RU2795117C1 - Method and system for data security when organizing data exchange with spacecraft - Google Patents

Abstract

FIELD: data security.

SUBSTANCE: security of data exchange systems with spacecraft (SC). The method organizes virtual local area networks for each type of traffic, and at the same time all types of traffic are transmitted in a single stream without reducing the level of cryptographic strength, where end devices of the same type are located in one local area network, separated by a closed communication channel, while data exchange with the spacecraft without the use of a repeater satellite is organized via virtual local computer networks: an open service communication channel; a closed local area network for controlling the space platform of the spacecraft; closed local area network for spacecraft payload control; a closed local area network for the transmission of target information, a closed local area network for controlling the earth station; data exchange with the spacecraft from the use of the repeater satellite is additionally organized by means of virtual local computer networks: a closed local control network of the space platform of the repeater satellite; a closed local area network for controlling the payload of the repeater satellite; local computer network of an open service communication channel of a repeater satellite and an earth station.

EFFECT: ensuring the data security in the organization of data exchange with spacecraft.

2 cl, 12 dwg

Description

The claimed invention relates to the field of information security in information exchange systems with spacecraft (SC).

Methods and systems for protecting information are known from the prior art, for example, a method (see RU2438941, publ. 01/10/2021) (1) for ensuring spacecraft flight control, which is used to create an information and computer complex (ICC) of the flight control center (MCC) using the principle of unification. According to this principle, a certain common part of hardware and software (HPS) and methodological and algorithmic support is distinguished from the composition of the control sectors of the NSEN spacecraft. This software and APS are suitable for use without restrictions in flight control of NSEN spacecraft of almost any type. A single segment of the local area network (LAN) is singled out as part of the CPI by integrating specialized CPI of the control sectors. This integration, as well as information interaction between the specified LAN segment and the APS of the control sectors, is provided by communication means of this single LAN segment. At the same time, the APS of the control sectors process specific information specific to each SC of the NSEN. The allocation of the specified single segment of the LAN allows the processing of standard ballistic and telemetric information simultaneously for all controlled spacecraft NSEN.

Method (1) has the following disadvantages - a large amount of channel-forming equipment is required, which is a consequence of the following problems:

- high cost of the space system as a whole;

- high energy consumption and weight and size characteristics of the onboard equipment (BA) of the spacecraft;

- additional information delays.

The closest analogues of the claimed invention are methods for controlling a space communication system (see RU 2713293 C2, publ. 05/16/2019) (2) and (see RU 2690966 C2, publ. 06/07/2019) (3). Methods (2) and (3) offer the following principles for the exchange of information with the spacecraft:

1) the use of a universal earth station (ES), which provides simultaneous reception and transmission of NI and control information (IM);

2) the use of a universal onboard radio-technical complex (BRTK) of the spacecraft, which simultaneously provides the reception and transmission of CI and control information (CI);

3) transmission of NI and DUT using the TCP / IP protocol stack in one terrestrial LAN and in one satellite LAN, but in different virtual local networks (VLANs);

4) the use of CP with the processing and routing of information on board, which ensures the integration and differentiation of various information flows.

Methods (2) and (3) have the following disadvantage - they do not provide information protection.

The technical result of the claimed invention is to reduce the number of airborne and ground-based CIPF and channel-forming equipment, which leads to:

- reduction of energy consumption and weight and size characteristics of the spacecraft;

- reducing the delay of information entered by CIPF;

- reducing the cost of the space system as a whole. The technical result is achieved through the use of technologies:

- ensuring end-to-end transmission of information in a closed form between terminal devices without reducing the level of cryptographic strength;

- transfer of various types of information in a single stream over a single physical wired and wireless communication line and, accordingly, the use of a single channel-forming equipment to ensure the transmission of various types of information.

The implementation of the technologies noted above is carried out through the use of the following equipment:

- routers that provide integration and differentiation of various information flows;

- unified airborne and ground-based CIPF, which are crypto-gateways (CS) that provide separate encryption and decryption of various types of information.

