Software security reconstruction method and system for segmented decoupling management

Abstract

The invention provides a software security reconstruction method and system for segmented decoupling management, and relates to the technical field of communication, and the method adopts a segmented decoupling architecture with cooperation of a ground end and a non-ground end. The ground end uploads software reconstruction data to the non-ground end through a first communication link including a user service link, the non-ground end stores the software reconstruction data, the non-ground end provides the software reconstruction data or verification feature information, and the verification feature information is sent to the non-ground end. The ground end verifies the software reconstruction data stored in the non-ground end through a ground trusted entity, and after verification is passed, the ground trusted entity sends an authorization execution instruction; and the non-ground end executes reconstruction operation after receiving the execution authorization instruction. According to the invention, through decoupling management of each stage on time, space and links, the reconstruction data can be conveniently uploaded at any place through multiple links, meanwhile, the safety and controllability of verification and execution are ensured, and the flexibility and operation and maintenance efficiency of on-orbit reconstruction of satellite-borne software are improved.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and in particular to a software security reconfiguration method and system with segmented decoupling management. Background Technology

[0002] With the continuous expansion of satellite application scenarios and the increasing complexity of missions, the on-orbit reconfiguration capability of onboard software has become an important indicator for measuring the performance of modern spacecraft. By updating on-orbit software, satellites can fix vulnerabilities, optimize performance, and adapt to new missions, thereby extending their service life and enhancing mission flexibility.

[0003] Currently, spaceborne software reconfiguration primarily relies on a centralized ground-based telemetry and control system. The transmission, verification, and execution control of reconfiguration data are all uniformly completed by the ground operations control center through a dedicated telemetry and control link, forming a highly integrated closed-loop control system. Specifically, this closed-loop control system employs a strict sequential execution mode. The various stages of the reconfiguration process are tightly coupled in terms of time sequence, physical location, and communication resources, making it unable to support parallel operation of multiple nodes or utilize heterogeneous link resources. Secondly, to achieve precise command-level control, the system generally uses dedicated communication protocols, lacking support for standardized file transfer mechanisms, resulting in low transmission efficiency and difficulty in compatibility with modern secure transmission standards. Furthermore, the entire reconfiguration process is highly dependent on manual intervention; operator participation is required from command initiation to status monitoring, resulting in poor system autonomy and limited error recovery capabilities.

[0004] Therefore, there is an urgent need to design a technical architecture that can break through the tight coupling of the entire process in spaceborne software reconfiguration, so as to improve the flexibility and operational efficiency of spaceborne software reconfiguration in orbit while ensuring operational safety. Summary of the Invention

[0005] This invention provides a software security reconfiguration method and system with segmented decoupling management, which solves the defects of low flexibility and low operation and maintenance efficiency caused by the tight coupling of the entire process of spaceborne software reconfiguration in related technologies.

[0006] Firstly, this invention provides a segmented decoupled management method for secure software reconfiguration. This method comprises three core stages: an upload stage, where software reconfiguration data is sent to a non-ground terminal via multiple communication links, including user service links; a verification stage, where a trusted ground entity verifies the reconfiguration data stored on the non-ground terminal; and an execution stage, where, after successful verification, the trusted ground entity sends an execution authorization command to the non-ground terminal, triggering it to initiate the software reconfiguration operation. At least two of the three core stages are executed discontinuously in time, either using different communication links or simultaneously implementing both decoupling methods.

[0007] According to the present invention, a software security reconfiguration method for segmented decoupled management is provided, wherein the ground trusted entity is specifically a satellite operation and control center or a satellite telemetry and control center, both of which have the qualifications and capabilities to complete verification and authorization operations.

[0008] According to the software security refactoring method for segmented decoupled management provided by the present invention, the ground end also includes an independent file upload entity. Upload operations can be completed either through this file upload entity, through a trusted ground entity, or through a combination of both, and the uploaded data uses a file format with clearly defined boundaries.

[0009] According to the software security reconfiguration method of segmented decoupling management provided by the present invention, the first communication link adopts a general file transfer protocol with a transmission reliability guarantee mechanism. The protocol specifically supports one or more combinations of session state maintenance, error recovery, breakpoint resume function or segmented verification function.

[0010] According to the software security reconfiguration method of segmented decoupling management provided by the present invention, the verification process is as follows: the ground trusted entity first receives complete software reconfiguration data from the non-ground end, and then performs integrity verification on the data to confirm that the data has not been tampered with or damaged, and performs legality verification to confirm that the data source is trustworthy and meets the execution requirements.

[0011] According to the software security reconfiguration method of segmented decoupling management provided by the present invention, another verification implementation method is provided: the ground trusted entity receives verification feature information calculated based on software reconfiguration data from the non-ground end, and then completes the integrity verification and legality verification of the original software reconfiguration data based on the verification feature information.

[0012] According to the present invention, a software security refactoring method with segmented decoupling management includes a legality verification method that specifically includes authenticating the digital signature carried by the refactoring data to verify the developer's identity, and performing version matching verification to ensure compatibility with the target software and hardware environment.

[0013] According to the software security reconfiguration method for segmented decoupling management provided by the present invention, the sending of the authorization instruction is transmitted from the ground trusted entity to the non-ground end via a second communication link.

[0014] According to the software security reconfiguration method with segmented decoupling management provided by the present invention, the ground end also includes a monitoring and interaction process: the ground trusted entity continuously receives reconfiguration status information from the non-ground end through a second communication link. This information includes task progress, real-time execution status and possible error information; and based on this status information, it sends control commands to the non-ground end through the same link to realize the interruption or continuation control of the reconfiguration process.

