Lightweight satellite network security management system and method

Abstract

The invention provides a lightweight satellite network security management system and method. According to the system, unified management of a satellite network security control plane is realized through the centralized network controller. The system has the functions of satellite node security authentication, dynamic security policy generation and issuing, real-time network monitoring, rapid security event response and the like. The network controller comprises an authentication module, a strategy generation module, a monitoring module, an event response module and the like, a security strategy can be customized according to satellite characteristics, and security threats can be dealt with through real-time monitoring and timely adjustment. The invention also comprises a lightweight design which is particularly suitable for a satellite environment with limited resources, and a method for continuously optimizing a security policy based on monitoring data and event records. In addition, the provided user interface allows a satellite network administrator to conveniently perform policy configuration and event processing. According to the system, through centralized management and dynamic adjustment, the safety and the operation efficiency of the satellite network are remarkably improved, the system has the advantages of light weight, flexibility, real-time performance and the like, and the safety management requirement of the modern satellite network is met.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a lightweight satellite network security management system and method suitable for a satellite network environment, for improving the security and efficiency of the satellite network. Background Art

[0002] With the acceleration of the global informatization process, satellite networks, as an important part of integrated space-ground communications, play an increasingly important role in military, civil, scientific research and other fields. However, due to the openness and dynamism of satellite networks, they face severe security challenges. Traditional satellite network security measures, such as static firewall rules and single authentication mechanisms, have been unable to meet the increasingly complex network threats and attack methods. Software Defined Network (SDN) technology, with its centralized control and programmability, provides a new idea for solving the security problems of satellite networks. SDN can achieve flexible control of network traffic and rapid deployment of security policies, but its application in satellite networks is still in the exploratory stage. In particular, the particularity of the satellite network environment, such as limited bandwidth, delay sensitivity, dynamic node changes, etc., puts forward higher requirements for the lightweight, real-time and reliability of SDN security solutions. Existing SDN security solutions often have problems such as large resource consumption, slow response speed and poor compatibility, which are difficult to meet the actual needs of satellite networks. In addition, the large-scale deployment and complex topology of satellite networks also bring challenges to the unified management and rapid response of security policies. Therefore, how to design a satellite network security management solution that is both lightweight and efficient to achieve comprehensive protection of satellite networks has become a key technical issue that needs to be solved urgently. Summary of the invention

[0003] The technical problem solved by the present invention is to overcome the limitations of existing satellite network security measures in terms of limited resources, poor adaptability to dynamic environments, and insufficient centralized management. A lightweight satellite network security management system and method are provided to achieve global monitoring of satellite networks, real-time security policy issuance and execution, and rapid response to security threats, thereby significantly improving the overall security and reliability of satellite networks.

[0004] The technical solution of the present invention is: a lightweight satellite network security management system, which includes a satellite network, a network controller, and a ground measurement and control station network;

[0005] The satellite nodes in the satellite network are connected to the ground measurement and control station network and send telemetry data to the ground measurement and control network. The telemetry data includes satellite link information and network operation status information. The network operation status information includes network traffic and policy execution feedback information. After receiving the security policy issued by the network controller, the corresponding security measures are executed and the execution results are fed back to the network controller.

[0006] The network controller is connected to the ground measurement and control website, receives registration request information from satellite nodes, verifies the identity and authority of the registered satellite through the built-in security authentication mechanism, and completes satellite registration and authentication; generates security policies based on the attributes of satellite nodes and network operation status information, and sends them to the corresponding satellite nodes through the ground measurement and control website; continuously optimizes and updates security policies based on the analysis results of security incidents in the satellite network and network feedback, and sends them through the ground measurement and control website; monitors the telemetry information of satellite nodes in real time, analyzes and detects security incidents, and guides each satellite node to respond when a security incident is detected; audits the behavior of satellite nodes and records key operations and event logs; dynamically adjusts the routing rules of the network control plane and the forwarding rules of the data plane according to the real-time network status and security policies of the satellite network; identifies network security trends and potential risks to adjust and optimize the security policies of the entire satellite network.

