. During the main-backup switching process of the onboard cryptographic equipment, the satellite payload will be temporarily interrupted until the backup machine switches to the main machine to resume normal operation.

[0005] Therefore, the reliability design mechanism of satellite-borne cryptographic equipment in the prior art needs to be further improved. Summary of the invention

[0006] In view of the above analysis, the present invention aims to disclose a dual-machine hot-standby satellite-borne cryptographic device, a master-standby switching method, a satellite and a communication system to improve the reliability of satellite payload service cryptographic processing.

[0007] The present invention discloses a dual-machine hot standby satellite-borne cryptographic device, which adopts a single-board dual-machine hot standby hardware architecture; comprising: a cryptographic module A and a cryptographic module B with completely identical software and hardware configurations as a primary and a standby, and a RAM chip as a shared memory for the cryptographic module A and the cryptographic module B;

[0008] The cryptographic module A and the cryptographic module B work in a dual-machine hot standby mode, wherein the cryptographic module in the master state provides business encryption and decryption services, and the cryptographic module in the standby state monitors the master state on standby;

[0009] Two unidirectional signal lines are connected between the cryptographic module A and the cryptographic module B, one of which transmits the master / slave signal of the cryptographic module A from the cryptographic module A to the cryptographic module B, and the other transmits the master / slave signal of the cryptographic module B from the cryptographic module B to the cryptographic module A; according to the master / slave signals transmitted on the two unidirectional signal lines, the master / slave switching control is performed between the cryptographic modules to realize the autonomous switching of the dual-machine hot standby;

[0010] The RAM chip is used to store the state information required for the master-slave switching; the password module in the master state writes data to the RAM chip; when the master-slave switching occurs, the password module newly switched to the master reads data from the RAM chip for data synchronization.

[0011] Further, the cryptographic module A includes a service port A and a control port A connected to the satellite payload; the cryptographic module B includes a service port B and a control port B connected to the satellite payload;

[0012] The business port is used to transmit business information to and from the satellite payload, and the control port is used to receive control instructions from the satellite payload and to report the working status to the satellite payload at regular intervals.

[0013] Furthermore, the satellite payload receives the working status of the main and backup machines through the management and control interface, and determines the main and backup status of the two cryptographic modules according to the received working status of the main and backup machines; the satellite payload only calls the cryptographic module in the host state to encrypt and decrypt the business data; the satellite payload does not send any business data to the cryptographic module in the backup state.

[0014] Furthermore, according to the power-on sequence or the predefined password module priority, a password module in normal state is selected to operate in the master state; and another password module is operated in the standby state.

[0015] Furthermore, during the encryption and decryption process, when the cryptographic module in the host state detects that its own work is abnormal, it switches from master to standby state, pulls down the master-standby signal, and informs the cryptographic module in the standby state through the local master-standby signal transmitted on the unidirectional signal line, and reports the abnormal working state to the satellite payload through the management and control interface; after the cryptographic module in the standby state monitors that the cryptographic module in the host state is working abnormally, it switches from master to standby state to host state, pulls up the master-standby signal, and informs the other end machine through the local master-standby signal transmitted on the unidirectional signal line that the local machine has switched to host state, reports the local working state as host state through the management and control interface, receives the service data of the satellite payload from the service interface, reads the status information from the RAM chip to complete data synchronization, and then continues to perform data encryption and decryption processing.

[0016] The present invention also discloses a method for switching between a master and a standby onboard cryptographic device of a dual-machine hot standby satellite, comprising the following steps:

[0017] After power-on, the status of the two password modules are set to the master or the standby according to the preset conditions of the master and standby machines, the self-test results of the password modules and whether it is the first startup; the master and standby machines transmit their respective master and standby control signals;

[0018] Before the active / standby switchover, the cryptographic module in the active state writes the data required for the business encryption / decryption processing into the shared RAM chip while performing the business encryption / decryption service; the cryptographic module in the standby state monitors the active / standby signal sent by the cryptographic module in the active state;

[0019] During the master-slave switch, the cryptographic module in the master state determines an abnormality during the service encryption and decryption service, pulls down the master-slave signal of the local machine, sets the state to the standby machine, and reports the fault state to the satellite payload; after the cryptographic module in the standby state monitors the master-slave signal pulled down by the host machine, it pulls up the master-slave signal of the local machine, sets the state to the host machine, reports the working state to the satellite payload, receives the service data sent by the satellite payload through the local service interface, and reads the status information from the RAM chip to complete data synchronization;

[0020] After the master-slave switch, the cryptographic module switched to the master state performs business encryption and decryption services and writes the data required for business encryption and decryption processing into the shared RAM chip. The cryptographic module switched to the backup state waits for the satellite payload to initiate a reset command before restarting.

