Satellite data encryption method and system based on satellite-ground cooperation

Abstract

The application discloses a satellite-ground cooperative satellite data encryption method and system. The method comprises the following steps: receiving key material sent by a ground operation control center, wherein the key material at least contains a master key generated by the ground operation control center; generating a sub-key by using a key derivation function according to the key material and a satellite identifier of a low-orbit satellite (LEO) running in a GEO coverage range, and distributing the sub-key to the LEO and a user terminal, wherein the sub-key is used for decrypting encrypted satellite data in the LEO by the user terminal. The method at least solves the technical problem of low satellite communication security in the prior art.

Description

Technical Field

[0001] This application relates to the field of satellite communication technology, and more specifically, to a satellite data encryption method and system for satellite-ground collaboration. Background Technology

[0002] The security framework for satellite communications is still incomplete. At this stage, the focus is more on functional implementation, with a general development strategy of "get it working first," while awareness of security during satellite communication transmission is relatively weak. For example, critical communication systems in the low-altitude economy, such as aircraft control links and navigation systems, may encounter multiple reliability challenges, including signal interference, transmission delays, connection interruptions, data distortion, and security vulnerabilities. While encryption technology is currently an effective option to meet security requirements, including the use of symmetric encryption, asymmetric encryption, and hash functions, communication security is relatively low in the dynamic environment of satellite-ground collaboration. Summary of the Invention

[0003] This application provides a satellite data encryption method and system for satellite-ground collaboration, which at least solves the technical problem of low security in satellite communication in related technologies.

[0004] According to one aspect of the embodiments of this application, a satellite data encryption method for satellite-ground collaboration is provided, comprising: receiving key material sent by a ground operation control center, wherein the key material includes at least a master key generated by the ground operation control center; generating a subkey using a key derivation function based on the key material and a satellite identifier of a low-Earth orbit (LEO) satellite operating within the coverage area of ​​the GEO, and distributing the subkey to the LEO and a user terminal, wherein the subkey is used by the user terminal to decrypt encrypted satellite data in the LEO.

[0005] Optionally, distributing a key to a low-Earth orbit (LEO) satellite operating within the coverage area of ​​a high-Earth orbit (GEO) satellite includes: establishing a communication connection with the LEO satellite within the coverage area of ​​the GEO satellite; and sending the subkey to the LEO satellite, wherein the subkey is used by the LEO satellite to encrypt the satellite data.

[0006] Optionally, the method further includes: receiving an access request from the user terminal, wherein the access request includes at least: the user terminal's identity credentials; and, if the user terminal's identity credentials and permissions are verified, sending the subkey to the user terminal.

[0007] Optionally, the method further includes: sending the notification message to the user terminal if the user terminal's identity credentials and permissions fail to be verified, wherein the notification message is used to indicate that the user terminal does not have permission to access satellite data in the LEO.

[0008] Optionally, after the user terminal is verified, the method further includes: sending indication information to the user terminal, wherein the indication information is used to indicate that the user terminal is allowed to establish a communication connection with the LEO, wherein the user terminal establishes a communication connection with the LEO after receiving the subkey and receives encrypted satellite data sent by the LEO.

[0009] Optionally, the method further includes: receiving the updated master key from the ground operations control center when the master key is updated; generating an updated subkey based on the updated master key; and sending the updated subkey to the LEO, wherein the updated subkey is used to replace the original subkey.

[0010] According to another aspect of the embodiments of this application, it further includes: a satellite data access method for satellite-ground collaboration, comprising: sending an access request to a high-orbit satellite (GEO); if the access request is verified, receiving a subkey sent by the GEO and establishing a communication connection with a low-orbit satellite (LEO), wherein the subkey is generated by the GEO based on key materials sent by a ground operations control center; receiving encrypted satellite data sent by the LEO and decrypting the encrypted satellite data using the subkey to obtain decrypted satellite data, wherein the encrypted satellite data is obtained by the LEO encrypting the satellite data using the subkey received from the GEO.

