Space optical and microwave integrated network multi-level security protection system

Abstract

The application discloses a space light and microwave composite network integrated multi-level security protection system, and relates to the technical field of satellite laser communication network systems.The system security and privacy integrated architecture comprises the following steps: a spaceborne integrated encryption device receives data frames from a space light link or a microwave link, identifies a logical subnet type, and calls a corresponding encryption system for encryption and decryption; when a user terminal is initially connected to a network, a home gateway station verifies the legality of the terminal and issues a time-limited token, which is distributed to a service gateway station and the user terminal through two channels; the service gateway station verifies the token, performs bidirectional authentication with the satellite, and negotiates a session key; the user terminal negotiates an independent symmetric key with the satellite to complete communication and inter-satellite security switching; when the service gateway station is switched, the independent symmetric key remains unchanged, and a new station reestablishes satellite-ground trust through the token and updates the session key.

Description

Technical Field

[0001] This invention relates to an integrated multi-level security protection system for space optical and microwave composite networks, belonging to the technical field of satellite laser communication network systems. Background Technology

[0002] With the development of satellite laser communication technology, space information networks are evolving from single microwave communication to optical / microwave hybrid transmission modes. Laser links have the advantages of large bandwidth and strong anti-interference capabilities, while microwave links have the characteristics of good penetration and high compatibility with existing ground stations. The complementary coexistence of the two has become an important development direction for the next generation of space networks.

[0003] Currently, the security protection of space networks mainly faces the following status quo and shortcomings:

[0004] First, existing satellite communication systems mostly adopt a single security control system, without logical isolation for different types of users (civilian, commercial, overseas, etc.), resulting in user data being transmitted in the same encrypted channel, which poses risks of lateral penetration and side channel leakage.

[0005] Second, the high-speed movement of low-orbit satellites leads to frequent switching of satellite-to-ground connections. The existing authentication mechanism requires the re-execution of the complete key negotiation process each time a connection is reconnected, resulting in high handshake overhead and affecting communication continuity.

[0006] Third, existing solutions mostly use independent authentication mechanisms for different stages such as terminal network access, satellite access, and inter-satellite networking, lacking an integrated authentication framework that covers the entire process, making it difficult to smoothly connect the trust relationships between each stage.

[0007] Fourth, the computing resources and power consumption of spaceborne equipment are limited, and the existing strong authentication protocols (such as public key infrastructure systems) have too high computational complexity, making them difficult to deploy efficiently on satellite platforms.

[0008] To address the aforementioned issues, some studies have proposed satellite-to-ground access schemes based on pre-shared keys, satellite-to-ground authentication schemes based on Kerberos tokens, and logical isolation schemes based on the concept of 5G network slicing. However, these schemes only solve the security problems of a single link and fail to provide a unified integrated design for security requirements such as terminal access, satellite-to-ground authentication, inter-satellite networking, multi-user subnet isolation, and seamless handover across gateway stations in an optical / microwave hybrid transmission environment. Summary of the Invention

[0009] To address the issue of how to achieve integrated security protection for multiple user subnets in a space optical and microwave composite network, this invention provides an integrated multi-level security protection system for space optical and microwave composite networks.

[0010] The present invention provides an integrated multi-level security protection system for a space optical and microwave composite network, comprising:

[0011] The system security and confidentiality integrated architecture is divided into a control layer, a network layer, and a user layer according to management authority. The control layer divides the system into multiple logical subnets, the network layer registers and authenticates user terminals, and the user layer includes various types of user terminals.

[0012] The spaceborne integrated cryptographic device, deployed on a satellite, is used to receive data frames from a space optical link or microwave link, identify the logical subnet type to which the data frame belongs, and call the corresponding cryptographic system to encrypt and decrypt the data frame according to the logical subnet type.

[0013] The home gateway station, deployed on the ground, stores the long-term authentication key of the user terminal. It is used to verify the legitimacy of the user terminal when the user terminal initially joins the network, generate a time-limited token, and distribute the time-limited token to the user terminal through the satellite-to-ground encrypted link and to the service gateway station through the ground secure channel.

[0014] The user terminal is deployed on the user side and holds the time-limited token issued by the home gateway station. When initiating access authentication to the serving gateway station, it actively presents the time-limited token and negotiates and shares an independent symmetric key with the currently accessed satellite after being verified by the serving gateway station. It then completes subsequent communication and inter-satellite secure handover through the independent symmetric key.

