摘要
低轨卫星网络作为新一代全球信息基础设施的核心,具备拓扑高度动态、节点资源受限、业务频繁切换等显著特征。传统基于静态网络标识和边界防护的安全机制,难以应对卫星网络中频繁变化的网络拓扑、通信承载关系的动态调整和复杂的多域协同场景。为此,提出一种面向低轨卫星网络的零信任微隔离架构,该架构针对低轨卫星网络的高动态特性,引入语义标签和增量计算方法,解决传统安全策略的适应性问题。通过构建时间扩展策略图模型,并提出增量更新机制,实现受影响子图的局部重算方法,从而显著降低策略更新的计算和通信开销。实验结果表明,该架构能有效支持高动态、资源受限的低轨卫星网络,显著减少策略更新的计算开销和执行延迟,满足低轨卫星网络对时延和资源开销的严格要求。
Low Earth Orbit(LEO)satellite networks,as the core of the next-generation global information infrastructure,are characterized by highly dynamic topologies,resource-constrained nodes,and frequent service events.Traditional security mechanisms relying on static network identifiers and perimeter defense are insufficient to address frequent network topology changes,dynamic communication path adjustments,and complex multi-domain coordination scenarios in satellite networks.To address these challenges,we propose a Zero Trust Micro-Segmentation architecture tailored for LEO satellite networks.This architecture leverages semantic labeling and incremental computation to address the adaptability limitations of conventional security policies.By constructing a time-extended policy graph model and introducing an incremental update mechanism,the architecture enables local recalculation of affected subgraphs,thereby significantly reducing computational and communication overheads for policy updates.Experimental results demonstrate that the proposed architecture effectively supports highly dynamic,resourceconstrained LEO satellite environments,significantly reduces computational overhead and execution latency for policy updates,while satisfying stringent requirements for delay and resource consumption.
作者
杨希磊
易小云
肖达
宋祁朋
李玥
YANG Xilei;YI Xiaoyun;XIAO Da;SONG Qipeng;LI Yue(School of Cyber Engineering,Xidian University,Xi’an 710126,China;Beijing Institute of Tracking and Telecommunications Technology,Beijing 100094,China;State Key Laboratory of Integrated Services Networks,Xidian University,Xi’an 710071,China)
出处
《航天技术与工程学报》
2026年第2期71-84,共14页
Journal of Space Technology and Engineering
关键词
低轨卫星网络
零信任架构
微隔离
语义标签
增量更新
扩展伯克利数据包过滤器(eBPF)
low earth orbit satellite internet
zero trust architecture
micro-segmentation
semantic labeling
incremental update
extended Berkeley Packet Filter(eBPF)
