Periodic maintenance and upgrading method and system for satellite security software

Abstract

The invention provides a method and a system for periodically maintaining and upgrading satellite security software. The method comprises the following steps of: S1, configuring a satellite-borne simulation system; s2, a satellite state assembly receives and responds to a remote control instruction injected on the ground, simulates the satellite working state and simulates the satellite temperature change; s3, the access authentication component checks the remote control instruction accessed to the satellite-borne simulation system, and verifies the remote control data packet through random key authentication and cyclic redundancy check; s4, setting test time, regularly testing the security software, summarizing test results, and updating the test results to a database so as to evaluate whether the security software works normally or not; and S5, upgrading the security software, notifying the ground through telemetry information after the upgrading is successful, testing the upgraded security software, and finally mapping the upgraded software into a real environment. According to the method, the security software cannot be interrupted during upgrading, and the security of the satellite software during upgrading can be ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of satellite software maintenance and upgrading, and in particular to a satellite safety software periodic maintenance and upgrading method and system. Background Art

[0002] Satellite security software plays a key role in modern aerospace technology, especially when facing uncertain threats. Once a satellite is attacked, it may not only cause itself to malfunction, but also cause a chain reaction to the entire satellite network. Therefore, it is crucial to ensure the stability and reliability of security software.

[0003] The periodic maintenance of satellite security software is a critical but often overlooked area. In the current environment, the frequency, method and timing of attacks are highly uncertain, making it difficult to determine whether a satellite is functioning properly when it is not under attack. This uncertainty increases the vulnerability of satellite systems because regular security software maintenance mechanisms are not established.

[0004] Currently, the lack of regular maintenance of security software means that the system may remain outdated for a long time, with undiscovered security vulnerabilities. This not only reduces the satellite's defense capabilities, but also makes it a target for attack. Once an attack occurs, it may cause data loss and communication interruption.

[0005] In addition, as technology continues to develop, attack methods are also constantly evolving. If security software is not regularly updated and maintained, the system will be difficult to defend against new attacks. Only through periodic inspections and updates can vulnerabilities be fixed in time and the software can be kept running efficiently.

[0006] Existing related technologies, such as the invention patent with publication number CN103777983A, disclose a method for on-orbit maintenance and upgrading of satellite-borne software. The satellite-borne software is divided into basic programs and application programs, the basic programs are stored in PROM, and the application programs are stored in readable and writable non-volatile storage media such as EEPROM or FLASH. The storage logic of the application program includes the original software storage area, the upgrade software storage area, and the module software annotation area. The three areas all contain area verification information. In the initial state, the storage contents of the original software storage area and the upgrade software storage area are the original application programs of the satellite-borne software, and the module software annotation area is empty.

[0007] Since the attack method and time are unpredictable, satellite security software also needs to be regularly upgraded to add more protection functions. However, the current software upgrades on satellites are completed during the satellite's idle time. However, for security, there is no idle time and it can only be performed in an environment that is identified as "safe". Once an attack comes, it will cause irreparable losses. Therefore, a new type of periodic maintenance and upgrade method for satellites is needed. Summary of the invention

[0008] In view of the defects in the prior art, the present invention provides a satellite safety software periodic maintenance and upgrade method and system.

[0009] According to a satellite safety software periodic maintenance and upgrade method and system provided by the present invention, the scheme is as follows: In a first aspect, a method for periodic maintenance and upgrading of satellite safety software is provided, the method comprising: Step S1: configuring a satellite-borne simulation system, wherein the satellite-borne simulation system includes a management component, a satellite status component, and an access authentication component; Step S2: The satellite status component receives the remote control command from the ground and responds to it, simulates the state of the satellite by using text description, and simulates the satellite working state according to the orbit information of the simulated satellite and the working state of the subsystem; at the same time, the satellite status component uses the temperature model to simulate the temperature change of the satellite; Step S3: the access authentication component checks the remote control command accessing the onboard simulation system to ensure that the remote control command meeting the set requirements enters the onboard simulation system, and verifies the remote control data packet through random key authentication and cyclic redundancy check; Step S4: Setting a test time, testing the security software regularly, and summarizing and updating the test results to the database to evaluate whether the security software is working properly; Step S5: When the security software is upgraded, the onboard simulation system is configured to verify whether the upgrade package is correct after receiving the complete security software upgrade package. If it is correct, the software is upgraded in the onboard simulation system. After the upgrade is successful, the ground is notified through telemetry information, and the upgraded security software is tested, and finally the upgraded software is mapped to the real environment.

[0010] Preferably, in step S1, the management component is responsible for storing and calling test cases that cause abnormal behavior of the satellite; The management component classifies and stores the test cases of satellite abnormal behaviors, and divides them into abnormal behaviors of data transmission subsystem, abnormal behaviors of measurement and control subsystem, abnormal behaviors of attitude and orbit control subsystem, and abnormal behaviors of thermal control subsystem, etc. These test cases are compiled into abnormal behavior telemetry packages and transmitted to the ground through the satellite-to-ground link, with different letters representing different subsystem abnormal behaviors; The remote control data packet specified in the above statement specifies the test cases to be used. The management component extracts the corresponding test cases from the corresponding subsystems. When the remote control data packet uploads new test cases, it is protected by security software and the currently extracted test cases are stored in different locations according to the affected subsystems. The storage table is then downloaded again and the new test case number is added to the storage table.

