Fengyun satellite terminal remote control method and system based on single-satellite link binding

Abstract

The embodiment of the application provides a method and system for remote control of a Fengyun satellite terminal based on single-satellite link binding, relates to the technical field of satellite communication, and comprises the following steps: constructing a dynamic binding relationship graph; generating a regulation and control instruction, and adding a hash tag to the regulation and control instruction; after encryption, the regulation and control instruction is sent through an LRIT / EWAIB downlink broadcast channel; performing three-level joint verification to obtain a verification identity confidence; obtaining a modified identity confidence and executing the regulation and control instruction; a first terminal node returns instruction execution confirmation through a DCP uplink, and a ground control center updates a historical instruction hash chain of the terminal node according to the return result. The problems that the DCP uplink and the LRIT / EWAIB downlink independently operate in the existing Fengyun meteorological satellite system and cannot realize closed-loop remote regulation and control on a large number of terminals in a single-satellite system are solved, and the technical effects of realizing accurate direction of an instruction, identity security authentication and improving the reliability of remote control are achieved.

Description

Technical Field

[0001] This invention relates to the field of satellite communication technology, and in particular to a remote control method and system for Fengyun satellite terminals based on single-satellite link binding. Background Technology

[0002] The Fengyun meteorological satellite system possesses uplink data collection capabilities via the Data Collection Platform (DCP) and downlink broadcasting capabilities via Low Resolution Image Transmission / Emergency Warning Information Broadcast (LRIT / EWAIB), and is widely used in meteorological observation, disaster warning, and marine monitoring. The DCP uplink receives sensor data from ground terminals, such as automatic weather stations and ocean buoys, while the LRIT / EWAIB downlink broadcasts meteorological cloud images and warning information to all terminals within the coverage area. In traditional solutions, the two links operate independently: terminals only upload data via the DCP, and ground centers only broadcast unidirectionally via LRIT / EWAIB, failing to establish a closed-loop remote control capability based on a single satellite system.

[0003] However, due to the lack of inherent logical connection between DCP uplink and LRIT / EWAIB downlink, the existing Fengyun satellite system cannot achieve closed-loop control from "data upload—command generation—precise distribution—terminal execution—feedback confirmation" in a single-satellite architecture. The downlink is a broadcast channel, where all terminals can receive the same command, lacking a command-oriented mechanism for a massive number of terminals, making point-to-point precise control difficult; furthermore, commands are easily forged or replayed in a broadcast environment, lacking effective identity security authentication methods. These shortcomings prevent the existing Fengyun satellite system from meeting the requirements for remote, reliable, and secure closed-loop control of terminals in remote areas.

[0004] It should be noted that the information disclosed in this background section is intended only to enhance the understanding of the overall background of the present invention, and should not be construed as an admission or in any way implying that the information constitutes prior art known to those skilled in the art. Summary of the Invention

[0005] To address the aforementioned deficiencies or improvement needs of existing technologies, this invention provides a remote control method and system for Fengyun satellite terminals based on single-satellite link binding. This solves the problem in existing Fengyun meteorological satellite systems where the DCP uplink and LRIT / EWAIB downlink operate independently, making it impossible to achieve closed-loop remote control of a large number of terminals within a single satellite system. It achieves the technical effects of precise command directionality, secure identity authentication, and improved reliability of remote control. The specific technical solution is as follows:

[0006] According to a first aspect of the present invention, a remote control method for a Fengyun satellite terminal based on single-satellite link bonding is provided, the method comprising:

[0007] Construct a dynamic binding relationship graph, wherein the dynamic binding relationship graph includes multiple terminal nodes, multiple instruction nodes, and multiple geographically adjacent edges between terminal nodes;

[0008] The first terminal node periodically uploads sensor data to the ground control center via the DCP uplink. The ground control center generates control commands based on the sensor data uploaded by the first terminal node and adds a first-level hash label, a second-level historical command chain hash label, and a third-level spatiotemporal binding code label to the control commands. After encryption, the commands are sent through the LRIT / EWAIB downlink broadcast channel. The first terminal node can be any one of multiple terminal nodes.

[0009] After the first terminal node performs identity matching and decryption of the broadcast command, it performs three-level joint verification in sequence according to the first-level hash label, the second-level historical command chain hash label and the third-level spatiotemporal binding code label to obtain the confidence level of the verified identity.

[0010] Based on the dynamic binding relationship graph, the verification identity confidence score is corrected to obtain a corrected identity confidence score. When the corrected identity confidence score is greater than or equal to a preset threshold, the control command is executed.

[0011] The first terminal node transmits instruction execution confirmation via the DCP uplink, and the ground control center updates the historical instruction hash chain of the terminal node based on the transmission result.

[0012] In one implementation, each instruction node in the dynamic binding relationship graph is associated with a sending edge pointing to the corresponding terminal node, and each terminal node is associated with a historical instruction hash chain.

[0013] The historical instruction hash chain is a concatenation of the sequence numbers of the three most recently successfully executed instructions and the HMAC hash values ​​of their execution results.

[0014] In one implementation, the construction of a dynamic binding relationship graph also includes the following processing:

[0015] By using each terminal as a terminal node and each control command as an instruction node, multiple terminal nodes and multiple instruction nodes can be obtained.

[0016] With the constraint that the geographical distance between two terminal nodes is less than the preset geographical grid edge length, multiple geographically adjacent edges between terminal nodes are constructed.

[0017] The dynamic binding relationship graph is constructed based on the multiple terminal nodes, multiple instruction nodes, and multiple geographically adjacent edges between terminal nodes.

[0018] In one implementation, the first terminal node periodically uploads sensor data to the ground control center via the DCP uplink, prior to which the following processing is performed:

[0019] The first terminal node reads the fixed identifier from the one-time programmable memory;

[0020] The solidified identifier is concatenated with the current geographical location of the first terminal node to form a registration request frame. The registration request frame is encoded using RS(223,255) forward error correction and then modulated using π / 4-QPSK. It is then sent to the Fengyun satellite via the DCP uplink.

[0021] The Fengyun satellite transparently forwards the registration request frame to the ground control center. After decoding, the ground control center generates a binding record for the first terminal node, creates the corresponding first terminal node in the dynamic binding relationship graph, and synchronizes the mapping relationship between the fixed identifier and the geographical location to the satellite's on-board memory.

[0022] In one implementation, the first-level hash label is a 16-bit hash value of the fixed identifier of the first terminal node;

[0023] The secondary historical instruction chain hash label is the historical instruction hash chain field of the first terminal node read by the ground control center from the dynamic binding relationship graph;

[0024] The three-level spatiotemporal binding code label is a dynamic binding code calculated using a key shared between the ground control center and the first terminal node, based on the current Fengyun satellite orbit time slot number, the geographic location grid code of the first terminal node, and the high bit of the current Unix UTC time.

[0025] In one implementation, after encryption, the signal is transmitted via the LRIT / EWAIB downlink broadcast channel, and the following processing is also performed:

[0026] The control command, along with the attached first-level hash label, second-level historical command chain hash label, and third-level spatiotemporal binding code label, together form the command plaintext;

[0027] The plaintext instruction is encrypted using the AES-256 algorithm to obtain the ciphertext payload;

[0028] The first-level hash label and the ciphertext payload are encapsulated into a SatCom-Lite protocol frame, wherein the SatCom-Lite protocol frame header is 5 bytes long and includes the frame type, the first-level hash label and the checksum;

[0029] The Fengyun satellite injects the SatCom-Lite protocol frames into the LRIT / EWAIB downlink broadcast channel according to the broadcast cycle.