The claimed invention is illustrated by the following drawings:

Fig. 1 - the traditional functional diagram of information protection when organizing communication between the MCC and the NCC with one spacecraft without the use of CP;

Fig. 2 - the traditional functional diagram of information protection when organizing communication between the MCC and the NCC with one spacecraft using CP;

Fig. 3 - functional diagram of information protection when organizing communication between the MCC / NCC with one SC using one AP (MCC / NCC-ES-KA);

Fig. 4 - functional diagram of information protection when organizing communication between the MCC / NCC with two spacecraft using one AP (TsUP / TsUS-ZS-KA-1; KA-2);

Fig. 5 is a functional diagram of information protection when organizing communication between the MCC / NCC with two spacecraft using two APs (TsUP / TsUS-ZS-1-KA-1 and TsUP / TsUS-ZS-2-KA-2);

Fig. 6 is a functional diagram of information protection during the organization of communication between the MCC / NCC with one spacecraft using one AP and one CP (TsUP / TsUS-ES-SR-KA);

Fig.7 is a functional diagram of information protection when organizing communication between the MCC / NCC with two SC using one ES and one CP (MCC / TsUS-ES-SR-KA-1; KA-2);

Fig. 8 is a functional diagram of information security when organizing communication between the MCC / NCC with two spacecraft using one ES and two CPs (TsUP / TsUS-ZS-SR-1-KA; TsUP / TsUS-ZS-SR-2-KA);

Fig. 9 is a functional diagram of information protection during the organization of communication between the MCC / NCC with one SC using one ES and two CPs interconnected by the MLS (MCC / TsUS-ZS-SR-1-SR-2-SC);

Fig. 10 is a functional diagram of information protection during the organization of communication between the MCC / NCC with two spacecraft using two APs and two CPs (TsUP / TsUS-ZS-SR-1-SR-2-SC);

Fig. 11 - algorithm of work in a direct communication channel;

Fig. 12 - algorithm of work in the reverse communication channel.

For the sake of simplicity, figures 1-10 show only network equipment and do not show channel-forming equipment, namely antenna systems, receivers, transmitters, modulators and demodulators.

Positions in figures 1-10 indicate the following:

1 - flight control center / spacecraft network control center (MCC / NCC SC);

2 - flight control center / relay satellite network control center (MCC / NCC CP);

3 - central router MCC/NCS SC and MCC/NCS CP;

4 - automated workstation (AWS) of the control operator of the space platform (SPL) of the spacecraft;

5 - Ethernet switch of the local area network (LAN) for control of the SC SC;

6 - crypto-gateway (KSh) of the LAN for the control of the SV SC;

7 - payload control operator's workstation (PN) of the spacecraft;

8 - switch Ethernet LAN control PN KA;

9 - KSh LAN control PN KA;

10 - workstation of the operator of the analysis of target information (NI) of the spacecraft;

11 - switch Ethernet LAN analysis QI CA;

12 - KSh LAN analysis NI KA;

13 - workstation of the control operator Kpl CP;

14 - Ethernet switch LAN control Kpl CP;

15 - KSh LAN control Kpl CP;

16 - workstation of the control operator PN CP;

17 - Ethernet switch LAN control PN CP;

18 - KSh LAN control PN CP;

19 - workstation of the earth station (ES) control operator;

20 - switch Ethernet LAN control AP;

21 - KSh LAN control AP;

22 - workstation of the administrator of the communication network of the spacecraft and AP;

23 - workstation of the administrator of the communication network CP and AP; 24 - ZS-1;

25 - router ZS-1;

26 - KSh LAN control ZS-1;

27 - control computer (CU) ZS-1; 28 - СР-1;

29 - router СР-1;

30 - KSh LAN control Kpl SR-1;

31 - KU operation Kpl CP-1;

32 - KSh LAN control PN SR-1;

33 - KU work PN SR-1; 34 - KA-1;

35 - router KA-1;

