Satellite Internet identification system, satellite Internet communication method and storage medium

Abstract

The invention provides a satellite Internet identification system, a satellite Internet communication method and a storage medium, and the system comprises a satellite identification analysis system which is used for storing satellite identification information through a distributed identification database, verifying the identity of a terminal through a certificate associated with a satellite identification, and carrying out the identification analysis; the satellite identification registration system is used for registering and managing satellite identification information by adopting a single-stage management architecture and directly registering satellite identification to an identification registration management center; the satellite identification certificate system is used for identity authentication and certificate signing and issuing of all request terminals in the network, and after certificate information is changed, the changed information is synchronized to the satellite identification registration system. The method and the system can adapt to the characteristics of the satellite internet, the network resource utilization rate and the identification analysis efficiency are improved, and the user experience is improved. Authentication and point-to-point encryption communication of a request terminal are supported, and technical support is provided for realizing large-scale networking which can be separated from the ground and is completely based on satellites.

Description

Technical Field

[0001] The present invention relates to the technical field of satellite Internet, and in particular to a satellite Internet identification system, a satellite Internet communication method, and a storage medium. Background Art

[0002] As a new communication method, satellite Internet is gradually becoming an important means to cover the globe and provide broadband access. Currently, satellite Internet is mainly used as an application means to access the terrestrial Internet. After a user accesses the satellite network, the user mainly accesses various services through the terrestrial Internet and relies on identification services such as the traditional Domain Name System (DNS) to address various services, and relies on the terrestrial Internet to access various network services. Due to the lack of an identification system adapted to satellite Internet, it is currently impossible to achieve large-scale networking completely based on satellites without relying on the ground. Moreover, the existing identification systems are designed for terrestrial Internet and are difficult to adapt to scenarios with frequent satellite dynamic networking, relatively high link latency, and relatively high communication security requirements. There are problems such as relatively low identification resolution efficiency, complex resource allocation and management, and difficulty in guaranteeing communication security and quality, and thus they cannot be directly transplanted into satellite Internet applications. Summary of the Invention

[0003] The present invention provides a satellite Internet identification system, a satellite Internet communication method, and a storage medium, so as to solve the problem that the identification method of the traditional domain name system is difficult to meet the requirements of scenarios with frequent satellite dynamic networking, relatively high link latency, and relatively high communication security requirements, and the defect of lacking an identification system adapted to the characteristics of satellite Internet.

[0004] The present invention provides a satellite Internet identification system, including: A satellite identification resolution system, including a distributed identification database, where the distributed identification database is used to store satellite identification information, and the satellite identification resolution system is used to verify the identity of a request terminal according to a certificate associated with the satellite identification information of the request terminal, perform resolution on a resolution request sent by the request terminal after the identity verification is passed, and confirm a target terminal according to the satellite identification information in the resolution request; A satellite identification registration system, which uses a single-level management architecture to register and manage satellite identification information, and is used to directly register the satellite identification of a terminal with an identification registration management center and transmit the satellite identification information of the terminal to the satellite identification resolution system; A satellite identification certificate system, which is used for identity authentication and certificate issuance of all request terminals in the network. After the certificate information changes, the changed information is synchronized to the satellite identification registration system, so that the satellite identification registration system updates the identification information according to the changed information and synchronizes the latest identification information to the satellite identification resolution system.

[0005] According to the satellite Internet identification system provided by the present invention, the satellite identification information includes multi-element identification including user equipment number, user equipment port, communication protocol, and user location. After the satellite identification resolution system verifies the identity of the requesting terminal based on the certificate status information of the requesting terminal, the user equipment number, user equipment port, communication protocol, and user location are respectively matched according to a preset priority. After successful matching, the resolution result is returned to the requesting terminal.

[0006] According to the satellite Internet identification system provided by the present invention, the satellite identification resolution system further includes a domain name resolution module and a satellite identification resolution module; the distributed identification database is further used to store key domain name information of part of the domain name system, and the satellite identification resolution system is further used to identify an identification resolution request. When it is identified that the identification resolution request is a domain name resolution, the key domain name information is resolved through the domain name resolution module to access the terrestrial Internet; When it is identified that the identification resolution request is a satellite identification resolution, the satellite identification information is resolved through the satellite identification resolution module to achieve point-to-point communication through the satellite Internet.

[0007] According to the satellite Internet identification system provided by the present invention, the satellite identification certificate system manages the life cycle of certificates, specifically including: When a terminal requests to access the satellite Internet, it sends a certificate issuance request to the satellite identification certificate system. The satellite identification certificate system verifies based on the identity information provided by the terminal. After verification passes, a certificate is issued to the terminal, and the certificate includes a public key and device identity identifier information; When the subject of the issued certificate needs to cancel the certificate, the satellite identification certificate system cancels the issued certificate and synchronizes the certificate status to the satellite identification registration system, so that the satellite identification registration system updates the identification information according to the certificate status; After the certificate is issued, updated, or cancelled, the satellite identification certificate system synchronizes the relevant information to the satellite identification registration system, so that the satellite identification registration system updates the identification information according to the certificate status, and synchronizes the identification information with the satellite identification resolution system.

