Satellite router software security reconstruction method

Abstract

The present application relates to a kind of on-orbit router software security reconstruction method, for transmission monitoring lag, high delay verification and insufficient isolation problem, propose integrity chain check and firewall double-layer verification collaborative scheme, combined with modular physical isolation design.Routing module activates hardware write protection lock when receiving data packet, prohibits unauthorized modification and supports policy lock-free update;Platform management module real-time download cumulative check value, ground verification after upper reconstruction instruction;Program burn module uses double Bank storage, supports atomization burn and trusted verification, abnormal automatic rollback safety version.Through space-earth collaborative double-loop verification (firewall filtering, token bucket flow limiting, ground CRC check) to resist attack, hardware isolation ensures that updating does not interrupt routing operation, intelligent rollback improves fault tolerance.Ceiling for high delay, strong interference on-orbit routing scene, guarantee transit / overseas satellite on-orbit maintenance when reconstructing business zero interruption, meet modern satellite network security needs.

Description

Technical Field

[0001] This invention relates to the field of electronic digital data processing technology, and specifically to a method for secure reconfiguration of spaceborne router software. Background Technology

[0002] Current on-orbit software reconfiguration technology for spaceborne routers faces multiple security challenges, severely restricting the reliable operation of space network equipment.

[0003] Traditional router software update methods lack real-time monitoring mechanisms during transmission. Attackers can exploit protocol vulnerabilities to tamper with data packets during transmission, resulting in malicious control code being injected into the reconstructed system.

[0004] Existing verification mechanisms generally adopt terminal verification mode, which performs verification in batches only after the complete data packet is received. This delayed verification method cannot effectively detect real-time attack behaviors such as bit flips and data packet injection that occur during transmission. Especially in scenarios where there is inherent high latency in the space-to-ground communication link, the ground control station has difficulty blocking ongoing attack behaviors in time, and security vulnerabilities are often exposed only after reconstruction is completed.

[0005] The existing architecture has significant hardware flaws: the software refactoring module and the routing service module share storage and computing resources. Attackers can exploit vulnerabilities such as memory overflows to infiltrate malicious code into the running routing and forwarding system, causing critical business data to be hijacked. Regarding storage design, most spaceborne systems use a single-bank storage system for software updates. Once a hidden backdoor is implanted in the refactored image, the system lacks the ability to quickly revert to a trusted version, easily leading to an irreversible loss of control. Existing technical improvements are limited to single-point verification at the receiver end, failing to build a continuity verification mechanism for the transmission link or achieve joint decision-making between space and ground.

[0006] Therefore, there is an urgent need to establish a new security reconstruction system that includes real-time rolling verification during transmission, satellite-ground collaborative decision-making, hardware-level resource isolation, and anomaly rollback mechanisms to cope with increasingly complex network attack threats. Summary of the Invention

[0007] The present application is to solve the problems of real-time security monitoring absence, multi-level verification system imperfection and system isolation deficiency in the existing on-board router software updating process, and provides an on-board router software security reconstruction method, which realizes end-to-end integrity protection of encrypted firmware / software block transmission between the satellite and the ground through a firewall double-layer verification system and a memory isolation architecture; adopts Content Addressable Memory (CAM) table item fast matching and token bucket flow limiting algorithm to resist flow attacks; realizes atomic switching of storage Bank through a fuse circuit; synchronously calculates a check value when receiving a data packet and transmits it to the ground for verification in real time, so as to ensure that malicious attack codes cannot penetrate into the running system. The whole-chain protection covering real-time rolling verification, hardware policy isolation and abnormal fuse rollback is formed, effectively solving the problem of malicious code penetration and significantly improving the anti-attack ability and task reliability of the spacecraft in orbit reconstruction.