[0030] In one implementation, after the first terminal node performs identity matching and decryption on the broadcast command, it sequentially performs three-level joint verification based on the first-level hash label, the second-level historical command chain hash label, and the third-level spatiotemporal binding code label to obtain the verification identity confidence level, and then performs the following processing:

[0031] Obtain the initial value of the identity confidence score of the first terminal node;

[0032] The first terminal node extracts the first-level hash tag from the header of the received SatCom-Lite protocol frame, compares it with the 16-bit hash value of the corresponding fixed identifier, and if they do not match, discards the instruction and terminates the verification, and adjusts the initial value of the identity confidence to 0. If they match, the identity confidence is increased by a preset first increment to obtain the first updated identity confidence, and then enters the second-level verification.

[0033] The first terminal node extracts the hash tag of the secondary historical instruction chain from the decrypted control instruction and performs a second-level comparison with the historical instruction hash chain stored in the local non-volatile memory. If they do not match, the first updated identity confidence is reduced by a preset second increment. If they match, the first updated identity confidence is increased by a preset second increment to obtain the second updated identity confidence.

[0034] The first terminal node extracts the third-level spatiotemporal binding code tag from the decrypted control command. At the same time, the first terminal node calculates the local spatiotemporal binding code based on the shared key, the current satellite orbit time slot number, the local geographic location grid code, and the high-order bits of the current Unix UTC time. The third-level spatiotemporal binding code tag is compared with the local spatiotemporal binding code. If they do not match, the second updated identity confidence is reduced by a preset third increment. If they match, the second updated identity confidence is increased by a preset third increment to obtain the verified identity confidence.

[0035] In one implementation, based on the dynamic binding relationship graph, the verified identity confidence score is corrected to obtain a corrected identity confidence score, and the following processing is further performed:

[0036] The first terminal node queries the list of neighboring terminals with adjacent geographical locations from the dynamic binding relationship graph;

[0037] The first terminal node broadcasts a query request to each neighbor terminal in the neighbor terminal list via Bluetooth or LoRa short-range communication. The query request includes the currently received instruction sequence number and instruction content hash.

[0038] After receiving a query request, each neighbor terminal in the neighbor terminal list checks whether it has received the same instruction sequence number and instruction content hash as the control instruction within the same broadcast cycle, and returns a positive or negative response.

[0039] The first terminal node counts the number of neighbors that return a positive response and uses the ratio of the number of positive responses to the total number of queried neighbors in the neighbor terminal list as the neighbor consensus degree.

[0040] The verified identity confidence is corrected based on the neighbor consensus to obtain the corrected identity confidence.

[0041] In one implementation, the following processing is also performed:

[0042] If the neighbor consensus is greater than or equal to 0.6, the verified identity confidence will be increased by a preset correction amount to obtain the corrected identity confidence.

[0043] If the neighbor consensus is less than 0.6, the current identity confidence is reduced by a preset correction amount to obtain the corrected identity confidence.

[0044] According to a second aspect of the present invention, a remote control system for a Fengyun satellite terminal based on single-satellite link bonding is provided, the system comprising:

[0045] The graph construction module is used to construct a dynamic binding relationship graph, wherein the dynamic binding relationship graph includes multiple terminal nodes, multiple instruction nodes, and multiple geographically adjacent edges between terminal nodes;

[0046] The control command generation module is used for the first terminal node to periodically upload sensor data to the ground control center through the DCP uplink. The ground control center generates control commands based on the sensor data uploaded by the first terminal node, and adds a first-level hash label, a second-level historical command chain hash label, and a third-level spatiotemporal binding code label to the control commands. After encryption, the commands are sent through the LRIT / EWAIB downlink broadcast channel. The first terminal node can be any one of multiple terminal nodes.

[0047] The identity verification confidence acquisition module is used by the first terminal node to perform identity matching and decryption of the broadcast command, and then perform three-level joint verification in sequence according to the first-level hash label, the second-level historical instruction chain hash label and the third-level spatiotemporal binding code label to obtain the identity verification confidence.

[0048] The instruction execution module is used to correct the verification identity confidence based on the dynamic binding relationship graph to obtain a corrected identity confidence. When the corrected identity confidence is greater than or equal to a preset threshold, the control instruction is executed.

[0049] The hash chain update module is used by the first terminal node to confirm the execution of instructions via the DCP uplink, and the ground control center updates the historical instruction hash chain of the terminal node based on the backhaul result.

[0050] Beneficial effects of the embodiments of the present invention:

[0051] In the solution provided by this invention, a dynamic binding relationship graph is constructed, which includes multiple terminal nodes, multiple command nodes, and multiple geographically adjacent edges between terminal nodes. A first terminal node periodically uploads sensor data to the ground control center via the DCP uplink. The ground control center generates control commands based on the sensor data uploaded by the first terminal node, and adds a first-level hash label, a second-level historical command chain hash label, and a third-level spatiotemporal binding code label to the control commands. After encryption, the commands are sent via the LRIT / EWAIB downlink broadcast channel. The first terminal node can be any one of the multiple terminal nodes. After the first terminal node performs identity matching and decryption on the broadcast commands, it sequentially performs three-level joint verification based on the first-level hash label, the second-level historical command chain hash label, and the third-level spatiotemporal binding code label to obtain a verification identity confidence level. Based on the dynamic binding relationship graph, the verification identity confidence level is corrected to obtain a corrected identity confidence level. When the corrected identity confidence level is greater than or equal to a preset threshold, the control command is executed. The first terminal node sends back command execution confirmation via the DCP uplink, and the ground control center updates the historical command hash chain of the terminal node based on the feedback result. This invention achieves the technical effect of improving the reliability of remote control by eliminating multi-system protocol conversion delays through a closed-loop link built within a single satellite system, thus compressing the time delay of remote control command issuance and meeting the real-time response requirements of meteorological equipment. Of course, implementing any product or method of this invention does not necessarily require achieving all of the advantages described above simultaneously. Attached Figure Description

[0052] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0053] Figure 1 This invention provides a schematic flowchart of a remote control method for Fengyun satellite terminals based on single-satellite link binding.

[0054] Figure 2 A schematic diagram of the structure of the Fengyun satellite terminal remote control system based on single-satellite link binding provided by the present invention is shown.

[0055] Figure labeling: Graph construction module 11, control instruction generation module 12, identity verification confidence acquisition module 13, instruction execution module 14, hash chain update module 15. Detailed Implementation

[0056] To facilitate understanding of the present invention, a more complete description of the invention will be given below with reference to the accompanying drawings, which illustrate preferred embodiments of the invention. However, the invention can be implemented in many different forms and is not limited to the embodiments described herein; rather, these embodiments are provided to enable a more thorough and complete understanding of the disclosure of the invention.

[0057] Furthermore, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0058] In the description of this invention, it should be understood that the terms "center," "longitudinal," "lateral," "length," "width," "thickness," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," "outer," "clockwise," and "counterclockwise," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this invention.

[0059] Unless otherwise expressly stated, throughout the specification and claims, the term "comprising" or its variations such as "including" or "comprises" shall be understood to include the stated elements or components without excluding other elements or other components.