[0015] The service gateway station, deployed on the ground, is used to receive and verify the time-limited token presented by the user terminal. After successful verification, the service gateway station and the satellite use the management key to complete two-way authentication and negotiate the session key. The service gateway station sends an authentication confirmation command to the currently accessed satellite through the satellite-to-ground link and maintains the session key with the satellite for secure transmission of management information.

[0016] When the service gateway station is switched, the independent symmetric key shared between the terminal and the currently accessed satellite remains unchanged. The new service gateway station rebuilds the trust relationship with the satellite through a token method and renegotiates and updates the session key with the satellite.

[0017] Preferably, when a service gateway station is switched, the old service gateway station encrypts and migrates the user terminal trust credentials to the new service gateway station via the terrestrial network; after receiving and decrypting the user terminal trust credentials, the new service gateway station takes over the authentication service for the user terminal.

[0018] Preferably, the authentication between the user terminal and the satellite includes:

[0019] Before a user terminal joins the network, it receives broadcast information encrypted with a satellite-to-ground broadcast key. After the legality verification is passed, the broadcast information is decrypted.

[0020] After a user terminal joins the network, it shares an independent symmetric key with the access satellite and uses the independent symmetric key for two-way authentication of communication and secure inter-satellite handover.

[0021] The satellite-to-ground broadcast key is a network-wide consistent broadcast key used for pre-screening of the legitimacy of user terminals before they join the network; the independent symmetric key is generated by negotiation between the user terminal and the access satellite after successful network access and is used for two-way authentication and secure inter-satellite handover after network access.

[0022] Preferably, the control layer deploys a primary operation and control center, responsible for satellite platform telemetry and control, system satellite resources and channel resource planning and management, and divides the system into multiple logical subnets, with logical isolation between each logical subnet; the network layer deploys a secondary operation and control center, mainly consisting of an integrated gateway station and various access gateway stations, responsible for the management and allocation of their respective network resources, and undertaking the registration and network access authentication of user terminals; the user layer includes various types of user terminals, responsible for user terminal network access authentication and end-to-end secure communication.

[0023] Preferably, the two-way authentication between the satellite and the service gateway includes:

[0024] The satellite and the service gateway station use a management key for two-way authentication and negotiate a session key during the authentication process. The session key is used for encryption, decryption, authentication, and anti-replay protection of management information between the service gateway station and the satellite.

[0025] When a change in the position of a low-Earth orbit satellite causes the service gateway to reconnect, the trust relationship between the satellite and the service gateway is re-established using a token mechanism.

[0026] Preferably, the system further includes:

[0027] Medium- and high-orbit satellites and low-orbit satellites use a pre-set inter-satellite shared root key for bidirectional authentication. After successful authentication, an inter-satellite temporary session key is derived based on a random number. The inter-satellite temporary session key is used for data encryption and anti-replay protection of the inter-satellite link, and the network authentication process does not rely on the participation of ground gateway stations.

[0028] Preferably, the time-limited token includes a user terminal ID, a valid timestamp, and a digital signature of the home gateway station.

[0029] Preferably, once the time-limited token has expired based on the valid timestamp, the user terminal needs to reapply for renewal through the home gateway.

[0030] Preferably, the logical subnet types include civilian subnets, commercial subnets, and overseas subnets; the spaceborne integrated cryptographic device identifies the logical subnet type based on the logical subnet identifier carried in the data frame header.

[0031] Preferably, the user terminals in the user layer are divided into civilian terminals, commercial terminals and overseas terminals according to their business attributes. The civilian terminals include government terminals and financial terminals. Each type of terminal operates its own corresponding security and confidentiality system and is subject to the security management of the logical subnet in which it is located.