[0011] According to another aspect of the embodiments of this application, it further includes: a satellite data encryption method for satellite-ground collaboration, comprising: receiving a subkey sent by a high-orbit satellite GEO, wherein the subkey is generated by the GEO based on key materials sent by a ground operations control center; encrypting satellite data using the subkey to obtain encrypted satellite data; and sending the encrypted satellite data to the user terminal in response to a data request from a user terminal authorized by the GEO, wherein the encrypted satellite data is used by the user terminal to decrypt the encrypted satellite data using the subkey, and the subkey in the user terminal is sent by the GEO.

[0012] According to another aspect of the embodiments of this application, it further includes: a satellite data access system with satellite-ground coordination, comprising: a high-orbit satellite, a low-orbit satellite, a ground operation control center, and a user terminal; the high-orbit satellite is used to receive key material sent by the ground operation control center, wherein the key material includes at least a master key generated by the ground operation control center; a subkey is generated based on the key material, and the subkey is distributed to the low-orbit satellite LEO operating within the coverage area of ​​the high-orbit satellite GEO and the user terminal, wherein the subkey is used by the user terminal to decrypt satellite data in the LEO; the low-orbit satellite is used to send encrypted satellite data to the user terminal; the ground operation control center is used to generate the key material; and the user terminal is used to decrypt the encrypted satellite data.

[0013] According to another aspect of the embodiments of this application, a communication device is also provided, including: a memory and a processor, wherein the memory is used to store program instructions; the processor, connected to the memory, is used to execute the above-described satellite data encryption method for satellite-to-ground collaboration.

[0014] In this embodiment, key materials sent by a ground operation control center are received, wherein the key materials contain at least a master key generated by the ground operation control center; a key derivation function is used to generate subkeys based on the key materials and the satellite identifiers of low-Earth orbit (LEO) satellites operating within the GEO coverage area, and the subkeys are distributed to the LEO satellites and user terminals, wherein the subkeys are used by the user terminals to decrypt encrypted satellite data in the LEO satellites. By generating keys from the ground control center and pre-distributing keys to high-Earth orbit (HEO) satellites, distributing keys from HEO satellites to low-Earth orbit (LEO) satellites for data encryption and storage, and distributing keys to authorized terminals for access control, the security of satellite communication is enhanced, thereby solving the technical problem of low satellite communication security in related technologies. Attached Figure Description

[0015] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0016] Figure 1 This is a hardware structure block diagram of a computer terminal for implementing a satellite data encryption method for satellite-ground collaboration according to an embodiment of this application;

[0017] Figure 2 This is a flowchart of a satellite data encryption method for satellite-ground collaboration according to an embodiment of this application;

[0018] Figure 3This is a schematic diagram of a satellite data access system structure for satellite-ground collaboration according to an embodiment of this application;

[0019] Figure 4 This is a flowchart of another satellite data encryption method for satellite-ground collaboration according to an embodiment of this application;

[0020] Figure 5 This is a schematic diagram of a satellite data access system architecture for satellite-ground collaboration according to an embodiment of this application;

[0021] Figure 6 This is a structural diagram of a satellite data encryption device for satellite-ground collaboration according to an embodiment of this application. Detailed Implementation

[0022] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0023] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0024] The information collected in this application embodiment is information and data authorized by the user or fully authorized by all parties. The collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data all comply with the relevant laws, regulations and standards of the relevant regions, and necessary confidentiality measures have been taken. It does not violate public order and good morals, and provides corresponding operation entry points for users to choose to authorize or reject the automated decision results. If the user chooses to reject, the process will proceed to the expert decision-making process.

[0025] To address the problems existing in related technologies, this application provides a satellite data encryption method for space-ground collaboration, which can operate in... Figure 1The computer terminal shown is explained below.