[0060] The present invention provides a remote control method and system for Fengyun satellite terminals based on single-satellite link binding, which is used to solve the problem that the DCP uplink and LRIT / EWAIB downlink in the existing Fengyun meteorological satellite system operate independently and cannot achieve closed-loop remote control of a large number of terminals within a single satellite system.

[0061] Example 1: See Figure 1 The flowchart of the remote control method for Fengyun satellite terminals based on single-satellite link binding provided in this embodiment of the invention includes:

[0062] Construct a dynamic binding relationship graph, wherein the dynamic binding relationship graph includes multiple terminal nodes, multiple instruction nodes, and multiple geographically adjacent edges between terminal nodes;

[0063] In one implementation, each instruction node in the dynamic binding relationship graph is associated with a sending edge pointing to the corresponding terminal node, and each terminal node is associated with a historical instruction hash chain.

[0064] The historical instruction hash chain is a concatenation of the sequence numbers of the three most recently successfully executed instructions and the HMAC hash values ​​of their execution results.

[0065] In one implementation, a dynamic binding relationship graph is constructed. This embodiment of the application further includes:

[0066] By using each terminal as a terminal node and each control command as an instruction node, multiple terminal nodes and multiple instruction nodes can be obtained.

[0067] With the constraint that the geographical distance between two terminal nodes is less than the preset geographical grid edge length, multiple geographically adjacent edges between terminal nodes are constructed.

[0068] The dynamic binding relationship graph is constructed based on the multiple terminal nodes, multiple instruction nodes, and multiple geographically adjacent edges between terminal nodes.

[0069] In one embodiment, the dynamic binding relationship graph is a directed attribute graph data structure stored in the ground control center server and distributed to each terminal, used to describe terminals, instructions, and the logical relationships between them. This graph organizes data in the form of nodes and edges, supporting fast neighborhood queries and attribute updates. Terminal nodes are a type of node in the graph, each uniquely corresponding to a physical terminal, such as an automatic weather station or an ocean buoy. Each terminal node is associated with the following attributes: a terminal identifier (8 bytes); current geographic location coordinates, including longitude and latitude in floating-point format; a historical instruction hash chain (32-byte binary string, storing the HMAC hash concatenation result of the three most recently successfully executed instructions); and the last communication timestamp (Unix UTC time, 4 bytes).

[0070] Each instruction node uniquely corresponds to a control instruction generated by the ground control center. Each instruction node is associated with the following attributes: instruction sequence number (2 bytes, cycling from 0 to 65535); control code (1 byte, indicating the specific operation, such as initiating cooling); time stamp (4 bytes, Unix UTC time, indicating the instruction's effective expiration time); and instruction status, including issued, confirmed, and timed out. Geographically adjacent edges are undirected edges connecting two terminal nodes, indicating their spatial proximity. The condition for establishing an edge is that the geographical distance between the two terminal nodes is less than a preset geographical grid edge length. Preferably, this edge length can be configured according to the terminal deployment density, for example, 10 kilometers in plains areas and 5 kilometers in mountainous areas. The historical instruction hash chain is a fixed-length binary string, calculated using the HMAC algorithm from the sequence numbers and execution results of the three most recently successfully executed instructions from the terminal node.

[0071] Preferably, the ground control center creates a terminal node table in a relational database, such as PostgreSQL, or a graph database, such as Neo4j, during the initialization phase or each time a new terminal registers. The primary key of each terminal node is a fixed terminal identifier, and other attribute fields are set according to the above definitions. When a terminal registers for the first time, a record is inserted, the historical instruction hash chain field is initialized to all zeros, and the last communication timestamp is set to the registration time. For instruction nodes, each time the ground control center generates a control instruction, a record is inserted into the instruction node table. The instruction sequence number is assigned by a globally incrementing counter, and the instruction status is initially set to "issued." The issuance edge is associated through the target terminal foreign key field in the instruction node table, eliminating the need for a separate edge table.

[0072] Furthermore, the ground control center periodically, such as hourly or each time a terminal reports a geographic location update, performs a neighbor edge construction process. Specifically, this involves obtaining the current geographic location coordinates (longitude and latitude) of all active terminal nodes. Spatial indexing techniques, such as GeoHash and R-tree, are used to bucket terminals by geographic location. For each terminal, only candidate terminals with the same GeoHash prefix are queried, and the spherical distance between them is calculated using the Haversine formula. If the distance is less than the preset geographic grid side length, a geographic neighbor edge is constructed, and the terminal node is added to the neighbor edge table of the terminal node at the other end of the edge. To avoid duplicate edges, undirected edges are stored only once. This neighbor edge table allows subsequent terminals to query their neighbor list.

[0073] The ground control center organizes the aforementioned terminal node table, command node table, and adjacent edge table into a dynamic binding relationship graph. Given a terminal node, all its attributes, including historical command hash chains, can be queried in the dynamic binding relationship graph, along with a list of neighboring terminal nodes for all its geographically adjacent edges. Given a command node, the target terminal node it points to and its command status can be queried. By constructing this dynamic binding relationship graph, the technical effect of providing a data structure foundation for subsequent three-level joint verification and confidence correction on the terminal side is achieved.

[0074] The first terminal node periodically uploads sensor data to the ground control center via the DCP uplink. The ground control center generates control commands based on the sensor data uploaded by the first terminal node and adds a first-level hash label, a second-level historical command chain hash label, and a third-level spatiotemporal binding code label to the control commands. After encryption, the commands are sent through the LRIT / EWAIB downlink broadcast channel. The first terminal node can be any one of multiple terminal nodes.

[0075] In one implementation, the first terminal node periodically uploads sensor data to the ground control center via the DCP uplink. Previous embodiments of this application also include:

[0076] The first terminal node reads the fixed identifier from the one-time programmable memory;

[0077] The solidified identifier is concatenated with the current geographical location of the first terminal node to form a registration request frame. The registration request frame is encoded using RS(223,255) forward error correction and then modulated using π / 4-QPSK. It is then sent to the Fengyun satellite via the DCP uplink.

[0078] The Fengyun satellite transparently forwards the registration request frame to the ground control center. After decoding, the ground control center generates a binding record for the first terminal node, creates the corresponding first terminal node in the dynamic binding relationship graph, and synchronizes the mapping relationship between the fixed identifier and the geographical location to the satellite's on-board memory.

[0079] In one embodiment, One-Time Programmable Memory (OTP) is a non-volatile memory unit built into the terminal microcontroller. It can only be written to once after leaving the factory and cannot be tampered with, used to store the terminal's fixed identifier. π / 4-QPSK modulation is a quadrature phase shift keying modulation method with constant envelope characteristics, suitable for nonlinear transponders in satellite channels, and can effectively suppress multipath interference. The DCP uplink is the data collection channel for Fengyun satellites, and the terminal transmits data in burst mode. Transparent forwarding means that after receiving the uplink signal, the satellite only performs frequency conversion and power amplification, without parsing or changing the data content, and directly forwards it to the ground.