[0007] Preferably, the network controller includes an authentication module, a security policy generation module, a monitoring module, an event response module, a data plane configuration module, and an audit and log management module:

[0008] After receiving the registration request, the authentication module verifies the identity and authority of the satellite through the built-in security authentication mechanism, feeds back the access authentication reply information package to the satellite node, and updates the access authentication whitelist information package to the entire network. The authentication whitelist information package includes the number of satellite nodes in the whitelist, the validity period of the whitelist, and the spacecraft identification of each satellite node in the whitelist. The whitelist is used to implement access control of satellite nodes to other satellite nodes in the network to prevent malicious access nodes from existing in the network;

[0009] The security policy generation and optimization module selects security policies according to the type and mission characteristics of satellite nodes, customizes security policies to meet the specific needs of satellite nodes, sends customized security policies to corresponding satellite nodes, and continuously optimizes and updates security policies during operation;

[0010] Monitoring module: The monitoring module of the network controller collects satellite network telemetry information in real time and monitors the traffic and behavior of the satellite network. When abnormal traffic or behavior is detected, the monitoring module analyzes and determines it as a security incident.

[0011] Event response module, based on the type and severity of the security incident, the event response module adjusts the current security policy and notifies the satellite node;

[0012] The data plane configuration module adjusts the routing and forwarding rules according to the real-time network status and the issued security policies. When the satellite link quality changes, the network topology changes, or network traffic anomalies occur, the routing and forwarding rules for each satellite are reconfigured.

[0013] Audit and log management module, used to record and audit satellite behavior, including key operations and event logs of satellites.

[0014] Preferably, the network controller also includes a user control interface, providing a graphical operation interface, allowing satellite network administrators to configure security policies, monitor and view, and handle events.

[0015] Another technical solution of the present invention is: a lightweight satellite network security management method, the method comprising the steps of satellite registration and authentication:

[0016] When joining the network, the satellite node sends an access authentication request information packet to the network controller; the access authentication request information packet includes the satellite's unique identification number, security credentials and timestamp information;

[0017] After receiving the registration request, the network controller verifies the satellite's identity and authority through the built-in security authentication mechanism, feeds back the access authentication reply information package to the satellite node, and updates the access authentication whitelist information package to the entire network. The authentication whitelist information package includes the number of whitelist satellite nodes, the validity period of the whitelist, the spacecraft identification of each satellite node in the whitelist, etc.

[0018] Preferably, the above lightweight satellite network security management method further includes the steps of security policy generation and distribution:

[0019] After the network controller completes initialization, it loads the preset security policy for each satellite node;

[0020] After the satellite node is registered, the network controller dynamically generates a security policy suitable for the registered satellite node based on the attributes of the registered satellite node and the security policy of the current network, combined with real-time network status information, and sends the generated security policy to the registered satellite. The attributes include the type, location, and mission characteristics of the satellite.

[0021] During network operation, the network controller optimizes, updates and distributes security policies based on the analysis results of security incidents in the satellite network and the security policy execution results feedback of satellite nodes.

[0022] Preferably, the step of generating and distributing the security policy further comprises:

[0023] The network controller collects and analyzes the operational data of the satellite network, including traffic patterns, security incidents, policy execution feedback, etc., conducts in-depth security analysis, and identifies security trends and potential risks of the network; based on the analysis results, the network controller makes system decisions to adjust and optimize the security strategy of the entire satellite network.

[0024] Preferably, the above lightweight satellite network security management method further includes a dynamic configuration step of the network data plane:

[0025] The network controller dynamically adjusts the routing rules of the network control plane and the forwarding rules of the data plane according to the real-time network status of the satellite network and the issued security policies.

[0026] Preferably, the real-time monitoring and security incident analysis and detection steps are:

[0027] The network controller monitors the traffic of the satellite network in real time, identifies and analyzes various network behaviors and potential security incidents by conducting in-depth inspections of the telemetry information of each satellite node in the satellite network, including security threats, abnormal traffic patterns and signs of attacks.

[0028] Preferably, the steps of security incident response are:

[0029] When the network controller detects a security incident in the satellite network, it immediately assesses the nature and severity of the incident, determines the corresponding response level, and handles it according to the preset response strategy. At the same time, the network controller sends security alerts and response guidelines to relevant satellite nodes to guide them to take necessary self-protection measures. In addition, the network controller records the details of the incident to provide a basis for subsequent analysis and tracking.

