A satellite internet terminal access control method

Abstract

This application discloses a satellite internet terminal access control method, belonging to the field of satellite communication technology. The method includes a satellite node receiving an access request from a terminal; the satellite node authenticating the terminal's identity and permissions locally; the satellite node allocating access resources to the terminal based on local resource status and service priority; and the satellite node synchronizing the access result to a ground server. When the ground server fails, multiple satellite nodes form an autonomous system (AAS) to independently complete access control, eliminating the need for repeated authentication, shortening handover time, and enabling the terminal to establish a connection with a new satellite while maintaining its connection with the original satellite, achieving seamless handover. The handover decision is based on accurate orbit prediction and resource status information, improving the handover success rate. Predicting future channel states improves the accuracy of resource pre-allocation. Adaptive adjustment of time-frequency synchronization parameters based on prediction confidence, along with a multi-satellite collaborative dynamic resource allocation method, achieves load balancing and improves the overall system capacity.

Description

Technical Field

[0001] This application belongs to the field of satellite communication technology, specifically, it relates to a satellite internet terminal access control method. Background Technology

[0002] Satellite internet, as a crucial supporting technology for future communications, achieves comprehensive global coverage through the seamless integration of space segment, user segment, ground segment, and terrestrial network. Low-Earth orbit (LEO) satellites, with their advantages of low latency, high bandwidth, and global coverage, have become a strategic high ground for countries to compete for development. However, the orbit of LEO satellites around the Earth leads to frequent switching of links between satellites and ground terminals, as well as between satellites themselves, resulting in average time intervals of discontinuity. Traditional switching methods, based on signal strength measurements, suffer from lag. Terminals first disconnect from the original satellite before establishing a connection with the new satellite, lacking accurate prediction of satellite orbital motion and making switching decisions inaccurate, posing a significant challenge to terminal access control. Summary of the Invention

[0003] To address the aforementioned problems and technical deficiencies, this application adopts the following technical solution: a satellite internet terminal access control method, comprising the following steps:

[0004] The satellite node receives the terminal's access request and performs identity and authorization authentication on the satellite node locally.

[0005] Satellite nodes allocate access resources to terminals based on local resource status and service priority;

[0006] The satellite nodes synchronize the access results to the ground server. When the ground server fails, multiple satellite nodes form an autonomous system and independently complete the access control.

[0007] Preferably, the identity and access authentication is a distributed identity authentication based on a consortium blockchain. The terminal's identity information and authentication credentials are stored on the consortium blockchain of multiple satellite nodes. When the terminal accesses the network, the satellite nodes verify the terminal's identity through the consortium blockchain. When the terminal switches satellites, the newly connected satellite obtains the terminal's authentication information from the consortium blockchain, eliminating the need for repeated authentication.

[0008] Furthermore, the terminal switching satellite employs an intelligent switching method based on orbit prediction, including:

[0009] Based on satellite orbit prediction information, the terminal sends a handover request to the target satellite in advance, and the target satellite reserves resources for the terminal in advance;

[0010] While maintaining its connection with the original satellite, the terminal establishes a connection with the target satellite. After the terminal completes the handover, it disconnects from the original satellite.

[0011] Furthermore, when the terminal accesses the network, it selects an access path that complies with local regulations based on its geographical location information, and then generates access control rules based on compliance, so that sensitive data is transferred through domestic gateway stations, all access behaviors are recorded, and audit logs are generated.

[0012] Preferably, the allocation of access resources includes:

[0013] Satellites share resource status information in real time via inter-satellite links;

[0014] When the target satellite's load exceeds the threshold, some terminals will be switched to adjacent satellites;

[0015] The terminal can connect to multiple satellites simultaneously and achieve load balancing by using a dynamic resource allocation method that coordinates multiple satellites.

[0016] Furthermore, the load balancing is performed by extracting multi-dimensional features from the resource status information of satellite nodes based on inter-satellite links, and then predicting the channel status probability distribution of the target satellite node in the next N time slots based on the extracted multi-dimensional features.

[0017] The time-frequency synchronization parameters are adaptively weighted based on the prediction confidence, and then pre-calculated in combination with the prediction results to obtain the pre-frequency adjustment value of the target channel.

[0018] The resources of the channel to which the terminal connected to the target satellite node belongs are dynamically adjusted based on the pre-frequency adjustment value.

[0019] Furthermore, the dynamic adjustment formula for the allocation of the target resources is as follows:

[0020]

[0021] in, For the number of terminals, For the first The service priority weight of each terminal For the first The transmission rate of each terminal To be assigned to the Bandwidth resources for each terminal For the total bandwidth resources of the satellite, To be assigned to the Power resources of each terminal This represents the total satellite launch power. For the first Minimum transmission rate requirement for each terminal.