[0015] According to the software security refactoring method of segmented decoupling management provided by the present invention, the upload stage, verification stage and execution stage are all independently executable, and each stage can be executed once or multiple times, thereby forming a flexible task orchestration.

[0016] Secondly, this invention provides a segmented decoupled management method for secure software reconfiguration, applicable to non-ground terminals. The method comprises three corresponding stages: receiving and storing software reconfiguration data transmitted from a ground terminal via a first communication link; responding to a verification request initiated by a trusted ground entity, returning the stored complete software reconfiguration data or verification feature information generated based on that data; and receiving an execution authorization instruction issued by the trusted ground entity after successful verification, and responding to that instruction to execute a software reconfiguration operation based on the stored software reconfiguration data.

[0017] According to the software security reconfiguration method with segmented decoupling management provided by the present invention, the specific process of receiving data at the non-ground end is as follows: receiving and storing software reconfiguration data encapsulated in file form from the ground end through a first communication link, and the first communication link supports one or more combinations of general file transfer protocols with breakpoint resume function or segmented verification function.

[0018] According to the software security refactoring method of segmented decoupling management provided by the present invention, the specific steps of performing the software refactoring operation are as follows: First, the target storage area of ​​the refactored unit is erased. The refactored unit is a hardware unit in the non-ground end that needs to be updated with software. Then, the stored software refactoring data is split into multiple independent data packets with additional check values, and sent to the refactored unit in sequence for writing operation.

[0019] According to the software security reconfiguration method with segmented decoupling management provided by the present invention, the non-ground end receives the execution authorization instruction through a second communication link. The method also includes a status interaction step: sending reconfiguration status information, including task progress, execution status, and error information, to the ground end through the second communication link; and receiving control instructions from the ground end through the same link, and responding to these control instructions to interrupt or continue the reconfiguration process.

[0020] Thirdly, the present invention also provides a ground-based system for segmented decoupling management of secure software reconfiguration. This system includes: a file upload module responsible for sending software reconfiguration data to a non-ground terminal via a first communication link including the user service link; a verification and control module that verifies the software reconfiguration data stored on the non-ground terminal using a trusted ground entity; and a reconfiguration execution module that, after successful verification, sends an execution authorization command to the non-ground terminal via the trusted ground entity, triggering the non-ground terminal to initiate the software reconfiguration process.

[0021] Fourthly, the present invention also provides a non-ground-based system that works in conjunction with a ground-based system. This system includes: a file service module, responsible for receiving and storing software reconfiguration data from the ground-based system via a first communication link including a user service link; and a reconfiguration control module, responsible for responding to verification requests initiated by a trusted ground entity, returning the stored software reconfiguration data or its characteristic information, receiving an execution authorization instruction issued by the trusted ground entity after successful verification, and responding to the instruction to perform software reconfiguration operations.

[0022] Fifthly, the present invention also provides a processor-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the software security refactoring method of segmented decoupling management as described in any one of the first or second aspects.

[0023] In a sixth aspect, the present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the software security refactoring method of segmented decoupling management as described in any one of the first or second aspects.

[0024] Compared with existing technologies, the software security refactoring method and system with segmented decoupling management provided by this invention has the following significant advantages: By dividing the refactoring process into three logically independent phases—upload, verification, and execution—and ensuring that at least two phases are executed discontinuously in time or through different communication links, the limitations of traditional tightly coupled architectures are overcome. This segmented decoupling design allows data uploads to flexibly utilize various communication resources, including user business links, while ensuring that the verification and execution phases are always under the centralized control of a trusted ground entity, thus improving the flexibility of the system architecture while ensuring security and controllability.

[0025] By adopting a general file transfer protocol that supports breakpoint resumption and segmented verification, and encapsulating and reconstructing data in a standard file format, the reliability of transmission in long-latency and unstable spatial link environments is effectively improved. This eliminates the need to retransmit the complete file after transmission interruption, reduces reconstruction time costs, and overcomes the limitations of traditional customized protocols in terms of functional completeness and transmission efficiency.

[0026] A dedicated second communication link is used to build a two-way control channel between the satellite and the ground, enabling real-time feedback on the progress, execution status and error information of the reconstruction mission. It also supports ground operators to remotely send control commands based on the monitoring results, transforming the traditional passive monitoring that relies on limited telemetry into active control that is observable and interactive throughout the process. This reduces the dependence on the professional experience of operators during operation and maintenance and improves the maintainability of the system.

[0027] It supports data upload via independent file upload entities or trusted ground entities, providing flexible implementation schemes; in the verification stage, it is compatible with both complete data download and verification feature information download modes, which can adapt to different bandwidth conditions and security policy requirements. Ultimately, this invention can cope with diverse on-orbit reconfiguration scenarios and has excellent system adaptability and versatility. Attached Figure Description

[0028] To more clearly illustrate the technical solutions in this invention or related technologies, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0029] Figure 1 This is a schematic diagram of the software security refactoring system with segmented decoupling management provided by the present invention.

[0030] Figure 2 This is one of the interactive flow diagrams of the segmented decoupling management software security refactoring method provided by the present invention.

[0031] Figure 3 This is the second interactive flowchart of the software security refactoring method with segmented decoupling management provided by the present invention.

[0032] Figure 4 This is a schematic diagram of the ground-side system for software security reconfiguration for segmented decoupling management provided by the present invention.