[0011] Preferably, the working state of the simulated satellite in step S2 includes: The satellite status component transmits a signal to the security software. The security software maps all current data to the satellite status component for multiple consecutive times, compares each data, and uses voting to retain the software data. After the final determination, it deletes other mapped software and starts to conduct protection tests for remote control commands. If the remote control command to end the test is not received, the satellite status information will be retained and re-uploaded to overwrite it. If the remote control command to end the test is received, all information in the satellite status component will be deleted. After each test case is completed, the process and results will be transmitted to the ground.

[0012] Preferably, simulating satellite temperature changes in step S2 includes: The temperature model is created based on Thermal Desktop software, and the shapes of the satellite's shell, solar panels and electronic payload are created through Thermal Desktop software; cylinders and rectangles are used to represent the main part of the satellite, and the height, radius and thickness of these geometric bodies are adjusted according to the actual size of the satellite; Create a rectangle for the solar panel to fit the shell, adjust the size and tilt angle of the rectangle to match the actual design, and perform detailed meshing; The temperature model scans the set grid and automatically marks the grid that is distorted, disconnected or inconsistent with the shape of the satellite components, and the developer makes modifications.

[0013] Preferably, the simulating satellite temperature change in step S2 further comprises: The temperature model reads the satellite orbit, attitude and electronic load power consumption set in the onboard simulation system, and further sets the radiation boundary conditions; adjusts the incident angle according to the orbit and attitude of the satellite to simulate the radiation reception under different conditions; Use radiation boundary conditions to simulate the radiation loss from the satellite surface to space, set internal heat sources for electronic equipment, automatically input the power consumption of each electronic load, define the time step and simulation time, perform transient analysis on the model, and provide changes in temperature-related data for the onboard simulation system.

[0014] Preferably, the step S3 comprises: the access authentication component performs docking through random key authentication between the satellite and the ground, and performs cyclic redundancy check on the remote control data packet through the check code; If there is a problem with the verification result, the ground will resend the remote control data packet, splice the different data in the data packet according to the sequence number, and send the spliced ​​data to the satellite status component.

[0015] Preferably, step S5 includes: when the security software is upgraded, after receiving the complete security software upgrade package, first check to confirm whether the security software upgrade package is correct, if it is wrong, then the ground will re-upload a security software upgrade package, the security software is first mapped to the satellite simulation system, and the software is upgraded in the satellite simulation system. After the upgrade is successful, a simple telemetry information will be transmitted to notify the ground, and the ground will then upload a remote control command to test the upgraded security software. After the newly added protection function is tested successfully, the security software in the satellite simulation system is mapped to the real environment, and then the original security software is deleted, thereby completing the upgrade of the security software.

[0016] In a second aspect, a satellite safety software periodic maintenance and upgrade system is provided, the system comprising: Module M1: configure a satellite-borne simulation system, the satellite-borne simulation system includes a management component, a satellite status component and an access authentication component; Module M2: Receives and analyzes the remote control commands from the ground through the satellite status component, simulates the state of the satellite using text descriptions, and simulates the satellite working state based on the simulated satellite's orbit information and the working state of the subsystem; at the same time, the satellite status component uses a temperature model to simulate the temperature change of the satellite; Module M3: The access authentication component checks the remote control commands that access the onboard simulation system to ensure that the remote control commands that meet the set requirements enter the onboard simulation system, and verifies the remote control data packets through random key authentication and cyclic redundancy check; Module M4: Set the test time, test the security software regularly, summarize the test results and update them to the database to evaluate whether the security software is working properly; Module M5: When upgrading the security software, configure the onboard simulation system to verify whether the upgrade package is correct after receiving the complete security software upgrade package. If it is correct, the software will be upgraded in the onboard simulation system. After the upgrade is successful, the ground will be notified through telemetry information and the upgraded security software will be tested. Finally, the upgraded software will be mapped to the real environment.

[0017] Preferably, in the module M1, the management component is responsible for storing and calling test cases that cause abnormal behavior of the satellite; The management component classifies and stores the test cases of satellite abnormal behaviors, and divides them into abnormal behaviors of data transmission subsystem, abnormal behaviors of measurement and control subsystem, abnormal behaviors of attitude and orbit control subsystem, and abnormal behaviors of thermal control subsystem, etc. These test cases are compiled into abnormal behavior telemetry packages and transmitted to the ground through the satellite-to-ground link, with different letters representing different subsystem abnormal behaviors; The remote control data package specified in the above statement specifies the test cases to be used. The management component extracts the corresponding test cases from the corresponding subsystems. When the remote control data package uploads new test cases, it is protected by security software and the currently extracted test cases are stored in different locations according to the affected subsystems. The storage table is then downloaded again and the number of the new test cases is added to the storage table. The working state of the simulated satellite in the module M2 includes: The satellite status component transmits a signal to the security software. The security software maps all current data to the satellite status component for multiple consecutive times, compares each data, and uses voting to retain the software data. After the final determination, it deletes other mapped software and starts to conduct protection tests for remote control commands. If the remote control command to end the test is not received, the satellite status information will be retained and re-uploaded to overwrite it. If the remote control command to end the test is received, all information in the satellite status component will be deleted. After each test case is completed, the process and results will be transmitted to the ground.