[0026] The satellite data encryption method for satellite-ground collaboration provided in this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1 A hardware block diagram of a computer terminal for implementing a satellite data encryption method for satellite-to-ground collaboration is shown. Figure 1 As shown, the computer terminal 10 may include one or more processors (shown as 102a, 102b, ..., 102n in the figure) (the processor may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission module 106 for communication functions connected via wired and / or wireless networks. In addition, it may also include: a display, a keyboard, a cursor control device, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, and a BUS bus. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0027] It should be noted that the aforementioned one or more processors and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10. As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0028] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the satellite data encryption method for satellite-ground collaboration in this embodiment. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby realizing the aforementioned satellite data encryption method for satellite-ground collaboration. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0029] The transmission module 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission module 106 includes a network interface controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission module 106 may be a radio frequency (RF) module, used for wireless communication with the Internet.

[0030] The display can be, for example, a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10.

[0031] It should be noted here that, in some optional embodiments, the above... Figure 1 The computer terminal shown may include hardware elements (including circuitry), software elements (including computer code stored on a computer-readable medium), or a combination of both hardware and software elements. It should be noted that... Figure 1 This is only one instance of a specific particular instance, and is intended to illustrate the types of components that may exist in the aforementioned computer terminal.

[0032] Under the above operating environment, this application provides an embodiment of a satellite data encryption method for satellite-ground collaboration. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Also, although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in a different order than that shown here.

[0033] To better illustrate the satellite data encryption method for space-ground collaboration in the embodiments of this application, the technical terms used in this application are explained as follows:

[0034] GOCC: Ground Operation Control Center, the ground operation control center for satellite communication systems;

[0035] GEO: Geostationary Earth Orbit, a type of high-orbit satellite;

[0036] LEO: Low Earth Orbit, a type of low Earth orbit satellite.

[0037] Figure 2 This is a flowchart of a satellite data encryption method for satellite-ground collaboration according to an embodiment of this application, such as... Figure 2 As shown, the method includes the following steps:

[0038] Step S202: Receive key material sent by the ground operations control center, wherein the key material contains at least the master key generated by the ground operations control center;

[0039] In step S202, the master key is seed data used to derive subsequent business keys within the GEO.

[0040] Key derivation function configuration parameters include LEO identifier, timestamp synchronization seed, etc., to ensure that GEO and LEO can calculate the same subkey K_enc.

[0041] Authorized user list and permission policy: Includes the public key certificate hash value of authorized UEs and the corresponding LEO access permissions, for GEO to perform authentication.

[0042] Key lifecycle management parameters include the master key rotation cycle and the retention period of old keys.

[0043] Step S204: Using a key derivation function, a subkey is generated based on the key material and the satellite identifier of the LEO satellite operating within the coverage area of ​​the GEO, and the subkey is distributed to the LEO and the user terminal. The subkey is used by the user terminal to decrypt the encrypted satellite data in the LEO.

[0044] In step S204, the process of generating a subkey based on the key material can be carried out by using a preset key derivation algorithm to generate a subkey based on the master key.

[0045] In one alternative approach, GEO reads the master key, the current timestamp T, and the identifiers of LEO satellites within its coverage area from pre-stored key materials. GEO then invokes a pre-defined key derivation algorithm, using the master key as the key seed, to generate a data encryption subkey, which is transmitted to LEO via a secure inter-satellite link. Upon receiving the subkey, LEO stores it in a secure storage area, using it only for subsequent data encryption and decryption operations, and it is not disclosed to external parties.

[0046] Through steps S202 to S204 above, key materials sent by the ground operation control center are received, wherein the key materials at least include a master key generated by the ground operation control center; subkeys are generated based on the key materials, and the subkeys are distributed to low-Earth orbit (LEO) satellites operating within the coverage area of ​​the high-Earth orbit (GEO) satellite and user terminals. The subkeys are used by the user terminals to decrypt encrypted satellite data in the LEO satellites. By generating keys from the ground control center and pre-distributing keys to the high-Earth orbit satellites, distributing keys from the high-Earth orbit satellites to the low-Earth orbit satellites for data encryption and storage, and distributing keys to authorized terminals for access control, the security of satellite communication is enhanced, thereby solving the technical problem of low satellite communication security in related technologies. A detailed explanation follows.