[0021] Furthermore, the cryptographic module switches from the host state to the standby state, and the workflow of encrypting and decrypting the business information of the satellite payload includes:

[0022] (1) The default setting of this end is that the password module of the host completes initialization and self-test after startup;

[0023] (2) Determine whether the self-test is an error; if so, pull down the local master-slave signal, set the state to the standby machine, and send the local master-slave signal to the password module preset as the standby machine at the other end through a one-way signal line; and report the self-test error state to the satellite payload through the control interface at regular intervals; if not, proceed to the next step;

[0024] (3) Determine whether it is the first startup; if yes, it means that no encryption and decryption processing abnormality has occurred, the local master-slave signal is pulled high, the state is set to the master, and the local master-slave signal is sent to the opposite end's cryptographic module through a one-way signal line, and the telemetry status is regularly reported to the satellite payload through the control interface, and jump to step (5); if no, go to the next step;

[0025] (4) For non-first startup, it indicates that the local machine has experienced an abnormal encryption and decryption process, and it is necessary to set whether the local machine is in the master state according to the master-slave state sent by the cryptographic module of the other end; if the master-slave state sent by the other end is low, indicating that the other end is a backup machine, then the master-slave signal of the local machine is pulled high, the state is set to the master, and the master-slave signal of the local machine is sent to the other end through the unidirectional signal line, and the working state is regularly reported to the satellite payload through the management and control interface, and jump to step (5); if the master-slave state sent by the other end is high, indicating that the other end is the master, then the master-slave signal of the local machine is pulled low, the state is set to the backup machine, and the master-slave signal of the local machine is sent to the other end through the unidirectional signal line, and then step (4) is repeated to monitor the master-slave signal sent by the other end;

[0026] (5) In the host state, the cryptographic module continuously receives service information sent by the satellite payload through the service interface, directly forwards the service data that does not need to be encrypted and decrypted, and completes the encryption and decryption processing and state synchronization for the service data that needs to be encrypted and decrypted before sending it to the satellite payload;

[0027] (6) Determine whether the encryption and decryption processing is abnormal; if not, return to (5); if yes, pull down the local master-slave signal, set the state to standby, and send the local master-slave signal to the other end through the unidirectional signal line, immediately report the telemetry state to the satellite payload, and wait for the satellite payload to initiate a reset command and then restart.

[0028] Furthermore, the cryptographic module switches from the standby state to the main state, and the work flow of encrypting and decrypting the business information of the satellite payload includes:

[0029] (1) The default setting of this terminal is to complete initialization and self-test after the standby machine is started;

[0030] (2) Determine whether the self-test is an error; if so, pull down the local master / slave signal, set the state to the standby machine, send the local master / slave signal to the password module preset as the master at the other end through a one-way signal line; and report the self-test error state to the satellite payload through the control interface at regular intervals; if not, proceed to the next step;

[0031] (3) If the self-check is correct, the machine is set to the standby state according to the master-slave state sent by the other end; if the other end is the host, the master-slave signal of the machine is pulled low, the state is set to the standby state, and the master-slave signal of the machine is sent to the other end through the unidirectional signal line; if the other end is the standby machine, the master-slave signal of the machine is pulled high, the state is set to the host, and the master-slave signal of the machine is sent to the other end through the unidirectional signal line; and the telemetry state is regularly reported to the satellite payload through the control interface, and the process goes to step (4);

[0032] (4) In the host state, the cryptographic module continuously receives service information sent by the satellite payload through the service interface, directly forwards the service data that does not need to be encrypted and decrypted, and completes the encryption and decryption processing and state synchronization for the service data that needs to be encrypted and decrypted before sending it to the satellite payload;

[0033] (5) Determine whether the encryption and decryption processing is abnormal; if not, return to (4); if yes, pull down the local master-slave signal, set the state to standby, and send the local master-slave signal to the other end through the unidirectional signal line, immediately report the working status to the satellite payload, and wait for the satellite payload to initiate a reset command and then restart.