[0033] Figure 5 This is a schematic diagram of the structure of a non-ground system for software security reconfiguration with segmented decoupling management in collaboration with a ground-based system, as provided by the present invention. Detailed Implementation

[0034] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0035] This invention provides a segmented decoupled management software security reconfiguration system, which consists of two parts: a ground-based component and a non-ground-based component. The ground-based component can be a group of ground-based components, and the non-ground-based component can be a satellite.

[0036] The following example uses ground-side devices as ground-side groups and non-ground-side devices as satellites to illustrate the segmented decoupling management software security reconfiguration system provided by this invention.

[0037] For example, such as Figure 1 As shown, the segmented decoupled management software security reconfiguration system includes ground-based group 110 and satellite 120.

[0038] The ground terminal group 110 includes ground terminal equipment 111 and a secure and controllable trusted entity 112. The ground terminal equipment 111 includes a file client 111a, and the secure and controllable trusted entity 112 includes a reconfiguration verification and control unit 112a.

[0039] Satellite 120 includes a file storage area 121, a file server 122, a reconfigurable unit 123, and an on-board reconfiguration controller 124.

[0040] In this embodiment of the invention, the ground terminal device 111 communicates with the satellite 120 through the satellite-to-ground user link; the secure and controllable trusted entity 112 communicates with the satellite 120 through the satellite-to-ground telemetry and control or power supply link; and the on-board reconfiguration controller 124 is connected to the file storage area 121.

[0041] It should be noted that the satellite-to-ground user link is the first communication link, and the satellite-to-ground telemetry, tracking, and command (TT&C) or power supply link is the second communication link. For ease of description, the terms "first communication link" and "second communication link" will be used consistently below.

[0042] In some embodiments, the ground terminal device 111 uploads the software reconstruction data to the satellite 120 in file form via the file client 111a through the first communication link, and stores it in the file storage area 121.

[0043] For example, file client 111a can be a user-owned satellite communication terminal or a workstation in the operations control center, uploading software reconstruction data through the user's service link. After receiving the file, file server 122 uses chroot technology to store the file in an isolated directory to prevent unauthorized access to critical areas of the system.

[0044] Specifically, the upload process uses a common file transfer protocol, such as the Consultative Committee for Space Data Systems File Delivery Protocol (CCSDS CFDP). This protocol supports reliable transmission in long-latency space link environments and can recover from the breakpoint when transmission is interrupted, avoiding repeated transmissions.

[0045] In some embodiments, a secure and controllable trusted entity 112 sends a verification request to the on-board reconfiguration controller 124 through the reconfiguration verification and control unit 112a. In response to the verification request, the on-board reconfiguration controller 124 reads the stored software reconfiguration data from the file storage area 121 and sends the software reconfiguration data to the reconfiguration verification and control unit 112a via the second communication link. If the software reconfiguration data is verified to be valid, the reconfiguration verification and control unit 112a sends an execution authorization instruction to the on-board reconfiguration controller 124 via the second communication link.

[0046] For example, the verification process includes integrity verification and legitimacy verification: integrity verification is achieved by comparing the cyclic redundancy check (CRC) value or hash digest (such as that generated by the secure hash algorithm 256-bit, SHA-256) of the received data; legitimacy verification ensures that the software origin is trustworthy and compatible with the satellite system through digital signature authentication (such as based on the Rivest-Shamir-Adleman (RSA) algorithm or elliptic curve cryptography (ECC) algorithm) and version matching checks.

[0047] In some embodiments, the on-board reconfiguration controller 124, in response to the execution authorization instruction, performs a software reconfiguration operation on the reconfigured unit 123 based on the software reconfiguration data stored in the file storage area 121.

[0048] For example, the reconfigurable unit 123 can configure memory or processor flash memory areas for a field-programmable gate array (FPGA) on a satellite.

[0049] Specifically, the on-board reconfiguration controller 124 first sends an erase command to the reconfigured unit 123 to erase the target storage sector; then it splits the software reconfiguration data into multiple data packets (e.g., each packet is 512 bytes and includes a CRC check value), sends and writes them packet by packet, and returns an acknowledgment status after each packet is written to ensure write reliability.

[0050] Thus, the segmented decoupled management software security reconstructing system provided by this invention, through a segmented decoupled architecture of space-ground collaboration, separates the three stages of uploading, verification, and execution in terms of link and timing. It enables flexible data uploading through the user link, while ensuring that verification and execution are controlled by a trusted ground entity. It adopts standard protocols such as CFDP that support breakpoint resumption, ensuring reliable transmission under the space link. Through centralized integrity verification, digital signature authentication, and version matching, combined with isolated storage of onboard files, it constructs an end-to-end security protection system. Relying on a dedicated control link, it realizes full-process status monitoring and remote intervention, improving system flexibility, transmission robustness, security controllability, and operation and maintenance observability, effectively solving the problems of tight coupling, single link, poor security, and low automation of traditional methods.

[0051] The software security refactoring method with segmented decoupling management provided by this invention includes three stages: an upload stage, a verification stage, and an execution stage. Furthermore, at least two of the upload, verification, and execution stages are implemented by executing them discontinuously in time and / or through different communication links.

[0052] For example, taking a satellite as an example, the three phases are executed discontinuously in time: after the software reconstruction data is uploaded, the verification process can be initiated several hours or even days later, depending on the satellite transit window and the ground decision cycle; after the verification is successful, the execution phase is triggered at an appropriate time according to the mission plan.