36 - KSh LAN control Kpl KA-1;

37 - KU operation Kpl KA-1;

38 - KSh LAN control PN KA-1;

39 - KU work PN KA-1;

40 - KSh LAN QI KA-1;

41 - KU processing NI KA-1;

42 - СР-2;

43 - router СР-2;

44 - KSh LAN control Kpl SR-2;

45 - KU work Kpl SR-2;

46 - KSh LAN control PN SR-2;

47 - KU work PN SR-2; 48 - ZS-2;

49 - router ZS-2;

50 - KSh LAN control ZS-1;

51 - control computer (KU) ZS-1; 52 - KA-1;

53 - router KA-1;

54 - KSh LAN control Kpl KA-1;

55 - KU by the operation of Kpl KA-1;

56 - KSh LAN control PN KA-1;

57 - KU by the work of PN KA-1; 58 - KSh LAN QI KA-1;

59 - KU processing NI KA-1;

60 - workstation of the communication network administrator TsUP-ground command and measuring station (NCMS);

61 - router TsUP traditional communication organization;

62 - NCIS of the traditional organization of communication;

63 - router NCIS traditional organization of communication;

64 - KSh NKIS of the traditional organization of communication;

65 - KU NKIS of the traditional organization of communication;

66 - a means of cryptographic information protection (CIPF) NCIS of the traditional organization of communication;

67 - CIDS BA KIS KA traditional communication organization;

68 - onboard control complex (OCC) of the spacecraft of the traditional organization of communications;

69 - telemetric system (TMS) Kpl KA of the traditional organization of communication;

70 - MCC of the spacecraft of the traditional communication organization;

71 - NCC KA traditional communication organization;

72 - MCC CP traditional communication organization;

73 - NCC CP traditional communication organization;

74 - information receiving station (SPI) spacecraft of the traditional organization of communication;

75 - SPI CP of the traditional organization of communication;

76 - workstation of the administrator of the communication network TsUS-SPI of the traditional communication organization;

77 - router NCC traditional communication organization;

78 - router SPI traditional communication organization;

79 - KSh SPI traditional communication organization;

80 - KU SPI of a traditional communication organization;

81 - CIPF SPI of a traditional communication organization;

82 - CIPF of the target equipment (CA) of the spacecraft of a traditional organization

communications;

83 - CA of the CA of the traditional communication organization;

84 - TMS on the spacecraft of the traditional communications organization;

85 - onboard radio-technical complex (BRTK) of the command radio link (KRL) of the spacecraft of the traditional communications organization;

86 - BRTK QI KA traditional communications organization.

List of abbreviations in figures 1-12:

ALS - subscriber LAN - is a LAN between the ES and the SC or between the CP and the SC;

FOCL - fiber-optic LAN;

MLS - inter-satellite LS is a LAN between CP and CP;

RFO - radio frequency equipment - the same as RTK;

RTK - radio engineering complex;

SSPD - communication and data transmission network;

FLS - feeder LS is a LS between AP and SR.

The claimed method and system of information protection in the implementation of information exchange with the spacecraft has the properties of flexibility and versatility, which allows you to effectively organize the protection of information in the following various options for organizing communication.

Option number 1. Organization of communication between the MCC / NCC with one spacecraft using one AP (MCC / TsUS-ES-KA).

The functional diagram of information protection when organizing communication between the MCC / NCC with one SC using one AP (MCC / NCC-ES-KA) is shown in figure 3.

Work in a direct communication channel (PC) - LS TsUP / TsUS-ZS-KA.

The work of the MCC / NCC.