[0034] The present invention also discloses an access network satellite, comprising: a satellite payload, an onboard cryptographic device, a routing switching device, an inter-satellite communication unit and a feeding communication unit; the onboard cryptographic device is the dual-machine hot standby onboard cryptographic device as described above.

[0035] The present invention also discloses a satellite communication system, comprising: an access network satellite, a space-based bearer network, a ground gateway station and a ground core network; the access network satellite is the access network satellite described above;

[0036] A space-based bearer network is built between access network satellites through inter-satellite links; inter-satellite links are built between the space-based bearer network and the ground gateway stations to jointly realize the routing and forwarding of inter-satellite and satellite-to-ground data, and provide NG interface connection for communication between the satellite access network and the ground core network; the ground core network adopts a 5G core network to implement user management and business management.

[0037] The present invention can achieve one of the following beneficial effects:

[0038] The dual-machine hot standby satellite-borne cryptographic device, the master-slave switching method, the dual-machine hot standby satellite-borne cryptographic device in the satellite and communication system disclosed by the present invention adopts a single-board dual-machine hot standby design mode, and the master and standby cryptographic modules support autonomous switching. The master and standby cryptographic modules do not need to send heartbeat information to each other, and only synchronize the master and standby states through signals, and synchronize the security context and working state through shared memory. The data in the shared memory adopts a triple-module redundancy design to improve reliability, with high real-time performance and strong reliability. Only the cryptographic module host works, and the standby only reports the working state. The satellite payload only needs to send data to the cryptographic module host and receive its processing results, which can effectively reduce the design complexity and working power consumption of the satellite payload. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] The accompanying drawings are only used for the purpose of illustrating specific embodiments and are not to be considered as limiting the present invention. In the entire drawings, the same reference symbols represent the same components;

[0040] Figure 1A schematic block diagram showing the connection of dual-machine hot standby onboard cryptographic equipment in an embodiment of the present invention;

[0041] Figure 2 It is a flow chart of a method for switching between a master and a standby onboard cryptographic device with dual hot standby in an embodiment of the present invention;

[0042] Figure 3 A flow chart of a method for switching a cryptographic module from a host state to a standby state in an embodiment of the present invention;

[0043] Figure 4 A flow chart of a method for switching a cryptographic module from a standby state to a master state in an embodiment of the present invention;

[0044] Figure 5 A schematic block diagram of the connection of satellite components of an access network in an embodiment of the present invention;

[0045] Figure 6 The present invention is a schematic block diagram showing the connection components of a satellite communication system in an embodiment of the present invention. DETAILED DESCRIPTION

[0046] The preferred embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings, wherein the accompanying drawings constitute a part of this application and are used to illustrate the principles of the present invention together with the embodiments of the present invention.

[0047] Embodiment 1

[0048] One embodiment of the present invention discloses a dual-machine hot standby on-board cryptographic device, such as Figure 1 As shown, a single-board dual-machine hot standby hardware architecture is adopted; including: a password module A and a password module B which are mutually active and standby, and a RAM chip which serves as a shared memory of the password module A and the password module B;

[0049] The software and hardware configurations of cryptographic modules A and B are exactly the same, and they work in a dual-machine hot standby mode. The cryptographic module in the master state provides business encryption and decryption services, and the cryptographic module in the standby state is on standby to monitor the master state.

[0050] Two unidirectional signal lines are connected between the cryptographic module A and the cryptographic module B, one of which transmits the master / slave signal of the cryptographic module A from the cryptographic module A to the cryptographic module B, and the other transmits the master / slave signal of the cryptographic module B from the cryptographic module B to the cryptographic module A; according to the master / slave signals transmitted on the two unidirectional signal lines, the master / slave switching control is performed between the two cryptographic modules to realize the autonomous switching of the dual-machine hot standby;

[0051] The RAM chip is used to store the state information required for the master-slave switching; the password module in the master state writes data to the RAM chip; when the master-slave switching occurs, the password module newly switched to the master reads data from the RAM chip to achieve data synchronization.

