Satellite optical network virtual subnetwork security isolation method

Abstract

This satellite optical network virtual subnet security isolation method, belonging to the field of satellite communication network technology, aims to solve the problems of complex configuration, difficult on-board deployment, lack of dynamic adjustment, and excessive dependence on ground gateway stations in existing satellite optical network virtual subnet isolation schemes. It includes: based on a software-defined networking (SDN) controller, user data packet domains are divided into multiple virtual areas at the data link layer, each assigned a unique Virtual Local Area Network (VLAN) ID; the SDN controller communicates with the onboard software-defined switch via a southbound interface and provides services to the application layer via a northbound interface; the onboard software-defined switch dynamically adds or removes VLAN headers for received user data packets according to rules issued by the SDN controller; user data packets within different virtual subnets are isolated from each other during transmission, and communication between different virtual subnets requires forwarding through a Layer 3 device. This method is used for the secure isolation and dynamic management of multi-user virtual subnets in satellite optical networks.

Description

Technical Field

[0001] This invention relates to a secure isolation method for virtual subnets in satellite optical networks, belonging to the field of satellite communication network technology. Background Technology

[0002] Satellite optical networks utilize inter-satellite laser links to construct a space backbone transmission network, offering significant advantages such as high bandwidth, low latency, and interference resistance, and have become an important component of global broadband communications. In satellite optical networks, it is typically necessary to provide logically isolated network services with corresponding security levels and quality of service to different user groups, such as governments, enterprises, and the military, to ensure that the services of various users can be carried on the same physical space network.

[0003] Currently, typical technologies for constructing logically isolated virtual subnets in satellite communication networks include Virtual Local Area Networks (VLANs) and Virtual Extended Local Area Networks (VXLANs). Among them, VLANs are a natively supported service and a fundamental means of constructing virtual subnets. VLAN-based virtual subnetting technology achieves a virtual workgroup solution by logically, rather than physically, dividing network devices into different network segments. This allows a physical network to be divided into multiple logical virtual subnets, each a separate broadcast domain, with subnets unable to communicate directly with each other. Applying VLAN technology in satellite communication systems allows for the assignment of a unique VLAN ID to each subnet, making each subnet an independent or closed virtual isolated IP network. Existing technologies also propose VLAN-based multi-channel satellite communication ground system design methods, utilizing the isolation and security features of VLAN technology to achieve isolated transmission of multi-channel services.

[0004] However, existing VLAN-based satellite network virtual subnet isolation solutions have the following shortcomings:

[0005] First, traditional VLAN configuration is complex and lacks flexibility. Traditional VLAN technology requires manual configuration on network devices one by one. The creation, modification, and cancellation of virtual subnets all require manual intervention, making it difficult to adapt to the actual needs of dynamic user access and rapid service changes in satellite optical networks.

[0006] Second, limited onboard processing capabilities make large-scale VLAN deployment difficult. Onboard switching and processing equipment in satellite optical networks is severely limited in terms of computing power, storage resources, and power consumption. Traditional VLAN technology has high management overhead in large-scale networks, making it difficult to deploy and operate efficiently in a satellite environment.

[0007] Third, there is a lack of a dynamic subnetting mechanism linked to user identity. Existing VLAN technology typically achieves network isolation based on static configuration, and cannot flexibly adjust the virtual subnetting strategy according to dynamic information such as user identity and service type, making it difficult to meet the differentiated security isolation and service quality needs of different user groups.

[0008] Fourth, the management functions are highly dependent on ground gateway stations. The management and control of existing satellite network virtual subnets usually rely on large ground gateway stations. Once the link between the gateway station and the satellite is interrupted, the management of the virtual subnet will be paralyzed, and the system's resilience and autonomous operation capabilities are insufficient.

[0009] In summary, there is an urgent need for a virtual subnet security isolation method suitable for satellite optical networks that can overcome the problems of complex configuration, difficult satellite deployment, lack of dynamic adjustment mechanism, and high dependence on ground gateway stations in traditional VLAN technology, and achieve flexible, efficient and secure virtual subnet isolation. Summary of the Invention

[0010] The purpose of this invention is to solve the problems of complex configuration, difficult on-board deployment, inability to dynamically adjust, and excessive dependence on ground gateway stations in existing virtual subnet isolation schemes of satellite optical networks, and to provide a secure isolation method for virtual subnets in satellite optical networks.

