Method and system for encrypted communication between ethercat slave nodes

Abstract

The application is suitable for the field of communication technology improvement, and provides an encryption communication method and system between EtherCAT slave nodes, which realizes encryption / decryption of EtherCAT messages at the hardware level by integrating OTP / non-volatile storage, encryption scrambling units and decryption scrambling units in the EtherCAT slave chip of the coupler and the I / O module; the encryption adopts XOR operation or AES algorithm, and the key is stored in the non-modifiable storage unit; meanwhile, an architecture parallel to the standard network is constructed, so as to ensure that the encryption communication does not affect the standard interaction between the slave node and the master station. The system solves the contradiction between "poor real-time performance of the private protocol" and "easy copying of the plaintext communication" in the prior art, realizes the effects of real-time lossless, strong communication exclusivity and flexible compatibility, and is suitable for an EtherCAT high-speed backplane bus system under Industry 4.0.

Description

Technical Field

[0001] This invention belongs to the field of communication technology improvement, and in particular relates to an encrypted communication method and system for EtherCAT slave nodes. Background Technology

[0002] The EtherCAT high-speed backplane bus solution consists of EtherCAT slave couplers and EtherCAT I / O modules. The couplers and I / O modules are highly integrated to form a high-speed backplane bus. The coupler is responsible for converting other industrial protocols to EtherCAT, or forming an EtherCAT network with other EtherCAT slave nodes. The I / O module is an EtherCAT slave node used to acquire analog / digital inputs or drive analog / digital outputs. Because EtherCAT communication between the coupler and I / O module is plaintext, the I / O module is easily reverse engineered and can communicate with the coupler. Therefore, existing products use proprietary protocols between the coupler and I / O module, requiring additional protocol conversion time and sacrificing communication performance.

[0003] In existing high-speed backplane solutions, to avoid communication between the coupler and third-party I / O modules, the existing high-speed backplane solutions use Modbus or other proprietary protocols. This method cannot meet the high-performance requirements of EtherCAT due to the need for additional protocol conversion. However, if the coupler and I / O module use the EtherCAT communication protocol, as long as commercially available EtherCAT slave chips are used, the coupler may communicate with third-party I / O modules, which cannot protect the core competitiveness of high-speed backplane products. Summary of the Invention

[0004] The purpose of this invention is to provide an encrypted communication method and system for EtherCAT slave nodes, aiming to solve the technical problem of maintaining the high real-time performance of the EtherCAT protocol and realizing exclusive communication between the coupler and I / O module in the EtherCAT high-speed backplane bus scheme, while taking into account both communication performance and product security.

[0005] This invention is implemented as follows: an encrypted communication system for EtherCAT slave nodes includes at least two EtherCAT slave nodes. Each EtherCAT slave node includes a coupler and an I / O module. The coupler is used to convert external industrial protocols into EtherCAT protocols or to form an EtherCAT network with other EtherCAT slave nodes. The I / O module is used to acquire analog / digital input signals or drive analog / digital output signals. Each EtherCAT slave node has a built-in EtherCAT slave chip, which integrates a storage unit for storing the keys required for encryption and scrambling.

[0006] Each EtherCAT slave chip integrates an encryption / scrambling unit at the EtherCAT message sending end and a decryption / descrambling unit at the receiving end. The encryption / scrambling unit is used to perform encryption / scrambling processing on the sent EtherCAT message stream; the decryption / descrambling unit is used to perform decryption / descrambling processing on the received EtherCAT message stream. The encryption / scrambling and decryption / descrambling processes do not affect the forwarding function of the EtherCAT slave chip for EtherCAT messages.

[0007] Without affecting the standard communication between the EtherCAT slave node and the EtherCAT master, the coupler and the I / O module construct an encrypted network through the encryption scrambling, decryption and descrambling of the EtherCAT slave chip and the key. When the EtherCAT slave chip of the coupler and the I / O module stores the same key, the coupler and the I / O module can communicate. If the keys are different, they cannot communicate.