[0030] Preferably, the satellite behavior audit and log management steps are:

[0031] The network controller collects link and network telemetry information of satellite nodes, audits the behavior of satellite nodes, and records key operations and event logs for subsequent analysis and tracking.

[0032] The advantages of the present invention compared with the prior art are:

[0033] (1) Improved security: The present invention significantly improves the security of satellite networks by introducing lightweight authentication mechanisms and dynamic security strategies. It can effectively identify and defend against external attacks, data leaks, and other network security threats, ensuring the confidentiality, integrity, and availability of critical data. Compared with traditional static defense measures, the active defense mechanism of the present invention provides a more comprehensive and robust security guarantee for satellite networks.

[0034] (2) Improved operational efficiency: Through centralized management and dynamic policy adjustment, the present invention greatly improves the operational efficiency of the satellite network. The network controller can monitor the network status in real time, respond quickly to changes, and optimize resource allocation, thereby reducing network congestion and delays and improving data transmission efficiency. This flexibility and response speed are particularly important in the face of complex and changing network environments, ensuring the stability and efficient operation of the satellite network.

[0035] (3) Lightweight design: The present invention adopts a lightweight design, taking into account the resource constraints of the satellite network. By streamlining the algorithm and optimizing the data processing flow, the demand for computing, storage, and energy is reduced. This design enables the security system to operate under limited resource conditions while maintaining efficient security protection capabilities. The lightweight design not only reduces deployment and maintenance costs, but also improves the reliability of the system and the overall performance of the satellite network.

[0036] (4) Adaptive deployment: The lightweight and efficient features of the present invention make it very suitable for deployment in resource-constrained satellite network environments. Whether in the early design stage or later upgrade, the present invention can quickly adapt to different satellite platforms and network architectures to achieve seamless integration. This adaptability ensures that satellite networks can continue to provide high-quality security services in an evolving technology environment to meet the needs of future network development. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 This is a schematic diagram of a software-defined satellite network security architecture according to an embodiment of the present invention;

[0038] Figure 2 This is the processing flow of the network controller and the newly registered satellite node according to the embodiment of the present invention;

[0039] Figure 3 This is the processing flow of the network controller and the satellite nodes on the network according to the embodiment of the present invention. DETAILED DESCRIPTION

[0040] The present invention is further described in detail below with reference to the accompanying drawings and specific embodiments:

[0041] The basic idea of ​​the present invention is to build a software-defined lightweight satellite network security management system, and realize dynamic security management of the satellite network through a centralized network controller, including real-time monitoring, generation and distribution of security policies, rapid response to security incidents, and continuous optimization of strategies, to ensure that the entire satellite network can flexibly and efficiently perform security and data protection in the face of ever-changing network threats.

[0042] like Figure 1 As shown, a lightweight satellite network security management system provided by the present invention includes a satellite network, a network controller, and a ground measurement and control station network;

[0043] The satellite nodes in the satellite network are connected to the ground measurement and control station network and send telemetry data to the ground measurement and control network. The telemetry data includes satellite link information and network operation status information. The network operation status information includes network traffic and policy execution feedback information. After receiving the security policy issued by the network controller, the corresponding security measures are executed and the execution results are fed back to the network controller.

[0044] The network controller is connected to the ground measurement and control website, receives registration request information from satellite nodes, verifies the identity and authority of the registered satellite through the built-in security authentication mechanism, and completes satellite registration and authentication; generates security policies based on the attributes of satellite nodes and network operation status information, and sends them to the corresponding satellite nodes through the ground measurement and control website; continuously optimizes and updates security policies based on the analysis results of security incidents in the satellite network and network feedback, and sends them through the ground measurement and control website; monitors the telemetry information of satellite nodes in real time, analyzes and detects security incidents, and guides each satellite node to respond when a security incident is detected; audits the behavior of satellite nodes and records key operations and event logs; dynamically adjusts the routing rules of the network control plane and the forwarding rules of the data plane according to the real-time network status and security policies of the satellite network; identifies network security trends and potential risks to adjust and optimize the security policies of the entire satellite network.

