A Real-Time Hierarchical Scheduling Method for Embedded Devices (TEEs) in Industrial Control Systems
By employing a two-layer hierarchical scheduling method in the embedded device TEE of the industrial control system, security and real-time performance are decoupled, interrupt overhead is reduced, and the complexity and performance problems of TCB in the prior art are solved, thereby improving real-time availability and security.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- ZHEJIANG UNIV
- Filing Date
- 2022-10-19
- Publication Date
- 2026-05-05
AI Technical Summary
In the prior art, the real-time process management of embedded devices (TEEs) in industrial control systems significantly increases the complexity of the TCB and interrupt overhead, affecting system performance.
A two-layer hierarchical scheduling design is adopted, with a security scheduler and an environment scheduler implemented in a secure environment and an insecure environment, respectively. Real-time task scheduling is performed based on priority to reduce interaction between environments, and a safety timer is set through predictable scheduling events to reduce the number of interruptions.
This reduces the complexity of TCB, ensures the real-time availability and security of the system, and improves system performance.
Smart Images
Figure CN115632792B_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of real-time process management technology for embedded TEE devices in industrial control systems, specifically relating to a real-time hierarchical scheduling method for TEE devices embedded in industrial control systems. Background Technology
[0002] In real-time systems of embedded devices in industrial control systems, security, criticality, and timeliness are the most important attributes of a single real-time task (process). Security refers to the ability to maintain confidentiality and integrity during attacks. Trusted Execution Environments (TEEs), based on hardware-provided isolation mechanisms, focus on protecting the confidentiality and integrity of the system. Criticality refers to the importance of a task to the correct operation of the system, and is usually consistent with security. Therefore, applying a TEE effectively protects the security and criticality of the system. Timeliness refers to completing a specific task before the deadline. To ensure timeliness, schedulable analysis is often performed during design, using a set of real-time task characteristics (cycle, deadline, budget) and generating a set of scheduling parameters. These parameters ensure that all tasks have computational resources to complete before the deadline. However, directly implementing such a scheduler for all secure and insecure processes significantly increases the complexity of the TCB, thus impacting system performance.
[0003] Currently, most TEE real-time process management is handled by a global scheduler in the insecure environment. In the secure environment, there is no scheduler, and system availability cannot be guaranteed. Moving the global scheduler directly into the secure environment introduces two problems: 1) The global scheduler still needs to understand the semantics of insecure tasks and maintain runtime information, significantly increasing its complexity; 2) During scheduling, the secure environment assumes that input information from the insecure environment is malicious, therefore, the interaction between the two environments in scheduling needs to be minimized. One existing scheduling method to minimize interaction is idle scheduling, which always prioritizes secure tasks. However, secure tasks do not necessarily require the shortest response time, so idle scheduling may lead to a decrease in overall system performance. Furthermore, traditional scheduling algorithms typically use timers to interrupt at fixed intervals, the overhead of which is tolerable in systems without a secure architecture. However, in TEEs, the context switching between secure and insecure environments is complex, and the overhead of time-slice interrupts is unacceptable. Summary of the Invention
[0004] Therefore, the technical problem this invention aims to solve is that the real-time process management of TEE (Transmission Equipment) in embedded devices of industrial control systems in the prior art significantly increases the complexity of the Task Control Block (TCB), leading to excessive interrupt overhead and affecting the overall system performance. This application proposes a real-time hierarchical scheduling method for TEE in embedded devices of industrial control systems. This method implements a secure scheduler that performs real-time task scheduling based solely on priority within the secure environment of the embedded device in the industrial control system with deployed TEE, effectively ensuring the real-time availability of the system. This method adopts a two-layer hierarchical scheduling design, decoupling security and real-time performance, minimizing the interaction between the secure and non-secure environments, reducing TCB complexity, and ensuring overall system performance. This method is event-driven, setting interrupts based on predictable scheduling events, significantly reducing the number of interrupts during the scheduling process and substantially reducing the system's interrupt overhead.
