近年來，立方體衛星的開發越來越受到商業和教育機構的青睞。 然而，現有的衛星安全大多側重於如何保護物理通信，很少討論如 何保護衛星系統本身的安全。為了增強立方體衛星系統的安全性， 我們提出了TrustCS（Trusted CubeSat），它基於立方體衛星On-Board Computer（OBC）系統中的TrustedFirmware-M（TF-M）可信執行環境。 與通過地面站發送遠程命令來重啟系統和驗證圖像不同，TrustCS能使 立方體衛星系統自動重啟並自動驗證圖像。我們還在SecureProcessing Environment（SPE）中對內部存儲記憶元件的寫入和擦除功能實施了 區域檢查機制，使其不會被惡意程序不當操作和使用。此外，我們還 為立方體衛星選擇了更新映像的方法，該方法在更新映像的同時確保 了系統的穩定性，如果更新過程因斷電或高能粒子穿透而失敗，仍可 恢復。最後，我們評估了在STM32L5開發板上的實現情況，證明了 其可靠性、低開銷和安全性。;In recent years, the development of CubeSats has become more and more popular among commercial and educational institutions. However, most of the existing satellite security focuses on how to protect the physical com munication, and rarely discusses how to protect the security of the satellite system itself. In order to enhance the security of the system on CubeSats, we propose TrustCS (Trusted CubeSat), which is based on the Trusted Execu tion Environment of Trusted Firmware-M (TF-M)intheOn-BoardComputer (OBC) system of the CubeSat. Unlike sending remote commands through the ground station to restart the system and image verification, TrustCS en ables the CubeSat system to automatically restart and automatically verify images. We also implement a region check mechanism in the Secure Pro cessing Environment (SPE) for the write and erase functions of the internal storage memorycomponents, sothattheywillnotbeimproperlyoperatedand used by malicious programs. In addition, we choose the method for updating the image for CubeSat, which ensures the system stability while updating the image, and can still recover if the update process fails due to power outage or high-energy particle penetration. Finally, we evaluate the implementation on the STM32L5developmentboard, demonstratingits reliability, low overhead and security.