[0053] For example, let's still take a satellite as the non-ground end. The different communication links are as follows: the uploading phase uses a user service link with a wide coverage, while the verification phase for issuing instructions and transmitting data back, and the execution phase for authorizing instructions and monitoring status, use a more reliable telemetry or power supply link (dedicated satellite-to-ground communication link).

[0054] Furthermore, the upload phase, verification phase, and execution phase can all be executed individually, once or multiple times.

[0055] For example, the upload phase supports multiple executions as follows: if the first upload is not completed due to link interruption, the system can re-initiate the upload process based on the breakpoint resume mechanism after the link is restored, without repeating the already transmitted part; the same software version can also be uploaded to different satellite nodes multiple times.

[0056] For example, the verification phase supports multiple executions, which means that the same reconstructed data packet that has been uploaded can be periodically and repeatedly verified according to security policy requirements (such as re-verification before critical tasks), or re-verification can be triggered when version dependencies change.

[0057] For example, the execution phase supports multiple executions as follows: for reconstructed data that has been verified, execution instructions can be triggered multiple times as needed (such as batch updates of multiple homogeneous satellites), or the complete execution process can be restarted after an abnormal interruption during execution.

[0058] For example, in a software iterative development scenario, developers can upload different versions of software packages multiple times through the user link (the upload phase is executed multiple times), the ground control center independently verifies each version (the verification phase is executed multiple times), and finally selects a stable version to deploy to multiple satellites in the constellation (the execution phase is executed multiple times).

[0059] For example, in on-orbit maintenance scenarios, when a satellite encounters a single-event upset that causes a software anomaly, the process of re-executing the verified software version can be directly triggered (the execution phase is executed again), without having to go through the upload and verification phases again.

[0060] Thus, this invention achieves a novel software reconfiguration through a decoupled architecture of timing, space, and links. The three stages support discontinuous execution and possess independent execution capabilities, while employing differentiated link strategies and supporting multiple executions for each stage. This design breaks through the limitations of traditional tightly coupled architectures, achieving flexible scheduling and resource optimization for task execution while ensuring centralized ground control, thereby improving the system's adaptability, reliability, and operational efficiency.

[0061] The following is combined with Figure 2 This invention describes a software security refactoring method based on segmented decoupling management.

[0062] Figure 2 This is a schematic diagram of the interaction flow of the segmented decoupling management software security refactoring method provided by the present invention. The method is illustrated using the interaction between a ground-end and a non-ground-end as an example. Of course, the entity executing the ground-end actions in this method can also be a device / module on the ground end, such as a file upload entity and a trusted entity on the ground end; similarly, the entity executing the non-ground-end actions in this method can also be a device / module on a non-ground end, and the embodiments of the present invention do not specifically limit this.

[0063] For example, such as Figure 2 As shown, the software security refactoring method with segmented decoupling management provided in this embodiment of the invention includes: S201. The ground terminal uploads the software reconfiguration data to the non-ground terminal. Correspondingly, the non-ground terminal receives and stores the software reconfiguration data from the ground terminal.

[0064] In this embodiment of the invention, the ground end may include a file upload entity and a trusted ground entity.

[0065] It should be noted that the above-mentioned file upload entity is the same as the one mentioned above. Figure 1The ground client 111 shown; the aforementioned trusted ground entity is the aforementioned Figure 1 The secure and controllable trusted entity 112 shown is illustrated.

[0066] Specifically, at the non-ground end Figure 1 In the case of satellite 120 shown, the trusted ground entity can be the satellite operation and control center or the satellite tracking and control center.

[0067] Optionally, when uploading software reconfiguration data at the ground end, the data can be uploaded to the non-ground end via a first communication link, including the user service link. Correspondingly, the non-ground end can receive and store the software reconfiguration data from the ground end via the first communication link.

[0068] In this embodiment of the invention, the first communication link supports a general file transfer protocol that supports breakpoint resume and / or segmented verification.

[0069] In this embodiment of the invention, the first communication link can be any one or more combinations of a user service link, a power supply link, or a measurement and control link. Employing the CCSDS CFDP protocol in a space link environment supports session state preservation and error recovery mechanisms, enabling automatic resumption of transmission after link interruption, while simultaneously performing segmented verification of files to ensure transmission reliability.

[0070] In some embodiments, the ground terminal can upload software reconfiguration data in file format to the non-ground terminal via a first communication link. Correspondingly, the non-ground terminal can receive software reconfiguration data packaged in file format from the ground terminal via the first communication link.

[0071] For example, the ground terminal can use a common file transfer protocol to upload software reconstruction data through the first communication link. This common file transfer protocol may include protocols such as File Transfer Protocol (FTP), Secure File Transfer Protocol (SFTP), FTP over SSL / TLS (FTPS), or CCSDS CFDP.

[0072] Among them, Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are included.

[0073] Specifically, identity authentication (such as username, password, or digital certificate) is performed before uploading, and an encrypted channel is established based on TLS / SSL mechanism to protect data confidentiality; the off-ground file server is configured with access control list (ACL) and intrusion detection mechanism to restrict the upload process to access only the preset virtual file system space, and avoid path out-of-bounds or malicious file overwriting.

[0074] Thus, this invention achieves universality and reliability of software-reconstructed data upload through standardized file transfer mechanisms and security measures, while adapting to various satellite-to-ground link environments and improving the flexibility and efficiency of the upload process.

[0075] In one alternative implementation, the software reconstruction data can be uploaded to a non-ground terminal in the form of a file via a file upload entity through a first communication link.