[0032] The beneficial effects of this invention are as follows: This invention divides the system into multiple logical subnets through a control layer. Each logical subnet employs an independent cryptographic system. The onboard integrated cryptographic device identifies the subnet type in real time based on the logical subnet identifier carried in the data frame header and calls the corresponding cryptographic algorithm for encryption and decryption. Data from civilian, commercial, and overseas subnets are logically and cryptographically isolated on the same onboard hardware platform. A key leak in any subnet will not affect the data security of other subnets, fundamentally solving the risks of lateral penetration and side-channel leakage when multiple users share a satellite communication system. This invention sets up a pre-authentication stage before user terminals join the network. The satellite uses a consistent satellite-to-ground broadcast key to encrypt broadcast information. Legitimate terminals can decrypt the information, while illegitimate terminals are blocked during the pre-authentication stage. This mechanism filters out a large number of illegal access requests without requiring a complete authentication process, avoiding the consumption of computing resources and satellite-to-ground link bandwidth by massive authentication requests initiated by illegal terminals. This solves the problem of large-scale access protection under conditions of limited computing power onboard equipment. In this invention, after successful network access, the user terminal and the currently accessed satellite negotiate and share an independent symmetric key. This key remains unchanged during inter-satellite handover. When the user terminal switches to a new accessed satellite, it directly uses this key to complete mutual authentication without needing to return to the ground gateway station for re-authentication or to re-execute the complete two-way authentication and key negotiation process. This mechanism significantly reduces the authentication latency during inter-satellite handover and supports continuous communication for user terminals in high-speed motion scenarios of low-Earth orbit satellite constellations. This invention designs the secure channel between the user terminal and the satellite and the secure channel between the satellite and the gateway station as two independent layers. When the serving gateway station switches, the independent symmetric key between the user terminal and the currently accessed satellite remains unchanged; only the new serving gateway station re-negotiates the session key with the satellite. The old serving gateway station encrypts and migrates the user terminal's trust credentials to the new serving gateway station via the terrestrial network, and the new serving gateway station takes over the authentication service. This mechanism eliminates the need for any cryptographic operations on the terminal side during gateway station handover, resulting in extremely short communication interruption time and achieving seamless handover of serving gateway stations. Attached Figure Description

[0033] Figure 1 This is a schematic diagram illustrating the principle of the integrated security and confidentiality architecture of the system in this application;

[0034] Figure 2 is a schematic diagram of the multi-level security protection system of this application. Detailed Implementation

[0035] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0036] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other.

[0037] The present invention will be further described below with reference to the accompanying drawings and specific embodiments, but this is not intended to limit the scope of the invention.

[0038] This embodiment provides an integrated multi-level security protection system for space optical and microwave composite networks. This system is built upon an integrated system security and confidentiality architecture, such as... Figure 1 As shown, the architecture is divided into three levels according to management authority: control layer, network layer, and user layer. The core working principle of this implementation system is as follows: independent management of multiple user resources is achieved through three-level permission isolation; onboard integrated cryptographic equipment is deployed to provide differentiated cryptographic services for data frames in the space optical link and microwave link based on their logical subnet type; user terminal authentication is achieved by issuing timed tokens through the home gateway station; a security protection system covering the entire process of terminal network access, satellite access, and inter-satellite networking is constructed through independent symmetric key negotiation between the user terminal and the satellite, and bidirectional authentication and session key negotiation between the satellite and the serving gateway station; when the serving gateway station switches, seamless switching is achieved by keeping the independent symmetric key between the user terminal and the satellite unchanged and only updating the session key between the satellite and the serving gateway station. The integrated multi-level security protection system for the space optical and microwave composite network in this implementation specifically includes:

[0039] Integrated system security and confidentiality architecture: deployed in three levels: control layer, network layer, and user layer.

[0040] The control layer is deployed on the ground, with a primary control center. This primary control center, managed by the system's overall control organization, is responsible for the telemetry, tracking, and command (TT&C) of all satellite platforms within the system, as well as the planning and management of system satellite and channel resources. The primary control center sends TT&C commands to the satellites through ground-based TT&C stations and receives telemetry data transmitted back from the satellites. The control layer divides the entire system into multiple logical subnets to support different usage modes, including civilian, commercial, and overseas applications. Logical isolation between these subnets is achieved through independent subnet identifiers. Resource allocation and user access management for different subnets are handled separately by the civilian, commercial, and overseas control centers, respectively. The control layer's security and confidentiality functions include encryption protection for TT&C information and payload control information, implemented in conjunction with ground-deployed TT&C cryptographic equipment and payload control cryptographic equipment.

[0041] The network layer is deployed on the ground, with a secondary operation and control center. The secondary operation and control center, primarily composed of a comprehensive gateway station and various access gateway stations, is responsible for the management and allocation of their respective network resources, and handles the registration and network access authentication functions for civilian, commercial, and overseas user terminals. The comprehensive gateway station is equipped with authentication servers, cryptographic resource management equipment, and channel cryptographic equipment. User terminal registration information, long-term authentication keys, and other information are stored in the authentication server of their respective gateway station.

[0042] The user layer includes various types of user terminals. Each user terminal has a built-in terminal cryptography device used to perform cryptographic operations during the network access authentication process and for end-to-end secure communication.

[0043] Spaceborne integrated cryptographic equipment: Deployed inside the satellite platform, it is connected to the satellite's integrated electronic unit, storage conversion unit, and network switching unit via a CAN bus.