[0047] In some embodiments of this application, the specific steps for distributing keys to LEO satellites operating within the coverage area of ​​a GEO satellite are as follows: establishing a communication connection with the LEO within the coverage area of ​​the GEO; sending the subkey to the LEO, wherein the subkey is used by the LEO to encrypt the satellite data.

[0048] In practical applications, when a user terminal needs to access satellite data in LEO (Light Array of Origin), it must first establish a connection with GEO. Specifically, the system receives the user terminal's access request, which includes at least the user terminal's identity credentials. If the user terminal's identity credentials and permissions are verified, the system sends the subkey to the user terminal. If the user terminal's identity credentials and permissions are not verified, the system sends a notification message to the user terminal, indicating that the user terminal does not have permission to access the satellite data in LEO.

[0049] The entire architecture relies on GEO high-orbit satellites as key relay and identity authentication hubs, while LEO low-orbit satellites are only responsible for encrypting the original satellite data with subkeys. GEO uniformly manages key distribution and terminal authentication, forming a secure link of authentication-key distribution-data encryption access. The unauthorized notification returned when authentication fails is a security interception node in the link.

[0050] The above methods block illegal data theft paths: failure to verify identity and permissions directly results in the refusal to distribute subkeys, while simultaneously sending unauthorized notifications. Even if an unauthorized terminal can establish a basic communication link with GEO, it cannot obtain the core credentials (subkeys) for decrypting LEO satellite data, and therefore cannot crack the encrypted on-board data. This eliminates theft and data theft at the source of the key, protecting classified original satellite business data such as remote sensing, communication, and telemetry and control data.

[0051] It also avoids the risk of forced cracking attempts: In real-world applications, if verification fails without feedback, attackers will continuously send batches of forged identity credentials to poll and test vulnerabilities; explicitly issuing unauthorized notifications allows the terminal to immediately terminate invalid requests, reducing the consumption of GEO satellite computing power and channel bandwidth by malicious requests, and lowering the probability of satellite payloads being attacked by traffic attacks or resource exhaustion attacks. After receiving the notification, the user terminal can determine that the root cause of its access failure is a permission issue, rather than disconnection, satellite failure, or key transmission failure. The terminal program can execute preset logic: reminding the user to verify the identity certificate, apply for permission renewal, and switch authorized access nodes, avoiding the waste of air interface communication resources by endlessly sending access requests. In addition, the terminal only starts the decryption process after receiving a valid subkey; when receiving an unauthorized notification, it skips the decryption process directly, without performing useless decryption operations. For small portable ground terminals and low-computing-power IoT terminals, it significantly reduces chip power consumption, adapting to low-power terminal scenarios such as field, airborne, and shipborne applications. If authentication fails, the subsequent key distribution process is immediately terminated, and operations that consume inter-satellite bandwidth, such as GEO-to-LEO secondary verification, inter-satellite key forwarding, and encrypted packet transmission, are no longer initiated. Invalid requests are truncated in advance, reserving satellite communication bandwidth and onboard processor computing power for legitimate access services, thereby improving the overall throughput efficiency of the satellite network. GEO, as the central authentication node, centrally undertakes authentication and key distribution; it intercepts illegal requests in advance to prevent a massive accumulation of malicious requests from consuming onboard memory and encryption modules, and to prevent GEO computing power overload, which could affect the normal key distribution service to all LEO satellites within the entire coverage area.

[0052] In addition, the satellite data encryption method for satellite-ground collaboration provided in this application embodiment allows the hierarchical permission policy to be implemented: for example, some terminals can only access a few LEOs, some terminals can only read low-secret data, and classified terminals need higher-level identity credentials. If the permissions do not match, a unified "no permission" notification will be returned, which rigidly enforces the permission boundaries and will not lead to vulnerabilities such as unauthorized access to subkeys or unauthorized reading of satellite data.

[0053] After the user terminal is verified, an instruction message is sent to the user terminal, wherein the instruction message is used to indicate that the user terminal is allowed to establish a communication connection with the LEO. After receiving the subkey, the user terminal establishes a communication connection with the LEO and receives encrypted satellite data sent by the LEO.