[0076] For example, the file upload entity is a user satellite terminal, which establishes an encrypted connection using the SFTP protocol through the first communication link to upload the file. Before uploading, the file is preprocessed to generate a hash digest for subsequent verification. During the transmission process, the function of resuming interrupted transmission is supported to ensure reliable file transmission in an unstable link environment.

[0077] In another alternative implementation, the software reconfiguration data can be uploaded to a non-ground terminal in file form via a trusted ground entity through a first communication link.

[0078] For example, the trusted ground entity is the operations control center server, which will upload files via the first communication link using the FTPS protocol, encrypt data transmission based on TLS / SSL, and combine certificate verification to ensure the entity's legitimate identity.

[0079] Specifically, the trusted ground entity digitally signs the file when uploading it and uploads the signature information along with the file for storage by the non-ground end for subsequent verification.

[0080] In another alternative implementation, software reconstruction data can be uploaded to a non-ground terminal in the form of a file via a file upload entity and a trusted ground entity through a first communication link.

[0081] For example, the file uploading entity and the trusted ground entity work together to upload different parts of the file through the first communication link. The non-ground end receives the files and stores them together. The system robustness is enhanced by link redundancy, so that even if one link is interrupted, the other link can continue to transmit.

[0082] Specifically, during the upload process, both entities transmit their status synchronously through the terrestrial network to ensure data consistency and employ the same security strategies (such as encryption and authentication) to guarantee overall security.

[0083] Thus, by flexibly combining various upload entities and links, this invention supports distributed and collaborative upload modes, adapting to different task scenarios, thereby improving data transmission efficiency and enhancing the system's adaptability and robustness.

[0084] S202. The ground terminal sends an authentication request to the non-ground terminal through a trusted ground entity. Correspondingly, the non-ground terminal receives the authentication request from the ground terminal.

[0085] For example, a trusted ground entity sends an authentication request to a non-ground entity via a second communication link. This authentication request includes an authentication mode indication (such as requesting the download of a complete file or verifying only feature information), and the non-ground entity parses the instruction and prepares the corresponding data.

[0086] Specifically, the verification request is sent through a protected dedicated channel (i.e., a second communication link), using encryption and authentication mechanisms (such as digital signatures) to ensure the trustworthiness of the request source and prevent replay attacks or tampering.

[0087] S203. In response to the verification request from the trusted ground entity, the non-ground terminal sends the stored software reconfiguration data, or verification feature information generated based on the software reconfiguration data, to the trusted ground entity. Correspondingly, the ground terminal receives the software reconfiguration data from the non-ground terminal, or the verification feature information generated based on the software reconfiguration data.

[0088] For example, the non-ground end downloads complete software reconstruction data or digest information generated by a hash algorithm (such as SHA-256) according to the request pattern. If the link bandwidth is limited, verification feature information (such as a 128-bit hash value) is downloaded first to reduce the amount of data transmission; otherwise, the complete file is downloaded for in-depth analysis by the ground end.

[0089] Specifically, the downlink data is transmitted through a second communication link, with a sequence number and timestamp added. The ground end receives the data and verifies its freshness and order to avoid duplication or out-of-order issues.

[0090] S204. The ground end verifies the software reconstruction data through a trusted ground entity.

[0091] In some embodiments, software reconfiguration data stored at a non-ground location can be verified by a trusted ground entity.

[0092] In one alternative implementation, software reconfiguration data from a non-ground end can be received by a trusted ground entity, and the integrity and legality of the software reconfiguration data can be verified.

[0093] For example, after receiving the complete file, the ground station calculates its CRC-32 checksum or hash value and compares it with the stored expected value; simultaneously, it verifies the digital signature (e.g., by decrypting the signature using an RSA public key and comparing the digest) and the version number (checking compatibility with the satellite's current software version). If the checksum matches and the signature is valid and the version is compatible, the verification passes.

[0094] Specifically, during the verification process, the ground end uses multi-threaded parallel processing to accelerate the verification of large files and records verification logs for audit traceability.

[0095] In another alternative implementation, a trusted ground entity can receive verification feature information generated from software reconstructed data from a non-ground entity, and perform integrity and legality verification on the software reconstructed data based on the verification feature information.

[0096] For example, after receiving the hash digest, the ground terminal compares it with the correctly pre-computed digest locally; at the same time, it verifies the signature information (such as verifying the signature authority through a certificate chain). If the digests match and the signature is valid, the file stored at the non-ground terminal is determined to be complete and trustworthy.

[0097] Specifically, the ground-based system maintains a version database and queries software version matching relationships during verification to ensure that the software reconfiguration data is compatible with the target hardware unit and avoid version conflicts.

[0098] Thus, this invention flexibly supports multiple verification methods to adapt to different bandwidth and security requirements, while ensuring data credibility through a centralized verification mechanism to prevent abnormal data from entering the execution phase.

[0099] Optionally, the above-mentioned verification of the legality of software reconstruction data may include signature authentication and version matching verification.

[0100] For example, an asymmetric encryption algorithm (such as the elliptic curve digital signature algorithm, ECDSA) can be used to reconstruct the data signature in the software, which is then verified on the ground using the corresponding public key. Version matching is achieved by checking the mapping relationship between the software version number and the hardware configuration file. If the signature verification is successful and the version number is in the compatibility list, the validity is passed.

[0101] Specifically, version matching verification also includes checking dependencies (such as library file versions) to ensure that the system can start and run normally after reconstruction.

[0102] Thus, this invention effectively prevents the risks of tampering, forgery, and version mismatch through multiple security verification mechanisms, thereby improving the security and reliability of the reconstruction process.