[0044] The spaceborne integrated cryptographic equipment has data frame identification and encryption / decryption processing capabilities. The satellite receives microwave link data frames from ground-based microwave gateway stations via a satellite-to-ground microwave antenna, or space optical link data frames from ground-based laser terminals via a satellite-to-ground laser terminal, or space optical link data frames from other satellites via an inter-satellite laser terminal. After processing by the corresponding front-end equipment, these data frames are sent to the spaceborne integrated cryptographic equipment via the CAN bus.

[0045] After receiving a data frame, the spaceborne integrated cryptographic device first reads the logical subnet identifier field in the data frame header. This logical subnet identifier is written by the network layer device at the sending end according to the subnet type when the data frame is generated. Logical subnet types include civilian subnets, commercial subnets, and overseas subnets, with corresponding logical subnet identifiers set to, for example, 0x01, 0x02, and 0x03, respectively. The spaceborne integrated cryptographic device determines the logical subnet type of the current data frame based on this identifier. After determination, the spaceborne integrated cryptographic device uses the cryptographic scheme corresponding to the logical subnet type to encrypt and decrypt the data frame. Different logical subnet types correspond to different cryptographic algorithms and key materials. Specifically, civilian subnets use civilian cryptographic algorithms and keys, commercial subnets use commercial cryptographic algorithms and keys, and overseas subnets use cryptographic algorithms and keys applicable overseas. Each cryptographic scheme is independent and not interchangeable.

[0046] During encryption and decryption, the onboard integrated cryptographic equipment performs decryption or encryption operations according to the transmission direction of the data frame. When the satellite receives an encrypted uplink data frame from an external link, such as service data or telemetry and control data sent from a ground user to the satellite, the onboard integrated cryptographic equipment decrypts the data frame using a cryptographic scheme corresponding to the current subnet type. The decrypted plaintext data frame is then provided to the onboard service processing unit, including the integrated electronic unit, storage and conversion unit, or network switching unit, via the CAN bus. When the onboard service processing unit generates a downlink data frame to be sent to an external link, the onboard service processing unit sends the plaintext data frame to the onboard integrated cryptographic equipment via the CAN bus. The onboard integrated cryptographic equipment encrypts the data frame using a cryptographic scheme corresponding to the current subnet type. The encrypted data frame is then sent out through the corresponding physical interface according to the target link type: if the target link is a satellite-to-ground microwave link, the encrypted data frame is sent to the ground microwave gateway station via the microwave antenna; if the target link is a satellite-to-ground space optical link, the encrypted data frame is sent to the ground laser terminal via the satellite-to-ground laser terminal; if the target link is an inter-satellite space optical link, the encrypted data frame is sent to other satellites via the inter-satellite laser terminal.

[0047] The hierarchical access authentication system comprises three levels: user terminal network access authentication, low-Earth orbit (LEO) satellite network access authentication, and medium-to-high-Earth orbit (MEO) satellite network access authentication. Specifically, user terminal network access authentication consists of two-way authentication between the user terminal and the satellite, as well as identity authentication between the user terminal and the serving gateway station; LEO satellite network access authentication is achieved through two-way authentication between the satellite and the serving gateway station; and MEO satellite network access authentication is achieved through two-way inter-satellite network authentication.

[0048] When a user terminal first joins the network, it needs to complete identity authentication based on a time-limited token through the serving gateway and the home gateway. The specific implementation method is as follows.

[0049] The home gateway is deployed on the ground, and its authentication server pre-stores long-term authentication keys for registered user terminals. These long-term authentication keys are either symmetric or asymmetric key pairs that are written into the terminal's cryptographic device during terminal registration and simultaneously stored at the home gateway.

[0050] When a user terminal needs to initially join the network, it sends a network access authentication request to the serving gateway station in its current area via a satellite-to-ground microwave link or a satellite-to-ground space optical link. This request includes the user terminal ID and the home gateway station identifier. Upon receiving the network access authentication request, the serving gateway station forwards the request to the user terminal's home gateway station via the terrestrial network based on the home gateway station identifier.

[0051] After receiving the network access authentication request forwarded by the serving gateway, the home gateway retrieves the long-term authentication key of the user terminal from its database based on the user terminal ID. It then uses this key to verify the legitimacy of the user terminal's identity: either the user terminal includes a digital signature generated using its private key in the network access request, which the home gateway verifies using the user terminal's public key; or the user terminal includes an authentication code generated based on a shared symmetric key in the network access request, which the home gateway verifies using the same shared symmetric key. If the verification is successful, the user terminal is confirmed as a legitimate registered terminal.