[0008] According to the satellite Internet identification system provided by the present invention, the synchronization of identification information with the satellite identification resolution system includes: using an incremental synchronization protocol to only transmit newly added, modified, or deleted identification data to the satellite identification resolution system.

[0009] The present invention also provides a satellite Internet communication method, including: Verifying whether the terminal identity authentication certificate for accessing the satellite Internet is valid through the satellite identification certificate system; The satellite identification registration system assigns a manageable identification to the terminals accessing the satellite Internet and synchronizes the identification information to the Zhongwei Satellite Identification Resolution System; The satellite identification resolution system resolves the identification information in the access request to determine the target terminal and establishes a connection with the target terminal.

[0010] According to the satellite Internet communication method of the present invention, the resolving the identification information in the access request by the satellite identification resolution system to determine the target terminal includes: When a terminal needs to communicate with another terminal, it sends an identification resolution request to the satellite to which it is nearest using the certificate of the initiating request terminal, and the identification resolution request includes the identification information of the target terminal; The identification resolution system on the nearest satellite checks whether the certificate provided by the requesting terminal is valid. If it is valid, an encrypted connection is established between the nearest satellite and the requesting terminal, and the request message type is identified: If the request type is domain name resolution, it is transferred to the domain name resolution module in the satellite identification resolution system for resolution to determine the target terminal; If the request type is satellite identification resolution, it is transferred to the satellite identification resolution module in the satellite identification resolution system for resolution to determine the target terminal.

[0011] According to the satellite Internet communication method provided by the present invention, the if the request type is domain name resolution, it is transferred to the domain name resolution module in the satellite identification resolution system for resolution to determine the target terminal includes: Judge whether it is an A record query. If it is not an A record query, the resolution ends and the resolution failure is returned; otherwise, the corresponding domain name information is searched in the distributed identification database, and the query result is returned to the requesting terminal.

[0012] According to the satellite Internet communication method provided by the present invention, the if the request type is satellite identification resolution, it is transferred to the satellite identification resolution module in the satellite identification resolution system for resolution to determine the target terminal includes: Search for the identification information of the target terminal in the distributed identification database, check whether the status of the identification is valid. If the status is invalid, the resolution failure is returned and the resolution ends; otherwise, the corresponding resolution result is returned to the requesting terminal according to the data in the distributed identification database.

[0013] The present invention also provides a non-transitory computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, it implements the satellite Internet communication method described in any one of the above.

[0014] The satellite Internet identification system, satellite Internet communication method, and storage medium provided by the present invention. The satellite Internet identification system includes a satellite identification resolution system, which includes a distributed identification database for storing satellite identification information. The satellite identification resolution system is used to verify the identity of the requesting terminal according to the certificate associated with the satellite identification information of the requesting terminal, parse the parsing request sent by the requesting terminal after the identity verification is passed, and confirm the target terminal according to the satellite identification information in the parsing request; a satellite identification registration system that uses a single-level management architecture to register and manage satellite identification information, and is used to directly register the satellite identification of the terminal with the identification registration management center and transmit the satellite identification information of the terminal to the satellite identification resolution system; a satellite identification certificate system for identity authentication and certificate issuance of all requesting terminals in the network. After the certificate information changes, the changed information is synchronized to the satellite identification registration system, so that the satellite identification registration system updates the identification information according to the changed information and synchronizes the latest identification information to the satellite identification resolution system. Through the single-level management architecture, it can adapt to the characteristics of the satellite Internet, improve network resource utilization and identification resolution efficiency, support the authentication of requesting terminals and point-to-point encrypted communication, and provide technical support for realizing large-scale networking that can be separated from the ground and completely based on satellites. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following will briefly introduce the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings in the following description are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0016] Figure 1 It is a schematic diagram of the architecture of the satellite Internet identification system provided by the embodiment of the present invention; Figure 2 It is a schematic diagram of the satellite Internet identification registration and resolution process provided by the embodiment of the present invention; Figure 3 It is a schematic diagram of the satellite Internet communication process provided by the embodiment of the present invention; Figure 4 It is a schematic diagram of the satellite Internet identification resolution process provided by the embodiment of the present invention; Figure 5 It is a schematic diagram of end-to-end communication based on the satellite Internet identification system provided by the embodiment of the present invention; Figure 6 It is a schematic diagram of end-to-end communication based on the satellite Internet identification system provided by the embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0017] To make the objectives, technical solutions and advantages of the present invention clearer, the technical solutions in the present invention will be clearly and completely described below with reference to the accompanying drawings in the present invention. Apparently, the described embodiments are some but not all of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the embodiments in the present invention without making creative efforts shall fall within the protection scope of the present invention.

[0018] Figure 1 The following is a schematic diagram of the architecture of the satellite Internet identification system provided by the embodiments of the present invention. As Figure 1 shown, the satellite Internet identification system provided by the embodiments of the present invention includes: A satellite identification resolution system, including a distributed identification database for storing satellite identification information. The satellite identification resolution system is used to verify the identity of a requesting terminal according to a certificate associated with the satellite identification information of the requesting terminal, resolve a resolution request sent by the requesting terminal after the identity verification is passed, and confirm a target terminal according to the satellite identification information in the resolution request; In the embodiments of the present invention, the satellite identification resolution system is deployed on a satellite in the space segment. Based on the satellite identification resolution algorithm, the system realizes efficient and secure satellite identification resolution and can be compatible with traditional DNS resolution.