[0018] Preferably, the simulation of satellite temperature change in the module M2 includes: The temperature model is created based on Thermal Desktop software, and the shapes of the satellite's shell, solar panels and electronic payload are created through Thermal Desktop software; cylinders and rectangles are used to represent the main part of the satellite, and the height, radius and thickness of these geometric bodies are adjusted according to the actual size of the satellite; Create a rectangle for the solar panel to fit the shell, adjust the size and tilt angle of the rectangle to match the actual design, and perform detailed meshing; The temperature model scans the set grid and automatically marks the grid that is distorted, disconnected or inconsistent with the shape of the satellite components, and the developer makes modifications; The simulation of satellite temperature change in the module M2 also includes: The temperature model reads the satellite orbit, attitude and electronic load power consumption set in the onboard simulation system, and further sets the radiation boundary conditions; adjusts the incident angle according to the orbit and attitude of the satellite to simulate the radiation reception under different conditions; Use radiation boundary conditions to simulate the radiation loss from the satellite surface to space, set internal heat sources for electronic equipment, automatically input the power consumption of each electronic load, and perform transient analysis on the model after defining the time step and simulation time to provide changes in temperature-related data for the onboard simulation system; The module M3 includes: an access authentication component performs docking through random key authentication between the satellite and the ground, and performs cyclic redundancy check on the remote control data packet through a check code; If there is a problem with the verification result, the ground will resend the remote control data packet, splice different data in the data packet according to the sequence number, and send the spliced ​​data to the satellite status component; The module M5 includes: when the security software is upgraded, after receiving the complete security software upgrade package, first check to confirm whether the security software upgrade package is correct. If it is wrong, the ground will re-upload a security software upgrade package. The security software is first mapped to the satellite simulation system, and the software is upgraded in the satellite simulation system. After the upgrade is successful, a simple telemetry notification will be transmitted to the ground, and the ground will then upload a remote control command to test the upgraded security software. After the newly added protection function is tested successfully, the security software in the satellite simulation system is mapped to the real environment, and then the original security software is deleted, thereby completing the upgrade of the security software.

[0019] Compared with the prior art, the present invention has the following beneficial effects: 1. The present invention does not interrupt the work of the security software during the upgrade, thus ensuring the security during the satellite software upgrade; 2. The present invention ensures the safety of satellites during periodic maintenance by means of in-orbit simulation, and prevents unprotected test cases from damaging the satellites during maintenance.

[0020] Other beneficial effects of the present invention will be explained in the specific implementation manner through the introduction of specific technical features and technical solutions. Through the introduction of these technical features and technical solutions, those skilled in the art should be able to understand the beneficial technical effects brought about by the technical features and technical solutions. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Other features, objects and advantages of the present invention will become more apparent from the detailed description of non-limiting embodiments made with reference to the following drawings: Figure 1 It is a schematic diagram of the overall process of the present invention; Figure 2 This is a schematic diagram of periodic maintenance of security software; Figure 3 This is a diagram of a security software upgrade. DETAILED DESCRIPTION

[0022] The present invention is described in detail below in conjunction with specific embodiments. The following embodiments will help those skilled in the art to further understand the present invention, but are not intended to limit the present invention in any form. It should be noted that, for those of ordinary skill in the art, several changes and improvements can also be made without departing from the concept of the present invention. These all belong to the protection scope of the present invention.

[0023] The embodiment of the present invention provides a satellite safety software periodic maintenance and upgrade method, referring to Figure 1 As shown, the method specifically includes: Step S1: configuring a satellite-borne simulation system, wherein the satellite-borne simulation system includes a management component, a satellite status component and an access authentication component.

[0024] Specifically, in step S1, the management component is responsible for storing and calling test cases that cause abnormal behavior of the satellite; the management component classifies and stores the test cases that cause abnormal behavior of the satellite, and classifies them into abnormal behavior of the data transmission subsystem, abnormal behavior of the measurement and control subsystem, abnormal behavior of the attitude and orbit control subsystem, and abnormal behavior of the thermal control subsystem, etc., and compiles these test cases into abnormal behavior telemetry packages and transmits them to the ground through the satellite-to-ground link, using different letters to represent abnormal behaviors of different subsystems; The remote control data packet specified in the above statement specifies the test cases to be used. The management component extracts the corresponding test cases from the corresponding subsystems. When the remote control data packet uploads new test cases, it is protected by security software and the currently extracted test cases are stored in different locations according to the affected subsystems. The storage table is then downloaded again and the new test case number is added to the storage table.

[0025] Step S2: Receive and parse the remote control commands from the ground through the satellite status component, simulate the state of the satellite using text descriptions, and simulate the satellite working state based on the simulated satellite's orbital information and the working state of the subsystem; at the same time, the satellite status component uses a temperature model to simulate the temperature change of the satellite.