[0054] If the master key is updated at the ground operations control center, the updated master key is received from the ground operations control center; an updated subkey is generated based on the updated master key; and the updated subkey is sent to the LEO, whereby the updated subkey is used to replace the original subkey.

[0055] To implement the satellite data encryption method for satellite-to-ground collaboration provided in this application, this application also provides a satellite data access system for satellite-to-ground collaboration, such as... Figure 3 As shown, the system includes: a high-orbit satellite 30, a low-orbit satellite 32, a ground operation control center 34, and a user terminal 36. The high-orbit satellite 30 receives key materials sent by the ground operation control center, wherein the key materials contain at least a master key generated by the ground operation control center. A key derivation function is used to generate a subkey based on the key materials and the satellite identifier of the low-orbit satellite (LEO) operating within the GEO coverage area, and the subkey is distributed to the LEO and the user terminal. The subkey is used by the user terminal to decrypt encrypted satellite data in the LEO. The low-orbit satellite is used to send encrypted satellite data to the user terminal. The ground operation control center generates the key materials. The user terminal decrypts the encrypted satellite data.

[0056] Based on the aforementioned satellite data access system, this application embodiment also provides another satellite data encryption method for satellite-ground collaboration, such as... Figure 4 As shown, it includes:

[0057] Step 1) Initialize the connection and establish a communication link between the GOCC ground operation control center and the GEO high-orbit satellite;

[0058] Step 2) GOCC internally generates the master key;

[0059] Step 3) GOCC distributes key materials to GEO, and GEO continues to manage the keys and perform access control functions before the master key is updated;

[0060] Step 4) Initialize the connection between GEO and the LEO low-Earth orbit satellites operating within the coverage area and establish a communication link;

[0061] Step 5) GEO distributes a subkey K_enc to LEO, which is specifically used to encrypt and decrypt data on the low-Earth orbit satellite;

[0062] Step 6) After LEO obtains the subkey K_enc, it continues to use this key to encrypt newly generated data on the LEO satellite until GEO updates the key;

[0063] Step 7) The UE user terminal and GEO initialize the connection. The UE submits its identity credentials and requests access to the satellite data of the current low-orbit satellite.

[0064] Step 8) The GEO verifies the UE's identity and permissions, and identifies the authorized UE user terminal;

[0065] Step 9) If the verification is successful, GEO recognizes that the UE is an authorized user terminal, and then GEO returns the subkey K_enc corresponding to the current low-orbit satellite to the authorized UE user terminal;

[0066] Step 10) Authorize the UE user terminal to initialize the connection with LEO and access LEO. The UE uses the subkey K_enc to decrypt LEO data to achieve secure and controllable access.

[0067] Step 11) If the verification in step 8 fails, the GEO will identify that the UE is not an authorized user terminal. In this case, the GEO will not return the subkey K_enc corresponding to the current low-orbit satellite to the UE and will notify the UE that the request has been rejected. Subsequently, the UE will not be able to access the LEO to access data.

[0068] The satellite data encryption method proposed in this application proposes a satellite-ground collaborative access control system architecture based on high-orbit satellites, low-orbit satellites, a ground control center, and user terminals. The ground control center serves as the primary key generation node; high-orbit satellites serve as auxiliary nodes for managing keys and distributing keys to low-orbit satellites and user terminals; low-orbit satellites serve as execution nodes for encrypting and storing onboard data; and user terminals serve as execution nodes for requesting keys and decrypting data.

[0069] To better illustrate the satellite data encryption method for satellite-ground collaboration proposed in this application embodiment, a specific interactive process is described below. The GEO establishes a first communication link with the Ground Operations Control Center (GOCC) and receives key materials sent by the GOCC. These key materials at least contain a master key generated by the GOCC. Based on the key materials and the satellite identifier of the target low-Earth orbit (LEO) satellite within the coverage area, a subkey K_enc dedicated to the target LEO is generated through a key derivation function. The K_enc is distributed to the target LEO via an inter-satellite security link, enabling the target LEO to use the K_enc to encrypt and store its onboard data. An access request is received from a user terminal (UE), which at least contains the UE's identity credentials. The identity credentials are verified, and upon successful verification, the K_enc is distributed to the UE, enabling the UE to decrypt the encrypted onboard data returned by the target LEO after establishing a connection with it. If verification fails, the distribution of the K_enc to the UE is refused.