[0045] Preferably, the network controller includes an authentication module, a security policy generation module, a monitoring module, an event response module, a data plane configuration module, and an audit and log management module:

[0046] After receiving the registration request, the authentication module verifies the identity and authority of the satellite through the built-in security authentication mechanism, feeds back the access authentication reply information package to the satellite node, and updates the access authentication whitelist information package to the entire network. The authentication whitelist information package includes the number of satellite nodes in the whitelist, the validity period of the whitelist, and the spacecraft identification of each satellite node in the whitelist. The whitelist is used to implement access control of satellite nodes to other satellite nodes in the network to prevent malicious access nodes from existing in the network;

[0047] The security policy generation and optimization module selects security policies according to the type and mission characteristics of satellite nodes, customizes security policies to meet the specific needs of satellite nodes, sends customized security policies to corresponding satellite nodes, and continuously optimizes and updates security policies during operation;

[0048] Monitoring module: The monitoring module of the network controller collects satellite network telemetry information in real time and monitors the traffic and behavior of the satellite network. When abnormal traffic or behavior is detected, the monitoring module analyzes and determines it as a security incident.

[0049] Event response module, based on the type and severity of the security incident, the event response module adjusts the current security policy and notifies the satellite node;

[0050] The data plane configuration module adjusts the routing and forwarding rules according to the real-time network status and the issued security policies. When the satellite link quality changes, the network topology changes, or network traffic anomalies occur, the routing and forwarding rules for each satellite are reconfigured.

[0051] Audit and log management module, used to record and audit satellite behavior, including key operations and event logs of satellites.

[0052] Preferably, the network controller also includes a user control interface, providing a graphical operation interface, allowing satellite network administrators to configure security policies, monitor and view, and handle events.

[0053] like Figure 2 As shown, the present invention also provides a lightweight satellite network security management method, which includes the steps of satellite registration and authentication:

[0054] When joining the network, the satellite node sends an access authentication request information packet to the network controller; the access authentication request information packet includes the satellite's unique identification number, security credentials and timestamp information;

[0055] After receiving the registration request, the network controller verifies the satellite's identity and authority through the built-in security authentication mechanism, feeds back the access authentication reply information package to the satellite node, and updates the access authentication whitelist information package to the entire network. The authentication whitelist information package includes the number of whitelist satellite nodes, the validity period of the whitelist, the spacecraft identification of each satellite node in the whitelist, etc.

[0056] Different satellite networks have different authentication mechanisms, some use spacecraft identification, and some use the steps of IP address security policy generation and distribution:

[0057] After the network controller completes initialization, it loads the preset security policy for each satellite node;

[0058] After the satellite node is registered, the network controller dynamically generates a security policy suitable for the registered satellite node based on the attributes of the registered satellite node and the security policy of the current network, combined with real-time network status information, and sends the generated security policy to the registered satellite through a secure communication channel. The attributes include the type, location, and mission characteristics of the satellite.

[0059] During network operation, the network controller optimizes, updates and distributes security policies based on the analysis results of security incidents in the satellite network and the security policy execution results feedback of satellite nodes.

[0060] The steps of security policy generation and distribution also include:

[0061] The network controller collects and analyzes the operational data of the satellite network, including traffic patterns, security events, policy execution feedback, etc., conducts in-depth security analysis, and identifies security trends and potential risks of the network. Based on the analysis results, the network controller makes system decisions to adjust and optimize the security policy of the entire satellite network. Security policies include adjusting encryption algorithms, updating access control rules, or updating firewall rules.

[0062] Dynamic configuration steps of the network data plane:

[0063] The network controller dynamically adjusts the routing rules of the network control plane and the forwarding rules of the data plane according to the real-time network status of the satellite network and the issued security policies.

[0064] like Figure 3 As shown, the real-time monitoring and security event analysis and detection steps are:

[0065] The network controller monitors the traffic of the satellite network in real time, identifies and analyzes various network behaviors and potential security incidents by conducting in-depth inspections of the telemetry information of each satellite node in the satellite network, including security threats, abnormal traffic patterns and signs of attacks.