[0080] After power-on or initialization, the first terminal node first reads an 8-byte fixed identifier from a fixed address in the OTP memory, such as 0x1FF0-0x1FFF, via the internal bus. Then, the terminal obtains its current geographic location coordinates (longitude, latitude, WGS-84 coordinate system) through the GPS / BeiDou module. The 8-byte fixed identifier is concatenated with the 16-byte geographic location (8 bytes for longitude, 8 bytes for latitude) to form a 24-byte registration request payload, which is then filled into the 223-byte RS-encoded input block (padding with 0x00 if necessary). The terminal calls the RS(223,255) encoder to calculate a 24-byte checksum and appends it to the end, forming a 255-byte encoded frame. This encoded frame is sent to the π / 4-QPSK modulator, and after symbol mapping, it is frequency-converted to the DCP uplink frequency (e.g., 468.825MHz) by the RF front-end and transmitted to the Fengyun satellite in burst mode.

[0081] After demodulation by the DCP receiver of the Fengyun satellite, the frame content is not parsed; instead, the frequency is directly converted to the downlink frequency and forwarded to the DCP ground station at the ground control center. After demodulation and decoding, the ground station extracts the fixed identifier and geographic location, queries the local database, and if the identifier is not registered, generates a binding record, inserts a new row in the terminal node table of the dynamic binding relationship graph, sets the terminal ID, geographic location, historical command hash chain to all zeros, and the registration timestamp to the current UTC time.

[0082] Simultaneously, the ground control center encrypts the mapping relationship between the terminal ID and its geographic location's grid code (calculated via GeoHash) and synchronously uploads it to the Fengyun satellite's onboard storage via the satellite-to-ground remote control link. This storage is used by the satellite for primary rapid filtering before broadcasting. This registration process ensures that each terminal has a unique and unforgeable identity anchor in the network and provides initial data for subsequent map construction and command orientation.

[0083] In one implementation, the first-level hash label is a 16-bit hash value of the fixed identifier of the first terminal node;

[0084] The secondary historical instruction chain hash label is the historical instruction hash chain field of the first terminal node read by the ground control center from the dynamic binding relationship graph;

[0085] The three-level spatiotemporal binding code label is a dynamic binding code calculated using a key shared between the ground control center and the first terminal node, based on the current Fengyun satellite orbit time slot number, the geographic location grid code of the first terminal node, and the high bit of the current Unix UTC time.

[0086] Preferably, when generating control commands, the ground control center queries the historical command hash chain field of the target terminal ID from the terminal node table of the dynamic binding relationship graph. This field is a 32-byte binary string, which is directly extracted as a secondary tag without any transformation.

[0087] For Level 1 tags, the ground control center uses the CRC-16-CCITT algorithm, inputting the 8-byte fixed identifier of the target terminal ID, to calculate a 2-byte hash value. For Level 3 tags, the ground control center obtains the current UTC time, for example, from a GPS timing server, and right-shifts the timestamp by 6 bits to obtain the high-order integer.

[0088] Obtain the current satellite orbit time slot number. Since Fengyun-4 is a GEO satellite with a fixed orbital period of 86,164 seconds, the ground center calculates the number of seconds of the current UTC time relative to a certain reference epoch (e.g., 00:00 on January 1, 2000), modulo 86,164, to obtain a time slot number between 0 and 86,163. Obtain the geographic location grid code of the target terminal. Read the latest reported latitude and longitude from the map, and use the GeoHash library (e.g., libgeohash) to encode it into a 6-level string, such as "wtw3qg". Input the above three parameters, the 4-byte time slot number, the 6-byte grid code, the 4-byte high-order time byte, and the shared key (32 bytes), into the HMAC-SHA256 algorithm to calculate a 32-byte hash value. Take the first 8 bytes as the third-level spatiotemporal binding code label.

[0089] The generation of this three-level tag utilizes strongly coupled information from three dimensions: satellite orbit, geographic location, and time. Any deviation in any one dimension will result in a tag mismatch, thus effectively preventing replay and forgery.

[0090] In one implementation, the encrypted signal is transmitted via the LRIT / EWAIB downlink broadcast channel. This application embodiment also includes:

[0091] The control command, along with the attached first-level hash label, second-level historical command chain hash label, and third-level spatiotemporal binding code label, together form the command plaintext;

[0092] The plaintext instruction is encrypted using the AES-256 algorithm to obtain the ciphertext payload;

[0093] The first-level hash label and the ciphertext payload are encapsulated into a SatCom-Lite protocol frame, wherein the SatCom-Lite protocol frame header is 5 bytes long and includes the frame type, the first-level hash label and the checksum;

[0094] The Fengyun satellite injects the SatCom-Lite protocol frames into the LRIT / EWAIB downlink broadcast channel according to the broadcast cycle.

[0095] It should be noted that the plaintext instruction refers to the complete payload before encryption, including the control instruction body and its three attached tags. The SatCom-Lite protocol frame is a lightweight encapsulation format designed for low-speed satellite channels. The header is fixed at 5 bytes: the first byte is the frame type, for example, 0x01 indicates a control instruction; the second and third bytes are the first-level hash tag; the fourth byte is the total frame length; and the fifth byte is the header checksum.

[0096] The ground control center first concatenates the control commands with the first-level hash tag (2 bytes), the second-level historical command chain hash tag (32 bytes), and the third-level spatiotemporal binding code tag (8 bytes) in a fixed order, for a total length of 7 + 2 + 32 + 8 = 49 bytes. Preferably, if the length is not a multiple of 16, it is padded to the next multiple of 16 according to the PKCS#7 standard, i.e., padded to 64 bytes.

[0097] The ground control center uses the AES-256-CBC encryption engine, inputting the key, a 32-byte key shared with the terminal, an initialization vector (IV, which can be the lower 16 bytes of the current timestamp padded with zeros), and padded plaintext, and outputting the ciphertext payload. Next, the ground control center encapsulates the SatCom-Lite protocol frame: constructing a 5-byte header—setting the frame type byte to 0x01, filling the first-level hash tag (2 bytes) into bytes 2-3, filling the total frame length field with 5+64=69 bytes, and filling the header checksum field with the XOR value of the first 4 bytes. The 5-byte header is then concatenated with the 64-byte ciphertext payload to obtain a complete 69-byte broadcast frame.

[0098] The broadcast frame is transmitted to the Fengyun satellite via a ground-based LRIT / EWAIB uplink station, such as using a Ka-band antenna. Upon reception, the satellite inserts the frame into the downlink data stream according to the standard LRIT / EWAIB protocol and repeats the broadcast every 30 seconds. Terminals within the broadcast coverage area can receive the frame. This encrypted broadcast process ensures the confidentiality and integrity of the instructions, and the small size of the SatCom-Lite header is suitable for low-speed broadcast channels, avoiding the redundant overhead of traditional IP protocol stacks.

[0099] After the first terminal node performs identity matching and decryption of the broadcast command, it performs three-level joint verification in sequence according to the first-level hash label, the second-level historical command chain hash label and the third-level spatiotemporal binding code label to obtain the confidence level of the verified identity.

[0100] In one implementation, after the first terminal node performs identity matching and decryption on the broadcast command, it sequentially performs three-level joint verification based on the first-level hash label, the second-level historical command chain hash label, and the third-level spatiotemporal binding code label to obtain the verification identity confidence level. This application embodiment also includes:

[0101] Obtain the initial value of the identity confidence score of the first terminal node;

[0102] The first terminal node extracts the first-level hash tag from the header of the received SatCom-Lite protocol frame, compares it with the 16-bit hash value of the corresponding fixed identifier, and if they do not match, discards the instruction and terminates the verification, and adjusts the initial value of the identity confidence to 0. If they match, the identity confidence is increased by a preset first increment to obtain the first updated identity confidence, and then enters the second-level verification.