[0070] The aforementioned satellite data encryption method for satellite-ground collaboration, based on the satellite-ground collaborative access control operation execution process involving high-orbit satellites, low-orbit satellites, ground control centers, and user terminals, includes four stages:

[0071] a. Key generation and pre-distribution between the ground control center and the high-orbit satellite;

[0072] b. Inter-satellite key distribution phase between high-orbit and low-orbit satellites;

[0073] c. The authentication and key transmission phase between the high-orbit satellite and the user terminal;

[0074] d. The continuous encryption, access, and decryption of data between low-orbit satellites and user terminals.

[0075] In practical application scenarios, the distributed architecture of satellite data access systems, such as Figure 5 As shown, it consists of three parts: space segment, ground segment, and user segment.

[0076] The space segment is a hybrid constellation network composed of low-Earth orbit (LEO) and high-Earth orbit (HEO) satellites. LEO satellite nodes are responsible for user data collection, encryption, and storage, while HEO satellite nodes are responsible for storing keys, enforcing access control policies, and authenticating user identities.

[0077] The ground segment consists of a ground operations control center and an authentication center. The ground operations control center is responsible for establishing communication and data transmission links with the high-orbit satellite, while the authentication center and the authentication module on the high-orbit satellite work together to centrally manage user identities.

[0078] The user segment includes various authorized user terminals equipped with security modules, used to initiate authentication requests to high-orbit satellites, securely receive keys, and perform data decryption.

[0079] In the case where the user terminal is the execution entity, this application embodiment also provides a satellite data access method, including: sending an access request to a high-orbit satellite GEO; if the access request is verified, receiving a subkey sent by the GEO and establishing a communication connection with a low-orbit satellite LEO, wherein the subkey is generated by the GEO based on key materials sent by the ground operation control center; receiving encrypted satellite data sent by the LEO and decrypting the encrypted satellite data using the subkey to obtain decrypted satellite data, wherein the encrypted satellite data is obtained by the LEO encrypting the satellite data using the subkey received from the GEO.

[0080] The aforementioned satellite data access method involves receiving key materials sent by a ground operations control center, wherein the key materials contain at least a master key generated by the ground operations control center; generating subkeys based on the key materials, and distributing the subkeys to low-Earth orbit (LEO) satellites operating within the coverage area of ​​a high-Earth orbit (GEO) satellite and to user terminals. The subkeys are used by the user terminals to decrypt encrypted satellite data in the LEO satellites. By generating keys from the ground control center and pre-distributing keys to high-Earth orbit satellites, distributing keys from high-Earth orbit satellites to low-Earth orbit satellites for data encryption and storage, and distributing keys to authorized terminals for access control, the method enhances satellite communication security and solves the technical problem of low satellite communication security in related technologies.

[0081] In the case where LEO is the executing entity, this application embodiment also provides a satellite data encryption method for satellite-ground collaboration, including: receiving a subkey sent by a high-orbit satellite GEO, wherein the subkey is generated by the GEO based on key materials sent by a ground operation control center; encrypting satellite data using the subkey to obtain encrypted satellite data; and sending the encrypted satellite data to the user terminal in response to a data request from a user terminal authorized by the GEO, wherein the encrypted satellite data is used by the user terminal to decrypt the encrypted satellite data using the subkey, and the subkey in the user terminal is sent by the GEO.