[0066] Steps for security incident response:

[0067] When the network controller detects a security incident in the satellite network, it immediately assesses the nature and severity of the incident, determines the corresponding response level, and handles it according to the preset response strategy. At the same time, the network controller sends security alerts and response guidelines to relevant satellite nodes to guide them to take necessary self-protection measures. In addition, the network controller records the details of the incident to provide a basis for subsequent analysis and tracking.

[0068] Satellite behavior audit and log management steps:

[0069] The network controller collects link and network telemetry information of satellite nodes, audits the behavior of satellite nodes, and records key operations and event logs, including satellite communication modes, data transmission records of each link, and security incident responses, to facilitate subsequent analysis and tracking.

[0070] Key operations include: satellite node registration and authentication operations, security policy generation and distribution operations, security policy update operations, data plane configuration operations, security incident response operations, satellite security policy execution and feedback operations.

[0071] The event log includes:

[0072] (1) Record detailed information of satellite registration request, including registration time, satellite ID, and authentication result;

[0073] (2) Record the generation, issuance, and change history of security policies, including policy content, issuance time, and target satellites;

[0074] (3) Record the reasons, content, and effect evaluation of security policy optimization;

[0075] (4) Record the time, content and reason of changes in routing and forwarding rules;

[0076] (5) Record the results of network traffic monitoring and detection, including detected abnormal behaviors and potential threats;

[0077] (6) Record detailed information and response measures of security incidents, including incident type, occurrence time, and handling results;

[0078] (7) Record the link and network telemetry information of satellite nodes.

[0079] Intelligent decision-making of the network controller: The network controller collects and analyzes the operating data of the satellite network, including traffic patterns, security events, policy execution feedback, etc., conducts in-depth security analysis, and identifies security trends and potential risks of the network; based on the analysis results, the network controller makes system decisions to adjust and optimize the security strategy of the entire satellite network.

[0080] Implementation example 1: Initial deployment and security policy configuration of satellite network.

[0081] (1) Initial deployment of satellite network: All satellite nodes are ready to register and enter standby mode. The network controller completes initialization, loads the preset security policy and satellite network authentication database, and sends access authentication whitelist information packets to online nodes in the network.

[0082] (2) Satellite registration and authentication: Satellite node A sends a registration request (access authentication request packet) to the network controller. The request includes information such as satellite A’s unique identification number, security credentials, and timestamp T1. After receiving A’s registration request, the network controller verifies satellite A’s identity and authority through the built-in security authentication mechanism, confirms that it is an authorized node, and sends satellite A an access authentication reply packet. It also updates the access authentication whitelist packet to the entire network.

[0083] (3) Security policy generation and distribution: The network controller dynamically generates a set of security policies suitable for the satellite based on the attributes of satellite node A in step (2) (such as satellite type, location, mission characteristics, etc.) and the current network security policy, combined with the real-time network status, and sends the generated security policies to satellite A through the satellite-to-ground link.

[0084] (4) Security policy execution and monitoring: Satellite A receives the security policy sent by the network controller in step (3) and executes it, and starts communicating with other satellite nodes; the network controller receives the telemetry information of satellite A and ensures that its security policy is correctly implemented by monitoring the communication behavior of satellite A.

[0085] (5) Security incident detection and response: The network controller checks the telemetry information of each satellite in the satellite network and detects that Satellite A has an abnormal traffic pattern, which is considered a potential data attack. It immediately adjusts the firewall rules of Satellite A to block suspicious traffic and notifies Satellite A to perform a self-check.

[0086] (6) Security policy update and optimization: The network controller optimizes the security policy based on the analysis results of the security incidents on Satellite A and network feedback, updates the security policy of Satellite A, and strengthens its defense capabilities against external attacks.

[0087] Implementation Example 2: Security Policy Adjustment and Security Incident Handling in Satellite Network Operation

[0088] (1) Network status monitoring: The network controller receives link telemetry and network telemetry of the satellite network in real time and monitors the operating status of the satellite network, including communication traffic and node status.

[0089] (2) Dynamic adjustment of security policies: The network controller discovers that there is a configuration error in the communication between satellite B and satellite C, resulting in low data transmission efficiency, and dynamically adjusts the routing policy and data forwarding traffic parameters between the two satellites.