[0008] A further technical solution of the present invention is: the encryption and scrambling unit uses 8-bit bytes of EtherCAT messages as units, according to the formula Perform encryption and scrambling, where This is the message byte sequence number, with a value ranging from 1 to 1518. The first EtherCAT message before encryption and scrambling byte, For the encrypted and scrambled EtherCAT message, the first... byte, The key is used; or the AES encryption algorithm is used to encrypt and scramble the EtherCAT message.

[0009] A further technical solution of the present invention is: the method by which the decryption / descrambling unit corresponds to the encryption / scrambling unit is based on the formula... Perform decryption and descrambling; or use the AES decryption algorithm to perform decryption and descrambling.

[0010] A further technical solution of the present invention is that the storage unit is an OTP memory or a non-volatile memory.

[0011] A further technical solution of the present invention is: the encryption process of the encryption scrambling unit includes:

[0012] Initialization: Read the key from the storage unit. Initialize the encryption state variable as ;

[0013] Message segmentation: The EtherCAT message to be sent is segmented into 8-bit bytes. to ;

[0014] Encryption byte by byte, from Begin by calculating sequentially. Continue until all bytes are encrypted;

[0015] Byte encapsulation: Encrypted to It is encapsulated into a frame structure conforming to the EtherCAT protocol and sent through the specified network port.

[0016] A further technical solution of the present invention is: the decryption processing of the decryption and descrambling unit includes:

[0017] Message reception: Receive encrypted EtherCAT messages through the designated network port and extract... to ;

[0018] Key reading: Reading the key from the local storage unit Initialize the decryption state variable as ;

[0019] Decrypting byte by byte: From Begin by calculating sequentially. This continues until all bytes have been decrypted.

[0020] Message verification: Check the decrypted message. to If the frame conforms to the EtherCAT protocol's frame structure, it is forwarded to the next processing unit; otherwise, it is discarded.

[0021] A further technical solution of the present invention is: the coupler is provided with at least two network ports, with network port 1 specifically used to build the encrypted network with the I / O module, and the other network ports used for standard EtherCAT communication with the EtherCAT master station or other standard EtherCAT slave stations.

[0022] A further technical solution of the present invention is: when using the AES encryption algorithm, specifically the AES-128 or AES-256 mode, the EtherCAT message is divided into 128-bit or 256-bit data blocks, each data block is encrypted with a key, and the encrypted data blocks are concatenated in the original order to form an encrypted message.

[0023] A further technical solution of the present invention is: the EtherCAT slave chip supports switching between "plaintext communication mode" and "encrypted communication mode": when configured in plaintext communication mode, the encryption scrambling unit and the decryption descrambling unit stop working, and the EtherCAT slave node communicates normally with other standard EtherCAT slave chips; when configured in encrypted communication mode, the encryption scrambling and decryption descrambling functions are enabled.

[0024] Another object of the present invention is to provide an encrypted communication method for EtherCAT slave nodes, the encrypted communication method comprising the following steps:

[0025] S1. When the EtherCAT network is powered on, the coupler and I / O module are initialized and the key is loaded.

[0026] S2. The EtherCAT master station sends an EtherCAT message to the coupler's network port Port0. The coupler forwards the message to the EPU to execute the message and then encrypts and scrambles the message. Finally, it sends the message to the I / O module slave node's network port Port0 through network port1.

[0027] S3, the I / O module slave node decrypts and descrambles the encrypted messages received at network port Port0, forwards the messages to the EPU to execute the messages, and then re-encrypts and scrambles the messages before forwarding them to the next I / O module slave node's network port Port0 through network port Port1;

[0028] S4. Determine whether the I / O module is the last EtherCAT slave node. If yes, the last I / O module slave node decrypts and descrambles the encrypted message received by the network port Port0, forwards the message to the EPU to execute the message, and then encrypts and scrambles the message again before forwarding the message back to the network port Port1 of the previous I / O module slave node through the network port Port0 and proceeds to the next step. If not, return to step S3.

