As satellite internet becomes a key part of China’s “New Infrastructure,” its development is accelerating, demonstrating immense potential in areas such as military-civil integration, global coverage, and emergency communications. However, the wide distribution of satellite nodes, open communication links, and complex deployment environments make it vulnerable to significant security threats, such as identity spoofing, data theft, signal interference, and fault injection attacks. In this context, RF chips, as the core components of satellite communication systems, directly determine the trustworthiness of the entire communication link.

Based on the core ideas of the paper “Security Chip Design for Satellite Internet” and the critical role RF chips play in satellite communication, this article proposes a design for RF chip architecture that integrates security mechanisms to enhance terminal security and the trustworthiness of satellite internet links.

1. Security Challenges of Satellite Internet and the Role of RF Chips

Satellite internet, achieved through Low Earth Orbit (LEO) satellites, provides global coverage, with terminals deployed in various scenarios including ground stations, vehicles, ships, and aircraft. RF chips handle the transmission and reception of signals and serve as the “first line of defense” in the communication link, making them the most susceptible to physical layer attacks. Traditional RF chips focus on signal modulation, demodulation, and frequency adaptation, lacking security mechanisms for identity authentication, anti-counterfeiting, and attack resistance, thus leaving them open to potential attacks.

To address this, integrating security modules in RF chips to achieve “communication as security” is crucial for building an end-to-end secure satellite network.

2. Security-Enhanced RF Chip Architecture Design

This paper proposes embedding a security subsystem within the RF chip, which includes:

2.1 Physical Unclonable Function (PUF) Module

Leveraging process variations in chip manufacturing, the RF chip integrates SRAM-based PUF units to generate a unique device identifier. This identifier can be used for device authentication, key derivation, and preventing device cloning and spoofing.

2.2 Hardware Acceleration of National Cryptography Algorithms

Integrating national encryption algorithms such as SM2, SM3, and SM4 for real-time encryption, decryption, and integrity verification of communication data ensures the confidentiality and authenticity of data during wireless transmission.

2.3 Fault Attack Resistance Mechanism

To counter non-contact attacks like electromagnetic and laser interference, a multi-region state machine monitoring circuit is embedded within the chip. Once abnormal state transitions are detected, it triggers an alarm and enters a secure mode to prevent key leakage or program tampering.

2.4 Secure Interface and Permission Isolation

A dedicated secure interface is designed to directly feed the PUF output into the encryption module, preventing CPU involvement and avoiding malicious software-level access. Additionally, Flash storage is partitioned to ensure isolation between secure and user programs.

3. Collaborative Mechanism Between RF Chips and Security Chips

In satellite terminals, RF chips and security chips do not operate in isolation; instead, they work together to integrate “signal-security.”

The RF chip handles the transmission and reception of wireless signals and preliminary processing.

The security chip manages identity authentication, key management, and data encryption.

The two are connected through an internal bus or dedicated secure interface, ensuring seamless coordination between “RF-baseband-security” at three levels.

This design allows the RF chip to recognize and block counterfeit devices and signals, enhancing the overall robustness of the system.

4. Experimental Verification and Application Prospects

The proposed design has been validated on an FPGA platform, with the following results:

The PUF module exhibits good randomness and uniqueness, meeting the requirements for device identity.

The fault detection circuit can effectively identify electromagnetic and laser injection attacks, with a response time in the microsecond range.

After integrating the security module, the RF chip still maintains low power consumption and latency, making it suitable for satellite terminal devices.

Looking ahead, as satellite internet integrates with 5G/6G networks and develops into a unified space-ground network, the security performance of RF chips will become a critical metric for determining whether terminal devices meet standards.

5. Conclusion

Building on traditional security chip designs, this paper proposes moving security mechanisms to the RF chip level, creating a “RF-security integrated” terminal architecture. By integrating PUF, national cryptography algorithms, and fault attack resistance modules, RF chips not only process signals but also become the first line of defense in satellite internet security. This design concept offers valuable insight into the future development of small, high-security, and low-cost satellite communication devices.