[0090] (3) Real-time response to security incidents: The network controller detects that satellite D receives data information from an unknown satellite node. This node is not in the network controller's satellite network authentication database. The network controller defines the behavior of this node as primary network security behavior - unauthorized access attempt. It believes that this behavior may be a precursor to an attack and immediately activates the emergency plan to enhance the security protection measures of satellite D.

[0091] (4) Long-term optimization of security policies: The network controller collects link and network telemetry information of satellite nodes over a long period of time, audits the behavior of satellite nodes, and records key operations and event logs, including satellite communication modes, data transmission records of each link, and security incident responses. Based on monitoring data and security event records, the network controller continuously optimizes security policies and regularly (every 7 days) evaluates and updates security policies for all satellites to ensure the timeliness and effectiveness of the policies.

[0092] (5) User interface operation example: A satellite network administrator uses a graphical user interface to view the security status of the satellite network. After discovering abnormal behavior of a specific satellite, the administrator manually issues a new security policy through the user interface to make real-time adjustments.

[0093] These two implementation examples demonstrate in detail how the present invention is applied in the early stage of satellite network deployment and during operation, including the customization, distribution, execution, monitoring and optimization of security policies, as well as the rapid response and processing of security incidents.

[0094] In summary, the present invention provides a lightweight satellite network security management system and method, which implements global security management of satellite networks through a centralized network controller. The system adopts an architecture that decouples the control plane from the data plane to improve the flexibility and response speed of the network. The network controller is responsible for satellite registration and authentication, generation and distribution of security policies, real-time monitoring and threat detection, and rapid response to security incidents. Through the interaction process between the satellite and the network controller, flexible configuration and dynamic adjustment of security policies are achieved, ensuring that the satellite network can perform security protection and data protection in a timely and effective manner when facing ever-changing network threats. In addition, the system also has a lightweight design to adapt to the resource limitations of the satellite network, and through system decision support, the security management efficiency and effectiveness of the satellite network are improved.

[0095] The above description is only the best specific implementation mode of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by any technician familiar with the technical field within the technical scope disclosed by the present invention should be covered within the protection scope of the present invention.

[0096] The contents not described in detail in the specification of the present invention belong to the common knowledge of the professionals in this field.

Claims

1. A lightweight satellite network security management system, characterized in that Including satellite network, network controller, and ground measurement and control station network; The satellite nodes in the satellite network are connected to the ground measurement and control station network and send telemetry data to the ground measurement and control network. The telemetry data includes satellite link information and network operation status information. The network operation status information includes network traffic and policy execution feedback information. After receiving the security policy issued by the network controller, the corresponding security measures are executed and the execution results are fed back to the network controller. The network controller is connected to the ground measurement and control website, receives the registration request information of the satellite node, verifies the identity and authority of the registered satellite through the built-in security authentication mechanism, and completes the satellite registration and authentication; generates security policies based on the attributes of the satellite node and the network operation status information, and sends them to the corresponding satellite nodes through the ground measurement and control website; based on the analysis results of security events in the satellite network and network feedback, continuously optimizes and updates security policies and sends them through the ground measurement and control website; Monitor the telemetry information of satellite nodes in real time, analyze and detect security events, and guide each satellite node to respond when a security event is detected; Audit the behavior of satellite nodes and record key operations and event logs; dynamically adjust the routing rules of the network control plane and the forwarding rules of the data plane according to the real-time network status and security policies of the satellite network; Identify network security trends and potential risks to adjust and optimize the security strategy of the entire satellite network.