The IS by the space platform (CS) of the spacecraft is formed on the automated workstation (AWS) 4 of the control operator of the space platform of the spacecraft, which is a computer, and through the Ethernet switch 5 of the local area network (LAN, LAN) No. 1 of the combined MCC / NCC 1 of the spacecraft (hereinafter referred to as - MCC/NCS 1), arrives at the internal port (LAN port) KSh 6, where the IP packets of the DUT are encrypted in their entirety together with the network layer headers (L3). The IP address of the recipient is assigned as an open header to the encrypted IP packets of the IU - the IP address of the external port (WAN port) of the onboard KSh 36 KA-1 34 and the IP address of the information sender is assigned - the IP address of the WAN port of the KSh 6 TsUP/ NCC 1. From WAN port KSh 6 MCC/NCS 1, encrypted IP packets of the OD arrive at the LAN port of the central router (CM) 3 MCC/NCS KA and MCC/NCS CP (hereinafter referred to as CM).

IU PN KA is formed on the workstation 7 of the control operator PN KA and through the Ethernet switch 8 LAN No. 2 MCC / NCC 1 KA, arrives at the LAN port KSh 9, where the IP packets of the IU are encrypted entirely together with the L3 headers. As an open header, the encrypted IP packets of the IU are assigned the IP address of the recipient - the IP address of the WAN port of the onboard KSh 38 KA-1 34, and the IP address of the sender of information is assigned - the NGN P address of the WAN port of KSh 9 MCC / NCC 1. From the WAN port KSh 9 MCC/NCS 1 encrypted IP packets of the OD arrive at the LAN port CM 3.

The IS is formed by the SC earth station on the workstation 19 of the ES control operator and through the Ethernet 20 LAN No. 6 MCC / NCC 1 SC, enters the LAN port KSh 21, where the IP packets of the IS are encrypted in their entirety together with the L3 headers. The IP address of the recipient is assigned to the encrypted IP packets of the ID as an open header - the IP address of the WAN port of KSh 26 3S-1 24 and the IP address of the sender of information is assigned - the IP address of the WAN port of KSh 9 MCC / NCC 1. With WAN -port KSh 21 MCC/NCS 1 encrypted IP packets of the OD arrive at the LAN port of the CM 3.

The information of the open service communication channel (OCSL), which is used to check the status of terrestrial and satellite LANs, as well as for remote primary installation of terrestrial and onboard routers, is sent from the workstation 22 of the communication network administrator of the spacecraft and the AP to the LAN port of the CM 3.

In CM 3, all information flows are integrated into a single stream of IP packets according to the priorities of information transmission. The IP packets of the IU Kpl KA have the highest priority, then the IP packets of the IU PN KA.

ZS work.

From the WAN port of the CM 3, a single information flow arrives via a terrestrial LAN to the WAN port No. 1 of the router 25 ZS-1 24, where the IP address of the recipient of the information is read.

If the IP address of the router 25 ZS-1 24 is indicated in the header of the IP packet as the recipient address, then this information comes from the workstation 22, is intended for this device and serves for the initial installation of the router 25 and for checking the communication channel with it.

If the IP address of the IP packet as the address of the recipient is the IP address of the KSh 26 ES-1 24, then this information comes from the workstation 19 and serves to control the operation of the ES-1. The OD by the work of the AP from the LAN port of the router 25 arrives at the WAN port of the KSh 26, where the IP packets are decrypted and the IP address of the recipient in the closed network segment becomes visible. Then, the IU by the work of ZS-1 24 in the open form enters the control computer (KU) 27 ZS-1 24.

If the IP address of the on-board router (BM) 35 KA-1 34 is indicated in the header of the IP packet as the recipient address, then this information comes from AWP 22, is intended for this device and serves for the initial installation of BM 35 KA-1 and for checking the channel connections with him. If KA-1 is currently in the radio visibility zone (ZRV) of ES-1, then ES-1 establishes communication with KA-1 and OD OXLS in a single stream with other information intended for KA-1, enters the channel-forming equipment ( radio engineering complex, RTK) ZS-1, where the transformations necessary for the emission of information in a satellite radio link (SRL) take place: coding, modulation, amplification and filtering.