[0019] A satellite identification registration system that uses a single-level management architecture to register and manage satellite identification information, and is used to directly register the satellite identification of a terminal with an identification registration management center and transmit the satellite identification information of the terminal to the satellite identification resolution system; In the embodiments of the present invention, the satellite identification registration system is deployed at an identification registration management center (Identifier Registration and Management Center, abbreviated as IRMC) in the ground segment. The identification registration management center is the core management agency of the satellite Internet identification system, responsible for the identification assignment, registration and management of all terminals accessing the satellite Internet globally. Ensure that the identification of each requesting terminal is unique, traceable and manageable. After the identification information changes, IRMC transmits the relevant data to the satellite identification resolution system in an incremental synchronization manner. Different from the multi-level hierarchical architecture such as the root, top-level domain, and second-level domain in the domain name system, in order to improve the identification resolution and management efficiency on the satellite Internet, the satellite Internet identification system adopts a single-level management architecture, and the identification registration management center is responsible for the assignment and management of all satellite identifications, which can significantly improve the management efficiency and security.

[0020] The satellite identification certificate system is used for identity authentication and certificate issuance of all requesting terminals in the network. When the certificate information changes, the change information is synchronized to the satellite identification registration system, so that the satellite identification registration system updates the identification information according to the change information and synchronizes the latest identification information to the satellite identification resolution system.

[0021] In an embodiment of the present invention, the satellite identification certificate system is deployed in the Identity Authentication and Management Center (IAMC) of the ground segment. The system is responsible for the identity authentication and certificate issuance of all requesting terminals in the network, ensuring that each terminal accessing the network is authenticated and protecting the system from unauthorized access. IAMC manages the life cycle of the certificate, including issuance, renewal, revocation, etc., to ensure the validity and security of the certificate. When the certificate information changes, IAMC synchronizes the relevant information to IRMC.

[0022] In the embodiment of the present invention, based on the single-level architecture of the identification system, identification resolution is completed in one stop by the identification resolution system on the satellite, without involving a recursive resolution process, thereby improving the efficiency of identification resolution.

[0023] Traditional identification systems are mostly designed for ground Internet, and are difficult to adapt to scenarios such as frequent dynamic satellite networking, high link latency, and high communication security requirements. They have relatively low identification resolution efficiency, complex resource allocation and management, and communication security and quality assurance. They cannot be directly transplanted to satellite Internet applications. Take the most widely used DNS as an example: the DNS system architecture is complex. DNS adopts a multi-layer management architecture including root, top-level domain, and second-level domain. The complex hierarchical relationship not only reduces the efficiency of domain name resolution, but also makes domain name management complicated. It is not suitable for scenarios with rapid dynamic networking and frequent topology changes in satellite Internet. DNS domain name records have low scalability. DNS resolution implements the mapping of domain names and IPs. After the client obtains the resolved IP, it uses port 80 of the IP by default. It is impossible to bind the domain name to different service ports, nor can it reflect the weight of these IPs. It is not suitable for satellite Internet, where various services provide services based on different ports and different priorities. The DNS resolution process is complex. DNS resolution relies on the DNS recursive server to iteratively query the DNS authoritative servers at all levels. Considering the high latency in the satellite network, it is unrealistic to deploy recursive DNS on the satellite and recursively query the authoritative DNS at all levels on the ground. The DNS security mechanism is weak and is not suitable for the needs of encrypted communications and terminal access control on satellite Internet.

[0024] The satellite Internet identification system provided by the embodiments of the present invention. The satellite identification resolution system includes a distributed identification database for storing satellite identification information. The satellite identification resolution system is used to verify the identity of the requesting terminal according to the certificate associated with the satellite identification information of the requesting terminal, resolve the resolution request sent by the requesting terminal after the identity verification is passed, and confirm the target terminal according to the satellite identification information in the resolution request; the satellite identification registration system uses a single-level management architecture to register and manage satellite identification information, and is used to directly register the satellite identification of the terminal with the identification registration management center and transmit the satellite identification information of the terminal to the satellite identification resolution system; the satellite identification certificate system is used for the identity authentication and certificate issuance of all requesting terminals in the network. After the certificate information changes, the changed information is synchronized to the satellite identification registration system, so that the satellite identification registration system updates the identification information according to the changed information and synchronizes the latest identification information to the satellite identification resolution system. Through the single-level management architecture, it can adapt to the characteristics of the satellite Internet, improve the utilization rate of network resources and the identification resolution efficiency, support the authentication of the requesting terminal and point-to-point encrypted communication, and provide technical support for realizing large-scale networking that can be separated from the ground and completely based on satellites. Through the single-level management architecture, an efficient identification management and resolution mechanism can be realized, which can adapt to the characteristics of the satellite Internet, improve the utilization rate of network resources and the identification resolution efficiency, support the authentication of the requesting terminal and point-to-point encrypted communication, and provide technical support for realizing large-scale networking that can be separated from the ground and completely based on satellites.