[0026] Specifically, the working state of the simulated satellite in step S2 includes: The satellite status component transmits a signal to the security software. The security software maps all current data to the satellite status component, maps it multiple times in a row, compares each data, and uses voting to retain the software data. After final confirmation, other mapped software will be deleted, and protection testing will begin for remote control commands. If the remote control command to end the test is not received, the satellite status information will be retained and the satellite status information will be re-uploaded for coverage. If the remote control command to end the test is received, all information in the satellite status component will be deleted. After each test case is completed, the process and results will be transmitted to the ground.

[0027] The simulation of satellite temperature changes in step S2 includes: the temperature model is created based on the Thermal Desktop software, and the shapes of the satellite's outer shell, solar panels and electronic payload are created through the Thermal Desktop software; cylinders and rectangles are used to represent the main part of the satellite, and the height, radius and thickness of these geometric bodies are adjusted according to the actual size of the satellite; a rectangle is created for the solar panel to match the outer shell, the size and tilt angle of the rectangle are adjusted to be consistent with the actual design, and detailed meshing is performed; the temperature model scans the set mesh, automatically marks out meshes that are distorted, disconnected or inconsistent with the shape of satellite components, and the developer makes modifications.

[0028] The temperature model reads the satellite orbit, attitude and electronic payload power consumption set in the onboard simulation system, and further sets the radiation boundary conditions; adjusts the incident angle according to the satellite's orbit and attitude to simulate the radiation reception under different conditions; uses the radiation boundary conditions to simulate the radiation loss from the satellite surface to space, sets the internal heat source for the electronic equipment, automatically inputs the power consumption of each electronic payload, and after defining the time step and simulation time, performs transient analysis on the model to provide changes in temperature-related data for the onboard simulation system.

[0029] Step S3: The access authentication component checks the remote control commands accessing the onboard simulation system to ensure that the remote control commands that meet the set requirements enter the onboard simulation system, and verifies the remote control data packets through random key authentication and cyclic redundancy check.

[0030] Specifically, step S3 includes: the access authentication component is connected through random key authentication between the satellite and the ground, and a cyclic redundancy check is performed on the remote control data packet through a verification code; if there is a problem with the verification result, the ground resends the remote control data packet, splices different data in the data packet according to the sequence number, and sends the spliced ​​data to the satellite status component.

[0031] Step S4: Setting a test time, testing the security software regularly, and summarizing and updating the test results to the database to evaluate whether the security software is working properly; Step S5: When the security software is upgraded, the onboard simulation system is configured to verify whether the upgrade package is correct after receiving the complete security software upgrade package. If it is correct, the software is upgraded in the onboard simulation system. After the upgrade is successful, the ground is notified through telemetry and the upgraded security software is tested, and finally the upgraded software is mapped to the real environment.

[0032] Specifically, when the security software is upgraded, after receiving the complete security software upgrade package, a check is first performed to confirm whether the security software upgrade package is correct. If it is incorrect, a new security software upgrade package is uploaded from the ground. The security software is first mapped to the onboard simulation system, and the software is upgraded in the onboard simulation system. After the upgrade is successful, a simple telemetry notification will be transmitted to the ground, and the ground will then upload remote control commands to test the upgraded security software. After the newly added protection function is tested successfully, the security software in the onboard simulation system will be mapped to the real environment, and the original security software will be deleted to complete the security software upgrade.

[0033] The present invention also provides a satellite safety software periodic maintenance and upgrade system, which can be implemented by executing the process steps of the satellite safety software periodic maintenance and upgrade method, that is, those skilled in the art can understand the satellite safety software periodic maintenance and upgrade method as a preferred implementation of the satellite safety software periodic maintenance and upgrade system. The system specifically includes the following contents: Module M1: configure the onboard simulation system, which includes a management component, a satellite status component and an access authentication component.

[0034] Specifically, in the module M1, the management component is responsible for storing and calling test cases that cause abnormal behavior of the satellite; the management component classifies and stores the test cases that cause abnormal behavior of the satellite, and classifies them into abnormal behavior of the data transmission subsystem, abnormal behavior of the measurement and control subsystem, abnormal behavior of the attitude and orbit control subsystem, and abnormal behavior of the thermal control subsystem, etc., and compiles these test cases into abnormal behavior telemetry packages and transmits them to the ground through the satellite-to-ground link, using different letters to represent different subsystem abnormal behaviors; The remote control data packet specified in the above statement specifies the test cases to be used. The management component extracts the corresponding test cases from the corresponding subsystems. When the remote control data packet uploads new test cases, it is protected by security software and the currently extracted test cases are stored in different locations according to the affected subsystems. The storage table is then downloaded again and the new test case number is added to the storage table.

[0035] Module M2: Receives and parses remote control commands from the ground through the satellite status component, simulates the satellite status using text descriptions, and simulates the satellite working status based on the simulated satellite's orbital information and the working status of the subsystem; at the same time, the satellite status component uses a temperature model to simulate satellite temperature changes.

[0036] Specifically, the working status of the simulated satellite in the module M2 includes: The satellite status component transmits a signal to the security software. The security software maps all current data to the satellite status component, maps it multiple times in a row, compares each data, and uses voting to retain the software data. After final confirmation, other mapped software will be deleted, and protection testing will begin for remote control commands. If the remote control command to end the test is not received, the satellite status information will be retained and the satellite status information will be re-uploaded for coverage. If the remote control command to end the test is received, all information in the satellite status component will be deleted. After each test case is completed, the process and results will be transmitted to the ground.