If the IP address of the IP packet contains the IP address of the BCS 36 KA-1 34 as the recipient address, then this is the IU Kpl and comes from the workstation 4. If the KA-1 is currently in the radio visibility zone (ZRV) of the ZS-1, then the AP-1 establishes communication with the KA-1 and the IU PN in a single stream with other information intended for the KA-1, enters the RTK AP-1, where the transformations necessary for the transmission of information to the SRL take place.

If the IP address of the IP packet contains the IP address of the BCS 38 KA-1 34 as the recipient's address, then this is the IU PN and comes from the workstation 7. If the KA-1 is currently in the radio visibility zone (ZRV) of the ZS-1, then the AP-1 establishes communication with the KA-1 and the IU PN in a single stream with other information intended for the KA-1, enters the RTK AP-1, where the transformations necessary for the transmission of information to the SRL take place.

Thus, in the router 25 ES-1 24, all information flows are integrated into a single stream of IP packets according to the priorities of the information transfer, which is transmitted for conversion to the RTC. BRTC receives a single stream of IP packets, converts it and transmits it to the WAN port of BM 35, which carries out its further routing, according to the recipient's IP addresses.

BA KA work.

BRTK KA-1 34 receives IU OKSlS, Kpl and PN in a single stream of information, performs all the necessary inverse transformations required after receiving from the SRL: amplification and filtering, demodulation and decoding. From the output of the BRTK, information is sent to the WAN port of the BM 35 KA-1 34, which, by the IP address of the recipient, determines which device the IP packets are intended for.

IU Kpl from the LAN port of the BM 35 goes to the WAN port of the BCS 36, where the IP packets are decrypted and the IP address of the recipient in the closed network segment becomes visible. Then the IU Kpl in the open form enters the BKU 37 by the operation of the Kpl KA-1 34.

DUT PN from the LAN port of the BM 35 goes to the WAN port of the BCS 38, where the IP packets are decrypted and the IP address of the recipient in the closed network segment becomes visible. Then IU PN in an open form enters the BKU 39 by the work of the PN KA-1 34.

Work in the reverse communication channel (OK) - LS KA-ZS-TsUP/TsUS.

BA KA work.

The IP packets of the IU Kpl from BKU 37 are addressed to AWP 4 PUP / NCC 1 and therefore in their header is indicated as the IP address of the recipient - the IP address of AWS 4, as the IP address of the sender - the IP address of the BKU 37. IU Kpl from BCU 37 arrives at the LAN port of the BCS 36 of the KA-1 34, where the IP packets are encrypted in their entirety together with the L3 headers. The IP address of the recipient is assigned as an open header to the encrypted IP packets of the IU Kpl - the IP address of the WAN port of the KSh 6 MCC / NCC 1 and the IP address of the sender of information is assigned - the IP address of the WAN port of the BCS 36 KA-1 34. From the WAN port of the BCS 36, encrypted IP packets arrive at the LAN port of the BM 35, where they are integrated with other IP packets and prioritized according to the assigned priorities.

The IP packets of the IU GSh from BKU 39 are addressed to AWP 7 MCC / NCC 1 and therefore in their header is indicated as the IP address of the recipient - the IP address of AWS 7, as the IP address of the sender - the IP address of the BKU 39. IU PN from BCU 39 arrives at the LAN port BCS 38 KA-1 34, where the IP packets are encrypted in their entirety together with the L3 headers. As an open header, the IP address of the recipient is assigned to the encrypted IP packets of the IU PN - the IP address of the WAN port of the KSh 8 MCC / NCC 1 and the IP address of the sender of information is assigned - the IP address of the WAN port of the BCS 38 KA-1 34. From the WAN port of the BCS 36, encrypted IP packets arrive at the LAN port of the BM 35, where they are integrated with other IP packets and prioritized according to the assigned priorities.