[0103] S205. After successful verification, the ground terminal sends an execution authorization command to the non-ground terminal through a trusted ground entity. Correspondingly, the non-ground terminal receives the execution authorization command from the ground terminal.

[0104] Optionally, after successful verification, the ground terminal can send an execution authorization command to the non-ground terminal via a trusted ground entity through a second communication link, triggering the non-ground terminal to initiate a software refactoring operation based on the software refactoring data. Correspondingly, the non-ground terminal can receive the execution authorization command from the ground terminal via the second communication link.

[0105] For example, the execution authorization instruction is an encrypted control instruction that includes a session identifier and execution parameters. The instruction is transmitted through a second communication link, encrypted using Advanced Encryption Standard (AES) and protected with a hash-based message authentication code (HMAC) integrity code to ensure the confidentiality and tamper-proof nature of the instruction.

[0106] Specifically, after receiving the authorization command, the non-ground terminal decrypts and verifies the validity of the command, and only triggers the reconstruction operation after the verification is successful.

[0107] Thus, this invention sends key instructions through a dedicated secure channel, achieving centralized control over operation permissions, preventing unauthorized execution, and ensuring the security and controllability of the reconstruction process.

[0108] In this embodiment of the invention, the second communication link is a dedicated communication link between a trusted ground entity and a non-ground terminal.

[0109] In some embodiments, the ground terminal may send a dedicated link establishment request to the non-ground terminal, and establish a second communication link upon receiving an establishment permission indication from the non-ground terminal.

[0110] For example, the ground end sends a link establishment request via broadcast or unicast, and after the non-ground end responds, both parties negotiate encryption parameters (such as a session key). After the link is established, the connection state is continuously maintained, supporting heartbeat detection and automatic reconnection to ensure channel reliability.

[0111] Specifically, the second communication link uses a reliable transmission protocol (such as a space extension protocol based on the Transmission Control Protocol (TCP)) to support two-way authentication and key updates, preventing man-in-the-middle attacks.

[0112] Thus, by dynamically establishing and maintaining dedicated communication links, this invention ensures the reliability and security of communication during the verification and execution phases, providing a foundation for real-time monitoring and control.

[0113] S206. The non-ground terminal responds to the authorization instruction and performs a software refactoring operation based on the software refactoring data.

[0114] In some embodiments, the non-ground end can erase the target storage area of ​​the reconstructed cell.

[0115] Among them, the reconfigured unit is the hardware unit to be reconfigured in the non-ground end, that is... Figure 1 The reconfigured unit 123 shown.

[0116] For example, a sector erase command can be issued to the reconfigured unit (such as the FPGA configuration memory). The erase is performed sector by sector, and a status response (such as "erasure successful" or "erasure failed") is returned after each sector is erased to ensure the erase operation is reliable.

[0117] Specifically, if erasure fails, the error code is recorded and the sector is retried or skipped, while the ground end is notified via the second communication link.

[0118] Furthermore, the software reconstruction data is split into multiple data packets with verification values, and each packet is sent to the reconstructed unit for writing.

[0119] For example, software reconstruction data can be read from the file storage area, split into fixed-size data packets (e.g., 1KB), and each packet can be appended with a CRC-16 checksum. The data packets are sent to the reconstructed unit one by one. The receiver verifies the integrity of each packet; if the verification is correct, it is written to the storage area; otherwise, it is discarded and a retransmission is requested.

[0120] Specifically, the writing process adopts a pipeline approach, with multiple packets processed in parallel to improve writing efficiency; each write result is returned via an acknowledgment frame, and the sending rhythm is adjusted based on the acknowledgment.

[0121] Thus, this invention, through a fine-grained erase and write control mechanism, combined with packet-by-packet verification and retransmission, ensures the reliability and integrity of the reconstruction operation and reduces the risk of failure caused by space environment interference.

[0122] In the software security refactoring method with segmented decoupling management provided by this invention, a comprehensive improvement in the flexibility, reliability, security and observability of software refactoring is achieved by constructing a segmented decoupling architecture.

[0123] In terms of flexibility, uploading, verification and execution are decoupled in terms of link and timing, supporting multiple primary communication links such as user business links, and allowing file uploading entities to complete data uploading collaboratively or independently with trusted ground entities, breaking the dependence of traditional processes on dedicated measurement and control links.

[0124] In terms of reliability, standard file transfer protocols such as CFDP, which support breakpoint resumption and segmented verification, are adopted to effectively resist the instability of spatial links and ensure reliable transmission of large amounts of data.

[0125] In terms of security, a centralized integrity check (such as hash digest comparison) and legality verification (including digital signature authentication and version matching) of satellite data is performed by trusted ground entities, building an end-to-end security defense to ensure that only trusted data can enter the execution phase.

[0126] In terms of observability and controllability, relying on a dedicated second communication link, a two-way interaction is realized throughout the entire process from verification request and status information feedback to the issuance of execution authorization instructions. This enables the ground to monitor the mission progress in real time and make remote interventions, improving the level of automation in operation and maintenance and the resilience of the system.

[0127] Optionally, combined Figure 2 ,like Figure 3 As shown, the software security refactoring with segmented decoupling management provided by this invention further includes: S301. The non-ground terminal sends reconfiguration status information to the ground terminal. Correspondingly, the ground terminal receives the reconfiguration status information from the non-ground terminal through a trusted ground entity.

[0128] Optionally, the non-ground terminal can send reconfiguration status information to the ground terminal via the second communication link. Correspondingly, the ground terminal can receive reconfiguration status information from the non-ground terminal via the second communication link through a trusted ground entity.