[0011] The satellite optical network virtual subnet security isolation method of the present invention includes:

[0012] Based on the software-defined networking (SDN) controller, the user data packet domain is divided into multiple virtual areas at the data link layer of the on-board processing and switching equipment, and each virtual area is assigned a unique virtual local area network (VLAN) identifier.

[0013] The SDN controller communicates with the onboard software-defined switch via the southbound interface and provides services to the application layer via the northbound interface.

[0014] The onboard software-defined switch dynamically adds or deletes VLAN headers for received user data packets according to the rules issued by the SDN controller, so as to realize the division and isolation of virtual subnets;

[0015] User data packets within different virtual subnets are isolated from each other during transmission, and communication between different virtual subnets needs to be forwarded through a Layer 3 device.

[0016] Preferably, the southbound interface of the SDN controller communicates with the onboard software-defined switch using the OpenFlow protocol.

[0017] Preferably, the northbound interface of the SDN controller provides a REST API interface for application layer calls.

[0018] Preferably, the SDN controller combines user identity information to formulate dynamic virtual subnetting rules or static virtual subnetting rules.

[0019] Preferably, the virtual area is divided using the IEEE 802.1Q protocol, and the number of VLAN IDs is no more than 4094.

[0020] Preferably, the number of VLAN IDs is controlled to be less than 1000.

[0021] Preferably, it also includes the user access process:

[0022] The onboard network controller sends system broadcast messages to the terminal via downlink carrier.

[0023] The terminal obtains random access resource configuration information by reading the system broadcast message and initiates a random access procedure;

[0024] The onboard network controller allocates dedicated service carriers and time slots to the terminal according to the terminal configuration information, and sends user establishment control messages to the satellite.

[0025] After receiving the user's control establishment message, the satellite receives and sends data according to the configuration, and returns an acknowledgment message to the onboard network controller.

[0026] The onboard network controller sends a random access response to the terminal via the downlink signaling channel, carrying the time and frequency resource information allocated to the terminal, to complete the point-to-point connection between the user terminal and the satellite.

[0027] Preferably, after the user terminal completes the point-to-point connection with the satellite, it establishes a connection with the AAA server located in the ground broadband center on the service carrier through the application layer protocol to carry out the authentication and authorization process.

[0028] Preferably, in the data plane, the user terminal performs protocol processing according to the physical layer, link layer, network layer and transport layer;

[0029] After the satellite completes the reception and demodulation of the user link physical layer signal, it encapsulates the user data using the onboard MPLS protocol and transmits it to the next satellite via the inter-satellite link. The data is then forwarded to the target user terminal or ground gateway station based on label routing.

[0030] Preferably, the network operation security isolation management is centrally controlled by the SDN controller for network topology, network slicing, virtual subnet establishment and QoS management; user access authentication management, security and confidentiality and billing are centrally controlled by the ground control entity.

[0031] Advantages of this invention: Based on SDN architecture, this invention dynamically adds or deletes VLAN headers for user data packets through an onboard software-defined switch, achieving flexible partitioning and secure isolation of virtual subnets, and has the following advantages:

[0032] 1. By centrally managing the establishment and configuration of virtual subnets through the SDN controller, the cumbersome mode of manually configuring VLANs device by device in the traditional way is eliminated, and the complexity of on-board management is reduced.

[0033] 2. Subnetting can be dynamically adjusted based on user identity and business type, improving the flexibility of isolation strategies;

[0034] 3. Management functions can be implemented through low-cost ground terminals, without relying on large ground gateway stations, thus enhancing the system's resilience;

[0035] 4. Different virtual subnets are isolated from each other, and communication between subnets needs to be forwarded through a three-layer device, which effectively enhances network security. Attached Figure Description

[0036] Figure 1 This is a schematic diagram of the subnetting frame format based on the 802.1Q protocol of this invention;

[0037] Figure 2 This is a schematic diagram of the system data flow of the present invention;

[0038] Figure 3 This is a schematic diagram of the terminal network access process of the present invention. Detailed Implementation

[0039] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0040] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other.