IP packets CI from BCU 41 are addressed to AWP 10 MCC / NCC 1 and therefore in their header is indicated as the address of the recipient - the IP address of ARM 10, as the IP address of the sender - the IP address of the BCU 41. CI from the BCU 41 arrives to the LAN port of the BCS 40 KA-1 34, where the IP packets are encrypted in their entirety together with the L3 headers. The IP address of the recipient is assigned as an open header to the encrypted IP packets of the CI - the IP address of the WAN port of the KSh 11 MCC / NCC 1 and the IP address of the sender of information is assigned - the IP address of the WAN port of the BCS 40 KA-1 34. With WAN -port BCS 40 encrypted IP packets arrive at the LAN port BM 35, where they are integrated with other IP packets and prioritized according to assigned priorities.

From WAN-port BM 35 IU Kpl in a single stream of information goes to the BRTK, where the transformations necessary for the emission of information in the SRL take place.

ZS work.

RTK ZS-1 24 receives in a single stream of information from KA-1 34, performs all the necessary inverse transformations required after receiving from the SRL. From the output of the RTK, information is sent to WAN port No. 2 of router 25 ZS-1 24, which determines by the IP address of the recipient that IP packets are intended for MCC / NCC 1. From WAN port No. 2, information is sent to WAN port No. 1 the same router 25, where it is integrated into a single information flow with the IU ZS-1 24.

The work of the MCC / NCC.

On ground LANs, a single stream of information from ES-1 24 arrives at the WAN port of the CM 3, where the addresses of the recipients are read. After that, the IU CL from the LAN port of the CM 3 arrives at the WAN port of the CS 6, where it is decrypted and then the IP packets in clear form through the switch 5 arrive at the workstation 4 of the MCC / NCC 1. The IU PN from the LAN port of the CM 3 arrives at the WAN port of CS 9, where it is decrypted, and then the IP packets in clear form through the switch 8 arrive at the workstation 7 of the MCC / NCC 1. The CI from the LAN port of the CM 3 arrives at the WAN port of the CS 12, where it occurs decryption and further IP-packets in clear form through the switch 11 arrives at the workstation 10 MCC/NCS 1.

In the presented system of information exchange with the spacecraft, the MCC / NCC acts as a control body, and the AP and the spacecraft act as a control object.

Thus, virtual LANs (Virtual LAN, VLAN) are organized for each type of traffic, where the end devices of the same type KU MCC / NCC and BKU of all SC are in one LAN, separated by a closed communication channel, consisting of terrestrial and satellite communication lines, where ZS - performs the functions of relaying, routers - combine and separate information flows, and KSh - close the communication channel between terminal devices.

Organized VLANs when organizing information exchange with a spacecraft without using CP:

VLAN-0-OXlS ES and KA;

VLAN-1 - control LAN of the SC SC;

VLAN-2 - control LAN of SC PN;

VLAN-3 - LAN for CI analysis;

VLAN-6 - AP control LAN;

Option number 2. Organization of communication between the MCC / NCC with two spacecraft simultaneously with the use of one AP.

The functional diagram of information protection when organizing communication between the MCC / NCC with two spacecraft using one AP (TsUP / TsUS-ZS-KA-1; KA-2) is shown in figure 4.

The difference between this option is as follows:

1) AP communicates not with one satellite, but with two at once. In this case, it is assumed that the AP should be multi-agent, i.e. can communicate simultaneously with several SCs - from two or more SCs, depending on the technical capabilities of the ES and on the need, which is especially important when controlling multi-satellite orbital constellations (OS) of SCs.

2) AWP for managing the operation of the SC SC forms the IS for two or more SC at once. Not one, but several CU can act as an AWP for controlling the operation of the SC SC. The workstations for controlling the work of the PN KA and the workstations for the analysis of QI work in a similar way.

3) The AP router singles out two or more similar types of information from a single information flow at once, routes them to the corresponding RTC sets that have established communication with these SC.

4) There are two or more subscriber BCUs in the same VLAN at once.

Option number 3. Organization of communication between the MCC / NCC with two spacecraft simultaneously using two APs.

The functional diagram of information security when organizing communication between the MCC / NCC with two spacecraft using two APs (TsUP / TsUS-ZS-1-KA-1 and TsUP / TsUS-ZS-2-KA-2) is shown in figure 5.