[0008] The present application provides an on-board router software security reconstruction method, comprising the following steps:

[0009] S1, the ground station generates a firewall policy configuration instruction package, the firewall policy configuration instruction package includes an IP address whitelist, a flow threshold and an encryption key, and after being digitally signed using an asymmetric encryption algorithm, the firewall policy configuration instruction package is sent to all nodes in the satellite network; the IP address whitelist includes a ground station IP;

[0010] S2, the platform management module of the on-board router receives the firewall policy configuration instruction package, verifies the validity of the digital signature, and then writes the firewall policy into a protected memory area; a timer is used to complete the firewall policy effectiveness countdown within a first specified time;

[0011] S3, the platform management module configures the firewall policy, the firewall logic unit dynamically updates the stored IP address whitelist and token bucket flow shaping parameters according to the firewall policy, establishes a fast query channel based on CAM table items, and completes the firewall policy matching, and notifies the ground station through telemetry;

[0012] S4, after the telemetry displays that the firewall policy configuration is successful, the ground station divides the to-be-updated firmware / software into blocks, adds a target satellite IP address, and adds a CRC check code in each data block, and then uploads them to the target satellite; for a transit satellite, the data packets are directly sent to the target satellite through a measurement and control link; for an out-of-bound satellite, the data packets are sent to a transit satellite and then relayed to the target satellite;

[0013] S5, when the target satellite receives the data packet, the verification and filtering of the data packet are carried out through the firewall strategy, when it is judged that the data is illegal, the firewall filters and discards; when it is judged that the data is legal, the routing module of the target satellite receives the data packet, the data packet is stored in the ring buffer according to the serial number, the platform management module carries out the CRC check rolling calculation on the effective load for each received data packet, the chain CRC calculation is carried out on the data packet passing the check to obtain the final CRC check value, and the final CRC check value is returned to the ground station in real time through the telemetry channel according to the data packet serial number, and step S6 is entered;

[0014] The data packet passing the check is transferred to the MRAM safe cache area, and step S7 is entered.

[0015] S6, the ground station receives telemetry and compares the consistency of the data packet number with the preset value, and compares the final CRC check value fed back on the satellite with the local precalculated reference value.

[0016] When and only when the data packet number error is zero and the final CRC check value is consistent with the reference value, the on-orbit firmware / software reconstruction instruction including the time stamp, the Bank identifier and the signature is generated and uploaded to the target satellite through the measurement and control channel, and step S7 is entered.

[0017] S7, the program burning module of the on-board router verifies the signature validity of the on-orbit firmware / software reconstruction instruction, triggers the routing module to enter the maintenance mode and freezes the business forwarding table, and synchronously checks the firewall event log; the program burning module reads data from the MRAM according to byte blocks, writes the data into the Flash Bank1 through DMA, the fuse circuit completes the Bank0 to Bank1 switching within the second specified time, loads the new firmware / software, completes the router security reconstruction, sends the reconstruction success telemetry, and the on-board router software security reconstruction method is completed.

[0018] As a preferred mode, in the step S1, the firewall strategy configuration instruction packet further includes an IP address blacklist, and in the step S3, the firewall logic unit dynamically updates the stored IP address blacklist according to the firewall strategy.

[0019] The traffic threshold is a single IP traffic threshold, and the asymmetric encryption algorithm is an SM2 elliptic curve public key cryptography algorithm.

[0020] As a preferred mode, in the step S2, after the platform management module receives the firewall strategy configuration instruction packet and verifies the digital signature validity, the firewall function enabling state is judged, when the firewall function is enabled, the firewall strategy is written into the protected memory area.

[0021] In a preferred embodiment of the spaceborne router software security reconfiguration method described in this invention, in step S3, the IP address whitelist / IP address blacklist in the firewall logical unit is stored in the CAM table.

[0022] In a preferred embodiment of the method for secure reconfiguration of spaceborne router software described in this invention, in step S4, the ground station divides the firmware / software to be updated into blocks and adds a header checksum and a tail CRC checksum to each block.