[0025] Based on any of the above embodiments, the distributed identification database is used to store the key domain name information of part of the domain name system. The satellite identification resolution system is further used to identify the identification resolution request. When it is identified that the identification resolution request is a domain name resolution, the key domain name information is resolved through the domain name resolution module to access the terrestrial Internet; when it is identified that the identification resolution request is a satellite identification resolution, the satellite identification information is resolved through the satellite identification resolution module to realize point-to-point communication through the satellite Internet.

[0026] Traditional DNS is based on UDP plaintext transmission and lacks an identity authentication mechanism for clients. Although the IETF has currently released encryption transmission-based solutions such as DoH and DoT, these solutions are only applied between the client and the recursive DNS and do not cover the entire DNS system resolution path, and there is no mechanism for authenticating the client's identity. The embodiments of the present invention can be compatible with traditional DNS to resolve key domain names, further improving the practicability and applicability of the system. Based on the standardized identification protocol, it supports multiple device types, supports interoperability with traditional DNS, and realizes the resolution of key domain names. Moreover, through a complete identity authentication mechanism, the identity of the access node is ensured to be trustworthy. The data is transmitted in encrypted form, guaranteeing data privacy and integrity.

[0027] In an embodiment of the present invention, the satellite identification information includes multi-factor identification, priority, and certificate status information. The multi-factor identification includes a user equipment number, a user equipment port, a communication protocol, and a user location. After the satellite identification resolution system verifies the identity of the requesting terminal based on the certificate status information of the requesting terminal, the user equipment number, the user equipment port, the communication protocol, and the user location are respectively matched according to a preset priority. After the matching is successful, the resolution result is returned to the requesting terminal.

[0028] Satellite identification information (SaID) is the name of a satellite Internet identification, which can be composed of symbols such as letters and numbers. Generally, it contains multiple fields, and each field is separated by a "." In practical applications, users can name the identification according to actual needs, and key information such as user equipment number, location, and status is included in the identification information. For example, a typical SaID identification coding format is: "Location.Type.Subtype.Name.Date.Seq".

[0029] The satellite Internet identification resolution message is assembled in JSON format. JSON provides a concise and clear hierarchical structure and is easy to expand. The satellite Internet identification resolution message includes an identification type, and the identification type includes a satellite identification or a domain name system. According to the identification type, a corresponding resolution module can be selected for resolution. The satellite Internet identification resolution message also includes the communication address corresponding to the SaID. When there are multiple communication addresses, priorities are assigned to each communication address to ensure connection with the optimal target terminal. The satellite Internet identification resolution message assembled in JSON format is, for example: { "IDType": {SaID, DNS} "OpCode": {Query, Answer}, "Key": SaID_Name, / * The following fields only appear in the resolution response message. * / "Result": {OK, Fail, Refuse, Invalid}, "Value": [{"IP": "IP1", "Port": Port1, "Protocol": Protocol1, "weight": 1}, …, {"IP": "IP2", "Port": Port2, "Protocol": Protocol2, "weight": N}], "TTL": Time-To-Live, } Among them, the meanings of each field are as follows: IDType: indicates whether the request type of this message is SaID or DNS; OpCode: indicates whether this message is a resolution request or a resolution response; Key: the SaID identification name or domain name for which resolution is requested; Result: indicates the resolution result status of this query; Value: the communication address corresponding to the SaID; the communication address corresponding to a SaID identification is a set of triples {(IP1, Port1, Protocol1, Weight1), …, (IPN, PortN, ProtocolN, WeightN)} composed of identification type, IP network address, and port number. Each record in the set is a communication address, and the Weight in it marks the priority of this address.

[0030] TTL: the validity period of the result of this query. The terminal can cache the resolution result, and the cache validity period is determined according to this TTL.

[0031] In the embodiment of the present invention, the satellite Internet identification system manages satellite identifications, including: (1) Identification allocation and registration. After receiving the identification application from the terminal, IRMC reviews the relevant information. After passing the review, it assigns a unique identification to it, binds it to the communication address of the terminal, and writes the identification information into the local data directory library.

[0032] (2) Identification update and revocation. When the terminal status changes (such as device replacement, address change, service termination, etc.), IRMC updates or revokes the identification information according to the corresponding request and writes the identification information into the local data directory library. If the identification is cancelled, IRMC sets the status in the identification to unavailable.

[0033] (3) Identification synchronization.

[0034] After the identification information is updated, IRMC synchronizes the updated identification information data to the satellite network in real time so that the satellite can use the latest data for identification resolution and routing. The identification synchronization uses an incremental synchronization protocol, which only transmits the newly added, modified, or deleted identification data to reduce the overhead of synchronization communication.

[0035] The format of the identification synchronization message is as follows: { "IDType": {SaID, DNS} "OpCode": {Update, Delete, Add}, "Result": {OK, Fail, Refuse, Invalid}, "Key": SaID_Name, / * The following lists all the fields that may appear in an identity synchronization message. In actual applications, which specific fields are included is determined according to the information to be synchronized. If an identity is deleted, the following fields are not required. If only the communication address is updated, only the "Value" field needs to be included. * / "Value": [{"IP": "IP1", "Port": Port1, "Protocol": Protocol1, "weight": 1}, …, {"IP": "IP2", "Port": Port2, "Protocol": Protocol2, "weight": N}], "TTL": Time-To-Live, "Period": {Permanent, Temporary}, "Cert": {Valid, Invalid}, "Status": {OK, Pending,} } In addition to the SaID identity, the satellite Internet identity system also supports the resolution of key DNS domain names. Since it does not involve the recursive resolution process, the system only implements the A record resolution of key domain names, that is, directly returns the final resolution results of these key domain names to the user. The data of relevant key domain names is also collected and updated regularly by the IRMC as part of the system identity data and uploaded to the satellite.