[0052] After the home gateway verifies the legitimacy of the user terminal, it generates a timed token. This timed token contains the user terminal ID, a valid timestamp, and the home gateway's digital signature. The home gateway uses its private key to digitally sign the user terminal ID and the valid timestamp, and the user terminal ID, valid timestamp, and digital signature together form the content of the timed token.

[0053] After the home gateway station generates a time-limited token, it distributes the token through two channels: one is through a secure terrestrial channel (such as a terrestrial fiber optic leased network, protected by IPSec or SSL security protocols) to the serving gateway station; the other is through a satellite-to-ground encrypted link, transmitting the token via encrypted satellite-to-ground transmission to the satellite currently connected to the user terminal, which then forwards it to the user terminal. The user terminal receives the time-limited token encrypted via the satellite link and stores it in the secure storage area of ​​the terminal's cryptographic device.

[0054] After storing the time-limited token, the user terminal proactively presents it when initiating access authentication with the serving gateway. The user terminal attaches the full text of the time-limited token to the access authentication request and signs the current timestamp and the hash value of the time-limited token using its private key to prevent replay attacks. Upon receiving the time-limited token from the user terminal, the serving gateway verifies the digital signature of the home gateway in the time-limited token using its public key. If the signature is valid and the current system time is within the time range specified by the valid timestamp, the time-limited token is confirmed to be valid and the user terminal's identity is legitimate.

[0055] The time-limited token has an expiration date, which can be configured to any value between 30 minutes and 24 hours. Once the time-limited token has expired according to the valid timestamp, the user terminal can no longer use it for access authentication. The user terminal needs to reapply for renewal through the home gateway, i.e., re-initiate an identity verification request to the home gateway. After the home gateway re-verifies the legitimacy of the user terminal, it issues a new time-limited token and redistributes it to the user terminal and the service gateway through the aforementioned dual-channel method.

[0056] After the service gateway verifies the timed token presented by the user terminal, the service gateway performs a two-way authentication and session key negotiation process with the satellite, and then sends an authentication confirmation command to the currently accessed satellite through the satellite-to-ground link. This command contains the user terminal ID and authentication result identifier.

[0057] The two-way authentication between the satellite and the gateway station is performed after the gateway station's channel terminal is powered on. The mutual authentication between the satellite and the gateway station is completed according to the satellite-to-ground equipment authentication process, establishing a secure transmission channel for management information between the ground station and the satellite.

[0058] Both the satellite and the gateway station pre-store management keys. These management keys are symmetric keys uniformly distributed by the system control layer when a device joins the network, and are used for initial two-way authentication between the satellite and the gateway station. When a satellite needs to establish a management connection with a service gateway station, it sends an authentication request to that service gateway station. This request includes the satellite ID and a random number R3. Upon receiving the authentication request, the service gateway station encrypts R3 using the management key and generates a random number R4, sending both encrypted R3 and R4 back to the satellite. The satellite decrypts R3 using the management key, verifies its consistency with its original value, and confirms the service gateway station's legitimacy. The satellite then encrypts R4 using the management key and sends it back to the service gateway station. The service gateway station decrypts and verifies the R4, confirming the satellite's legitimacy. After successful two-way authentication, the satellite and the service gateway station generate a session key based on R3 and R4 using a key derivation function during the authentication process. This session key is used for encryption, integrity authentication, and replay protection of management information between the service gateway station and the satellite. Subsequent management information transmissions are encrypted using this session key and used for message authentication code calculation. Upon receiving the management information, the recipient uses the same session key for decryption and verification.

[0059] Because the orbital motion of low-Earth orbit (LEO) satellites causes continuous changes in their relative positions with ground gateway stations, LEO satellites frequently need to switch and reconnect with different service gateway stations. When a change in the LEO satellite's position renders the current service gateway station unavailable, the LEO satellite searches for and selects a new service gateway station to initiate a reconnection. During reconnection, the satellite and the new service gateway station rebuild their trust relationship using a token mechanism. Specifically, the satellite holds a satellite-to-ground trust token issued by the previous service gateway station during its connection with that station. This token contains the satellite ID, a valid timestamp, and the previous service gateway station's digital signature. The satellite sends a reconnection request to the new service gateway station, attaching the satellite-to-ground trust token to the request. The new service gateway station uses the previous service gateway station's public key to verify the validity of the token signature. If the verification is successful, it confirms that the satellite has previously been legally authenticated, and the new service gateway station directly negotiates a new session key with the satellite using its management key. This token is different from the time-limited token held by the user terminal; the two differ in their holder, issuing entity, and purpose.