[0082] The aforementioned satellite data encryption method for satellite-ground collaboration employs receiving key materials sent by a ground operations control center. These key materials include at least a master key generated by the ground operations control center. Subkeys are generated based on these key materials and distributed to low-Earth orbit (LEO) satellites operating within the coverage area of ​​a high-Earth orbit (GEO) satellite and to user terminals. The subkeys are used by the user terminals to decrypt encrypted satellite data in the LEO satellites. By generating keys from the ground control center and pre-distributing keys to high-Earth orbit satellites, distributing keys from high-Earth orbit satellites to low-Earth orbit satellites for data encryption and storage, and distributing keys to authorized terminals for access control, the method enhances satellite communication security and solves the technical problem of low satellite communication security in related technologies.

[0083] Figure 6 A satellite data encryption device for satellite-to-ground collaboration is shown, the device comprising:

[0084] The receiving module 60 is used to receive key materials sent by the ground operations control center, wherein the key materials contain at least the master key generated by the ground operations control center;

[0085] The distribution module 62 is used to generate a subkey based on the key material and distribute the subkey to the low-orbit satellite LEO and user terminals operating within the coverage area of ​​the high-orbit satellite GEO. The subkey is used by the user terminal to decrypt the encrypted satellite data in the LEO.

[0086] The aforementioned satellite data encryption device for satellite-ground collaboration employs a method of receiving key materials sent by a ground operations control center. These key materials include at least a master key generated by the ground operations control center. Subkeys are generated based on these key materials and distributed to low-Earth orbit (LEO) satellites operating within the coverage area of ​​a high-Earth orbit (GEO) satellite and to user terminals. The subkeys are used by the user terminals to decrypt encrypted satellite data in the LEO satellites. By generating keys from the ground control center and pre-distributing keys to high-Earth orbit satellites, distributing keys from high-Earth orbit satellites to low-Earth orbit satellites for data encryption and storage, and distributing keys to authorized terminals for access control, the device enhances satellite communication security and solves the technical problem of low satellite communication security in related technologies.

[0087] The distribution module 62 includes a distribution submodule for distributing keys to low-Earth orbit (LEO) satellites operating within the coverage area of ​​the high-Earth orbit (GEO) satellite, including: establishing a communication connection with the LEO satellite within the coverage area of ​​the GEO satellite; and sending the subkey to the LEO satellite, wherein the subkey is used by the LEO satellite to encrypt the satellite data.

[0088] The satellite data encryption device for satellite-ground collaboration also includes: a receiving submodule, used to receive the access request from the user terminal, wherein the access request includes at least: the identity credentials of the user terminal; and, if the identity credentials and permissions of the user terminal are verified, to send the subkey to the user terminal.

[0089] The receiving submodule includes a sending unit, which is used to send the notification message to the user terminal when the user terminal's identity credentials and permissions fail to be verified, wherein the notification message is used to indicate that the user terminal does not have the right to access the satellite data in the LEO.

[0090] The transmitting unit includes a transmitting subunit, which, after authentication, sends an indication message to the user terminal, wherein the indication message indicates that the user terminal is allowed to establish a communication connection with the LEO, and wherein, after receiving the subkey, the user terminal establishes a communication connection with the LEO and receives encrypted satellite data sent by the LEO.

[0091] The aforementioned satellite data encryption device for space-ground collaboration further includes: receiving the updated master key from the ground operation control center when the master key is updated; generating an updated subkey based on the updated master key; and sending the updated subkey to the LEO, wherein the updated subkey is used to replace the original subkey.

[0092] It should be noted that, Figure 6 The satellite data encryption device shown is used to perform satellite-to-ground coordination. Figure 2 The satellite data encryption method shown is a satellite-ground coordinated method. Therefore, the relevant explanations and descriptions in the above-mentioned satellite data encryption method, except for the satellite-ground coordinated method, also apply to the network behavior tracing device for this anonymous network traffic, and will not be repeated here.

[0093] This application also provides a communication device, including: a memory and a processor, wherein the memory is used to store program instructions; and the processor, connected to the memory, is used to execute the above-described satellite data encryption method for satellite-ground collaboration.

[0094] This application also provides a computer program product, including computer instructions that, when executed by a processor, implement the steps of the satellite data encryption method for satellite-ground collaboration in this application.