[0036] The embodiment of the present invention adopts a flat single-level architecture, with the identity registration and management center uniformly managing the terminal identities, simplifying the complexity of multi-level management, and improving the efficiency of identity allocation and management. Moreover, the identity can be self-coded and named by the user according to application needs; the communication address corresponding to the identity includes elements such as IP, port, and priority, facilitating service deployment; the identity resolution message is defined based on JSON and is easy to expand.

[0037] Based on any of the above embodiments, the satellite identity certificate system manages the life cycle of certificates, specifically including: When the terminal requests to access the satellite Internet, it sends a certificate issuance request to the satellite identity certificate system. The satellite identity certificate system verifies according to the identity information provided by the terminal. After passing the verification, it issues a certificate for the terminal, and the certificate includes the public key and device identity identifier information; When the subject of a signed certificate needs to cancel the certificate, the satellite identification certificate system cancels the signed certificate and synchronizes the status of the certificate to the satellite identification registration system, so that the satellite identification registration system updates the identification information according to the certificate status; After the certificate is issued, updated or cancelled, the satellite identification certificate system synchronizes the relevant information to the satellite identification registration system, so that the satellite identification registration system updates the identification information according to the certificate status and synchronizes the identification with the satellite identification resolution system.

[0038] The identity authentication function in the satellite Internet identification system is realized by the linkage between the satellite network and the identity authentication management center on the ground. The identity authentication management center issues a certificate for each terminal accessing the satellite network, and the on-board identification system verifies the certificate to achieve the secure access and data protection of the terminal. Specifically: (1) Certificate Issuance When a terminal requests to access the satellite Internet, it needs to first send a certificate issuance request to the IAMC. The IAMC verifies according to the identity information provided by the terminal (such as user identity information, device ID, geographical location information, etc.). After the verification passes, the center issues a unique digital certificate for the terminal, which contains information such as the public key and the device identity identifier. The communication terminal uses the issued certificate to access the satellite Internet, and the on-board identification system verifies the legitimacy of the terminal according to the certificate to ensure that only the authenticated terminals can access the network.

[0039] (2) Certificate Cancellation When the identity information of the subject of a signed certificate is leaked or other emergencies occur and the certificate needs to be cancelled, the IAMC can cancel the signed certificate according to the corresponding situation. After the certificate is issued and cancelled, the IAMC synchronizes the status of the certificate to the IRMC, and the IRMC updates the identification information according to the certificate status and synchronizes the updated identification information to the satellite network. If the certificate is cancelled, both the certificate status and the identification status of the identification are set to unavailable.

[0040] (3) Certificate Information Synchronization The certificate is recorded as a status field ("Cert") in the identification data, that is, only the availability of the corresponding certificate status is stored in the SaID identification data, and the file information of the certificate itself is not stored. After the certificate is issued, updated or cancelled, the IAMC synchronizes the relevant information to the IRMC, and the IRMC updates the corresponding identification status and then synchronizes the information to the satellite network.

[0041] Based on any of the above embodiments, the synchronization of the identification with the satellite identification resolution system includes: using the incremental synchronization protocol to transmit only the newly added, modified or deleted identification data to the satellite identification resolution system.

[0042] Such as Figure 2As shown in the figure, the main working process of the satellite Internet identification system is as follows: 1. Certificate application. First, the main body of the communication terminal (Research Vessel A) submits identity information, such as user identity information, device ID, geographical location information, etc., to the IAMC to apply for an identity authentication certificate for accessing the satellite Internet. The IAMC reviews the submitted information and issues a certificate to the main body of the terminal after passing the review.

[0043] 2. Identification registration. After obtaining the certificate, the main body of the communication terminal uses the certificate as an identity proof to apply to the IRMC for a unique identifier. After verifying the certificate, the IRMC reviews the identifier format, assigns an identifier to the terminal, and writes the newly added identifier into the SaID directory library. Then, the newly added information is synchronized to the satellite.

[0044] 3. Identification resolution. Research Vessel A uses the certificate assigned by the IAMC to access the satellite Internet and initiates an identification resolution request for Research Vessel B. The satellite receives the resolution request, verifies the identity of Research Vessel A, and after passing the verification, resolves the identifier of Research Vessel B and returns the resolution result to Research Vessel A.

[0045] 4. Terminal communication. Research Vessel A uses the communication address of Research Vessel B obtained to establish an encrypted transmission channel with Research Vessel B based on the satellite network.