[0060] The authentication between the user terminal and the satellite includes a pre-authentication stage before the terminal enters the network and a two-way authentication stage after the terminal enters the network.

[0061] During the pre-authentication phase before a terminal joins the network, the satellite periodically transmits broadcast information encrypted with a network-wide consistent satellite-to-ground broadcast key via the satellite-to-ground broadcast channel. This satellite-to-ground broadcast key is a symmetric key shared by all legitimate user terminals and the satellite, and is pre-written into the terminal cryptographic devices of each legitimate user terminal and the onboard integrated cryptographic device of each satellite. After a user terminal is powered on, it first searches for the satellite broadcast signal and receives the satellite-to-ground broadcast information. The user terminal then attempts to decrypt the received broadcast information using the satellite-to-ground broadcast key stored in its terminal cryptographic device. Only user terminals holding a legitimate key can successfully decrypt the broadcast information; unauthorized terminals, lacking the satellite-to-ground broadcast key, are unable to decrypt the information and are blocked during the network access pre-authentication phase.

[0062] During the two-way authentication phase after the terminal joins the network, after the user terminal verifies the timed token through the serving gateway, the serving gateway sends an authentication confirmation command to the currently accessed satellite via the satellite-to-ground link. The currently accessed satellite confirms that the user terminal has completed ground identity authentication based on this command. Subsequently, the user terminal and the currently accessed satellite perform a two-way authentication and key negotiation process. The user terminal generates a random number R1, encrypts R1 using a preset satellite-to-ground shared root key, and sends it to the currently accessed satellite. The currently accessed satellite decrypts R1 using the same satellite-to-ground shared root key, generates a random number R2, encrypts R1 and R2 using the satellite-to-ground shared root key, and sends them back to the user terminal. After decryption, the user terminal verifies that R1 matches its original value, confirming the satellite's legitimacy, and simultaneously encrypts R2 using the satellite-to-ground shared root key and sends it back to the satellite. The satellite decrypts and verifies that R2 matches its original value, confirming the user terminal's legitimacy. After successful verification by both parties, an independent symmetric key is derived based on the XOR value of R1 and R2. This independent symmetric key is the unique session key for this session.

[0063] Subsequent communications between the user terminal and the currently accessed satellite are protected by this independent symmetric key for encryption and authentication. When the user terminal needs to switch from the currently accessed satellite to another satellite, the independent symmetric key shared between the user terminal and the currently accessed satellite remains unchanged. During the handover process, the inter-satellite secure handover between the user terminal and the newly accessed satellite directly uses this independent symmetric key to complete mutual authentication.

[0064] Two-way authentication between medium- and high-orbit satellites and low-orbit satellites is achieved using a pre-set inter-satellite shared root key.

[0065] Before each satellite is launched into orbit, the control layer injects an inter-satellite shared root key through ground-based security injection equipment. This key is stored in the onboard integrated cryptographic device of each satellite. When a medium-to-high orbit (MTO) satellite needs to establish an inter-satellite link with a low-Earth orbit (LEO) satellite, the LEO satellite sends an inter-satellite networking authentication request to the MTO satellite. This request includes the LEO satellite's satellite ID and its own generated random number R5. Upon receiving the authentication request, the MTO satellite encrypts R5 using the inter-satellite shared root key and generates its own random number R6, sending both the encrypted R5 and R6 back to the LEO satellite. The LEO satellite decrypts R5 using the inter-satellite shared root key, verifies that it matches its original value, and confirms the legitimacy of the MTO satellite. The LEO satellite then encrypts R6 using the inter-satellite shared root key and sends it back to the MTO satellite. The MTO satellite decrypts and verifies R6, confirming the legitimacy of the LEO satellite. After successful verification by both parties, an inter-satellite temporary session key is derived based on R5 and R6 through an XOR operation. The inter-satellite temporary session key is used only for data encryption and replay protection during this inter-satellite link connection. Its validity expires when the inter-satellite link is disconnected, and a new inter-satellite temporary session key is generated the next time the inter-satellite link is established. The entire network authentication process is completed between satellites without the involvement of ground gateway stations.

[0066] When the service gateway changes due to satellite movement or the user terminal's own movement, a service gateway handover procedure is executed.