[0095] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0096] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0097] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0098] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0099] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0100] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0101] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A satellite data encryption method based on satellite-ground cooperation, applied to a geostationary satellite GEO, characterized in that, include: Receive key materials sent by the ground operations control center, wherein the key materials contain at least the master key generated by the ground operations control center; A key derivation function is used to generate a subkey based on the key material and the satellite identifier of the LEO satellite operating within the coverage area of ​​the GEO, and the subkey is distributed to the LEO and the user terminal. The subkey is used by the user terminal to decrypt the encrypted satellite data in the LEO.

2. The method according to claim 1, characterized in that, Distributing keys to LEO satellites operating within the coverage area of ​​GEO satellites, including: Establish a communication connection with the LEO within the coverage area of ​​the GEO; The subkey is sent to the LEO, wherein the subkey is used by the LEO to encrypt the satellite data.

3. The method according to claim 1, characterized in that, The method further includes: Receive the access request from the user terminal, wherein the access request includes at least: the identity credentials of the user terminal; If the user terminal's identity credentials and permissions are verified, the subkey is sent to the user terminal.

4. The method according to claim 3, characterized in that, The method further includes: If the user terminal's identity credentials and permissions fail to be verified, a notification message is sent to the user terminal, wherein the notification message is used to indicate that the user terminal does not have permission to access satellite data in the LEO.

5. The method according to claim 4, characterized in that, After the user terminal is verified, the method further includes: The user terminal is sent an instruction message, wherein the instruction message is used to indicate that the user terminal is allowed to establish a communication connection with the LEO, wherein after receiving the subkey, the user terminal establishes a communication connection with the LEO and receives encrypted satellite data sent by the LEO.

6. The method according to claim 1, characterized in that, The method further includes: If the master key is updated at the ground operations control center, the updated master key is received from the ground operations control center. Generate an updated subkey based on the updated master key; The updated subkey is sent to the LEO, and the updated subkey is used to replace the original subkey.

7. A satellite data access method for space-ground collaboration, characterized in that, include: Send an access request to the high-orbit satellite GEO; If the access request is verified, the subkey sent by the GEO is received, and a communication connection is established with the LEO satellite. The subkey is generated by the GEO based on key materials sent by the ground operations control center. The LEO receives encrypted satellite data sent by the GEO and decrypts the encrypted satellite data using the subkey to obtain decrypted satellite data. The encrypted satellite data is obtained by encrypting satellite data with the subkey received by the LEO from the GEO.

8. A satellite data encryption method for space-ground collaboration, characterized in that, include: Receive a subkey sent by a high-orbit satellite GEO, wherein the subkey is generated using a key derivation function based on key material and the satellite identifier of a low-orbit satellite LEO operating within the coverage area of ​​the GEO; The satellite data is encrypted using the subkey to obtain encrypted satellite data; In response to a user terminal's data request authorized by the GEO, the encrypted satellite data is sent to the user terminal, wherein the encrypted satellite data is used by the user terminal to decrypt the encrypted satellite data using the subkey, and the subkey in the user terminal is sent by the GEO.

9. A satellite data access system with space-ground coordination, characterized in that, include: High-orbit satellites, low-orbit satellites, ground operations and control centers, and user terminals; The high-orbit satellite is used to receive key materials sent by the ground operation control center, wherein the key materials contain at least a master key generated by the ground operation control center; a key derivation function is used to generate a subkey based on the key materials and the satellite identifier of the LEO operating within the GEO coverage area, and the subkey is distributed to the LEO and the user terminal, wherein the subkey is used by the user terminal to decrypt encrypted satellite data in the LEO; The low-orbit satellite is used to send encrypted satellite data to the user terminal; The ground operations control center is used to generate the key material; The user terminal is used to decrypt the encrypted satellite data.

10. A communication device, characterized in that, include: A memory and a processor, wherein the memory is used to store program instructions; The processor, connected to the memory, is used to execute the satellite data encryption method for satellite-ground collaboration as described in any one of claims 1 to 6.

Images