[0029] S5, the I / O module slave node directly forwards the encrypted message received by network port Port1 to the previous slave node through network port Port0 until it is sent to network port Port1 of the coupler;

[0030] S6. After decrypting and descrambling the encrypted message received by the network port 1, the coupler forwards the plaintext message to the next coupler through the network port 2, so that the plaintext message finally returns to the EtherCAT master station.

[0031] A further technical solution of the present invention is that the encryption algorithm is XOR encryption or AES encryption.

[0032] The beneficial effects of this invention are: It achieves encrypted scrambling communication between EtherCAT slave chips through encryption and scrambling, protecting the privacy requirements of different products. Following the EtherCAT protocol standard, the EtherCAT network requires no modifications and does not sacrifice EtherCAT communication performance. It enables non-homogeneous communication between EtherCAT slave chips of the same model, reducing chip costs. Attached Figure Description

[0033] Figure 1 This is a schematic diagram illustrating the implementation of EtherCAT message encryption / scrambling / decryption / descrambling by the EtherCAT slave chip provided in this embodiment of the invention. Figure 1 .

[0034] Figure 2 This is a schematic diagram illustrating the implementation of EtherCAT message encryption / scrambling / decryption / descrambling by the EtherCAT slave chip provided in this embodiment of the invention. Figure 2 .

[0035] Figure 3 This is a flowchart of an encrypted communication method between EtherCAT slave nodes provided in an embodiment of the present invention. Detailed Implementation

[0036] Embodiments of the present invention are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain the present invention, and should not be construed as limiting the present invention.

[0037] In the description of this invention, it should be understood that the terms "length," "width," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," and "outer," etc., indicating orientation or positional relationships, are based on the orientation or positional relationships shown in the accompanying drawings and are only for the convenience of describing the invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of the invention. Furthermore, in the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0038] like Figure 1 As shown, the encrypted communication system for EtherCAT slave nodes provided by the present invention includes at least two EtherCAT slave nodes. Each EtherCAT slave node includes a coupler and an I / O module. The coupler is used to convert external industrial protocols into EtherCAT protocols or to form an EtherCAT network with other EtherCAT slave nodes. The I / O module is used to acquire analog / digital input signals or drive analog / digital output signals. Each EtherCAT slave node has a built-in EtherCAT slave chip, and the EtherCAT slave chip integrates a storage unit for storing the keys required for encryption and scrambling.

[0039] Each EtherCAT slave chip integrates an encryption / scrambling unit at the EtherCAT message sending end and a decryption / descrambling unit at the receiving end. The encryption / scrambling unit is used to perform encryption / scrambling processing on the sent EtherCAT message stream; the decryption / descrambling unit is used to perform decryption / descrambling processing on the received EtherCAT message stream. The encryption / scrambling and decryption / descrambling processes do not affect the forwarding function of the EtherCAT slave chip for EtherCAT messages.

[0040] Without affecting the standard communication between the EtherCAT slave node and the EtherCAT master, the coupler and the I / O module construct an encrypted network through the encryption scrambling, decryption and descrambling of the EtherCAT slave chip and the key. When the EtherCAT slave chip of the coupler and the I / O module stores the same key, the coupler and the I / O module can communicate. If the keys are different, they cannot communicate.

[0041] This solution implements encrypted scrambling communication between EtherCAT slave nodes at the chip level. This prevents communication between different manufacturers using the same model of EtherCAT slave chip, provided they are configured for encrypted scrambling communication and have different encryption / scrambling keys. Furthermore, when the EtherCAT slave chip is configured for plaintext communication, it can communicate normally with other EtherCAT slave chips.

[0042] The EtherCAT slave chip implements OTP or non-volatile memory for programming encryption and scrambling keys. The EtherCAT slave performs encryption and scrambling of the message stream at the EtherCAT message sending end and decryption and descrambling of the EtherCAT message stream at the receiving end, without affecting the chip's forwarding of EtherCAT messages. Figure 1 As shown.