[0067] During the service gateway switchover, the independent symmetric key already shared between the user terminal and the currently accessed satellite remains unchanged. This independent symmetric key is always bound between the user terminal and the currently accessed satellite and is independent of the ground gateway. The user terminal does not need to renegotiate this independent symmetric key with the satellite due to the service gateway switchover.

[0068] The new service gateway re-establishes the trust relationship with the satellite using a token and renegotiates and updates the session key with the satellite. The specific process is as follows: When a low-Earth orbit satellite leaves the coverage area of ​​the old service gateway due to orbital motion and enters the coverage area of ​​the new service gateway, the satellite uses the aforementioned satellite-to-ground trust token to initiate a reconnection with the new service gateway and re-establish the trust relationship. After the trust is re-established, the satellite and the new service gateway renegotiate and update the session key for the satellite-service gateway segment.

[0069] Simultaneously, the old service gateway station encrypts and migrates the user terminal trust credentials to the new service gateway station via the terrestrial network. The terrestrial network is a terrestrial fiber optic communication network. During the migration, the old service gateway station uses a pre-negotiated inter-site shared key with the new service gateway station to encrypt the trust credentials and sends them to the new service gateway station through a secure terrestrial channel. This trust credential includes a timed token issued by the home gateway station, the user terminal ID, a valid timestamp, and current session state information. Upon receiving the encrypted trust credential, the new service gateway station decrypts it using the same inter-site shared key, verifies its validity, and then takes over the authentication service for the user terminal. Subsequently, when a user terminal initiates a service request to the new service gateway station, the new service gateway station already stores the user terminal's trust credentials and can directly verify the user terminal's identity based on these credentials. The validity period of the timed token between the user terminal and the home gateway station is not affected by the service gateway station switch. If the timed token is still valid after the switch, the user terminal does not need to reapply for a token.

[0070] Logical subnet types include civilian subnets, commercial subnets, and overseas subnets. Data frames from each logical subnet carry a corresponding logical subnet identifier in their frame header.

[0071] User terminals in the user layer are categorized by service attributes into civilian terminals, commercial terminals, and overseas terminals. Civilian terminals include government terminals and financial terminals. Government terminals are used for communication services of government agencies, while financial terminals are used for communication services of financial institutions. Each type of user terminal operates its own corresponding security and confidentiality system. Civilian terminals store civilian cryptographic algorithms and keys in their terminal cryptographic devices and access the civilian subnet; commercial terminals store commercial cryptographic algorithms and keys in their terminal cryptographic devices and access the commercial subnet; overseas terminals store cryptographic algorithms and keys applicable overseas and access the overseas subnet. When accepting security management from their respective logical subnets, each type of user terminal uses the logical subnet identifier as the basis for subnet identification. When a user terminal transmits data to a satellite, the terminal cryptographic device writes the corresponding logical subnet identifier into the data frame generated according to the subnet type to which the terminal belongs, and performs link-layer encryption internally within the terminal cryptographic device. Each logical subnet is logically isolated from others; a user terminal in one subnet cannot decrypt encrypted data from other subnets.

[0072] While the invention has been described herein with reference to specific embodiments, it should be understood that these embodiments are merely examples of the principles and applications of the invention. Therefore, it should be understood that many modifications can be made to the exemplary embodiments, and other arrangements can be designed without departing from the spirit and scope of the invention as defined by the appended claims. It should be understood that different dependent claims and features described herein can be combined in ways different from those described in the original claims. It is also understood that features described in conjunction with individual embodiments can be used in other described embodiments.

Claims

1. A multi-level security protection system integrating spatial optical and microwave composite networks, characterized in that, include: The system's integrated security and confidentiality architecture is divided into a control layer, a network layer, and a user layer based on management permissions. The control layer divides the system into multiple logical subnets, the network layer registers and authenticates user terminals, and the user layer includes various types of user terminals. The spaceborne integrated cryptographic device, deployed on a satellite, is used to receive data frames from a space optical link or microwave link, identify the logical subnet type to which the data frame belongs, and call the corresponding cryptographic system to encrypt and decrypt the data frame according to the logical subnet type. The home gateway station, deployed on the ground, stores the long-term authentication key of the user terminal. It is used to verify the legitimacy of the user terminal when the user terminal initially joins the network, generate a time-limited token, and distribute the time-limited token to the user terminal through the satellite-to-ground encrypted link and to the service gateway station through the ground secure channel. The user terminal is deployed on the user side and holds the time-limited token issued by the home gateway station. When initiating access authentication to the serving gateway station, it actively presents the time-limited token and negotiates and shares an independent symmetric key with the currently accessed satellite after being verified by the serving gateway station. It then completes subsequent communication and inter-satellite secure handover through the independent symmetric key. The service gateway station, deployed on the ground, is used to receive and verify the time-limited token presented by the user terminal. After successful verification, the service gateway station and the satellite use the management key to complete two-way authentication and negotiate the session key. The service gateway station sends an authentication confirmation command to the currently accessed satellite through the satellite-to-ground link and maintains the session key with the satellite for secure transmission of management information. When the service gateway station is switched, the independent symmetric key shared between the terminal and the currently accessed satellite remains unchanged. The new service gateway station rebuilds the trust relationship with the satellite through a token method and renegotiates and updates the session key with the satellite.