[0103] The first terminal node extracts the hash tag of the secondary historical instruction chain from the decrypted control instruction and performs a second-level comparison with the historical instruction hash chain stored in the local non-volatile memory. If they do not match, the first updated identity confidence is reduced by a preset second increment. If they match, the first updated identity confidence is increased by a preset second increment to obtain the second updated identity confidence.

[0104] The first terminal node extracts the third-level spatiotemporal binding code tag from the decrypted control command. At the same time, the first terminal node calculates the local spatiotemporal binding code based on the shared key, the current satellite orbit time slot number, the local geographic location grid code, and the high-order bits of the current Unix UTC time. The third-level spatiotemporal binding code tag is compared with the local spatiotemporal binding code. If they do not match, the second updated identity confidence is reduced by a preset third increment. If they match, the second updated identity confidence is increased by a preset third increment to obtain the verified identity confidence.

[0105] It should be noted that the initial identity confidence value is a preset fixed value, usually set to 0, and stored in the terminal's non-volatile memory, serving as the starting benchmark for the three-level verification. The preset first increment, preset second increment, and preset third increment are three pre-configured data, corresponding to the confidence adjustment range when the first, second, and third levels of verification are passed, respectively. The sum of the three is less than or equal to 1, and the preset first increment is greater than the preset second increment, while the preset second increment is greater than or equal to the preset third increment.

[0106] In one embodiment, upon receiving a SatCom-Lite protocol frame, the terminal first performs header verification: extracting the 5-byte frame header and verifying whether the 5th byte is the XOR value of the first 4 bytes. If they do not match, the entire frame is discarded; if they match, the boundary of the ciphertext payload is determined based on the 4th byte of the header (total frame length). Then, the terminal uses the AES-256 key and initialization vector (IV) shared with the ground control center to decrypt the ciphertext payload, obtaining the decrypted plaintext instructions. Completing header verification and decryption is a prerequisite for Level 3 Joint Authentication, ensuring that the received data has not been tampered with during transmission and that its source is trustworthy. Based on this, the terminal initiates the Level 3 Joint Authentication process.

[0107] The terminal reads a preset initial identity confidence value from a specific address in its internal non-volatile memory, such as EEPROM, and stores it in a memory variable. This initial value is set by the ground control center via downlink commands during terminal registration or system configuration.

[0108] The first-level comparison is a fast filtering based on the first-level hash tag. The terminal node extracts the first-level hash tag from the decrypted SatCom-Lite protocol frame header. Simultaneously, the terminal node reads the 8-byte fixed identifier from its local OTP memory and uses the same CRC-16-CCITT algorithm as the ground control center to calculate its 16-bit hash value. The received tag is compared bit-by-bit with the locally calculated value: if they do not match, the terminal determines that the instruction was not sent to itself, immediately sets the initial identity confidence value to 0, discards the instruction, and terminates all subsequent verifications; if they match, the terminal increases the initial identity confidence value by a first increment of 0.4 to obtain the updated second identity confidence value and proceeds to the second-level verification.

[0109] The second level of comparison is a continuity verification based on the historical instruction hash chain. The terminal node extracts the second-level historical instruction chain hash tag from the decrypted plaintext instruction, according to a fixed offset position agreed upon by the ground control center, for example, after the first-level tag and before the control code. Simultaneously, the terminal node reads the maintained historical instruction hash chain from its local non-volatile memory (such as EEPROM or flash memory). This chain records the sequence numbers of the three most recently successfully executed instructions and the concatenated HMAC hash values ​​of their execution results. The terminal calls the memory comparison interface to perform a byte-by-byte comparison of the two 32-byte arrays. If all bytes are equal, it indicates that the current instruction is continuous with the terminal's historical execution record and has not been replayed or tampered with; the terminal increases the first updated identity confidence score by a preset second increment (e.g., 0.3). If any byte is unequal, it indicates that the historical chain does not match; the terminal decreases the first updated identity confidence score by the preset second increment. The updated second updated identity confidence score is obtained, and the process proceeds to the third level of verification.

[0110] The third level of comparison is a validity verification based on the spatiotemporal binding code. The terminal node extracts the third-level spatiotemporal binding code tag (8 bytes) from the decrypted plaintext instruction at a fixed offset position. Simultaneously, the terminal performs a local spatiotemporal binding code calculation process, reads the local shared key, and pre-programs a 32-byte symmetric key in the OTP or secure storage area. It obtains the current satellite orbit time slot number. Specifically, the terminal obtains the current UTC time through the real-time clock (RTC), and then calculates the time slot number within the period of the Fengyun satellite (the period for geostationary orbit satellites is 86,164 seconds) based on the orbital period (taking the UTC seconds modulo 86,164). It obtains the local geographic location grid code. The terminal obtains the current latitude and longitude coordinates through the GPS / BeiDou module, encodes them into a 6-level string (e.g., "wtw3qg") using the GeoHash algorithm, and obtains the high-order bits of the Unix UTC time—shifting the current UTC timestamp 6 bits to the right (i.e., dividing by 64 and rounding down). The four parameters mentioned above—slot number, grid code, high-order time byte, and shared key—are input into the HMAC-SHA256 algorithm to calculate a 32-byte hash value. The first 8 bytes are taken as the local spatiotemporal binding code. The extracted instruction tag is compared byte by byte with the locally calculated code. If they are all equal, it means the instruction was issued at the correct spatiotemporal location and was not replayed. The terminal increases the second updated identity confidence score by a preset third increment, such as 0.3. If they are inconsistent, the second updated identity confidence score is decreased by the preset third increment to obtain the verified identity confidence score.

[0111] The three-level joint verification expands a single identity comparison into a multi-dimensional trust accumulation mechanism. The first level filters out non-target commands, the second level prevents the replay of historical commands, and the third level prevents spatiotemporal forgery. These three levels are progressively more advanced, ensuring that every command in the broadcast channel must simultaneously meet the three conditions of identity, history, and spatiotemporal information to obtain a high degree of confidence, thereby solving the orientation problem in broadcast environments.

[0112] Based on the dynamic binding relationship graph, the verification identity confidence score is corrected to obtain a corrected identity confidence score. When the corrected identity confidence score is greater than or equal to a preset threshold, the control command is executed.

[0113] The first terminal node transmits instruction execution confirmation via the DCP uplink, and the ground control center updates the historical instruction hash chain of the terminal node based on the transmission result.

[0114] In one implementation, the verified identity confidence level is corrected based on the dynamic binding relationship graph to obtain a corrected identity confidence level. This application embodiment further includes:

[0115] The first terminal node queries the list of neighboring terminals with adjacent geographical locations from the dynamic binding relationship graph;

[0116] The first terminal node broadcasts a query request to each neighbor terminal in the neighbor terminal list via Bluetooth or LoRa short-range communication. The query request includes the currently received instruction sequence number and instruction content hash.

[0117] After receiving a query request, each neighbor terminal in the neighbor terminal list checks whether it has received the same instruction sequence number and instruction content hash as the control instruction within the same broadcast cycle, and returns a positive or negative response.