[0046] The satellite Internet identification system provided by the embodiments of the present invention can achieve efficient, secure, and flexible adaptation to the identification coding, identification management, and identification resolution of the satellite Internet, support the unique identification of a large number of terminals in the satellite Internet, the efficient management and real-time resolution of identification information, ensure the security of the communication process through the identity authentication mechanism, and be compatible with the resolution of key domain names through the traditional DNS method to meet the requirements of dynamic networking, large-scale terminal access, and cross-domain communication in the satellite Internet. Figure 3 It is a flowchart of the satellite Internet communication method provided by the embodiments of the present invention. As Figure 3 shown, the satellite Internet communication method provided by the embodiments of the present invention includes: Step 301, obtain a terminal identity authentication certificate for accessing the satellite Internet through the satellite identification certificate system; Step 302, assign a manageable identifier to the terminal accessing the satellite Internet through the satellite identification registration system, and synchronize the identifier information to the satellite identification resolution system; Step 303, resolve the identifier information in the access request through the satellite identification resolution system to determine the target terminal, and establish a connection with the target terminal.

[0047] In the embodiments of the present invention, the resolving the identifier information in the access request through the satellite identification resolution system to determine the target terminal includes: When a terminal needs to communicate with another terminal, it sends an identifier resolution request to the satellite to which it is proximally connected. The identifier resolution request includes the identifier information of the target terminal and the certificate of the requesting terminal. The identifier resolution system on the proximally connected satellite checks whether the certificate provided by the requesting terminal is valid. If it is valid, an encrypted connection is established between the proximally connected satellite and the requesting terminal, and the type of the request message is identified: If the request type is terrestrial domain name resolution, the target terminal is determined according to the domain name system resolution. If the request type is satellite identifier resolution, the target terminal is determined according to the satellite identifier resolution.

[0048] The case where if the request type is terrestrial domain name resolution, the target terminal is determined according to the domain name system resolution includes: It is determined whether it is an A record query. If it is not an A record query, the resolution ends and a resolution failure is returned. Otherwise, the corresponding domain name information is searched in the distributed identifier database, and the query result is returned to the requesting terminal.

[0049] The case where if the request type is satellite identifier resolution, the target terminal is determined according to the satellite identifier resolution includes: The identifier information of the target terminal is searched in the distributed identifier database, and the status of the identifier is checked whether it is valid. If the status is invalid, a resolution failure is returned and the resolution ends. Otherwise, the corresponding resolution result is returned to the requesting terminal according to the data in the distributed identifier database.

[0050] As Figure 4 shown, the specific process of identifier resolution includes: (1) Receive the identifier resolution request of the terminal.

[0051] (2) Verify whether the certificate of the terminal is valid. If the certificate is invalid, reject this resolution request and the resolution ends. If the certificate is valid, go to step (3).

[0052] (3) Establish an encrypted connection with the terminal, receive the request message, and check whether the request message is legal. If the request type is DNS, go to step (4); if the request type is SaID, go to step (5).

[0053] (4) Transfer the resolution request to the DNS resolution module: 4a) Determine whether it is an A record query. If it is a non-A record query, the resolution ends and a resolution failure is returned.

[0054] 4b) Search the distributed identifier database, perform resolution and return the resolution result to the terminal, and then the resolution ends.

[0055] (5) Transfer the resolution request to the SaID resolution module: 5a) Search the SaID identification library to determine whether the status of the identification is Valid. If it is Invalid, return a parsing failure and the parsing ends.

[0056] 5b) Based on the data in the SaID identification library, the parsing result is returned and the parsing is completed.

[0057] In the embodiment of the present invention, the identification resolution is completed by the satellite Internet identification resolution system on board. Different from the resolution mode in DNS, which relies on the recursive server to recursively query the authoritative servers at all levels, the SaID identification resolution is resolved in one stop on the satellite that the user is closest to, without involving the recursive resolution process, thus improving the resolution efficiency.

[0058] like Figure 5 As shown, in order to better introduce the end-to-end communication based on the satellite Internet identification system, the embodiment of the present invention is described by example, specifically see Example 1: Example 1 shows that two research vessels implement end-to-end encrypted communication based on the satellite Internet identification system. The implementation steps are as follows (assuming that research vessel B has been assigned the identification China.ResearchVessel.Tanxian1.20221030.000001 and connected to the satellite Internet): 1) Research vessel A submits relevant information of identity certification to IAMC and applies for access to satellite Internet; 2) IAMC reviews the identity information of research vessel A. After passing the review, it issues a certificate to research vessel A and synchronizes the newly issued certificate information to IRMC; 3) Research vessel A submits a certificate to IRMC and applies for registration of the SaID logo “China.ResearchVessel.Tanxian99.20241224.000020”; 4) IRMC verifies the certificate of research vessel A. After verification, it assigns the SaID "China.ResearchVessel.Tanxian99.20241224.000020" to research vessel A. After that, the new identification data is synchronized to the satellite.

[0059] 5) Research vessel A uses the certificate to access the nearest satellite Internet and requests to resolve the SaID identifier of research vessel B "China.ResearchVessel.Tanxian1.20221030.000001".

[0060] 6) The satellite receives the parsing request from research vessel A, verifies the certificate of research vessel A, and after the verification, parses "China.ResearchVessel.Tanxian1.20221030.000001" and returns the parsing result to research vessel A.