[0043] EtherCAT messages are sent / received in units of bytes (8 bits), where:

[0044] P(X): Represents the Xth byte of the EtherCAT message before encryption and scrambling;

[0045] C(X): Represents the Xth byte of the encrypted and scrambled EtherCAT message;

[0046] The formula for encryption and scrambling is: C(X) = C(X-1) ^ P(X) (X=1,2,...,1518);

[0047] The formula for decryption and descrambling is: P(X) = C(X) ^ C(X-1) (X=1,2,...,1518);

[0048] Where C(0) is the encryption scrambling key, and the encrypted streams will be different as long as C(0) is different.

[0049] Encryption and scrambling of EtherCAT slave stations can also be achieved through encryption / decryption methods such as AES.

[0050] The network consisting of the coupler and I / O slave nodes is shown in the figure below. In the implementation scheme of this patent, without affecting the standard network communication with the EtherCAT master station, an encrypted network is isolated between the coupler and the I / O slave nodes. The encrypted network is exclusive; the coupler's network port Port1 can only communicate encryptedly with specific I / O slave nodes. The encryption scrambling / decryption / descrambling circuit implemented in the coupler and I / O slave nodes is the circuit implementation scheme of this patent. Moreover, as long as different manufacturers use different encryption scrambling keys, different couplers and I / O slave nodes using the same chip can build any non-homogeneous encrypted network, further protecting product security. Figure 2 As shown.

[0051] The EtherCAT private encrypted network implemented in this application does not affect communication with the EtherCAT master station and other standard EtherCAT slave stations via standard networks, nor does it affect the communication performance of the EtherCAT network.

[0052] The encryption scrambling unit uses 8-bit bytes of EtherCAT messages as the unit, according to the formula... Perform encryption and scrambling, where This is the message byte sequence number, with a value ranging from 1 to 1518. The first EtherCAT message before encryption and scrambling byte, For the encrypted and scrambled EtherCAT message, the first... byte, The key is used; or the AES encryption algorithm is used to encrypt and scramble the EtherCAT message.

[0053] The decryption / descrambling unit corresponds to the encryption / scrambling unit in a manner that follows the formula. Perform decryption and descrambling; or use the AES decryption algorithm to perform decryption and descrambling.

[0054] The encryption process of the encryption scrambling unit includes:

[0055] Initialization: Read the key from the storage unit. Initialize the encryption state variable as ;

[0056] Message segmentation: The EtherCAT message to be sent is segmented into 8-bit bytes. to ;

[0057] Encryption byte by byte, from Begin by calculating sequentially. Continue until all bytes are encrypted;

[0058] Byte encapsulation: Encrypted to It is encapsulated into a frame structure conforming to the EtherCAT protocol and sent through the specified network port.

[0059] The decryption process of the decryption and descrambling unit includes:

[0060] Message reception: Receive encrypted EtherCAT messages through the designated network port and extract... to ;

[0061] Key reading: Reading the key from the local storage unit Initialize the decryption state variable as ;

[0062] Decrypting byte by byte: From Begin by calculating sequentially. This continues until all bytes have been decrypted.

[0063] Message verification: Check the decrypted message. to If the frame conforms to the EtherCAT protocol's frame structure, it is forwarded to the next processing unit; otherwise, it is discarded.

[0064] The coupler has at least two network ports. Port 1 is dedicated to building the encrypted network with the I / O module, while the other network ports are used for standard EtherCAT communication with the EtherCAT master or other standard EtherCAT slaves.

[0065] When using the AES encryption algorithm, specifically AES-128 or AES-256 mode, the EtherCAT message is divided into 128-bit or 256-bit data blocks. Each data block is encrypted using a key, and the encrypted data blocks are concatenated in their original order to form an encrypted message.

[0066] EtherCAT slave chips support switching between "plaintext communication mode" and "encrypted communication mode": When configured in plaintext communication mode, the encryption scrambling unit and decryption / descrambling unit stop working, and the EtherCAT slave node can communicate normally with other standard EtherCAT slave chips; when configured in encrypted communication mode, encryption scrambling and decryption / descrambling functions are enabled.