2. A lightweight satellite network security management system according to claim 1, characterized in that: The network controller includes an authentication module, a security policy generation module, a monitoring module, an event response module, a data plane configuration module, and an audit and log management module: After receiving the registration request, the authentication module verifies the identity and authority of the satellite through the built-in security authentication mechanism, feeds back the access authentication reply information package to the satellite node, and updates the access authentication whitelist information package to the entire network. The authentication whitelist information package includes the number of satellite nodes in the whitelist, the validity period of the whitelist, and the spacecraft identification of each satellite node in the whitelist. The whitelist is used to implement access control of satellite nodes to other satellite nodes in the network to prevent malicious access nodes from existing in the network; The security policy generation and optimization module selects security policies according to the type and mission characteristics of satellite nodes, customizes security policies to meet the specific needs of satellite nodes, sends customized security policies to corresponding satellite nodes, and continuously optimizes and updates security policies during operation; Monitoring module,The monitoring module of the network controller collects satellite network telemetry information in real time, and monitors the traffic and behavior of the satellite network; When abnormal traffic or behavior is detected, the monitoring module analyzes it and determines it as a security incident; Event response module, based on the type and severity of the security incident, the event response module adjusts the current security policy and notifies the satellite node; The data plane configuration module adjusts the routing and forwarding rules according to the real-time network status and the issued security policies. When the satellite link quality changes, the network topology changes, or network traffic anomalies occur, the routing and forwarding rules for each satellite are reconfigured. Audit and log management module, used to record and audit satellite behavior, including key operations and event logs of satellites.

3. A lightweight satellite network security management system according to claim 2, characterized in that: The network controller also includes a user control interface, which provides a graphical operation interface and allows satellite network administrators to configure security policies, monitor and view, and handle events.

4. A lightweight satellite network security management method, characterized in that Including satellite registration and authentication steps: When joining the network, the satellite node sends an access authentication request information packet to the network controller; the access authentication request information packet includes the satellite's unique identification number, security credentials and timestamp information; After receiving the registration request, the network controller verifies the satellite's identity and authority through the built-in security authentication mechanism, feeds back the access authentication reply information package to the satellite node, and updates the access authentication whitelist information package to the entire network. The authentication whitelist information package includes the number of whitelist satellite nodes, the validity period of the whitelist, the spacecraft identification of each satellite node in the whitelist, etc.

5. A lightweight satellite network security management method according to claim 4, characterized in that: It also includes the steps of security policy generation and distribution: After the network controller completes initialization, it loads the preset security policy for each satellite node; After the satellite node is registered, the network controller dynamically generates a security policy suitable for the registered satellite node based on the attributes of the registered satellite node and the security policy of the current network, combined with real-time network status information, and sends the generated security policy to the registered satellite. The attributes include the type, location, and mission characteristics of the satellite. During network operation, the network controller optimizes, updates and distributes security policies based on the analysis results of security incidents in the satellite network and the security policy execution results feedback of satellite nodes.

6. A lightweight satellite network security management method according to claim 5, characterized in that: The steps of generating and distributing the security policy also include: The network controller collects and analyzes the operational data of the satellite network, including traffic patterns, security incidents, policy execution feedback, etc., conducts in-depth security analysis, and identifies security trends and potential risks of the network; based on the analysis results, the network controller makes system decisions to adjust and optimize the security strategy of the entire satellite network.

7. A lightweight satellite network security management method according to claim 4, characterized in that: It also includes the dynamic configuration steps of the network data plane: The network controller dynamically adjusts the routing rules of the network control plane and the forwarding rules of the data plane according to the real-time network status of the satellite network and the issued security policies.

8. A lightweight satellite network security management method according to claim 4, characterized in that: Real-time monitoring and security incident analysis and detection steps: The network controller monitors the traffic of the satellite network in real time, identifies and analyzes various network behaviors and potential security incidents by conducting in-depth inspections of the telemetry information of each satellite node in the satellite network, including security threats, abnormal traffic patterns and signs of attacks.

9. A lightweight satellite network security management method according to claim 4, characterized in that: Steps for security incident response: When the network controller detects a security incident in the satellite network, it immediately assesses the nature and severity of the incident, determines the corresponding response level, and handles it according to the preset response strategy. At the same time, the network controller sends security alerts and response guidelines to relevant satellite nodes to guide them to take necessary self-protection measures. In addition, the network controller records the details of the incident to provide a basis for subsequent analysis and tracking.

10. A lightweight satellite network security management method according to claim 4, characterized in that: Satellite behavior audit and log management steps: The network controller collects link and network telemetry information of satellite nodes, audits the behavior of satellite nodes, and records key operations and event logs for subsequent analysis and tracking.

Images