[0118] The first terminal node counts the number of neighbors that return a positive response and uses the ratio of the number of positive responses to the total number of queried neighbors in the neighbor terminal list as the neighbor consensus degree.

[0119] The verified identity confidence is corrected based on the neighbor consensus to obtain the corrected identity confidence.

[0120] In one implementation, the verified identity confidence level is corrected based on the neighborhood consensus level to obtain a corrected identity confidence level. This application embodiment further includes:

[0121] If the neighbor consensus is greater than or equal to 0.6, the verified identity confidence will be increased by a preset correction amount to obtain the corrected identity confidence.

[0122] If the neighbor consensus is less than 0.6, the current identity confidence is reduced by a preset correction amount to obtain the corrected identity confidence.

[0123] It should be noted that the neighbor terminal list refers to the set of identifiers of all other terminal nodes that are geographically adjacent to this terminal node, obtained from the dynamic binding relationship graph. Preferably, it is updated incrementally by the ground control center periodically through downlink broadcast or by using DCP uplink confirmation back.

[0124] After obtaining the identity verification confidence level, the terminal node reads a pre-stored dynamic binding relationship graph fragment from its local flash memory. This fragment stores a list of identifiers of all neighboring terminals that are geographically adjacent to the terminal in key-value pairs. The terminal iterates through this list and sends query request frames to each neighboring terminal sequentially via a short-range communication protocol stack. For Bluetooth, the terminal acts as the master device, establishing low-power connections with each neighbor in turn. After the connection is established, it sends the request by writing feature values ​​through a general attribute protocol and sets a timeout timer, such as 2 seconds. For LoRa, the terminal uses a point-to-point broadcast mode, sending the request frame with the same spreading factor and bandwidth, which is received by neighboring terminals in the listening slot. The request frame content includes an instruction sequence number and an instruction content hash. The instruction content hash is obtained by performing a SHA-256 operation on the decrypted plaintext instruction payload and taking the first 8 bytes. After receiving the request, the neighboring terminal queries its instruction reception record cache for the most recent broadcast cycle. This cache stores the most recently received instruction sequence number and content hash in a circular queue. If the same sequence number exists in the cache and the content hash matches exactly, the neighboring terminal returns a 1-byte positive response, such as 0x01; otherwise, it returns a negative response, such as 0x00. If no response is received within the timeout period, it is considered negative.

[0125] The first terminal node counts the number of neighbors that return a positive response and calculates the ratio of this number to the total number of queried neighbors to obtain the neighbor consensus score. The neighbor consensus score reflects the broad consistency of the current control command within the geographically proximate area. If most neighbors receive the same command, the command is highly likely to be a genuine broadcast; if only the local node receives it and none of the neighbors receive it, the command may be targeted forgery or there may be local channel interference.

[0126] The preset correction amount is a fixed weighting coefficient used to incrementally or subtractively adjust the identity verification confidence based on the neighbor consensus, such as 0.1. If the neighbor consensus is greater than or equal to 0.6, the identity verification confidence is increased by the preset correction amount to obtain the corrected identity confidence; if the neighbor consensus is less than 0.6, the current identity confidence is decreased by the preset correction amount to obtain the corrected identity confidence.

[0127] The corrected identity confidence level is compared with a preset execution threshold, such as an initial value of 0.7, which can be dynamically configured. If the corrected identity confidence level is greater than or equal to the preset execution threshold, the terminal node sends a control signal to the device control unit through a general-purpose input / output interface or integrated circuit bus. For example, for a command to start the cooling fan, the terminal outputs a pulse width modulation signal, sets the duty cycle to 100%, and drives the fan motor to rotate; for a command to enter power-saving mode, the terminal shuts down the power supply of non-essential peripherals, reduces the main frequency, and extends the sampling period from 10 minutes to 30 minutes. If the corrected identity confidence level is less than the preset execution threshold, the terminal discards the command and writes the reason for the verification failure, such as insufficient neighbor consensus or confidence level below the threshold, into the circular log buffer for subsequent uplink to the ground control center.

[0128] After executing a control command, the terminal node records the command's sequence number and execution result (e.g., 0x00 for success, 0x01 for failure) as a new record. The terminal node reads the currently stored historical command hash chain from its local non-volatile memory. It then uses the HMAC-SHA256 algorithm to calculate new hash values ​​for the three records, along with the original data, sequence number, and result of the two most recent old records, and concatenates them sequentially to form a new hash chain, overwriting the original storage location.

[0129] Simultaneously, the terminal node constructs a DCP uplink confirmation frame, assembling a data frame containing the terminal's fixed identifier, frame sequence number, timestamp, sensor data (such as temperature and battery voltage), and a confirmation field including the current command sequence number and execution result. This frame is then RS(223,255) encoded and π / 4-QPSK modulated before being transmitted to the Fengyun satellite via the DCP uplink. The satellite transparently forwards the data to the ground control center. After decoding, the ground control center locates the corresponding command node in the dynamic binding relationship graph based on the command sequence number in the confirmation field, updating its status field from "issued" to "confirmed." Simultaneously, based on the execution result in the confirmation, the historical command hash chain field corresponding to the terminal node is updated to the new value reported by the terminal. If the new value reported by the terminal matches the value calculated locally by the ground center, it is updated synchronously; otherwise, the terminal's report prevails, and the anomaly is recorded. This achieves the technical effect of improving remote control reliability, eliminating multi-system protocol conversion delays through a closed-loop link built within a single satellite system, compressing the delay in issuing remote control commands, and meeting the real-time response requirements of meteorological equipment.

[0130] Example 2: Based on the same inventive concept as the Fengyun satellite terminal remote control method based on single-satellite link binding in the foregoing examples, this invention provides a Fengyun satellite terminal remote control system based on single-satellite link binding. See [link to example]. Figure 2 As shown, the system includes:

[0131] Graph construction module 11 is used to construct a dynamic binding relationship graph, wherein the dynamic binding relationship graph includes multiple terminal nodes, multiple instruction nodes, and multiple geographically adjacent edges between terminal nodes;

[0132] The control command generation module 12 is used for the first terminal node to periodically upload sensor data to the ground control center through the DCP uplink. The ground control center generates control commands based on the sensor data uploaded by the first terminal node, and adds a first-level hash label, a second-level historical command chain hash label and a third-level spatiotemporal binding code label to the control commands. After encryption, the commands are sent through the LRIT / EWAIB downlink broadcast channel. The first terminal node can be any one of multiple terminal nodes.

[0133] The identity verification confidence acquisition module 13 is used by the first terminal node to perform identity matching and decryption of the broadcast command, and then perform three-level joint verification in sequence according to the first-level hash label, the second-level historical instruction chain hash label and the third-level spatiotemporal binding code label to obtain the identity verification confidence.

[0134] The instruction execution module 14 is used to correct the verification identity confidence based on the dynamic binding relationship graph to obtain a corrected identity confidence. When the corrected identity confidence is greater than or equal to a preset threshold, the control instruction is executed.

[0135] The hash chain update module 15 is used by the first terminal node to send back instruction execution confirmation via the DCP uplink, and the ground control center updates the historical instruction hash chain of the terminal node based on the back transmission result.

[0136] Furthermore, in the dynamic binding relationship graph, each instruction node is associated with a sending edge pointing to the corresponding terminal node, and each terminal node is associated with a historical instruction hash chain.