[0037] The simulation of satellite temperature changes in module M2 includes: the temperature model is created based on the Thermal Desktop software, and the shape of the satellite's outer shell, solar panels and electronic payload are created through the Thermal Desktop software; cylinders and rectangles are used to represent the main part of the satellite, and the height, radius and thickness of these geometric bodies are adjusted according to the actual size of the satellite; a rectangle is created for the solar panel to match the outer shell, the size and tilt angle of the rectangle are adjusted to be consistent with the actual design, and detailed meshing is performed; the temperature model scans the set mesh and automatically marks out meshes that are distorted, disconnected or inconsistent with the shape of satellite components, and the developer makes modifications.

[0038] The temperature model reads the satellite orbit, attitude and electronic payload power consumption set in the onboard simulation system, and further sets the radiation boundary conditions; adjusts the incident angle according to the satellite's orbit and attitude to simulate the radiation reception under different conditions; uses the radiation boundary conditions to simulate the radiation loss from the satellite surface to space, sets the internal heat source for the electronic equipment, automatically inputs the power consumption of each electronic payload, and after defining the time step and simulation time, performs transient analysis on the model to provide changes in temperature-related data for the onboard simulation system.

[0039] Module M3: The access authentication component checks the remote control commands accessing the onboard simulation system to ensure that the remote control commands that meet the set requirements enter the onboard simulation system, and verifies the remote control data packets through random key authentication and cyclic redundancy check.

[0040] Specifically, the module M3 includes: the access authentication component is connected through random key authentication between the satellite and the ground, and a cyclic redundancy check is performed on the remote control data packet through the verification code; if there is a problem with the verification result, the ground resends the remote control data packet, splices different data in the data packet according to the sequence number, and sends the spliced ​​data to the satellite status component.

[0041] Module M4: Set the test time, test the security software regularly, summarize the test results and update them to the database to evaluate whether the security software is working properly; Module M5: When upgrading the security software, configure the onboard simulation system to verify whether the upgrade package is correct after receiving the complete security software upgrade package. If it is correct, the software will be upgraded in the onboard simulation system. After the upgrade is successful, the ground will be notified through telemetry information and the upgraded security software will be tested. Finally, the upgraded software will be mapped to the real environment.

[0042] Specifically, when the security software is upgraded, after receiving the complete security software upgrade package, a check is first performed to confirm whether the security software upgrade package is correct. If it is incorrect, a new security software upgrade package is uploaded from the ground. The security software is first mapped to the onboard simulation system, and the software is upgraded in the onboard simulation system. After the upgrade is successful, a simple telemetry notification will be transmitted to the ground, and the ground will then upload remote control commands to test the upgraded security software. After the newly added protection function is tested successfully, the security software in the onboard simulation system will be mapped to the real environment, and the original security software will be deleted to complete the security software upgrade.

[0043] Next, the present invention will be described in more detail.

[0044] The present invention provides a satellite safety software periodic maintenance and upgrade method, referring to Figure 1 As shown, the method specifically includes the following contents: 1. The satellite measurement and control system is additionally configured with an onboard simulation system. The onboard simulation system includes a management component, a satellite status component, and an access authentication component. The management component is responsible for storing and calling test cases that cause abnormal satellite behavior; the satellite status component is responsible for receiving remote control commands from the ground, and using text descriptions to simulate a certain state of the satellite, which can be a state during normal operation, or it can directly upload abnormal status data of the satellite; the access authentication component is responsible for checking the remote control commands accessing the onboard simulation system, and only remote control commands that meet the requirements can enter the onboard simulation system.

[0045] 2. The management component classifies and stores the test cases of abnormal satellite behavior, and divides them into abnormal behavior of the data transmission subsystem, abnormal behavior of the measurement and control subsystem, abnormal behavior of the attitude and orbit control subsystem, abnormal behavior of the thermal control subsystem, etc., and compiles these test cases into abnormal behavior telemetry packages and transmits them to the ground through the satellite-to-ground link, using different letters to represent different subsystem abnormal behaviors. Among them, "A" is the data transmission subsystem, "B" is the measurement and control subsystem, "C" is the attitude and orbit control subsystem, and "D" is the thermal control subsystem. The above remote control data packet can specify the test case to be used, and the management component will extract the corresponding test case from the corresponding subsystem. When the remote control data packet uploads a new test case, it is protected by security software, and the case is stored in different locations according to the affected subsystem, and the storage table is re-downloaded. The number of this new test case will be added to this table, as shown in Table 1.

[0046] Table 1

[0047] 3. The satellite status component parses the remote control command and simulates the working status of the satellite based on the simulated satellite's orbital information and the working status of the subsystem. The satellite status component transmits a simple signal to the security software. The security software maps all current data to the satellite status component for three consecutive times, and compares each data. The software data will be retained by voting. After the final determination, the other two mapped software will be deleted, and protection testing will be started for the remote control command. If the remote control command to end the test is not received, the satellite status information will be retained, and the satellite status information will be overwritten if it is re-uploaded. If the remote control command to end the test is received, all information in the satellite status component will be deleted. After each test case is completed, the process and results will be transmitted to the ground.