The difference between this option is as follows:

1) MCC/NCS 1 communicates not with one ES, but with two or more ES at once. In this case, it is assumed that MCC/NCS 1 should be multi-agent, i.e. can communicate simultaneously with several APs - depending on the need to ensure globality and efficiency in establishing communication with the spacecraft, which is especially important when controlling multi-satellite SCs.

2) AWS for controlling the operation of the AP forms the IS for two or more APs at once, and the ARM for managing the operation of the SC of the SC forms the IS for two or more SCs at once. The workstations for controlling the work of the PN KA and the workstations for the analysis of QI work in a similar way. Not one, but several CUs can act as a work management workstation.

3) In one same type VLAN there are two or more subscriber BCUs of the SC and CU of the ES at once.

Option number 4. Organization of communication between the MCC / NCC with one spacecraft using one AP and one SR.

The functional diagram of information protection when organizing communication between the MCC / NCC with one SC using one ES and one CP (MCC / NCC-ES-SR-SC) is shown in figure 6.

The difference between this option is as follows:

1) The AP communicates not with the SC, but with the CP located in its ZRV and which, in the communication system with the SC, as well as the AP, performs the functions of a repeater. In this case, it is assumed that the AP should be multifunctional and multi-agent, i.e. can communicate with both SC and CP, and can simultaneously work with several CPs and several SC, which is especially important when controlling multi-satellite SCs.

2) The MCC / NCC CP additionally participates in the organization of communication and therefore the following virtual LANs are additionally organized:

VLAN-4 - LAN control Kpl CP;

VLAN-5 - LAN control PN CP;

VLAN-7 - OCSL CP and AP.

3) BM CP selects from the common single information flow the IU Kpl CP and IU PN CP and routes these IP packets to the corresponding ones - BCS LAN control Kpl CP and BCS LAN control PN SR. VLAN-7 is used to test the communication line of the MCC/NCC 2 with the ES and CP and the initial installation of the routers of this LAN.

Option number 5. Organization of communication between the MCC / NCC with two spacecraft using one AP and one SR.

The functional diagram of information protection when organizing communication between the MCC / NCC with two spacecraft using one ES and one CP (TsUP / TsUS-ZS-SR-KA-1; KA-2) is shown in figure 7.

AWS for managing the operation of the corresponding BKU and KU works similarly to options No. 2-4.

The difference between this option is as follows:

1) CP in this case must be multi-agent, i.e. provide communication with two or more spacecraft, depending on the technical capabilities of the CP and on the needs, which is especially important when controlling multi-satellite SCs.

3) BM CP selects two or more types of information of the same type from a single information flow at once, routes them to the corresponding BRTK sets that have established communication with these spacecraft.

Option number 6. Organization of communication between the MCC / NCC with two spacecraft using one AP and two SRs.

The functional diagram of information protection in the organization of communication between the MCC / NCC with two spacecraft using one ES and two CPs (TsUP / TsUS-ZS-SR-1-KA; TsUP / TsUS-ZS-SR-2-KA) is shown in figure 8.

AWS for controlling the operation of the corresponding BKU CP, BKU KA and KU ZS works similarly to option No. 4.

The difference between this option is as follows:

1) AP in this case should be multi-agent, i.e. provide communication with two or more CPs, depending on the technical capabilities of the AP and on the needs, which is especially important when controlling multi-satellite SCs.

2) The AP router singles out two or more types of information of the same type from a single information flow at once, routes them to the corresponding RTC sets that have established communication with these SRs.

Option number 7. Organization of MCC/NCS communication with two spacecraft using one AP and two CPs interconnected by MLS.

The functional diagram of information protection when organizing communication between the MCC / NCC with one SC using one ES and two CPs interconnected by the MLS (MCC / NCC-3S-SR-1-SR-2-SC) is shown in figure 9.

AWS for controlling the operation of the corresponding BKU CP, BKU KA and KU ZS works similarly to options No. 4-6.