[0067] like Figure 3 The flowchart shown is a method for encrypted communication between EtherCAT slave nodes, and its details are as follows:

[0068] Step S1: Power on the constructed EtherCAT network and initialize its couplers and I / O modules, setting their state variables to... And load the encryption / scrambling / decryption / descrambling key.

[0069] Step S2: On the encrypted network, the EtherCAT master station sends an EtherCAT message to the coupler's network port Port0. The coupler forwards the message to the EPU to execute the message and then encrypts and scrambles the message. Finally, it sends the message to the I / O module slave node's network port Port0 through network port1.

[0070] Step S3: The I / O module slave node decrypts and descrambles the encrypted message received at network port Port0, forwards the message to the EPU to execute the message, and then further encrypts and scrambles the message before forwarding it to the network port Port0 of the next I / O module slave node through network port Port1;

[0071] Step S4: Determine whether the I / O module is the last EtherCAT slave node. If yes, the last I / O module slave node decrypts and descrambles the encrypted message received by the network port Port0, forwards the message to the EPU to execute the message, and then encrypts and scrambles the message again before forwarding it back to the network port Port1 of the previous I / O module slave node through the network port Port0 and proceeding to the next step. If no, return to step S3.

[0072] Step S5: The I / O module slave node directly forwards the encrypted message received by network port Port1 to the previous slave node through network port Port0 until it is sent to network port Port1 of the coupler;

[0073] In step S6, the coupler decrypts and descrambles the encrypted message received by port 1 and then forwards the plaintext message to the next coupler through port 2, so that the plaintext message finally returns to the EtherCAT master station.

[0074] The implemented EtherCAT private encrypted network does not affect standard network communication with EtherCAT master stations and other standard EtherCAT slave stations, nor does it affect the communication performance of the EtherCAT network.

[0075] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A system for encrypted communication between EtherCAT slave nodes, comprising at least two EtherCAT slave nodes, each of the EtherCAT slave nodes comprising a coupler and an I / O module, the coupler being configured to convert an external industrial protocol into an EtherCAT protocol or to form an EtherCAT network with other EtherCAT slave nodes, the I / O module being configured to acquire analog / digital input signals or to drive analog / digital output signals, characterized in that, Each of the EtherCAT slave nodes is built-in with an EtherCAT slave chip, and the EtherCAT slave chip is integrated with a storage unit for storing a key required for encryption and scrambling; Each of the EtherCAT slave chips is integrated with an encryption and scrambling unit at a sending end of an EtherCAT message and an decryption and descrambling unit at a receiving end, the encryption and scrambling unit is used for performing encryption and scrambling processing on a sent EtherCAT message stream, and the decryption and descrambling unit is used for performing decryption and descrambling processing on a received EtherCAT message stream, and the encryption and scrambling processing and the decryption and descrambling processing do not affect a forwarding function of the EtherCAT slave chip on the EtherCAT message; When standard communication between the EtherCAT slave nodes and an EtherCAT master station is not affected, the coupler and the I / O module build an encrypted network through encryption, decryption, descrambling and key construction of the EtherCAT slave chip, when the EtherCAT slave chips of the coupler and the I / O module store the same key, communication is realized between the coupler and the I / O module, and when the keys are different, communication cannot be realized.

2. The system for encrypted communication between EtherCAT slave node according to claim 1, wherein, The encryption scrambling unit adopts 8-bit bytes of EtherCAT messages as units, and performs encryption scrambling according to the formula performing encryption scrambling, wherein is a message byte serial number, and the value range is 1 to 1518, is the first byte of the EtherCAT message before encryption scrambling, is the first byte of the EtherCAT message after encryption scrambling, is the first byte of the EtherCAT message after encryption scrambling, is the first byte of the EtherCAT message after encryption scrambling, is the key; or the AES encryption algorithm is used to perform encryption scrambling on the EtherCAT message.