[0022] Furthermore, each satellite node periodically collects its own resource status information, including the number of currently connected terminals, channel occupancy rate of each beam, available bandwidth, average signal-to-interference-plus-noise ratio, buffer queue length, and energy consumption budget. Adjacent satellite nodes exchange resource status information through inter-satellite links to generate a distributed resource status view. Each satellite node maintains a resource status table of adjacent satellites, and uses an exponentially weighted moving average method to smooth historical resource status data, eliminating the interference of instantaneous fluctuations on decision-making.

[0023] An electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements the content of a satellite internet terminal access control method as described above.

[0024] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the content of a satellite internet terminal access control method as described above.

[0025] Compared to existing technologies, the beneficial effects of this application are as follows:

[0026] (1) This application uses consortium blockchain technology to achieve distributed identity authentication. The terminal identity information and authentication credentials are stored on the consortium blockchain of multiple satellite nodes. When the terminal switches satellites, the newly connected satellite directly obtains the authentication information from the consortium blockchain, without needing to re-authenticate, thus shortening the switching time.

[0027] (2) This application makes preparations for handover and reserve resources in advance based on orbit prediction, and adopts a soft handover method. The terminal establishes a connection with the new satellite while maintaining the connection with the original satellite, so as to achieve seamless handover. The handover decision is based on accurate orbit prediction and resource status information, which improves the success rate of handover.

[0028] (3) The satellites in this application share resource status information in real time through inter-satellite links, realize global resource optimization, predict future channel status, and improve the accuracy of resource pre-allocation. Based on the prediction confidence, the time and frequency synchronization parameters are adaptively adjusted, and the dynamic resource allocation method of multi-satellite collaboration realizes load balancing and improves the overall system capacity. Attached Figure Description

[0029] In the attached diagram:

[0030] Figure 1 This is a schematic diagram of the method steps in an embodiment of this application. Detailed Implementation

[0031] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are some embodiments of this application, but not all embodiments. Generally, the components of the embodiments of this application described and shown in the accompanying drawings can be arranged and designed in various different configurations.

[0032] Example 1, such as Figure 1 As shown, a satellite internet terminal access control method includes the following steps:

[0033] The satellite node receives the terminal's access request and performs identity and authorization authentication on the satellite node locally.

[0034] Identity and access authentication is a distributed identity authentication based on a consortium blockchain. Terminal identity information and authentication credentials are stored on a consortium blockchain across multiple satellite nodes. When a terminal connects, the satellite nodes verify the terminal's identity through the consortium blockchain. When a terminal switches satellites, the newly connected satellite obtains the terminal's authentication information from the consortium blockchain, eliminating the need for repeated authentication.

[0035] The terminal handover satellite employs an intelligent handover method based on orbit prediction, including:

[0036] Based on satellite orbit prediction information, the terminal sends a handover request to the target satellite in advance, and the target satellite reserves resources for the terminal in advance;

[0037] While maintaining its connection with the original satellite, the terminal establishes a connection with the target satellite. After the terminal completes the handover, it disconnects from the original satellite.

[0038] When a terminal accesses the network, it selects an access path that complies with local regulations based on its geographical location information. Then, it generates access control rules based on compliance, which transfer sensitive data through domestic gateway stations, records all access behaviors, and generates audit logs.

[0039] During the system initialization phase, a consortium blockchain is jointly established by multiple satellite nodes and ground management nodes. The consortium blockchain adopts a practical Byzantine fault-tolerant consensus algorithm to ensure that consensus can still be reached even in the presence of malicious nodes.

[0040] When a terminal first accesses the network, it generates an ECDSA public-private key pair. The private key is stored in the terminal's secure element. The terminal sends its identity attributes, such as the public key, device type, serial number, and service level, to the nearest satellite node. The satellite node broadcasts the terminal's registration request to all verification nodes in the consortium blockchain. The verification nodes jointly verify the legitimacy of the terminal's identity. After successful verification, a distributed digital identity credential is generated. The distributed digital identity credential, along with the terminal's public key and identity attributes, is stored on the blockchain. At the same time, a session key is generated. The satellite node encrypts the session key and sends it to the terminal. The terminal uses its private key to decrypt the session key and obtain the session key.

[0041] When the terminal subsequently accesses the network, it uses its private key to sign the access request and sends the signed access request and distributed digital identity credential to the currently connected satellite node. The satellite node obtains the terminal's public key and identity credential from the consortium blockchain. The satellite node uses the public key to verify the validity of the access request signature and checks the terminal's service permissions and validity period. After successful authentication, the satellite node and the terminal use the previously generated session key for encrypted communication. The satellite node records the authentication result on the consortium blockchain and generates an audit log.