[0052] Specifically, the state information required for the active / standby switching stored in the RAM chip includes synchronous security context and working state data; and the data in the RAM chip adopts a triple-module redundancy design.

[0053] In this embodiment, the master and standby cryptographic modules do not need to send heartbeat information to each other. The master and standby states are synchronized only through signals. Shared memory is used to synchronize security context and working status. The data in the shared memory adopts a triple-module redundant design to improve reliability, with high real-time performance and strong reliability.

[0054] Specifically, the cryptographic module A includes a service port A and a control port A connected to the satellite payload; the cryptographic module B includes a service port B and a control port B connected to the satellite payload;

[0055] The business port is used to transmit business information to and from the satellite payload, and the control port is used to receive control instructions from the satellite payload and to report the working status to the satellite payload at regular intervals.

[0056] Among them, the business interface of the cryptographic module is used to transmit business information between the satellite payload;

[0057] The control interface is used to receive control instructions from the satellite payload and to report the working status to the satellite payload at regular intervals.

[0058] The satellite payload receives the working status of the main and backup machines through the management and control interface, and determines the main and backup status of the two cryptographic modules based on the received working status of the main and backup machines; the satellite payload only calls the cryptographic module in the host state to encrypt and decrypt the business data; the satellite payload does not send any business data to the cryptographic module in the backup state.

[0059] In this embodiment, only the cryptographic module host is working, and the cryptographic module standby only reports the working status. The satellite payload only needs to send data to the cryptographic module host and receive its processing results, which can effectively reduce the design complexity and working power consumption of the satellite payload.

[0060] When the dual-machine hot standby onboard cryptographic device is working, according to the power-on sequence or the predefined cryptographic module priority, the cryptographic module in normal state is selected to work in the master state; the other cryptographic module is made to work in the standby state.

[0061] During the encryption and decryption process, when the cryptographic module in the host state detects that its own work is abnormal, it switches from master to standby state, pulls the master-standby signal low, and informs the cryptographic module in the standby state through the local master-standby signal transmitted on the unidirectional signal line, and reports the abnormal working state to the satellite payload through the management and control interface; after the cryptographic module in the standby state monitors that the cryptographic module in the host state is working abnormally, it switches from master to standby state, pulls the master-standby signal high, and informs the other end machine through the local master-standby signal transmitted on the unidirectional signal line that the local machine has switched to the host state, reports the local working state as the host state through the management and control interface, receives the service data of the satellite payload from the service interface, reads the status information from the RAM chip to complete data synchronization, and then continues to perform data encryption and decryption processing.

[0062] In summary, the dual-machine hot standby satellite-borne cryptographic equipment disclosed in this embodiment adopts a single-board dual-machine hot standby design mode, and supports autonomous switching between the main and standby cryptographic modules. The main and standby cryptographic modules do not need to send heartbeat information to each other, and only synchronize the status of the main and standby machines through signals. Shared memory is used to synchronize security context and working status. The data in the shared memory adopts a triple-module redundancy design to improve reliability, with high real-time performance and strong reliability. Only the main cryptographic module works, and the standby machine only reports the working status. The satellite payload only needs to send data to the main cryptographic module and receive its processing results, which can effectively reduce the design complexity and working power consumption of the satellite payload.

[0063] Embodiment 2

[0064] An embodiment of the present invention discloses a method for switching between a dual-machine hot standby onboard cryptographic device and a master-slave device. Figure 2 As shown, the following steps are included:

[0065] After power-on, the status of the two password modules are set to the master or the standby according to the preset conditions of the master and standby machines, the self-test results of the password modules and whether it is the first startup; the master and standby machines transmit their respective master and standby control signals;

[0066] The master-slave machine preset condition is to preset the password modules as master and backup machines according to the power-on sequence; or to preset the password modules as master and backup machines with predefined password module priorities; for example, predefine password module A as the master machine and password module B as the backup machine.