[0023] In the preferred embodiment of the satellite router software security reconstruction method described in this invention, in step S4, the platform management module of the transit satellite performs two-layer verification: it compares the consistency of the source IP and destination IP with the CAM entries, verifies the inter-satellite link digital certificate, and checks the legality of the target satellite IP address.

[0024] When both the source IP and destination IP match the CAM entry, the digital certificate is valid, and the target satellite IP address is valid, data packets are forwarded to overseas satellites via the laser communication link.

[0025] In the preferred embodiment of the satellite router software security reconstruction method described in this invention, in step S4, after the satellite receives the data packet, it verifies the consistency between the target IP address in the packet header and the local IP address. If they are consistent, the process proceeds to step S5.

[0026] If there is a discrepancy, the forwarding path is checked to see if it exceeds the threshold. If it does not exceed the threshold, it is relayed. If it exceeds the threshold, it is discarded.

[0027] The method to verify whether the forwarding path exceeds the threshold is to verify whether the number of hops in the forwarding path is less than the threshold.

[0028] In a preferred embodiment of the method for reconstructing the software security of a satellite router as described in this invention, in step S5, when the target satellite receives a data packet, it filters data packets from unauthorized ground stations or relay satellites through an IP whitelist. The firewall automatically activates the traffic monitoring state machine, and when it detects that the data rate of a single IP address exceeds a set threshold, it immediately starts the token bucket rate limiting algorithm.

[0029] A NACK retransmission request is triggered when a data packet overflows in the circular buffer.

[0030] After the CRC check is calculated in a rolling manner, it is compared with the checksum at the end of the packet. Failed packets are marked with an error code; the final CRC checksum value is the cumulative checksum value.

[0031] As a preferred mode, in step S5, the MRAM safe cache area is isolated by the memory protection unit MPU authority, and the access of the routing module is prohibited; when the target satellite is an overseas satellite, the final CRC check value is sent to the transit satellite with the data packet serial number, and the transit satellite is forwarded to the target satellite through the laser link;

[0032] In step S7, when a policy conflict or illegal access record is found, the burning process is terminated, a safety alarm is activated, the system is reset, and the malicious forwarding table items remaining in the cache are cleared.

[0033] After each data block is written into the Flash Bank1, a CRC secondary check is performed, and if the check fails, the process is retried; after all checks are passed, the fuse circuit completes the Bank0 to Bank1 switching within a second specified time.

[0034] As a preferred mode, the on-board router is physically isolated, and the function is decoupled through the hardware bus isolation and independent memory partitioning.

[0035] The platform management module integrates a special monitoring unit, the special monitoring unit allocates a safe cache area, the access of other modules is limited through the memory protection unit, the cumulative check value of the reconstruction data packet is calculated in real time and is downloaded to the ground;

[0036] The routing module runs in an independent kernel, separates the service data stream and the maintenance instruction through a double bus architecture, is responsible for receiving the reconstruction data packet, activates the hardware write protection lock to prohibit unauthorized memory modification during the reconstruction, and performs the non-lock updating of the policy table item.

[0037] The program burning module is built-in with a double Bank Flash controller, the Bank0 solidifies the trusted starting program and the original firmware / software image, the Bank1 is used as an update writing area, and the Bank0 and the Bank1 are switched through the fuse control circuit at the hardware level.

[0038] The application is especially suitable for the on-orbit maintenance scene of the spacecraft on-board routing equipment when the on-board routing equipment is attacked by malicious data packets.

[0039] The application realizes the attack security reconstruction of the on-board router through the hardware architecture isolation and the safety process design, specifically a dynamic reconstruction method of the on-board routing software for the malicious data packet forwarding attack, based on the star-ground cooperative check mechanism and the layered defense architecture, combined with the firewall double-layer verification, the on-board routing software is safely updated when the network is attacked, and the task continuity is ensured.