[0048] 4. The access authentication component connects the satellite and the ground through random key authentication, and performs cyclic redundancy check on the remote control data packet through the verification code. If there is a problem with the verification result, the ground will resend the remote control data packet, splice different data in the data packet according to the sequence number, and send the spliced ​​data to the satellite status component.

[0049] 5. The temperature of the satellite status components uses a temperature model to simulate the temperature changes that will occur. Use ThermalDesktop software to create the shape of the satellite's outer shell, solar panels, and electronic payloads. Use cylinders and rectangles to represent the main part of the satellite. Adjust the height, radius, and thickness of these geometric bodies according to the actual size of the satellite; create a rectangle that matches the outer shell for the solar panel, and adjust the size and tilt angle of the rectangle to be consistent with the actual design. And perform detailed meshing. Set a mesh size of 1mm or smaller for electronic payloads, set a network size of 5mm or larger for areas with gentle temperatures on the outer shell and solar panels, and create a mesh size of 0.5mm or smaller around heat sources and near radiation boundaries. The model will scan the set mesh and automatically mark out meshes that are distorted, disconnected, or inconsistent with the shape of satellite components, and the developer will make corresponding modifications.

[0050] 6. The model will read the satellite orbit, attitude and electronic load power consumption set in the onboard simulation system, and further set boundary conditions. Adjust the incident angle according to the satellite's orbit and attitude to simulate the radiation reception under different conditions. Use radiation boundary conditions to simulate the radiation loss from the satellite surface to space, set internal heat sources for electronic equipment, and automatically input the power consumption of each electronic load. After defining the time step and simulation time, perform transient analysis on the model to provide changes in temperature-related data for the onboard simulation system.

[0051] 7. Test the security software once a month, summarize the test results and update them in the database to evaluate whether the security software can work properly.

[0052] 8. When upgrading the security software, after receiving the complete security software upgrade package, first check to confirm whether the security software upgrade package is correct. If it is wrong, the ground will re-upload a security software upgrade package. The security software is first mapped to the satellite simulation system, and the software is upgraded in the satellite simulation system. After the upgrade is successful, a simple telemetry notification will be transmitted to the ground, and the ground will then upload remote control commands to test the upgraded security software. After the newly added protection function is tested successfully, the security software in the satellite simulation system will be mapped to the real environment, and then the original security software will be deleted to complete the security software upgrade.

[0053] The specific implementation examples are as follows: Embodiment 1: Reference Figure 2 As shown, security software is periodically maintained: 1) The ground and space-borne simulation systems use randomly generated keys to connect, and after confirmation, a communication link between the ground and space-borne simulation systems is established.

[0054] 2) The satellite status component simulates the state of the satellite, which includes orbit information, the state of the data transmission subsystem, the measurement and control subsystem, the attitude and orbit control subsystem and the thermal control subsystem, the test case 1 pre-stored by the onboard simulation system and the new test case k1. In this state, the satellite is in the state of changing the orbit. The onboard simulation system performs redundancy check on the remote control command and retains the correct remote control information package.

[0055] 3) The onboard simulation system sends a mapping request signal to the safety software. The safety software maps to the onboard simulation system three times, retains the correct mapping result, and starts to enable test case 1. This test case instructs the virtual satellite that is changing its orbit to perform attitude and orbit control system software reconstruction. After the safety software is started, the instruction is successfully blocked.

[0056] 4) A new test case k1 is used. This test case causes the virtual satellite, which is changing its orbit, to flip its solar panels. The security software fails to protect it successfully, causing the satellite to malfunction. The onboard simulation system learns this test case and stores it in the management component.

[0057] 5) The onboard simulation system clears the abnormal state of the satellite and simulates the satellite orbit change state simulated by the initial telemetry information again. The attack is carried out again using test case k1. After the security software is started, the command is successfully blocked.

[0058] Embodiment 2: Reference Figure 3 As shown, security software upgrade: 1) Multiple reconstruction packages are uploaded from the ground to Satellite 1 which is equipped with security software. Satellite 1 performs redundancy check on the reconstruction packages, retains the correct ones, and discards the rest.

[0059] 2) Import the reconstruction package into the onboard simulation system, map the security software into the onboard simulation system multiple times, upgrade the mapped security software using the reconstruction package, and test it using the test cases in the onboard simulation system.

[0060] 3) The upgraded security software is mapped to the real satellite environment after testing, and the original security software is deleted.

[0061] The embodiment of the present invention provides a method and system for periodic maintenance and upgrading of satellite safety software, wherein the upgrading is completed while the satellite safety software is working at all times, thereby realizing the upgrading of the satellite safety software; the protection function of the safety software is simulated and tested on-orbit through a satellite-borne simulation system, thereby realizing the regular on-orbit maintenance of the satellite safety software.

[0062] Those skilled in the art know that, in addition to realizing the system and its various devices, modules, and units provided by the present invention in a purely computer-readable program code, it is entirely possible to realize the same functions in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, the system and its various devices, modules, and units provided by the present invention can be considered as a hardware component, and the devices, modules, and units included therein for realizing various functions can also be regarded as structures within the hardware component; the devices, modules, and units for realizing various functions can also be regarded as both software modules for realizing the method and structures within the hardware component.