[0067] Before the active / standby switchover, the cryptographic module in the active state writes the data required for the business encryption / decryption processing into the shared RAM chip while performing the business encryption / decryption service; the cryptographic module in the standby state monitors the active / standby signal sent by the cryptographic module in the active state;

[0068] During the master-slave switch, the cryptographic module in the master state determines an abnormality during the service encryption and decryption service, pulls down the master-slave signal of the local machine, sets the state to the standby machine, and reports the fault state to the satellite payload; after the cryptographic module in the standby state monitors the master-slave signal pulled down by the host machine, it pulls up the master-slave signal of the local machine, sets the state to the host machine, reports the working state to the satellite payload, receives the service data sent by the satellite payload through the local service interface, and reads the status information from the RAM chip to complete data synchronization;

[0069] After the master-slave switch, the cryptographic module switched to the master state performs business encryption and decryption services and writes the data required for business encryption and decryption processing into the shared RAM chip. The cryptographic module switched to the backup state waits for the satellite payload to initiate a reset command before restarting.

[0070] More specifically, the cryptographic module switches from the host state to the standby state, and the satellite payload's business information is encrypted and decrypted. Figure 3 As shown, including:

[0071] (1) The default setting of this end is that the password module of the host completes initialization and self-test after startup;

[0072] (2) Determine whether the self-test is an error; if so, pull down the local master-slave signal, set the state to the standby machine, and send the local master-slave signal to the password module preset as the standby machine at the other end through a one-way signal line; and report the self-test error state to the satellite payload through the control interface at regular intervals; if not, proceed to the next step;

[0073] (3) Determine whether it is the first startup; if yes, it means that no encryption and decryption processing abnormality has occurred, the local master-slave signal is pulled high, the state is set to the master, and the local master-slave signal is sent to the opposite end's cryptographic module through a one-way signal line, and the telemetry status is regularly reported to the satellite payload through the control interface, and jump to step (5); if no, go to the next step;

[0074] (4) For non-first startup, it indicates that the local machine has experienced an abnormal encryption and decryption process, and it is necessary to set whether the local machine is in the master state according to the master-slave state sent by the cryptographic module of the other end; if the master-slave state sent by the other end is low, indicating that the other end is a backup machine, then the master-slave signal of the local machine is pulled high, the state is set to the master, and the master-slave signal of the local machine is sent to the other end through the unidirectional signal line, and the working state is regularly reported to the satellite payload through the management and control interface, and jump to step (5); if the master-slave state sent by the other end is high, indicating that the other end is the master, then the master-slave signal of the local machine is pulled low, the state is set to the backup machine, and the master-slave signal of the local machine is sent to the other end through the unidirectional signal line, and then step (4) is repeated to monitor the master-slave signal sent by the other end;

[0075] (5) In the host state, the cryptographic module continuously receives service information sent by the satellite payload through the service interface, directly forwards the service data that does not need to be encrypted and decrypted, and completes the encryption and decryption processing and state synchronization for the service data that needs to be encrypted and decrypted before sending it to the satellite payload;

[0076] (6) Determine whether the encryption and decryption processing is abnormal; if not, return to (5); if yes, pull down the local master-slave signal, set the state to standby, and send the local master-slave signal to the other end through the unidirectional signal line, immediately report the telemetry state to the satellite payload, and wait for the satellite payload to initiate a reset command and then restart.

[0077] More specifically, the cryptographic module switches from the standby state to the main state, and the satellite payload's business information is encrypted and decrypted. Figure 4 As shown, including:

[0078] (1) The default setting of this terminal is to complete initialization and self-test after the standby machine is started;

[0079] (2) Determine whether the self-test is an error; if so, pull down the local master / slave signal, set the state to the standby machine, send the local master / slave signal to the password module preset as the master at the other end through a one-way signal line; and report the self-test error state to the satellite payload through the control interface at regular intervals; if not, proceed to the next step;

[0080] (3) If the self-check is correct, the machine is set to the standby state according to the master-slave state sent by the other end; if the other end is the host, the master-slave signal of the machine is pulled low, the state is set to the standby state, and the master-slave signal of the machine is sent to the other end through the unidirectional signal line; if the other end is the standby machine, the master-slave signal of the machine is pulled high, the state is set to the host, and the master-slave signal of the machine is sent to the other end through the unidirectional signal line; and the telemetry state is regularly reported to the satellite payload through the control interface, and the process goes to step (4);