[0041] The present invention will be further described below with reference to the accompanying drawings and specific embodiments, but this is not intended to limit the scope of the invention.

[0042] Example 1:

[0043] The following is combined Figures 1-3 This embodiment describes a satellite optical network virtual subnet security isolation method, which includes:

[0044] I. Virtual Subnetting Based on 802.1Q Protocol:

[0045] like Figure 1 As shown, this invention divides the user data packet domain into several virtual areas at the data link layer for on-board switching, with each virtual area having a unique identifier (VLAN ID). The adopted protocol is 802.1Q, theoretically supporting a maximum of 4096 (in practice, 4094 are available). Considering the complexity and latency of on-board switching processing, it is recommended that the number of virtual subnets be controlled within 1000.

[0046] The control layer implements the core functions of the virtual subnet module for the SDN controller. The southbound interface of the control layer uses the OpenFlow protocol to communicate with the switch. The northbound interface of the control layer provides a REST API for easy use by the application layer. Rules for dynamically dividing virtual subnets can be formulated based on user identity and other information, or static virtual subnetting rules can be defined. The virtual subnetting function is implemented by dynamically adding and deleting VLAN headers to user data packets through the onboard software-defined switch.

[0047] II. System Data Flow:

[0048] like Figure 2 As shown by the red line in the diagram above, the system information flow is as follows: The terminal transmits user authentication information via network layer protocols through XDRLink / MDRLink user links, inter-satellite links, and XDRLink / MDRLink links, then to the AAA service area via the broadband service center. The AAA server authenticates the user, and the authentication result is sent back to the terminal via the same route, completing the network access authentication process. Packet service data generated by the terminal and Internet application services are transmitted bidirectionally through a transmission network composed of XDRLink / MDRLink links, inter-satellite links, XDRLink / MDRLink links, and the broadband service center.

[0049] The implementation of secure isolation in network operations still primarily relies on ground nodes. This includes two main aspects: first, network operational isolation management, which involves centralized control of network topology, slicing, virtual subnet establishment, and QoS management through software-defined network controllers; and second, centralized control of user authentication, security, and billing. These two centralized measures do not intervene in the business itself, thus remaining decentralized from a business perspective, which this paper refers to as a weakly centralized network. Another characteristic of weak centralization is that, since management functions do not require the transmission of large amounts of data, the ground entities performing these management functions can achieve this at a relatively low cost, such as a single ground terminal system with a 1.2m antenna aperture, coupled with a related control system, avoiding reliance on large ground gateway stations.

[0050] In the data plane, the user link is divided into the physical layer, link layer, network layer, and transport layer. The user terminal processes the protocol according to the above layers. The satellite completes the reception and demodulation of the physical layer signal of the user link, recovers the user data, encapsulates it with the on-board MPLS protocol, and then transmits it to the next satellite through the inter-satellite link. It is then forwarded to the user terminal based on label routing. Data to the ground network is sent by the satellite to the adjacent ground gateway station through the microwave high-speed link and then forwarded according to IP packets. Data to the user terminal is directly exchanged and forwarded by the satellite through the user link.

[0051] In the control plane, the user link is divided into the physical layer, user link layer, network layer, transport layer, and application layer. The user terminal performs protocol processing according to the above layers. The satellite completes the reception and demodulation of the physical layer signal of the user link, extracts the network management and control data, encapsulates it with the MPLS protocol, transmits it to the next satellite through the inter-satellite link, forwards it to the ground based on label routing, extracts the network management and control data, and forwards it to the operation and management center in the form of IP packets.

[0052] III. Terminal Network Access Process:

[0053] like Figure 3 As shown, user access for Ka-band broadband communication is implemented on-board, and the system terminal network access process is as follows:

[0054] (1) The onboard network controller sends system WCCB messages to the terminal via downlink carrier;

[0055] (2) The terminal obtains information such as WRACH resource configuration by reading system broadcast messages, and initiates a random access procedure;

[0056] (3) The onboard network controller sends a user establishment control message to the satellite based on the dedicated service carrier and time slot allocated to the terminal according to the terminal configuration information.