[0040] The present application aims at the problems of lack of real-time monitoring in the transmission process, lag in high-delay environment verification and insufficient system isolation in the prior art, and proposes a technical solution combining integrity chain verification and firewall double-layer verification system, and physical isolation is realized by dividing platform management module, routing module and program burning module, etc.: the routing module is responsible for receiving the reconstructed data packet, and activates the hardware write protection lock during reconstruction to prohibit unauthorized memory modification, and realizes lock-free update of policy table items; the platform management module calculates the cumulative verification value of the data packet in real time and downloads it to the ground, and the ground station verifies the data integrity and uploads the reconstruction instruction; the program burning module adopts a double-Bank storage structure, performs atomic burning and trusted startup verification, and automatically reverts to the safe version when it fails. The present application realizes safe reconstruction of routing software through the firewall double-layer verification system and the chain verification mechanism, combines star-ground collaborative decision-making and hardware-level memory isolation control, significantly improves the safety of on-orbit maintenance of the spacecraft, ensures zero business interruption during the reconstruction process when subjected to malicious data packet attacks, can be used for transit satellites and overseas satellites, is suitable for high-delay and strong-interference on-board routing scenarios, and meets the safety management needs of modern satellite networks.

[0041] The technical solution of the present application is to provide a kind of on-board router software safe reconstruction method, which realizes the safe reconstruction of on-board router by hardware isolation architecture and safety process design, and supports the safe reconstruction of router software of transit star and overseas star, and the specific technical steps are as follows:

[0042] S1, the ground station generates a firewall policy configuration instruction packet, including IP address whitelist, traffic threshold and encryption key, adopts asymmetric encryption algorithm for digital signature, and sends it to all nodes in the satellite network;

[0043] S2, the platform management module of on-board router receives the information packet, verifies the validity of digital signature, analyzes the instruction to determine the firewall function enable state: if enabled, write the black and white list policy into the protected memory area, and complete the policy effective countdown through the timer within a certain time;

[0044] S3, the platform management module completes the firewall policy configuration, the firewall logic unit dynamically updates the stored IP address whitelist and token bucket traffic shaping parameters, establishes a fast query channel based on CAM table items, and realizes microsecond-level policy matching;

[0045] S4, after the telemetry displays the success of the firewall policy configuration, the ground station divides the firmware / software to be updated into blocks according to a certain byte, and each block is attached with a header and a trailer CRC check code;

[0046] Packet upload transmission: ①Transit star direct transmission: directly sent to the target satellite through the TT&C link; ②Overseas star relay: send the data packet to the transit star, and the IP address of the target overseas star is contained in the packet header;

[0047] The transit satellite platform management module verifies the execution of double-layer verification: ① consistency of source IP and destination IP with CAM table items; ② verification of inter-satellite link digital certificate, and checking of legality of target satellite IP address, and forwarding of data packets to the foreign satellite through the laser communication link;

[0048] The foreign satellite checks consistency of the target IP address in the packet header with the local IP address, and verifies whether the forwarding path exceeds the threshold, and discards the data packet if the threshold is exceeded;

[0049] S5, the routing module of the target satellite receives the data packet, filters the data packet from the unauthorized ground station or relay satellite through the IP whitelist (when the target satellite enables the receiving port, the firewall automatically activates the traffic monitoring state machine, and when it is detected that the data rate of a single IP address exceeds the set threshold, the token bucket throttling algorithm is immediately started);

[0050] The data packet is stored in the ring buffer according to the sequence number, and the NACK retransmission request is triggered when it overflows;

[0051] CRC verification is performed on the payload rolling calculation for each received data packet, and the error code is marked for the failed packet compared with the tail verification code;

[0052] For the data packet that passes the verification, chain CRC calculation is performed, and the cumulative verification value is returned to the ground station in real time through the telemetry channel along with the data packet sequence number, and enters step S7;

[0053] The data packet that passes the verification is stored in the MRAM safe cache area (accessed by the routing module is prohibited through the memory protection unit MPU permission isolation);