[0081] (4) In the host state, the cryptographic module continuously receives service information sent by the satellite payload through the service interface, directly forwards the service data that does not need to be encrypted and decrypted, and completes the encryption and decryption processing and state synchronization for the service data that needs to be encrypted and decrypted before sending it to the satellite payload;

[0082] (5) Determine whether the encryption and decryption processing is abnormal; if not, return to (4); if yes, pull down the local master-slave signal, set the state to standby, and send the local master-slave signal to the other end through the unidirectional signal line, immediately report the working status to the satellite payload, and wait for the satellite payload to initiate a reset command and then restart.

[0083] Embodiment 3

[0084] One embodiment of the present invention discloses an access network satellite, such as Figure 5As shown, it includes satellite payload (gNB), satellite-borne cryptographic equipment, routing and switching equipment, inter-satellite communication unit, feed communication unit and other functional units;

[0085] Among them, the satellite payload, routing and switching equipment, intersatellite communication unit and feed communication unit all adopt existing equipment and technologies disclosed in the prior art that can realize the satellite terminal access function, and realize random access and mobility management of satellite communication terminals.

[0086] Among them, the satellite payload realizes the function of communication base station;

[0087] The routing exchange unit realizes the routing exchange between the satellite payload and the inter-satellite communication unit, the feed communication unit and other functional units;

[0088] Intersatellite communication unit, used to establish intersatellite links between satellites in the access network to build a space-based bearer network;

[0089] The feeding communication unit is used to realize the feeding and communication functions of each component unit in the access network satellite;

[0090] Other functional units are necessary functional units for the access network satellite to realize the satellite terminal network access function;

[0091] The onboard cryptographic device is the dual-machine hot standby onboard cryptographic device as described in Example 1;

[0092] The dual-machine hot standby satellite-borne cryptographic equipment provides dual-machine hot standby encryption and decryption processing services for access network satellites, thereby improving the reliability of satellite payload service cryptographic processing.

[0093] In this embodiment, the specific technical features and beneficial effects of the dual-machine hot standby onboard cryptographic device are the same as those disclosed in Example 1, so please refer to them and will not be elaborated here.

[0094] Embodiment 4

[0095] One embodiment of the present invention discloses a satellite communication system, such as Figure 6 As shown, it includes access network satellites, space-based bearer networks, ground gateway stations and ground core networks;

[0096] Among them, the access network satellite is the access network satellite with dual-machine hot-standby onboard cryptographic equipment as described in Example 3; it provides control information and business information encryption and decryption services for the satellite payload (gNB) of the access network satellite.

[0097] A space-based bearer network is built between the access network satellites through inter-satellite links; an inter-satellite-ground feeder link is built between the space-based bearer network and the ground gateway station; the space-based bearer network and the gateway station jointly realize the routing and forwarding of inter-satellite and satellite-ground data, provide NG interface connection between the satellite access network and the ground core network, and transmit control plane signaling and user plane data.

[0098] The ground core network adopts a 5G core network to implement user management and business management; the ground core network may include 5G core networks of multiple operators; each operator's 5G core network performs user management and business management on its own satellite communication terminals; the core networks are logically isolated to ensure the security of each operator's user information and business information.

[0099] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by any technician familiar with the technical field within the technical scope disclosed by the present invention should be covered within the protection scope of the present invention.

Claims

1. A dual-machine hot standby onboard cryptographic device, characterized in that: Adopt single-board dual-machine hot standby hardware architecture; including: cryptographic module A and cryptographic module B with completely the same hardware and software configuration as each other, and RAM chip as shared memory of cryptographic module A and cryptographic module B; The cryptographic module A and the cryptographic module B work in a dual-machine hot standby mode, wherein the cryptographic module in the master state provides business encryption and decryption services, and the cryptographic module in the standby state monitors the master state on standby; Two unidirectional signal lines are connected between the cryptographic module A and the cryptographic module B, one of which transmits the master / slave signal of the cryptographic module A from the cryptographic module A to the cryptographic module B, and the other transmits the master / slave signal of the cryptographic module B from the cryptographic module B to the cryptographic module A; according to the master / slave signals transmitted on the two unidirectional signal lines, the master / slave switching control is performed between the cryptographic modules to realize the autonomous switching of the dual-machine hot standby; The RAM chip is used to store the state information required for the master-slave switching; the password module in the master state writes data to the RAM chip; when the master-slave switching occurs, the password module newly switched to the master reads data from the RAM chip for data synchronization.