[0129] The reconstructed status information includes task progress, execution status, and error information.

[0130] In this embodiment of the invention, task progress refers to the percentage of reconstruction task completion or the amount of data processed; execution status refers to the current operation stage (such as erasure, write, verification) and result code; error information refers to the specific error type (such as verification failure, write timeout) and location identifier.

[0131] For example, the non-ground end periodically (e.g., every second) sends status frames via a second communication link, containing progress values ​​(e.g., 75%), status codes (e.g., "Writing in progress"), and error codes (e.g., "CRC error"). The status information is encapsulated in a lightweight binary format to reduce bandwidth consumption.

[0132] Specifically, the ground terminal receives status information, parses it, and displays it on the monitoring interface for operators to view in real time; the system automatically parses error codes and triggers early warnings or assists in decision-making.

[0133] S302. The ground terminal sends control commands to the non-ground terminal based on the reconfiguration status information. Correspondingly, the non-ground terminal receives the control commands from the ground terminal.

[0134] Optionally, the ground terminal can send control commands to the non-ground terminal via the second communication link based on the reconfiguration status information to interrupt or continue the reconfiguration operation. Correspondingly, the non-ground terminal can receive control commands from the ground terminal via the second communication link.

[0135] For example, when the ground terminal detects an error message (such as multiple consecutive packet verification failures), it automatically or manually sends an interrupt command. This control command includes the operation type (such as pause or resume) and target parameters, and is transmitted securely through an encrypted channel.

[0136] Specifically, the ground terminal supports instruction queues and priority management. High-priority instructions (such as emergency interruptions) can be sent immediately and processed first by the non-ground terminal.

[0137] S303, the non-ground terminal responds to control commands and performs either interruption or continuation of reconfiguration.

[0138] For example, upon receiving an interrupt command, the non-ground terminal suspends the current write operation and saves the breakpoint state (such as the sequence number of the last successfully written packet); upon receiving a resume command, it resumes transmission and writing from the breakpoint. During the interruption, it can enter debug mode, allowing the ground terminal to request a readback of the written data for comparison and analysis.

[0139] Specifically, the non-ground end can maintain the operation state machine, switch states according to control commands (such as from "running" to "paused"), and provide feedback confirmation of the state change.

[0140] Thus, this invention, through real-time status monitoring and remote control mechanisms, enables the ground end to intervene in the reconstruction process in a timely manner, quickly locate and recover from faults, and significantly improve the maintainability of the system and the success rate of the mission.

[0141] The following describes the ground-side system for segmented decoupling management and the non-ground-side system for segmented decoupling management and software security reconstructing in coordination with the ground-side system, provided by embodiments of the present invention. The ground-side system for segmented decoupling management and the non-ground-side system for segmented decoupling management and software security reconstructing in coordination with the ground-side system described below can be referred to in correspondence with the segmented decoupling management and software security reconstructing method described above.

[0142] like Figure 4As shown, this embodiment of the invention provides a ground-based system for segmented decoupling management of software security reconfiguration. The ground-based system includes: a file upload module 401, used to upload software reconfiguration data to a non-ground terminal via a first communication link including a user service link; a verification and control module 402, used to verify the software reconfiguration data stored on the non-ground terminal through a trusted ground entity; and a reconfiguration execution module 403, used to send an execution authorization command to the non-ground terminal through the trusted ground entity after successful verification, thereby triggering the non-ground terminal to initiate a software reconfiguration operation based on the software reconfiguration data.

[0143] like Figure 5 As shown, this invention provides a non-ground-based system for segmented, decoupled management of software security reconfiguration in collaboration with a ground-based system. The non-ground-based system includes: a file service module 501, used to receive and store software reconfiguration data from a ground-based system via a first communication link including a user service link; and a reconfiguration control module 502, used to: in response to a verification request from a ground-based trusted entity, send the stored software reconfiguration data, or verification feature information generated based on the software reconfiguration data, to the ground-based trusted entity; receive an execution authorization instruction from the ground-based trusted entity, the execution authorization instruction being sent by the ground-based trusted entity after successful verification of the software reconfiguration data from the non-ground-based system; and in response to the execution authorization instruction, execute a software reconfiguration operation based on the software reconfiguration data.

[0144] Specifically, the functions of each module in the ground-side system for segmented decoupling management and the non-ground-side system for segmented decoupling management in collaboration with the ground-side system provided in this embodiment of the invention correspond one-to-one with the operation flow of each step in the above-described method-like embodiments, and the achieved effects are also the same. For details, please refer to the above embodiments, and this will not be repeated in this embodiment of the invention.

[0145] On the other hand, embodiments of the present invention also provide a computer program product, the computer program product including a computer program, the computer program being stored on a non-transitory computer-readable storage medium, and when the computer program is executed by a processor, the computer is able to perform the steps of the segmented decoupling management software security refactoring method provided in the above embodiments.

[0146] On the other hand, embodiments of the present invention also provide a processor-readable storage medium storing a computer program for causing the processor to execute the steps of the segmented decoupling management software security refactoring method provided in the above embodiments.

[0147] Processor-readable storage media can be any available medium or data storage device that the processor can access, including but not limited to magnetic storage (such as floppy disks, hard disks, magnetic tapes, magneto-optical (MO) etc.), optical storage (such as compact discs (CDs), digital versatile discs (DVDs), Blu-ray discs (BDs), holographic versatile discs (HVDs) etc.), and semiconductor storage (such as read-only memory (ROMs), erasable programmable read-only memory (EPROMs), electrically erasable programmable read-only memory (EEPROMs), non-volatile memory (NAND flash memory), solid-state drives (SSDs), etc.).