2. The integrated multi-level security protection system for space optical and microwave composite networks according to claim 1, characterized in that, When a service gateway station is switched, the old service gateway station encrypts and migrates the user terminal trust credentials to the new service gateway station via the terrestrial network; after receiving and decrypting the user terminal trust credentials, the new service gateway station takes over the authentication service for the user terminal.

3. The integrated multi-level security protection system for space optical and microwave composite networks according to claim 1, characterized in that, The authentication between the user terminal and the satellite includes: Before a user terminal joins the network, it receives broadcast information encrypted with a satellite-to-ground broadcast key. After the legality verification is passed, the broadcast information is decrypted. After a user terminal joins the network, it shares an independent symmetric key with the access satellite and uses the independent symmetric key for two-way authentication of communication and secure inter-satellite handover. The satellite-to-ground broadcast key is a network-wide consistent broadcast key used for pre-screening of the legitimacy of user terminals before they join the network; the independent symmetric key is generated by negotiation between the user terminal and the access satellite after successful network access and is used for two-way authentication and secure inter-satellite handover after network access.

4. The integrated multi-level security protection system for space optical and microwave composite networks according to claim 1, characterized in that, The control layer deploys a primary operation and control center, responsible for satellite platform telemetry and control, system satellite resources and channel resource planning and management, and divides the system into multiple logical subnets, with logical isolation between each subnet; the network layer deploys a secondary operation and control center, mainly consisting of an integrated gateway station and various access gateway stations, responsible for the management and allocation of their respective network resources, and undertaking user terminal registration and network access authentication; the user layer includes various types of user terminals, responsible for user terminal network access authentication and end-to-end secure communication.

5. The integrated multi-level security protection system for space optical and microwave composite networks according to claim 1, characterized in that, The two-way authentication between the satellite and the service gateway includes: The satellite and the service gateway station use a management key for two-way authentication and negotiate a session key during the authentication process. The session key is used for encryption, decryption, authentication, and anti-replay protection of management information between the service gateway station and the satellite. When a change in the position of a low-Earth orbit satellite causes the service gateway to reconnect, the trust relationship between the satellite and the service gateway is re-established using a token mechanism.

6. The integrated multi-level security protection system for space optical and microwave composite networks according to claim 1, characterized in that, The system also includes: Medium- and high-orbit satellites and low-orbit satellites use a pre-set inter-satellite shared root key for bidirectional authentication. After successful authentication, an inter-satellite temporary session key is derived based on a random number. The inter-satellite temporary session key is used for data encryption and anti-replay protection of the inter-satellite link, and the network authentication process does not rely on the participation of ground gateway stations.

7. The integrated multi-level security protection system for space optical and microwave composite networks according to claim 1, characterized in that, The time-limited token includes the user terminal ID, a valid timestamp, and the digital signature of the originating gateway.

8. The integrated multi-level security protection system for space optical and microwave composite networks according to claim 7, characterized in that, Once the time-limited token expires based on the valid timestamp, the user terminal needs to reapply for renewal through the home gateway.

9. The integrated multi-level security protection system for space optical and microwave composite networks according to claim 1, characterized in that, The logical subnet types include civilian subnets, commercial subnets, and overseas subnets; the onboard integrated cryptographic equipment identifies the logical subnet type based on the logical subnet identifier carried in the data frame header.

10. The integrated multi-level security protection system for space optical and microwave composite networks according to claim 9, characterized in that, The user terminals in the user layer are divided into civilian terminals, commercial terminals, and overseas terminals according to their business attributes. The civilian terminals include government terminals and financial terminals. Each type of terminal operates its own corresponding security and confidentiality system and is subject to the security management of the logical subnet in which it is located.

Images