2. The dual-machine hot standby onboard cryptographic device according to claim 1 is characterized in that: The cryptographic module A includes a service port A and a control port A connected to the satellite payload; the cryptographic module B includes a service port B and a control port B connected to the satellite payload; The business port is used to transmit business information to and from the satellite payload, and the control port is used to receive control instructions from the satellite payload and to report the working status to the satellite payload at regular intervals.

3. The dual-machine hot standby onboard cryptographic device according to claim 2 is characterized in that: The satellite payload receives the working status of the master and backup machines through the control interface, and determines the master and backup status of the two cryptographic modules according to the received working status of the master and backup machines; The satellite payload only calls the cryptographic module in the host state to encrypt and decrypt the business data; the satellite payload does not send any business data to the cryptographic module in the standby state.

4. The dual-machine hot standby onboard cryptographic device according to claim 2 is characterized in that: According to the power-on sequence or the predefined password module priority, a password module in normal state is selected to work in the master state; and another password module is made to work in the standby state.

5. The dual-machine hot standby onboard cryptographic device according to claim 1, characterized in that: During the encryption and decryption process, when the cryptographic module in the host state detects that its own work is abnormal, it switches from master to standby state, pulls the master-standby signal low, and informs the cryptographic module in the standby state through the local master-standby signal transmitted on the unidirectional signal line, and reports the abnormal working state to the satellite payload through the management and control interface; after the cryptographic module in the standby state monitors that the cryptographic module in the host state is working abnormally, it switches from master to standby state, pulls the master-standby signal high, and informs the other end machine through the local master-standby signal transmitted on the unidirectional signal line that the local machine has switched to the host state, reports the local working state as the host state through the management and control interface, receives the service data of the satellite payload from the service interface, reads the status information from the RAM chip to complete data synchronization, and then continues to perform data encryption and decryption processing.

6. A method for switching between a master and a standby onboard cryptographic device of a dual-machine hot standby spacecraft according to any one of claims 1 to 5, characterized in that: The following steps are involved: After power-on, the status of the two password modules are set to the master or the standby according to the preset conditions of the master and standby machines, the self-test results of the password modules and whether it is the first startup; the master and standby machines transmit their respective master and standby control signals; Before the active / standby switchover, the cryptographic module in the active state writes the data required for the business encryption / decryption processing into the shared RAM chip while performing the business encryption / decryption service; the cryptographic module in the standby state monitors the active / standby signal sent by the cryptographic module in the active state; During the master-slave switch, the cryptographic module in the master state determines an abnormality during the service encryption and decryption service, pulls down the master-slave signal of the local machine, sets the state to the standby machine, and reports the fault state to the satellite payload; after the cryptographic module in the standby state monitors the master-slave signal pulled down by the host machine, it pulls up the master-slave signal of the local machine, sets the state to the host machine, reports the working state to the satellite payload, receives the service data sent by the satellite payload through the local service interface, and reads the status information from the RAM chip to complete data synchronization; After the master-slave switch, the cryptographic module switched to the master state performs business encryption and decryption services and writes the data required for business encryption and decryption processing into the shared RAM chip. The cryptographic module switched to the backup state waits for the satellite payload to initiate a reset command before restarting.