3. The system for encrypted communication between EtherCAT slave node according to claim 2, wherein, The decryption descrambling unit corresponds to the encryption scrambling unit in the manner of formula The decryption descrambling is executed; or the decryption descrambling is executed in the AES decryption algorithm.

4. The system for encrypted communication between EtherCAT slave node according to claim 3, wherein, The storage unit is an OTP memory or a non-volatile memory.

5. The system for encrypted communication between EtherCAT slave node according to claim 4, wherein, The encryption processing of the encryption and scrambling unit includes: Initialization: Read the key in the storage unit , initialize the encryption state variable to ; Packet segmentation: the EtherCAT packet to be sent is segmented into 8-bit bytes to ; byte-by-byte encryption, from starting, computing in sequence, until all byte encryption is complete; Byte encapsulation: the encrypted to encapsulated into a frame structure conforming to the EtherCAT protocol and sent through the specified network port.

6. The system for encrypted communication between EtherCAT slave node according to claim 5, wherein, The decryption processing of the decryption and descrambling unit includes: Packet receiving: receiving encrypted EtherCAT packet through designated network port, extracting to ; Key read: read key in local storage unit , initialize decryption state variable to ; Byte-by-byte decryption: from start, compute in sequence , until all bytes are decrypted; Message verification: check the decrypted to whether it conforms to the frame structure of EtherCAT protocol, if it conforms, it is forwarded to subsequent processing unit, if it does not conform, the message is discarded.

7. The system for encrypted communication between EtherCAT slave node according to claim 6, wherein, The coupler is provided with at least two network ports, a network port Port1 is specially used for building the encrypted network with the I / O module, and other network ports are used for standard EtherCAT communication with the EtherCAT master station or other standard EtherCAT slave nodes.

8. The system for encrypted communication between EtherCAT slave node according to claim 7, wherein, When an AES encryption algorithm is used, the AES encryption algorithm is specifically in an AES-128 or AES-256 mode, the EtherCAT message is divided according to 128-bit or 256-bit data blocks, each data block is encrypted through a key, and the encrypted data blocks are spliced in the original order to form an encrypted message.

9. The system for encrypted communication between EtherCAT slave node according to claim 8, wherein, The EtherCAT slave chip supports switching between a plaintext communication mode and an encrypted communication mode: when the EtherCAT slave chip is configured as the plaintext communication mode, the encryption and scrambling unit and the decryption and descrambling unit stop working, and the EtherCAT slave node normally communicates with other standard EtherCAT slave chips; and when the EtherCAT slave chip is configured as the encrypted communication mode, the encryption and scrambling function and the decryption and descrambling function are enabled.

10. A method for encrypted communication between EtherCAT slave nodes, characterized in that, The encrypted communication method includes the following steps: S1, power on of an EtherCAT network, power-on initialization and key loading of the coupler and the I / O module; S2, the EtherCAT master station sends an EtherCAT message to a network port Port0 of the coupler, the coupler forwards the message to an EPU to execute the message and performs encryption and scrambling processing on the message, and then sends the message to a network port Port0 of an I / O module slave node through a network Port1; S3, the I / O module slave node decrypts and descrambles the encrypted message received by the network port Port0, forwards the message to the EPU to execute the message, and continues to encrypt and scramble the message, and then forwards the message to the network port Port1 of the next I / O module slave node through the network port Port0; S4, whether the I / O module is the last EtherCAT slave node is judged, if yes, the last I / O module slave node decrypts and descrambles the encrypted message received by the network port Port0, forwards the message to the EPU to execute the message, and continues to encrypt and scramble the message, and then forwards the message to the network port Port1 of the previous I / O module slave node through the network port Port0 and executes the next step, if not, returns to step S3; S5, the I / O module slave node directly forwards the encrypted message received by the network port Port1 to the network port Port0 of the previous slave node until the network port Port1 of the coupler; S6, the coupler decrypts and descrambles the encrypted message received by the network port Port1, and forwards the clear text message to the next coupler through the network port Port2, so that the final clear text message returns to the EtherCAT master station.

Images