[0054] S6, the ground station receives the telemetry and compares the number of data packets with the preset value, and compares the final CRC verification value fed back by the satellite with the locally pre-calculated reference value;

[0055] Only when the number of data packets is zero and the verification values are consistent, the on-orbit firmware / software reconfiguration instruction containing the timestamp, Bank identification and signature is generated;

[0056] The on-orbit firmware / software reconfiguration instruction is uploaded to the target satellite through the measurement and control channel;

[0057] S7, the program burning module verifies the validity of the instruction signature, triggers the routing module to enter the maintenance mode and freezes the business forwarding table, synchronously checks the firewall event log, and if a policy conflict or illegal access record is found, the burning process is terminated and the security alarm is activated;

[0058] Data is read from the MRAM in byte blocks, written into the Flash Bank1 through direct memory access (DMA), and CRC secondary verification is performed after each block is written (failed retry);

[0059] After all the checks are passed, the fuse circuit completes the Bank0 to Bank1 switching within a certain time;

[0060] If any link fails, immediately back to Bank0, watchdog timer resets the system within a certain time and clears the cache;

[0061] After the system loads new firmware / software, the router security reconstruction is completed, and the successful telemetry is sent.

[0062] The on-board router adopts physical isolation design, including platform management module, routing module and program burning module, etc. The function decoupling is realized through hardware bus isolation and independent memory partition. The platform management module integrates a special monitoring unit, is responsible for allocating a safe cache area (MRAM), limiting access of other modules through a memory protection unit (MPU), calculating a cumulative check value of a reconstruction data packet in real time and downloading to the ground; the routing module runs in an independent kernel, separates service data flow and maintenance instructions through a double bus architecture, and is responsible for receiving the reconstruction data packet, activating a hardware write protection lock to prohibit unauthorized memory modification during reconstruction, and realizing lock-free update of policy table items; the program burning module has a double Bank Flash controller, Bank0 solidifies a trusted startup program and an original firmware / software image, Bank1 is used as an update writing area, and the two Banks are switched through a fuse control circuit.

[0063] The present application has the following advantages:

[0064] (1) Star-ground cooperative attack immunity: the on-board router is configured with a firewall (IP white list filtering and token bucket limiting) and a ground station checks data packet integrity (chain CRC tolerance check) to form a double closed loop verification, further improving reliability, and being suitable for high delay, strong interference communication scenes under malicious data packet attack.

[0065] (2) Hardware level security isolation: the business function and the firmware / software update operation are isolated through independent hardware modules, so that even if an attack is encountered during the update process, the normal operation of the routing system will not be affected.

[0066] (3) Intelligent fault tolerance recovery: if the update fails or an abnormality is detected, the system will automatically back to the original stable version without human intervention, greatly shortening the fault recovery time and ensuring the continuous and reliable operation of the spacecraft.

[0067] (4) Strong adaptability to complex environment: in view of the characteristics of high delay and easy interference of star-ground communication, a star-ground cooperative verification mechanism is adopted, so that even in a long distance communication scene, the attack can still be accurately identified and the security reconstruction is completed. BRIEF DESCRIPTION OF DRAWINGS

[0068] Figure 1 It is a flow chart of a software security reconstruction method for an on-board router.

[0069] Figure 2 A satellite router architecture diagram for a satellite router software security reconstruction method. DETAILED DESCRIPTION

[0070] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments of the present application.

[0071] Embodiment 1

[0072] As shown in the drawings, Figure 1 A satellite router software security reconstruction method, the application environment is: a low-orbit satellite (target satellite IP: 192.168.10.*, * is the last address of the target satellite IP) needs to update the routing software on orbit, the satellite is an overseas satellite, including the following steps:

[0073] S1, the ground station generates a firewall policy configuration instruction package containing its own IP (192.168.1.**, ** is the last address of the ground station IP) white list, sets the single IP traffic threshold to 1000 pps, uses the SM2 elliptic curve public key cryptography algorithm for digital signature, and then sends it to all nodes in the satellite network;