[0061] 7) The research vessel A obtains the communication address of the research vessel B from the parsing result and establishes an encrypted communication channel based on the satellite Internet with the research vessel B.

[0062] In the embodiment of the present invention, the research vessel A first applies for a certificate from the IAMC, and the IAMC issues the certificate after verification. This ensures that each terminal has a legal identity certificate. The IAMC and the IRMC perform certificate status synchronization to ensure that all terminals participating in the communication have valid identity authentication. After the terminal obtains the certificate, it applies for a unique identifier from the IRMC. The IRMC verifies the certificate and assigns the identifier, and at the same time synchronizes the identifier information to the satellite. The identifier information is synchronized between the ground center and the satellite to ensure that all nodes can access the latest identifier information.

[0063] The research vessel A uses the certificate assigned by the IAMC to access the satellite Internet and initiates an identifier resolution request for the research vessel B. After receiving the request, the satellite directly performs the resolution locally without involving the recursive query process, significantly improving the resolution efficiency. The research vessel A communicates through the satellite accessed nearby, reducing the latency time. The communication between the terminal and the satellite is carried out through an encrypted connection to ensure the security of data transmission. The validity of the terminal's certificate is verified before each resolution request to ensure that only legal terminals can communicate. The system stores the key domain name information of some traditional DNS, enabling the terminal to seamlessly access ground Internet resources, improving the compatibility and practicality of the system. The satellites can directly perform routing selection and forwarding, reducing the dependence on the ground network and improving the flexibility and reliability of communication. The IAMC and the IRMC are responsible for identity authentication and identifier registration respectively, and this distributed management method improves the scalability and fault tolerance of the system. The terminal can discover the identifier information of other terminals in real time through the satellite to ensure the real-time and accuracy of communication.

[0064] As Figure 6 shown, to better introduce the DNS resolution of the identifier system based on the satellite Internet, the embodiment of the present invention is described by way of example. See Embodiment 2 for details: Embodiment 2 shows that the client accesses the Xinhua News website based on the satellite Internet identifier system. The steps are as follows (assuming that the client has obtained the certificate issued by the IAMC): 1) The client uses the certificate to access the satellite Internet nearby and requests to resolve the domain name "www.news.cn"; 2) The satellite receives the client's resolution request, verifies the client's certificate, and after passing the verification, resolves "www.news.cn" and returns the resolution result to the client.

[0065] 3) The client obtains the IP address of the Xinhua News website from the resolution result and initiates a connection request to this IP.

[0066] 4) The satellite Internet routes client requests. Through the ground gateway station, the client accesses the ground Internet and visits Xinhuanet.

[0067] In the embodiment of the present invention, the terminal device (client) communicates through the satellite accessed nearby, reducing the latency time. This design ensures fast Internet access even in remote areas. The client initiates a resolution request for a domain name (such as www.news.cn) and performs efficient resolution through the satellite Internet identification system. This indicates that the system can be compatible with traditional DNS resolution requirements, ensuring that users can access ground Internet resources. Routing selection and forwarding are directly carried out between satellites, reducing the dependence on the ground network. This design improves the flexibility and reliability of communication. The service discovery mechanism between satellites ensures that the terminal can quickly find the required service, enhancing the overall communication efficiency. The process of certificate verification ensures that only legitimate terminals can communicate. This security mechanism prevents unauthorized access and data leakage. The system adopts a distributed management method, where the IAMC and IRMC are respectively responsible for identity authentication and identification registration, improving the scalability and fault tolerance of the system. The terminal accesses the ground Internet through the ground gateway station and visits websites such as Xinhuanet. This design ensures the seamless connection between the satellite Internet and the traditional Internet, enhancing the practicality of the system. The direct routing selection and forwarding mechanism between satellites reduces the dependence on the ground network and improves the flexibility and reliability of communication.

[0068] The satellite Internet communication method provided by the embodiment of the present invention obtains the terminal identity authentication certificate for accessing the satellite Internet through the satellite identification certificate system; assigns a manageable identifier to the terminal accessing the satellite Internet through the satellite identification registration system and synchronizes the identifier information to the medium satellite identification resolution system; resolves the identifier information in the access request through the satellite identification resolution system to determine the target terminal and establishes a connection with the target terminal, which can adapt to the characteristics of the satellite Internet, improve the utilization rate of network resources and the identifier resolution efficiency, support the authentication of the requesting terminal and point-to-point encrypted communication, and provide technical support for realizing large-scale networking that can be separated from the ground and is completely based on satellites.

[0069] On the other hand, the present invention also provides a non-transitory computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, it implements the satellite Internet communication method provided by the above-mentioned various methods. The method includes: obtaining the terminal identity authentication certificate for accessing the satellite Internet through the satellite identification certificate system; assigning a manageable identifier to the terminal accessing the satellite Internet through the satellite identification registration system and synchronizing the identifier information to the medium satellite identification resolution system; resolving the identifier information in the access request through the satellite identification resolution system to determine the target terminal and establishing a connection with the target terminal.

[0070] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed to multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. Those of ordinary skill in the art can understand and implement it without creative efforts.