[0042] When a terminal needs to switch satellites, the newly connected satellite directly obtains the terminal's authentication information and session key from the consortium blockchain, without requiring the terminal to resubmit its identity credentials for complete authentication.

[0043] Satellite nodes allocate access resources to terminals based on local resource status and service priority;

[0044] The allocation of access resources includes:

[0045] Satellites share resource status information in real time via inter-satellite links;

[0046] When the target satellite's load exceeds the threshold, some terminals will be switched to adjacent satellites;

[0047] The terminal can connect to multiple satellites simultaneously and achieve load balancing by using a dynamic resource allocation method that coordinates multiple satellites.

[0048] Load balancing involves extracting multi-dimensional features from the resource status information of satellite nodes based on inter-satellite links, and then predicting the channel state probability distribution of the target satellite node over the next N time slots based on the extracted multi-dimensional features.

[0049] The time-frequency synchronization parameters are adaptively weighted based on the prediction confidence, and then pre-calculated in combination with the prediction results to obtain the pre-frequency adjustment value of the target channel.

[0050] The resources of the channel to which the terminal connected to the target satellite node belongs are dynamically adjusted based on the pre-frequency adjustment value.

[0051] Satellite nodes perform multi-dimensional feature extraction on neighboring satellite resource status information acquired via inter-satellite links. The extracted feature dimensions include: information...

[0052] Time autocorrelation characteristics and frequency autocorrelation characteristics of the state;

[0053] The rate of change of Doppler frequency shift caused by the relative motion between the terminal and the satellite;

[0054] Power spectral density distribution of each beam channel;

[0055] Time series of arrival rates for historical access requests.

[0056] For each prediction time slot and each beam channel, calculate the prediction confidence, which can be defined as the inverse variance of the prediction probability distribution or the Bayesian posterior accuracy of the prediction model output.

[0057] Based on the prediction confidence level, the compensation parameters in the time-frequency synchronization parameters are adaptively weighted. The compensation parameters include timing advance compensation and frequency offset compensation.

[0058] The dynamic adjustment formula for target resource allocation is as follows:

[0059]

[0060] in, For the number of terminals, For the first The service priority weight of each terminal For the first The transmission rate of each terminal To be assigned to the Bandwidth resources for each terminal For the total bandwidth resources of the satellite, To be assigned to the Power resources of each terminal This represents the total satellite launch power. For the first Minimum transmission rate requirement for each terminal.

[0061] Each satellite node periodically collects its own resource status information, including the number of currently connected terminals, channel occupancy rate of each beam, available bandwidth, average signal-to-interference-plus-noise ratio, buffer queue length, and energy consumption budget. Adjacent satellite nodes exchange resource status information through inter-satellite links to generate a distributed resource status view. Each satellite node maintains a resource status table of adjacent satellites and uses an exponentially weighted moving average method to smooth historical resource status data, eliminating the interference of instantaneous fluctuations on decision-making.

[0062] When the overall load index of a satellite node exceeds a preset threshold, the satellite node triggers a load offloading process. The overall load index can be defined as the weighted sum of beam channel occupancy, buffer queue length, and energy consumption budget. The satellite node selects candidate satellites with an overall load index lower than the preset threshold from its neighboring satellite nodes, and determines the target terminal list and corresponding target satellites based on the predicted idle resources and signal quality index of the candidate satellites. The satellite node sends an offloading request and context information to the target satellite through the inter-satellite link. After the target satellite confirms the request, the seamless transfer of the terminal is completed.

[0063] The satellite nodes synchronize the access results to the ground server. When the ground server fails, multiple satellite nodes form an autonomous system and independently complete the access control.

[0064] When a terminal connects to multiple satellites simultaneously, a dynamic resource allocation method based on multi-satellite collaboration is adopted. Each serving satellite node determines the data splitting ratio of each link and its own transmission parameters through distributed negotiation based on shared resource status information and channel prediction results. The negotiation process adopts distributed auction or game theory methods with the goal of maximizing the total system throughput while meeting the service quality constraints of each terminal, and iteratively converges to an equilibrium allocation scheme.

[0065] Under normal circumstances, satellite nodes will synchronize the access results to the ground server, including access authentication records, handover execution records, resource allocation decisions and audit logs. When a satellite node detects a connection interruption with the ground server and the interruption lasts for more than a preset tolerance threshold, multiple satellite nodes will spontaneously form an autonomous domain.

[0066] Within the autonomous domain, satellite nodes elect a coordinating node through the consortium blockchain consensus mechanism to independently complete the entire process of terminal access control, including identity authentication, handover decision, resource allocation, and compliance determination. Access decisions within the autonomous domain rely entirely on the synchronized credential information and local copies of the compliance rule base on the consortium blockchain. Once the connection with the ground server is restored, the autonomous domain will synchronize all access records generated during the interruption to the ground server in batch processing to ensure the integrity and continuity of access control records.