[0074] S2, the platform management module verifies the validity of the signature, writes the policy into the protected memory area, and starts a 5-minute policy effective countdown timer;

[0075] S3, the platform management module completes the firewall policy configuration, updates the newly added IP (192.168.1.**) and QoS parameters in the CAM table, and realizes microsecond-level policy matching;

[0076] S4, the ground station divides the software to be updated (size 2.5M) into 5120 data packets according to 512 bytes, adds a header and a tail CRC32 check code to each block, adds the target IP address (192.168.10.*), and uploads the data packets to the transit satellite through the Ka TT&C link;

[0077] At the same time, the attacker sends a fake update packet to the target satellite, and uploads the data packet to the transit satellite through the Ka TT&C link;

[0078] The platform management module of the transit satellite performs double-layer verification: ①detects that the packet source IP (192.168.0.66) is not in the CAM table, and directly discards it ②the platform management module verifies that the legal data packet digital signature is valid, the target satellite IP is legal, and forwards the data packet to the target satellite through the laser communication link;

[0079] The target satellite checks the consistency of the target IP address (192.168.10.*) in the target satellite packet header with the local IP address, verifies that the forwarding path hop count is less than the 3-hop threshold, receives the data packet and stores it in the buffer area, and intercepts the 4-hop path data packet forged by the attacker;

[0080] When the routing module of the target satellite receives the data packet, the traffic monitoring state machine of the firewall detects that the burst traffic of the attack source IP (10.1.1.33) reaches 5000 pps, and immediately starts the token bucket traffic limiting (token generation speed = 1000 pps)

[0081] The legal data packet is stored in the 4MB ring buffer area according to the sequence number, and when the overflow is triggered after 500ms, the NACK retransmission request is triggered;

[0082] The CRC32 rolling calculation is performed on the valid load of each received data packet, and the error code is marked for the failed packet by comparing with the packet tail check code;

[0083] The global CRC64 check value is accumulated and transmitted to the ground station in real time through the inter-satellite laser link with the data packet sequence number, and the ground station compares and finds that it is consistent with the pre-computed value, confirming the data integrity;

[0084] The data packet that passes the check is transferred to the MRAM safe buffer area, and the MPU sets this area as "only writable module readable" to prevent the routing module from accessing;

[0085] S6, the ground station receives telemetry and verifies the consistency of the received data packet number 5120 with the preset value, confirms that all packets are completely received, and compares the global CRC64 fed back by the satellite with the local pre-computed reference value;

[0086] Generate an on-orbit software reconstruction instruction containing a timestamp (UTC 2025-04-2716:18:30.456), Bank identification (Bank1), and signature;

[0087] The instruction is sent to the transit satellite through the TT&C link, and the transit satellite forwards it to the target satellite through the laser link;

[0088] S7, the program burning module of the target satellite verifies the validity of the instruction signature, triggers the routing module to enter maintenance mode and freezes the forwarding table;

[0089] DMA reads a 512-byte block from MRAM and writes it to Flash Bank1, and all 5120 blocks pass the CRC check (retry count 0);

[0090] The fuse circuit completes the Bank0→Bank1 switching within 50ms, and the routing service interruption rate is 0.1%;

[0091] If any link fails, immediately back to Bank0, watchdog timer resets the system within 300ms and clears the remaining malicious forwarding table items in the cache;

[0092] After the system loads the new software in Bank1, the ground station receives the confirmation signal, completes the router security reconstruction, restores the business forwarding to normal, and successfully resists the coordinated attack.