[0063] The above describes the specific embodiments of the present invention. It should be understood that the present invention is not limited to the above specific embodiments, and those skilled in the art can make various changes or modifications within the scope of the claims, which does not affect the essence of the present invention. In the absence of conflict, the embodiments of the present application and the features in the embodiments can be combined with each other arbitrarily.

Claims

1. A satellite safety software periodic maintenance and upgrade method, characterized in that: include: Step S1: configuring a satellite-borne simulation system, wherein the satellite-borne simulation system includes a management component, a satellite status component, and an access authentication component; Step S2: The satellite status component receives and analyzes the remote control command from the ground, simulates the state of the satellite by using text description, and simulates the satellite working state according to the orbit information of the simulated satellite and the working state of the subsystem; at the same time, the satellite status component uses the temperature model to simulate the temperature change of the satellite; Step S3: the access authentication component checks the remote control command accessing the onboard simulation system to ensure that the remote control command meeting the set requirements enters the onboard simulation system, and verifies the remote control data packet through random key authentication and cyclic redundancy check; Step S4: Setting a test time, testing the security software regularly, and summarizing and updating the test results to the database to evaluate whether the security software is working properly; Step S5: When the security software is upgraded, the onboard simulation system is configured to verify whether the upgrade package is correct after receiving the complete security software upgrade package. If it is correct, the software is upgraded in the onboard simulation system. After the upgrade is successful, the ground is notified through telemetry information and the upgraded security software is tested, and finally the upgraded software is mapped to the real environment.

2. The satellite safety software periodic maintenance and upgrade method according to claim 1, characterized in that: In step S1, the management component is responsible for storing and calling test cases that cause abnormal behavior of the satellite; The management component classifies and stores the test cases of satellite abnormal behaviors, and divides them into abnormal behaviors of data transmission subsystem, abnormal behaviors of measurement and control subsystem, abnormal behaviors of attitude and orbit control subsystem, and abnormal behaviors of thermal control subsystem. These test cases are compiled into abnormal behavior telemetry packages and transmitted to the ground through the satellite-to-ground link, with different letters representing different subsystem abnormal behaviors. The remote control data packet specified in the above statement specifies the test cases to be used. The management component extracts the corresponding test cases from the corresponding subsystems. When the remote control data packet uploads new test cases, it is protected by security software and the currently extracted test cases are stored in different locations according to the affected subsystems. The storage table is then downloaded again and the new test case number is added to the storage table.

3. The satellite safety software periodic maintenance and upgrade method according to claim 1, characterized in that: The working state of the simulated satellite in step S2 includes: The satellite status component transmits a signal to the security software. The security software maps all current data to the satellite status component for multiple consecutive times, and compares each data. It uses voting to retain the software data. After the final determination, it deletes other mapped software and starts to conduct protection tests on the remote control information. If the remote control command to end the test is not received, the satellite status information will be retained and re-uploaded to overwrite it. If the remote control command to end the test is received, all information in the satellite status component will be deleted. After each test case is completed, the process and results will be transmitted to the ground.

4. The satellite safety software periodic maintenance and upgrade method according to claim 1, characterized in that: The simulation of satellite temperature change in step S2 includes: The temperature model is created based on Thermal Desktop software, and the shapes of the satellite's shell, solar panels and electronic payload are created through Thermal Desktop software; cylinders and rectangles are used to represent the main part of the satellite, and the height, radius and thickness of these geometric bodies are adjusted according to the actual size of the satellite; Create a rectangle for the solar panel to fit the shell, adjust the size and tilt angle of the rectangle to match the actual design, and perform detailed meshing; The temperature model scans the set grid and automatically marks the grid that is distorted, disconnected or inconsistent with the shape of the satellite components, and the developer makes modifications.

5. The satellite safety software periodic maintenance and upgrade method according to claim 4, characterized in that: The simulation of satellite temperature change in step S2 also includes: The temperature model reads the satellite orbit, attitude and electronic load power consumption set in the onboard simulation system, and further sets the radiation boundary conditions; adjusts the incident angle according to the orbit and attitude of the satellite to simulate the radiation reception under different conditions; Use radiation boundary conditions to simulate the radiation loss from the satellite surface to space, set internal heat sources for electronic equipment, automatically input the power consumption of each electronic load, define the time step and simulation time, perform transient analysis on the model, and provide changes in temperature-related data for the onboard simulation system.

6. The satellite safety software periodic maintenance and upgrade method according to claim 1, characterized in that: The step S3 includes: the access authentication component performs docking through random key authentication between the satellite and the ground, and performs cyclic redundancy check on the remote control data packet through the check code; If there is a problem with the verification result, the ground will resend the remote control data packet, splice the different data in the data packet according to the sequence number, and send the spliced ​​data to the satellite status component.