[0057] (4) After receiving the control message established by the user, the satellite receives and sends data according to the configuration and returns an ACK message to the network controller;

[0058] (5) The onboard network controller sends a random access response to the terminal through the downlink signaling channel, carrying the time and frequency resource information allocated to the terminal.

[0059] At this point, the user terminal has completed its point-to-point connection with the satellite. The process then transitions to authentication, where the terminal establishes a connection with the AAA server located at the terrestrial broadband center via application layer protocols on the service carrier, and performs the AAA authentication process.

[0060] While the invention has been described herein with reference to specific embodiments, it should be understood that these embodiments are merely examples of the principles and applications of the invention. Therefore, it should be understood that many modifications can be made to the exemplary embodiments, and other arrangements can be designed without departing from the spirit and scope of the invention as defined by the appended claims. It should be understood that different dependent claims and features described herein can be combined in ways different from those described in the original claims. It is also understood that features described in conjunction with individual embodiments can be used in other described embodiments.

Claims

1. A secure isolation method for virtual subnets in satellite optical networks, characterized in that, It includes: Based on the software-defined networking (SDN) controller, the user data packet domain is divided into multiple virtual areas at the data link layer of the on-board processing and switching equipment, and each virtual area is assigned a unique virtual local area network (VLAN) identifier. The SDN controller communicates with the onboard software-defined switch via the southbound interface and provides services to the application layer via the northbound interface. The onboard software-defined switch dynamically adds or deletes VLAN headers for received user data packets according to the rules issued by the SDN controller, so as to realize the division and isolation of virtual subnets; User data packets within different virtual subnets are isolated from each other during transmission, and communication between different virtual subnets needs to be forwarded through a Layer 3 device.

2. The satellite optical network virtual subnet security isolation method according to claim 1, characterized in that, The southbound interface of the SDN controller communicates with the onboard software-defined switch using the OpenFlow protocol.

3. The satellite optical network virtual subnet security isolation method according to claim 1, characterized in that, The northbound interface of the SDN controller provides a REST API interface for application layer calls.

4. The satellite optical network virtual subnet security isolation method according to claim 1, characterized in that, The SDN controller combines user identity information to formulate dynamic virtual subnetting rules or static virtual subnetting rules.

5. The satellite optical network virtual subnet security isolation method according to claim 1, characterized in that, The virtual area is divided using the IEEE 802.1Q protocol, and the number of VLAN IDs is limited to 4094.

6. The satellite optical network virtual subnet security isolation method according to claim 1, characterized in that, The number of VLAN IDs shall be controlled to within 1000.

7. The satellite optical network virtual subnet security isolation method according to claim 1, characterized in that, It also includes the user access process: The onboard network controller sends system broadcast messages to the terminal via downlink carrier. The terminal obtains random access resource configuration information by reading the system broadcast message and initiates a random access process; The onboard network controller allocates dedicated service carriers and time slots to the terminal according to the terminal configuration information, and sends user establishment control messages to the satellite. After receiving the user's control establishment message, the satellite receives and sends data according to the configuration, and returns an acknowledgment message to the onboard network controller. The onboard network controller sends a random access response to the terminal via the downlink signaling channel, carrying the time and frequency resource information allocated to the terminal, to complete the point-to-point connection between the user terminal and the satellite.

8. The satellite optical network virtual subnet security isolation method according to claim 7, characterized in that, After the user terminal completes the point-to-point connection with the satellite, it establishes a connection with the AAA server located in the ground broadband center on the service carrier through the application layer protocol to carry out the authentication and authorization process.

9. The satellite optical network virtual subnet security isolation method according to claim 1, characterized in that, In the data plane, user terminals perform protocol processing according to the physical layer, link layer, network layer, and transport layer; After the satellite completes the reception and demodulation of the user link physical layer signal, it encapsulates the user data using the onboard MPLS protocol and transmits it to the next satellite via the inter-satellite link. The data is then forwarded to the target user terminal or ground gateway station based on label routing.

10. The satellite optical network virtual subnet security isolation method according to claim 1, characterized in that, The security isolation management of network operation is centrally controlled by the SDN controller, which manages network topology, network slicing, virtual subnet establishment, and QoS management; the authentication management, security and confidentiality, and billing of user access are centrally controlled by the ground control entity.

Images