[0093] As shown in Figure 2 The on-board router adopts physical isolation design and includes a platform management module, a routing module, and a program burning module. The function decoupling is realized by hardware bus isolation and independent memory partitioning. The platform management module integrates a special monitoring unit, is responsible for allocating a secure cache area (MRAM), restricts access of other modules through a memory protection unit (MPU), calculates a cumulative check value of the reconstruction data packet in real time and transmits it to the ground, and runs in an independent kernel. The routing module separates business data flow and maintenance instructions through a double-bus architecture, is responsible for receiving the reconstruction data packet, activates a hardware write protection lock to prohibit unauthorized memory modification during the reconstruction, and realizes lock-free update of the policy table item. The program burning module is built-in with a double-Bank flash controller. Bank0 is solidified with a trusted startup program and an original firmware / software image, Bank1 is used as an update writing area, and the two Banks are switched through a fuse control circuit at the hardware level.

[0094] The embodiment example shows in detail how the application is applied in on-orbit maintenance of the on-board routing equipment of the spacecraft, including specific design of the CPU module of the on-board router and a security reconstruction execution flow under malicious attack data.

[0095] The above describes only the preferred specific implementation of the application, but the protection scope of the application is not limited to this. Any person skilled in the art can make equivalent replacement or change according to the technical solution and the inventive concept of the application within the technical range disclosed by the application, which should be covered in the protection scope of the application.

Claims

1. A method for software security reconfiguration of a spaceborne router, the method comprising: The method comprises the following steps: ​ S1, the ground station generates a firewall policy configuration instruction package, the firewall policy configuration instruction package comprises an IP address whitelist, a traffic threshold and an encryption key, and the firewall policy configuration instruction package is sent to all nodes in a satellite network after being digitally signed using an asymmetric encryption algorithm; the IP address whitelist comprises a ground station IP; S2, a platform management module of an on-board router receives the firewall policy configuration instruction package, verifies the validity of the digital signature, and writes the firewall policy into a protected memory area; a timer is used to complete a firewall policy effectiveness countdown within a first specified time; S3, the platform management module performs firewall policy configuration, a firewall logic unit dynamically updates a stored IP address whitelist and token bucket traffic shaping parameters according to the firewall policy, establishes a fast query channel based on a CAM table item, completes firewall policy matching, and notifies the ground station through telemetry; S4, after the telemetry displays that the firewall policy configuration is successful, the ground station divides to-be-updated firmware / software into blocks, appends a target satellite IP address, and appends a CRC check code in each data block, and then uploads the data to a target satellite; for a transit satellite, the data packet is directly sent to the target satellite through a measurement and control link; for an out-of-bound satellite, the data packet is sent to a transit satellite and then relayed to the target satellite; S5, when the target satellite receives the data packet, the target satellite performs verification and filtering on the data packet through the firewall policy; when the data packet is determined to be illegal, the firewall filters and discards the data packet; when the data packet is determined to be legal, a routing module of the target satellite receives the data packet, the data packet is stored in a ring buffer according to a serial number, the platform management module performs CRC check rolling calculation on a payload every time a data packet is received, a final CRC check value is obtained through chain-wise CRC calculation on the data packet that passes the check, and the final CRC check value and the serial number of the data packet are fed back to the ground station in real time through a telemetry channel; and the process proceeds to step S6; The data packet that passes the check is transferred to an MRAM safe cache area, and the process proceeds to step S7; S6, the ground station receives telemetry and compares the consistency of the number of data packets with a preset value, and compares the final CRC check value fed back by the satellite with a locally pre-calculated reference value; When and only when the number of data packets is zero and the final CRC check value is consistent with the reference value, an on-orbit firmware / software reconstruction instruction comprising a timestamp, a Bank identifier and a signature is generated and uploaded to the target satellite through a measurement and control channel, and the process proceeds to step S7; S7, a program burning module of the on-board router verifies the validity of the signature of the on-orbit firmware / software reconstruction instruction, triggers the routing module to enter a maintenance mode and freeze a business forwarding table, and synchronously checks a firewall event log; the program burning module reads data from the MRAM in byte blocks, writes the data into a Flash Bank1 through DMA, a fuse circuit completes Bank0 to Bank1 switching within a second specified time, loads new firmware / software, completes router security reconstruction, sends a reconstruction success telemetry, and a kind of on-board router software security reconstruction method is completed.