[0137] The historical instruction hash chain is a concatenation of the sequence numbers of the three most recently successfully executed instructions and the HMAC hash values ​​of their execution results.

[0138] Furthermore, the system is also used to perform the following steps:

[0139] By using each terminal as a terminal node and each control command as an instruction node, multiple terminal nodes and multiple instruction nodes can be obtained.

[0140] With the constraint that the geographical distance between two terminal nodes is less than the preset geographical grid edge length, multiple geographically adjacent edges between terminal nodes are constructed.

[0141] The dynamic binding relationship graph is constructed based on the multiple terminal nodes, multiple instruction nodes, and multiple geographically adjacent edges between terminal nodes.

[0142] Furthermore, the system is also used to perform the following steps:

[0143] The first terminal node reads the fixed identifier from the one-time programmable memory;

[0144] The solidified identifier is concatenated with the current geographical location of the first terminal node to form a registration request frame. The registration request frame is encoded using RS(223,255) forward error correction and then modulated using π / 4-QPSK. It is then sent to the Fengyun satellite via the DCP uplink.

[0145] The Fengyun satellite transparently forwards the registration request frame to the ground control center. After decoding, the ground control center generates a binding record for the first terminal node, creates the corresponding first terminal node in the dynamic binding relationship graph, and synchronizes the mapping relationship between the fixed identifier and the geographical location to the satellite's on-board memory.

[0146] Furthermore, the first-level hash label is the 16-bit hash value of the fixed identifier of the first terminal node;

[0147] The secondary historical instruction chain hash label is the historical instruction hash chain field of the first terminal node read by the ground control center from the dynamic binding relationship graph;

[0148] The three-level spatiotemporal binding code label is a dynamic binding code calculated using a key shared between the ground control center and the first terminal node, based on the current Fengyun satellite orbit time slot number, the geographic location grid code of the first terminal node, and the high bit of the current Unix UTC time.

[0149] Furthermore, the system is also used to perform the following steps:

[0150] The control command, along with the attached first-level hash label, second-level historical command chain hash label, and third-level spatiotemporal binding code label, together form the command plaintext;

[0151] The plaintext instruction is encrypted using the AES-256 algorithm to obtain the ciphertext payload;

[0152] The first-level hash label and the ciphertext payload are encapsulated into a SatCom-Lite protocol frame, wherein the SatCom-Lite protocol frame header is 5 bytes long and includes the frame type, the first-level hash label and the checksum;

[0153] The Fengyun satellite injects the SatCom-Lite protocol frames into the LRIT / EWAIB downlink broadcast channel according to the broadcast cycle.

[0154] Furthermore, the system is also used to perform the following steps:

[0155] Obtain the initial value of the identity confidence score of the first terminal node;

[0156] The first terminal node extracts the first-level hash tag from the header of the received SatCom-Lite protocol frame, compares it with the 16-bit hash value of the corresponding fixed identifier, and if they do not match, discards the instruction and terminates the verification, and adjusts the initial value of the identity confidence to 0. If they match, the identity confidence is increased by a preset first increment to obtain the first updated identity confidence, and then enters the second-level verification.

[0157] The first terminal node extracts the hash tag of the secondary historical instruction chain from the decrypted control instruction and performs a second-level comparison with the historical instruction hash chain stored in the local non-volatile memory. If they do not match, the first updated identity confidence is reduced by a preset second increment. If they match, the first updated identity confidence is increased by a preset second increment to obtain the second updated identity confidence.

[0158] The first terminal node extracts the third-level spatiotemporal binding code tag from the decrypted control command. At the same time, the first terminal node calculates the local spatiotemporal binding code based on the shared key, the current satellite orbit time slot number, the local geographic location grid code, and the high-order bits of the current Unix UTC time. The third-level spatiotemporal binding code tag is compared with the local spatiotemporal binding code. If they do not match, the second updated identity confidence is reduced by a preset third increment. If they match, the second updated identity confidence is increased by a preset third increment to obtain the verified identity confidence.

[0159] Furthermore, the system is also used to perform the following steps:

[0160] The first terminal node queries the list of neighboring terminals with adjacent geographical locations from the dynamic binding relationship graph;

[0161] The first terminal node broadcasts a query request to each neighbor terminal in the neighbor terminal list via Bluetooth or LoRa short-range communication. The query request includes the currently received instruction sequence number and instruction content hash.

[0162] After receiving a query request, each neighbor terminal in the neighbor terminal list checks whether it has received the same instruction sequence number and instruction content hash as the control instruction within the same broadcast cycle, and returns a positive or negative response.

[0163] The first terminal node counts the number of neighbors that return a positive response and uses the ratio of the number of positive responses to the total number of queried neighbors in the neighbor terminal list as the neighbor consensus degree.

[0164] The verified identity confidence is corrected based on the neighbor consensus to obtain the corrected identity confidence.

[0165] Furthermore, the system is also used to perform the following steps:

[0166] If the neighbor consensus is greater than or equal to 0.6, the verified identity confidence will be increased by a preset correction amount to obtain the corrected identity confidence.

[0167] If the neighbor consensus is less than 0.6, the current identity confidence is reduced by a preset correction amount to obtain the corrected identity confidence.

[0168] The above description is merely a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

[0169] The foregoing description of specific exemplary embodiments of the invention is for illustrative and explanatory purposes. These descriptions are not intended to limit the invention to the precise forms disclosed, and it will be apparent that many changes and variations can be made in accordance with the foregoing teachings. The exemplary embodiments were chosen and described in order to explain the specific principles of the invention and its practical application, thereby enabling those skilled in the art to implement and utilize various different exemplary embodiments of the invention, as well as various different choices and variations. The scope of the invention is intended to be defined by the claims and their equivalents.

Claims

1. A remote control method for Fengyun satellite terminals based on single-satellite link binding, characterized in that, The method includes: Construct a dynamic binding relationship graph, wherein the dynamic binding relationship graph includes multiple terminal nodes, multiple instruction nodes, and multiple geographically adjacent edges between terminal nodes; The first terminal node periodically uploads sensor data to the ground control center via the DCP uplink. The ground control center generates control commands based on the sensor data uploaded by the first terminal node and adds a first-level hash label, a second-level historical command chain hash label, and a third-level spatiotemporal binding code label to the control commands. After encryption, the commands are sent through the LRIT / EWAIB downlink broadcast channel. The first terminal node can be any one of multiple terminal nodes. After the first terminal node performs identity matching and decryption of the broadcast command, it performs three-level joint verification in sequence according to the first-level hash label, the second-level historical command chain hash label and the third-level spatiotemporal binding code label to obtain the confidence level of the verified identity. Based on the dynamic binding relationship graph, the verification identity confidence score is corrected to obtain a corrected identity confidence score. When the corrected identity confidence score is greater than or equal to a preset threshold, the control command is executed. The first terminal node transmits instruction execution confirmation via the DCP uplink, and the ground control center updates the historical instruction hash chain of the terminal node based on the transmission result.

2. The remote control method for Fengyun satellite terminals based on single-satellite link binding as described in claim 1, characterized in that, In the dynamic binding relationship graph, each instruction node is associated with a sending edge pointing to the corresponding terminal node, and each terminal node is associated with a historical instruction hash chain. The historical instruction hash chain is a concatenation of the sequence numbers of the three most recently successfully executed instructions and the HMAC hash values ​​of their execution results.