7. The satellite safety software periodic maintenance and upgrade method according to claim 1, characterized in that: The step S5 includes: when the security software is upgraded, after receiving the complete security software upgrade package, first check to confirm whether the security software upgrade package is correct. If it is wrong, the ground will re-upload a security software upgrade package. The security software is first mapped to the satellite simulation system, and the software is upgraded in the satellite simulation system. After the upgrade is successful, a simple signal will be transmitted to notify the ground, and the ground will then upload a remote control command to test the upgraded security software. After the newly added protection function is tested successfully, the security software in the satellite simulation system is mapped to the real environment, and then the original security software is deleted, thereby completing the upgrade of the security software.

8. A satellite safety software periodic maintenance and upgrade system, characterized in that: include: Module M1: configure a satellite-borne simulation system, the satellite-borne simulation system includes a management component, a satellite status component and an access authentication component; Module M2: Receives and analyzes the remote control commands from the ground through the satellite status component, simulates the state of the satellite using text descriptions, and simulates the satellite working state based on the simulated satellite's orbit information and the working state of the subsystem; at the same time, the satellite status component uses a temperature model to simulate the temperature change of the satellite; Module M3: The access authentication component checks the remote control commands that access the onboard simulation system to ensure that the remote control commands that meet the set requirements enter the onboard simulation system, and verifies the remote control data packets through random key authentication and cyclic redundancy check; Module M4: Set the test time, test the security software regularly, summarize the test results and update them to the database to evaluate whether the security software is working properly; Module M5: When upgrading the security software, configure the onboard simulation system to verify whether the upgrade package is correct after receiving the complete security software upgrade package. If it is correct, the software will be upgraded in the onboard simulation system. After the upgrade is successful, the ground will be notified through telemetry information and the upgraded security software will be tested. Finally, the upgraded software will be mapped to the real environment.

9. The satellite safety software periodic maintenance and upgrade system according to claim 8, characterized in that: In the module M1, the management component is responsible for storing and calling test cases that cause abnormal behavior of the satellite; The management component classifies and stores the test cases of satellite abnormal behaviors, and divides them into abnormal behaviors of data transmission subsystem, abnormal behaviors of measurement and control subsystem, abnormal behaviors of attitude and orbit control subsystem, and abnormal behaviors of thermal control subsystem. These test cases are compiled into abnormal behavior telemetry packages and transmitted to the ground through the satellite-to-ground link, with different letters representing different subsystem abnormal behaviors. The remote control data package specified in the above statement specifies the test cases to be used. The management component extracts the corresponding test cases from the corresponding subsystems. When the remote control data package uploads new test cases, it is protected by security software and the currently extracted test cases are stored in different locations according to the affected subsystems. The storage table is then downloaded again and the number of the new test cases is added to the storage table. The working state of the simulated satellite in the module M2 includes: The satellite status component transmits a signal to the security software. The security software maps all current data to the satellite status component for multiple consecutive times, compares each data, and uses voting to retain the software data. After the final determination, it deletes other mapped software and starts to conduct protection tests for remote control commands. If the remote control command to end the test is not received, the satellite status information will be retained and re-uploaded to overwrite it. If the telemetry information to end the test is received, all information in the satellite status component will be deleted. After each test case is completed, the process and results will be transmitted to the ground.

10. The satellite safety software periodic maintenance and upgrade system according to claim 8, characterized in that: The simulation of satellite temperature changes in the module M2 includes: The temperature model is created based on Thermal Desktop software, and the shapes of the satellite's shell, solar panels and electronic payload are created through Thermal Desktop software; cylinders and rectangles are used to represent the main part of the satellite, and the height, radius and thickness of these geometric bodies are adjusted according to the actual size of the satellite; Create a rectangle for the solar panel to fit the shell, adjust the size and tilt angle of the rectangle to match the actual design, and perform detailed meshing; The temperature model scans the set grid and automatically marks the grid that is distorted, disconnected or inconsistent with the shape of the satellite components, and the developer makes modifications; The simulation of satellite temperature change in the module M2 also includes: The temperature model reads the satellite orbit, attitude and electronic load power consumption set in the onboard simulation system, and further sets the radiation boundary conditions; adjusts the incident angle according to the orbit and attitude of the satellite to simulate the radiation reception under different conditions; Use radiation boundary conditions to simulate the radiation loss from the satellite surface to space, set internal heat sources for electronic equipment, automatically input the power consumption of each electronic load, and perform transient analysis on the model after defining the time step and simulation time to provide changes in temperature-related data for the onboard simulation system; The module M3 includes: an access authentication component performs docking through random key authentication between the satellite and the ground, and performs cyclic redundancy check on the remote control data packet through a check code; If there is a problem with the verification result, the ground will resend the remote control data packet, splice different data in the data packet according to the sequence number, and send the spliced ​​data to the satellite status component; The module M5 includes: when the security software is upgraded, after receiving the complete security software upgrade package, first check to confirm whether the security software upgrade package is correct. If it is wrong, the ground will re-upload a security software upgrade package. The security software is first mapped to the satellite simulation system, and the software is upgraded in the satellite simulation system. After the upgrade is successful, a simple telemetry notification will be transmitted to the ground, and the ground will then upload a remote control command to test the upgraded security software. After the newly added protection function is tested successfully, the security software in the satellite simulation system is mapped to the real environment, and then the original security software is deleted, thereby completing the upgrade of the security software.

Images