[0071] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on such an understanding, the essence of the above technical solution, or the part that contributes to the related technology, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0072] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some of the technical features; and these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A satellite Internet identification system, characterized in that, Including: A satellite identification resolution system, including a distributed identification database for storing satellite identification information. The satellite identification resolution system is used to verify the identity of a requesting terminal based on a certificate associated with the satellite identification information of the requesting terminal, resolve a resolution request sent by the requesting terminal after successful identity verification, and confirm a target terminal according to the satellite identification information in the resolution request; A satellite identification registration system that uses a single-level management architecture to register and manage satellite identification information, and is used to directly register the satellite identification of a terminal with an identification registration management center and transmit the satellite identification information of the terminal to the satellite identification resolution system; A satellite identification certificate system for identity authentication and certificate issuance of all requesting terminals in a network. After the certificate information changes, the changed information is synchronized to the satellite identification registration system, so that the satellite identification registration system updates the identification information according to the changed information and synchronizes the latest identification information to the satellite identification resolution system.

2. The satellite Internet identification system according to claim 1, characterized in that The satellite identification information includes multi-factor identification, priority, and certificate status information. The multi-factor identification includes user equipment number, user equipment port, communication protocol, and user location. After the satellite identification resolution system verifies the identity of the requesting terminal based on the certificate status information of the requesting terminal, the user equipment number, user equipment port, communication protocol, and user location are respectively matched according to a preset priority. After successful matching, the resolution result is returned to the requesting terminal.

3. The satellite Internet identification system according to claim 1, wherein The satellite identification resolution system further includes a domain name resolution module and a satellite identification resolution module; the distributed identification database is also used to store key domain name information of a partial domain name system, and the satellite identification resolution system is also used to identify an identification resolution request. When it is identified that the identification resolution request is for domain name resolution, the key domain name information is resolved through the domain name resolution module to access the terrestrial Internet; When it is identified that the identification resolution request is for satellite identification resolution, the satellite identification information is resolved through the satellite identification resolution module to achieve point-to-point communication through the satellite Internet.

4. The satellite Internet identification system according to claim 1, wherein The satellite identification certificate system manages the life cycle of certificates, specifically including: When a terminal requests to access the satellite Internet, it sends a certificate issuance request to the satellite identification certificate system. The satellite identification certificate system verifies according to the identity information provided by the terminal. After successful verification, a certificate is issued for the terminal, and the certificate includes a public key and device identity identifier information; When the subject of a issued certificate needs to cancel the certificate, the satellite identification certificate system cancels the issued certificate and synchronizes the status of the certificate to the satellite identification registration system, so that the satellite identification registration system updates the identification information according to the certificate status; After a certificate is issued, updated, or cancelled, the satellite identification certificate system synchronizes the relevant information to the satellite identification registration system, so that the satellite identification registration system updates the identification information according to the certificate status and synchronizes the identification information with the satellite identification resolution system.

5. The satellite Internet identification system according to claim 4, characterized in that, Synchronizing the identification information with the satellite identification resolution system includes: using an incremental synchronization protocol to transmit only the newly added, modified, or deleted identification data to the satellite identification resolution system.

6. A satellite Internet communication method, characterized in that, Including: Verifying whether the terminal identity authentication certificate for accessing the satellite Internet is valid through the satellite identification certificate system; Allocating a manageable identification for the terminal accessing the satellite Internet through the satellite identification registration system and synchronizing the identification information to the satellite identification resolution system; Resolving the identification information in the access request through the satellite identification resolution system to determine the target terminal and establishing a connection with the target terminal.

7. The satellite Internet communication method according to claim 6, wherein The resolving the identification information in the access request through the satellite identification resolution system to determine the target terminal includes: When a terminal needs to communicate with another terminal, sending an identification resolution request to the satellite to which it is proximally connected. The identification resolution request includes the identification information of the target terminal and the certificate of the initiating request terminal; The identification resolution system on the proximally connected satellite checks whether the certificate provided by the requesting terminal is valid. If valid, an encrypted connection is established between the proximally connected satellite and the requesting terminal, and the type of the request message is identified: If the request type is domain name resolution, it is transferred to the domain name resolution module in the satellite identification resolution system for resolution to determine the target terminal; If the request type is satellite identification resolution, it is transferred to the satellite identification resolution module in the satellite identification resolution system for resolution to determine the target terminal.

8. The satellite Internet communication method according to claim 7, wherein, The if the request type is domain name resolution, it is transferred to the domain name resolution module in the satellite identification resolution system for resolution to determine the target terminal includes: Judging whether it is an A record query. If it is not an A record query, the resolution ends and returns a resolution failure; otherwise, searching for the corresponding domain name information in the distributed identification database and returning the query result to the requesting terminal.

9. The satellite Internet communication method according to claim 7, wherein The if the request type is satellite identification resolution, it is transferred to the satellite identification resolution module in the satellite identification resolution system for resolution to determine the target terminal includes: Searching for the identification information of the target terminal in the distributed identification database, checking whether the status of the identification is valid. If the status is invalid, return a resolution failure and end the resolution; otherwise, returning the corresponding resolution result to the requesting terminal according to the data in the distributed identification database.

10. A non-transitory readable storage medium, on which a computer program is stored, characterized in that, When the computer program is executed by a processor, it implements the satellite Internet communication method according to any one of claims 6 to 9.

Images