[0148] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0149] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / random access memory (RAM), magnetic disk, optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0150] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A software security refactoring method with segmented decoupling management, characterized in that, Applied to the ground end, the method includes: Upload phase: The software reconstruction data is uploaded to the non-terrestrial terminal via the first communication link, including the user service link; Verification phase: The software reconstruction data stored at the non-ground end is verified by a trusted ground entity; Execution phase: After verification, the ground trusted entity sends an execution authorization command to the non-ground terminal to trigger the non-ground terminal to start the software reconstruction operation based on the software reconstruction data; Specifically, at least two of the upload phase, the verification phase, and the execution phase are implemented by executing them discontinuously in time and / or through different communication links.

2. The method according to claim 1, characterized in that, The trusted ground entity is the satellite operation and control center or the satellite telemetry and control center.

3. The method according to claim 1, characterized in that, The ground terminal also includes a file upload entity. Uploading the software reconstruction data to the non-ground terminal via a first communication link, including the user service link, includes: The software reconstruction data is uploaded to the non-ground terminal in file form via the file upload entity and / or the ground trusted entity through the first communication link.

4. The method according to claim 1 or 3, characterized in that, The first communication link supports a general file transfer protocol that supports breakpoint resume and / or segmented verification.

5. The method according to claim 1, characterized in that, The verification of the software reconstruction data stored at a non-ground location by a trusted ground entity includes: The software reconfiguration data is received from the non-ground end via a trusted ground entity; The integrity and legality of the reconstructed software data are verified.

6. The method according to claim 1, characterized in that, The verification of the software reconstruction data stored at a non-ground location by a trusted ground entity includes: The verification feature information generated based on the software reconstructed data is received from the non-ground end through a trusted ground entity; Based on the verification feature information, the software reconstruction data is subjected to integrity verification and legality verification.

7. The method according to claim 5 or 6, characterized in that, The legitimacy verification includes signature authentication and version matching verification.

8. The method according to claim 1, characterized in that, The step of sending the execution authorization instruction to the non-ground terminal through the trusted ground entity includes: The execution authorization instruction is sent from the ground-based trusted entity to the non-ground terminal via a second communication link.

9. The method according to claim 1, characterized in that, The method further includes: The ground-based trusted entity receives reconstruction status information from the non-ground end via a second communication link. The reconstruction status information includes task progress, execution status, and error information. Based on the reconfiguration status information, a control command is sent to the non-ground terminal via the second communication link to interrupt or continue the reconfiguration operation.

10. The method according to claim 1, characterized in that, The upload phase, the verification phase, and the execution phase can all be executed individually, once or multiple times.

11. A software security refactoring method with segmented decoupling management, characterized in that, Applied to non-ground terminals, the method includes: The software reconfiguration data from the ground end is received and stored via the first communication link, including the user service link. In response to a verification request from a trusted ground entity, the stored software reconfiguration data or verification feature information generated based on the software reconfiguration data is sent to the trusted ground entity. Receive an execution authorization instruction from the ground trusted entity, the execution authorization instruction being sent by the ground trusted entity after verifying the software reconstruction data from the non-ground end; In response to the execution authorization instruction, a software refactoring operation based on the software refactoring data is performed.

12. The method according to claim 11, characterized in that, The process of receiving and storing software reconfiguration data from the ground terminal via a first communication link, including the user service link, includes: The system receives and stores software reconstruction data encapsulated in file form from the ground via the first communication link, which supports a common file transfer protocol that supports breakpoint resume and / or segmented verification.

13. The method according to claim 11, characterized in that, The execution of the software refactoring operation based on the software refactoring data includes: The target storage area of ​​the reconstructed unit is erased, and the reconstructed unit is the hardware unit to be reconstructed in the non-ground terminal. The software reconstruction data is split into multiple data packets with verification values, and each packet is sent to the reconstructed unit for writing.

14. The method according to claim 11, characterized in that, The step of receiving the execution authorization instruction from the ground trusted entity includes: Receive the execution authorization instruction from the ground trusted entity via a second communication link; The method further includes: The reconstruction status information is sent to the ground terminal via the second communication link. The reconstruction status information includes task progress, execution status, and error information. Receive control commands from the ground terminal via the second communication link; In response to the control command, either interrupt or continue the reconstruction operation is performed.

15. A ground-based system for software security reconfiguration of segmented decoupling management, characterized in that, include: The file upload module is used to upload software reconstruction data to the non-ground terminal via the first communication link, including the user business link. The verification and control module is used to verify the software reconstruction data stored at a non-ground end through a trusted ground entity; The reconstruction execution module is used to send an execution authorization instruction to the non-ground terminal through the ground trusted entity after verification, so as to trigger the non-ground terminal to start the software reconstruction operation based on the software reconstruction data.

16. A non-ground-based system with segmented decoupled management for software security reconfiguration in collaboration with a ground-based system, characterized in that, include: The file service module is used to receive and store software reconstruction data from the ground end via the first communication link, including the user service link. Reconfigure the control module for: In response to a verification request from a trusted ground entity, the stored software reconfiguration data or verification feature information generated based on the software reconfiguration data is sent to the trusted ground entity. Receive an execution authorization instruction from the ground trusted entity, the execution authorization instruction being sent by the ground trusted entity after verifying the software reconstruction data from the non-ground end; In response to the execution authorization instruction, a software refactoring operation based on the software refactoring data is performed.

Images