[0067] Example 2, from a hardware perspective, this application provides an embodiment of an electronic device containing all or part of a satellite internet terminal access control method. The electronic device includes a service processor and a distributed memory. The service processor is connected to the memory. The distributed memory stores a service self-management program configured to store machine-readable instructions. The service processor executes the service self-management program. When the instructions are executed by the processor, a satellite internet terminal access control method as described above can be implemented.

[0068] Example 3: This application also provides a computer-readable storage medium capable of implementing a satellite internet terminal access control method with a server or client as the execution subject in the above embodiments. The computer-readable storage medium stores a computer program, which, when executed by a processor, implements all the contents of the satellite internet terminal access control method with a server or client as the execution subject in the above embodiments.

[0069] The embodiments described above are merely preferred embodiments of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this application. It should be noted that those skilled in the art can make various modifications, improvements, and substitutions without departing from the concept of this application, and these all fall within the protection scope of this application.

Claims

1. A satellite internet terminal access control method, characterized in that, Includes the following steps: The satellite node receives the terminal's access request and performs identity and authorization authentication on the satellite node locally. Satellite nodes allocate access resources to terminals based on local resource status and service priority; The satellite nodes synchronize the access results to the ground server. When the ground server fails, multiple satellite nodes form an autonomous system and independently complete the access control.

2. The satellite internet terminal access control method according to claim 1, characterized in that, The identity and access authentication is a distributed identity authentication based on a consortium blockchain. The terminal's identity information and authentication credentials are stored on the consortium blockchain of multiple satellite nodes. When a terminal connects, the satellite nodes verify the terminal's identity through the consortium blockchain. When a terminal switches satellites, the newly connected satellite obtains the terminal's authentication information from the consortium blockchain, eliminating the need for repeated authentication.

3. The satellite internet terminal access control method according to claim 2, characterized in that, The terminal handover satellite employs an intelligent handover method based on orbit prediction, including: Based on satellite orbit prediction information, the terminal sends a handover request to the target satellite in advance, and the target satellite reserves resources for the terminal in advance; While maintaining its connection with the original satellite, the terminal establishes a connection with the target satellite. After the terminal completes the handover, it disconnects from the original satellite.

4. The satellite internet terminal access control method according to claim 3, characterized in that, When the terminal accesses the network, it selects an access path that complies with local regulations based on its geographical location information, and then generates access control rules based on compliance, so that sensitive data is transferred through domestic gateway stations, all access behaviors are recorded, and audit logs are generated.

5. The satellite internet terminal access control method according to claim 1, characterized in that, The allocation of access resources includes: Satellites share resource status information in real time via inter-satellite links; When the target satellite's load exceeds the threshold, some terminals will be switched to adjacent satellites; The terminal can connect to multiple satellites simultaneously and achieve load balancing by using a dynamic resource allocation method that coordinates multiple satellites.

6. The satellite internet terminal access control method according to claim 5, characterized in that, The load balancing is based on multi-dimensional feature extraction of resource status information of satellite nodes from inter-satellite links, and prediction of the channel status probability distribution of the target satellite node in the next N time slots based on the extracted multi-dimensional features. The time-frequency synchronization parameters are adaptively weighted based on the prediction confidence, and then pre-calculated in combination with the prediction results to obtain the pre-frequency adjustment value of the target channel. The resources of the channel to which the terminal connected to the target satellite node belongs are dynamically adjusted based on the pre-frequency adjustment value.

7. The satellite internet terminal access control method according to claim 6, characterized in that, The dynamic adjustment formula for the allocation of target resources is as follows: in, For the number of terminals, For the first The service priority weight of each terminal For the first The transmission rate of each terminal To be assigned to the Bandwidth resources for each terminal For the total bandwidth resources of the satellite, To be assigned to the Power resources of each terminal This represents the total satellite launch power. For the first Minimum transmission rate requirement for each terminal.

8. A satellite internet terminal access control method according to claim 6, characterized in that, Each satellite node periodically collects its own resource status information, including the number of currently connected terminals, channel occupancy rate of each beam, available bandwidth, average signal-to-interference-plus-noise ratio, buffer queue length, and energy consumption budget. Adjacent satellite nodes exchange resource status information through inter-satellite links to generate a distributed resource status view. Each satellite node maintains a resource status table of adjacent satellites, and uses an exponentially weighted moving average method to smooth historical resource status data, eliminating the interference of instantaneous fluctuations on decision-making.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the content of the satellite internet terminal access control method as described in claim 1.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the content of the satellite internet terminal access control method as described in claim 1.

Images