7. The method for switching between active and standby dual-machine hot standby onboard cryptographic equipment according to claim 6, characterized in that: The cryptographic module switches from the host state to the standby state, and the workflow for encrypting and decrypting the satellite payload's business information includes: (1) The default setting of this end is that the password module of the host completes initialization and self-test after startup; (2) Determine whether the self-test is an error; if so, pull down the local master-slave signal, set the state to the standby machine, and send the local master-slave signal to the password module preset as the standby machine at the other end through a one-way signal line; and report the self-test error state to the satellite payload through the control interface at regular intervals; if not, proceed to the next step; (3) Determine whether it is the first startup; if yes, it means that no encryption and decryption processing abnormality has occurred, the local master-slave signal is pulled high, the state is set to the master, and the local master-slave signal is sent to the opposite end's cryptographic module through a one-way signal line, and the telemetry status is regularly reported to the satellite payload through the control interface, and jump to step (5); if no, go to the next step; (4) For non-first startup, it indicates that the local machine has experienced an abnormal encryption and decryption process, and it is necessary to set whether the local machine is in the master state according to the master-slave state sent by the cryptographic module of the other end; if the master-slave state sent by the other end is low, indicating that the other end is a backup machine, then the master-slave signal of the local machine is pulled high, the state is set to the master, and the master-slave signal of the local machine is sent to the other end through the unidirectional signal line, and the working state is regularly reported to the satellite payload through the management and control interface, and jump to step (5); if the master-slave state sent by the other end is high, indicating that the other end is the master, then the master-slave signal of the local machine is pulled low, the state is set to the backup machine, and the master-slave signal of the local machine is sent to the other end through the unidirectional signal line, and then step (4) is repeated to monitor the master-slave signal sent by the other end; (5) In the host state, the cryptographic module continuously receives service information sent by the satellite payload through the service interface, directly forwards the service data that does not need to be encrypted and decrypted, and completes the encryption and decryption processing and state synchronization for the service data that needs to be encrypted and decrypted before sending it to the satellite payload; (6) Determine whether the encryption and decryption processing is abnormal; if not, return to (5); if yes, pull down the local master-slave signal, set the state to standby, and send the local master-slave signal to the other end through the unidirectional signal line, immediately report the telemetry state to the satellite payload, and wait for the satellite payload to initiate a reset command and then restart.

8. The method for switching between active and standby dual-machine hot standby onboard cryptographic equipment according to claim 6, characterized in that: The cryptographic module switches from the standby state to the main state, and the satellite payload's business information is encrypted and decrypted. The workflow includes: (1) The default setting of this terminal is to complete initialization and self-test after the standby machine is started; (2) Determine whether the self-test is an error; if so, pull down the local master / slave signal, set the state to the standby machine, send the local master / slave signal to the password module preset as the master at the other end through a one-way signal line; and report the self-test error state to the satellite payload through the control interface at regular intervals; if not, proceed to the next step; (3) If the self-check is correct, the machine is set to the standby state according to the master-slave state sent by the other end; if the other end is the host, the master-slave signal of the machine is pulled low, the state is set to the standby state, and the master-slave signal of the machine is sent to the other end through the unidirectional signal line; if the other end is the standby machine, the master-slave signal of the machine is pulled high, the state is set to the host, and the master-slave signal of the machine is sent to the other end through the unidirectional signal line; and the telemetry state is regularly reported to the satellite payload through the control interface, and the process goes to step (4); (4) In the host state, the cryptographic module continuously receives service information sent by the satellite payload through the service interface, directly forwards the service data that does not need to be encrypted and decrypted, and completes the encryption and decryption processing and state synchronization for the service data that needs to be encrypted and decrypted before sending it to the satellite payload; (5) Determine whether the encryption and decryption processing is abnormal; if not, return to (4); if yes, pull down the local master-slave signal, set the state to standby, and send the local master-slave signal to the other end through the unidirectional signal line, immediately report the working status to the satellite payload, and wait for the satellite payload to initiate a reset command and then restart.

9. An access network satellite, comprising: Satellite payload, onboard cryptographic equipment, routing and switching equipment, intersatellite communication unit and feed communication unit, characterized in that the onboard cryptographic equipment is a dual-machine hot standby onboard cryptographic equipment as described in any one of claims 1-5.

10. A satellite communication system comprising: An access network satellite, a space-based bearer network, a ground gateway station and a ground core network; wherein the access network satellite is the access network satellite as claimed in claim 9; A space-based bearer network is built between access network satellites through inter-satellite links; inter-satellite links are built between the space-based bearer network and the ground gateway stations to jointly realize the routing and forwarding of inter-satellite and satellite-to-ground data, and provide NG interface connection for communication between the satellite access network and the ground core network; the ground core network adopts a 5G core network to implement user management and business management.

Images