3. The remote control method for Fengyun satellite terminals based on single-satellite link binding as described in claim 2, characterized in that, Constructing a dynamic binding relationship graph includes: By using each terminal as a terminal node and each control command as an instruction node, multiple terminal nodes and multiple instruction nodes can be obtained. With the constraint that the geographical distance between two terminal nodes is less than the preset geographical grid edge length, multiple geographically adjacent edges between terminal nodes are constructed. The dynamic binding relationship graph is constructed based on the multiple terminal nodes, multiple instruction nodes, and multiple geographically adjacent edges between terminal nodes.

4. The remote control method for Fengyun satellite terminals based on single-satellite link binding as described in claim 1, characterized in that, The first terminal node periodically uploads sensor data to the ground control center via the DCP uplink, which also includes: The first terminal node reads the fixed identifier from the one-time programmable memory; The solidified identifier is concatenated with the current geographical location of the first terminal node to form a registration request frame. The registration request frame is encoded using RS(223,255) forward error correction and then modulated using π / 4-QPSK. It is then sent to the Fengyun satellite via the DCP uplink. The Fengyun satellite transparently forwards the registration request frame to the ground control center. After decoding, the ground control center generates a binding record for the first terminal node, creates the corresponding first terminal node in the dynamic binding relationship graph, and synchronizes the mapping relationship between the fixed identifier and the geographical location to the satellite's on-board memory.

5. The remote control method for Fengyun satellite terminals based on single-satellite link binding as described in claim 1, characterized in that, The first-level hash label is the 16-bit hash value of the fixed identifier of the first terminal node; The secondary historical instruction chain hash label is the historical instruction hash chain field of the first terminal node read by the ground control center from the dynamic binding relationship graph; The three-level spatiotemporal binding code label is a dynamic binding code calculated using a key shared between the ground control center and the first terminal node, based on the current Fengyun satellite orbit time slot number, the geographic location grid code of the first terminal node, and the high bit of the current Unix UTC time.

6. The remote control method for Fengyun satellite terminals based on single-satellite link binding as described in claim 1, characterized in that, After encryption, it is transmitted via the LRIT / EWAIB downlink broadcast channel, including: The control command, along with the attached first-level hash label, second-level historical command chain hash label, and third-level spatiotemporal binding code label, together form the command plaintext; The plaintext instruction is encrypted using the AES-256 algorithm to obtain the ciphertext payload; The first-level hash label and the ciphertext payload are encapsulated into a SatCom-Lite protocol frame, wherein the SatCom-Lite protocol frame header is 5 bytes long and includes the frame type, the first-level hash label and the checksum; The Fengyun satellite injects the SatCom-Lite protocol frames into the LRIT / EWAIB downlink broadcast channel according to the broadcast cycle.

7. The remote control method for Fengyun satellite terminals based on single-satellite link binding as described in claim 1, characterized in that, After the first terminal node performs identity matching and decryption of the broadcast command, it sequentially performs three-level joint verification based on the first-level hash label, the second-level historical command chain hash label, and the third-level spatiotemporal binding code label to obtain the verification identity confidence level, including: Obtain the initial value of the identity confidence score of the first terminal node; The first terminal node extracts the first-level hash tag from the header of the received SatCom-Lite protocol frame, compares it with the 16-bit hash value of the corresponding fixed identifier, and if they do not match, discards the instruction and terminates the verification, and adjusts the initial value of the identity confidence to 0. If they match, the identity confidence is increased by a preset first increment to obtain the first updated identity confidence, and then enters the second-level verification. The first terminal node extracts the hash tag of the secondary historical instruction chain from the decrypted control instruction and performs a second-level comparison with the historical instruction hash chain stored in the local non-volatile memory. If they do not match, the first updated identity confidence is reduced by a preset second increment. If they match, the first updated identity confidence is increased by a preset second increment to obtain the second updated identity confidence. The first terminal node extracts the third-level spatiotemporal binding code tag from the decrypted control command. At the same time, the first terminal node calculates the local spatiotemporal binding code based on the shared key, the current satellite orbit time slot number, the local geographic location grid code, and the high-order bits of the current Unix UTC time. The third-level spatiotemporal binding code tag is compared with the local spatiotemporal binding code. If they do not match, the second updated identity confidence is reduced by a preset third increment. If they match, the second updated identity confidence is increased by a preset third increment to obtain the verified identity confidence.

8. The remote control method for Fengyun satellite terminals based on single-satellite link binding as described in claim 1, characterized in that, Based on the dynamic binding relationship graph, the verified identity confidence is corrected to obtain a corrected identity confidence, including: The first terminal node queries the list of neighboring terminals with adjacent geographical locations from the dynamic binding relationship graph; The first terminal node broadcasts a query request to each neighbor terminal in the neighbor terminal list via Bluetooth or LoRa short-range communication. The query request includes the currently received instruction sequence number and instruction content hash. After receiving a query request, each neighbor terminal in the neighbor terminal list checks whether it has received the same instruction sequence number and instruction content hash as the control instruction within the same broadcast cycle, and returns a positive or negative response. The first terminal node counts the number of neighbors that return a positive response and uses the ratio of the number of positive responses to the total number of queried neighbors in the neighbor terminal list as the neighbor consensus degree. The verified identity confidence is corrected based on the neighbor consensus to obtain the corrected identity confidence.

9. The remote control method for Fengyun satellite terminals based on single-satellite link binding as described in claim 8, characterized in that, The verified identity confidence is corrected based on the neighborhood consensus to obtain a corrected identity confidence, including: If the neighbor consensus is greater than or equal to 0.6, the verified identity confidence will be increased by a preset correction amount to obtain the corrected identity confidence. If the neighbor consensus is less than 0.6, the current identity confidence is reduced by a preset correction amount to obtain the corrected identity confidence.

10. A remote control system for Fengyun satellite terminals based on single-satellite link bonding, characterized in that, For implementing the method steps of any one of claims 1 to 9, including: The graph construction module is used to construct a dynamic binding relationship graph, wherein the dynamic binding relationship graph includes multiple terminal nodes, multiple instruction nodes, and multiple geographically adjacent edges between terminal nodes; The control command generation module is used for the first terminal node to periodically upload sensor data to the ground control center through the DCP uplink. The ground control center generates control commands based on the sensor data uploaded by the first terminal node, and adds a first-level hash label, a second-level historical command chain hash label, and a third-level spatiotemporal binding code label to the control commands. After encryption, the commands are sent through the LRIT / EWAIB downlink broadcast channel. The first terminal node can be any one of multiple terminal nodes. The identity verification confidence acquisition module is used by the first terminal node to perform identity matching and decryption of the broadcast command, and then perform three-level joint verification in sequence according to the first-level hash label, the second-level historical instruction chain hash label and the third-level spatiotemporal binding code label to obtain the identity verification confidence. The instruction execution module is used to correct the verification identity confidence based on the dynamic binding relationship graph to obtain a corrected identity confidence. When the corrected identity confidence is greater than or equal to a preset threshold, the control instruction is executed. The hash chain update module is used by the first terminal node to confirm the execution of instructions via the DCP uplink, and the ground control center updates the historical instruction hash chain of the terminal node based on the backhaul result.

Images