2. The method of claim 1, wherein: In step S1, the firewall policy configuration instruction package further comprises an IP address blacklist, and in step S3, the firewall logic unit dynamically updates the stored IP address blacklist according to the firewall policy. The traffic threshold is a single IP traffic threshold, and the asymmetric encryption algorithm is an SM2 elliptic curve public key cryptography algorithm.

3. The method of claim 1, wherein: In step S2, the platform management module receives the firewall policy configuration instruction package, verifies the validity of the digital signature, and then judges the firewall function enabling state. When the firewall function is enabled, the firewall policy is written into the protected memory area.

4. The method of claim 1, wherein: In step S3, the IP address whitelist / IP address blacklist in the firewall logic unit is stored in the CAM table.

5. The method of claim 1, wherein: In step S4, the ground station divides the to-be-updated firmware / software into blocks, and appends a header check code and a trailer CRC check code in each block.

6. The method of claim 1, wherein: In step S4, the platform management module of the transit satellite performs double-layer verification: comparing the consistency of the source IP and the destination IP with the CAM table item, verifying the inter-satellite link digital certificate, and verifying the legality of the target satellite IP address. When the source IP and the destination IP are consistent with the CAM table item, the digital certificate is legal, and the target satellite IP address is legal, the data packet is forwarded to the foreign satellite through the laser communication link.

7. The method of claim 6, wherein: In step S4, after the satellite receives the data packet, the consistency of the target IP address in the packet header with the local IP address is verified. When they are consistent, step S5 is entered. When they are inconsistent, it is verified whether the forwarding path exceeds the threshold. If not, the relay forwarding is performed. If it exceeds the threshold, it is discarded. The method of verifying whether the forwarding path exceeds the threshold is to verify whether the hop count of the forwarding path is less than the threshold.

8. The method of claim 1, wherein: In step S5, when the target satellite receives the data packet, the data packet from the unauthorized ground station or relay satellite is filtered through the IP whitelist, and the firewall automatically activates the traffic monitoring state machine. When the data rate of a single IP address exceeds the set threshold, the token bucket throttling algorithm is started immediately. When the data packet is stored in the ring buffer and overflows, the NACK retransmission request is triggered. The CRC check value is compared with the trailer check code after rolling calculation. The failed packet is marked with an error code. The final CRC check value is an accumulated check value.

9. The method of claim 1, wherein: In step S5, the MRAM secure cache area is isolated by the memory protection unit MPU permission, and the routing module is prohibited from accessing. When the target satellite is a foreign satellite, the final CRC check value is sent to the transit satellite with the data packet sequence number, and the transit satellite forwards it to the target satellite through the laser link. In step S7, when a policy conflict or illegal access record is found, the burning process is terminated and the security alarm is activated, the system is reset, and the remaining malicious forwarding table items in the cache are cleared. After each data block is written into the Flash Bank1, a CRC secondary check is performed. If it fails, it is retried. After all the checks are passed, the fuse circuit completes the Bank0 to Bank1 switching within a second specified time.

10. The method of claim 1, wherein: The on-board router is physically isolated, and the function is decoupled through the hardware bus isolation and independent memory partition. The platform management module integrates a special monitoring unit, which allocates a secure cache area, limits access of other modules through a memory protection unit, calculates a cumulative check value of a reconstructed data packet in real time, and transmits the check value to the ground; The routing module runs in an independent kernel, separates service data flow and maintenance instructions through a double bus architecture, is responsible for receiving the reconstructed data packet, activates a hardware write protection lock during reconstruction to prohibit unauthorized memory modification, and performs lock-free update of a policy table item; The program burning module is internally provided with a double Bank Flash controller, wherein Bank 0 solidifies a trusted starting program and an original firmware / software image, Bank 1 serves as an update writing area, and Bank 0 and Bank 1 are switched through a fuse control circuit at a hardware level.

Images