The difference between this option is as follows:

1) If the CP that has established communication with the SC is not in the ZRZ of the ES, then in the presence of an inter-satellite communication link (ILS) between the CPs, information can be relayed to the SC through two or more SRs.

2) The CP that has established communication with the ES retransmits to the CP that has established communication with the SC:

- SC control information;

- control information of the spacecraft launcher;

- target information from the spacecraft;

- information of the OKSLS spacecraft;

- control information Kpl CP;

- management information PN SR.

- information OKSLS SR.

Option number 8. Organization of communication between the MCC / NCC with two spacecraft using one AP and two SRs.

The functional diagram of information protection when organizing communication between the MCC / NCC with two spacecraft using two APs and two CPs (TsUP / TsUS-3S-1-SR-1; TsUP / TsUS-ZS-2-SR-2-KA) is shown in the figure 10.

AWS for controlling the operation of the corresponding BKU CP, BKU KA and KU ZS works similarly to options No. 4-6.

The difference between this option is as follows:

1) CM 3 routes the corresponding DUT of various spacecraft to two or more APs at once via two or more ground-based LANs.

The proposed approach in the various variants discussed above to the organization of information security in the system of information exchange with the spacecraft has the following advantages compared to the traditional organization of information security:

1) has the flexibility and versatility of building a communication network, where both radio links and optical communication links can be used as inter-satellite communication links;

2) provides a differential approach to the protection of information of various types;

3) does not require a significant increase in the hardware-software complexes of the CIPF.

Claims (2)

1. A method for protecting information when organizing information exchange with spacecraft, including the transmission of information from the flight control center of the spacecraft and the network control center to at least one earth station, to at least one spacecraft directly or via at least one satellite - repeater and vice versa, characterized in that virtual local area networks are organized for each type of traffic, and at the same time all types of traffic are transmitted in a single stream without reducing the level of cryptographic strength, where the end devices are of the same type: the mission control center, the spacecraft network control center and the onboard complex control and target equipment of all spacecraft are located in one local area network, separated by a closed communication channel, consisting of terrestrial and satellite communication lines, where the earth station performs the functions of relaying, routers combine and separate information flows, and crypto-gateways close the communication channel between terminal devices, at the same time, information exchange with the spacecraft without the use of a repeater satellite is organized through virtual local computer networks: an open intercom channel; a closed local area network for controlling the space platform of the spacecraft; closed local area network for spacecraft payload control; a closed local area network for the transmission of target information, a closed local area network for controlling the earth station; information exchange with the spacecraft from the use of the repeater satellite is additionally organized by means of virtual local computer networks: closed local control network of the space platform of the repeater satellite; a closed local area network for controlling the payload of the repeater satellite; local computer network of an open service communication channel of a repeater satellite and an earth station. 2. An information security system for organizing information exchange with spacecraft, containing network equipment of the flight control center of the spacecraft and the network control center, network equipment of at least one earth station, network equipment of at least one spacecraft and / or network equipment of at least at least one relay satellite, characterized in that it includes virtual local area networks for each type of traffic, where end devices of the same type: the flight control center, the spacecraft network control center and the onboard control complex for all spacecraft are located in one local area network, separated by a closed a communication channel consisting of terrestrial and satellite communication lines, where the earth station performs the functions of relaying, routers ensure the integration and separation of information flows, and crypto-gateways ensure the closing of the communication channel between terminal devices; as well as virtual local computer networks: open intercom channel and spacecraft; local computer network for controlling the space platform of the spacecraft; local area network for controlling the payload of the spacecraft; a local computer network for controlling the earth station, which provide information exchange with the spacecraft without the use of a repeater satellite; and virtual local computer networks: local computer network for control of the space platform of the repeater satellite; local area network for controlling the payload of the repeater satellite; a local computer network for controlling the payload of an open service communication channel of a repeater satellite and an earth station, which provide information exchange with a spacecraft using a repeater satellite.

Images