[0005] To achieve the above objectives, the technical solution of the present invention is as follows: A real-time hierarchical scheduling method for an embedded device TEE in an industrial control system, the method comprising the following steps:
[0006] S1: In the non-safe environment of the embedded device of the industrial control system with TEE already deployed, initialize the safe and non-safe environment parameters, initialize the real-time task parameters, load the user task, and start the environment scheduler in the safe environment;
[0007] S2: The environment scheduler supplements the budget and update the deadline for the safe environment and the unsafe environment based on the current environment parameters, and sets both environments to a runnable state;
[0008] S3: The environment scheduler sets a safety timer based on the next scheduling event, and then jumps to the safety scheduler for the safe environment in step S4 or the scheduler for the unsafe environment in step S5 according to the environment priority algorithm.
[0009] S4: The safety scheduler consumes the budget supplemented in step S2, updates the budget for the safety real-time task, and switches the execution of the safety real-time task according to the safety scheduling algorithm;
[0010] S5: The insecure scheduler switches the execution of insecure real-time tasks according to the insecure scheduling algorithm;
[0011] S6: When the safety timer set in step S3 expires, interrupt the execution of the current task, save the task context, and jump to the environment scheduler in step S2.
[0012] Furthermore, in step S1, the environmental parameters include environmental budget, environmental deadline, environmental cycle, and environmental status for both safe and unsafe environments; the environmental status includes four types: running, runnable, budget insufficient, and idle, with the initial state being budget insufficient.
[0013] Furthermore, in step S1, the initialization of real-time task parameters specifically includes the following steps:
[0014] S11: Determine the real-time task model for secure and unsecured environments;
[0015] S12: Perform a comprehensive schedulable analysis on the real-time task model obtained in step S11;
[0016] S13: Generate real-time task parameters, including task budget, task execution time, task deadline, task cycle, and task priority.
[0017] Furthermore, in step S2, when the embedded device is initialized, the environment parameters are the initialization parameters in step S1. After initialization, the environment parameters are updated by the environment scheduler in a secure environment.
[0018] Furthermore, the supplementary budget in step S2 specifically includes the following steps:
[0019] S21: Update the execution budget. If the execution budget is less than the consumption, proceed to step S22; if the execution budget is not less than the consumption, proceed to step S24.
[0020] S22: Compare the replenishment area header budget with the consumption amount. If the replenishment area header budget is less than the consumption amount, proceed to step S23; otherwise, proceed to step S24.
[0021] S23: Subtract the head budget of the replenishment area from the consumption, assign the original head budget of the replenishment area to the tail, shift the overall replenishment area budget upward, and jump to step S22.
[0022] S24: Merge the execution budget with the head budget to complete the budget supplementation.
[0023] Furthermore, in step S3, the environment scheduler sets a safety timer based on the next scheduling event, which includes high-priority tasks entering the queue, budget replenishment, and task completion.
[0024] Furthermore, in step S3, the environment priority algorithm used is the delay monotonic rate algorithm, where the current task τ i Delayed preemption state time t i for:
[0025] t i ≤D1-T-e1-COUT i -CIN i
[0026] Where D1 is the deadline of the preempted task τ1, T is the current time, e1 is the running time of task τ1, and COUT is the timeout. i and CINi Task τ i The cut-out and cut-in times.
[0027] Further, in step S4, the safety scheduler switches the execution of safety real-time tasks according to a monotonic rate algorithm, including RTU management and control tasks, real-time I / O interrupt tasks, excess analog input reporting tasks, and state change reporting tasks; safety task τ i Priority P i The calculation method is as follows:
[0028]
[0029] Among them W i For safety weighting, reflecting the safety importance of the task, T i The task cycle is defined as follows: the shorter the cycle, the higher the priority. k is the urgency coefficient.
[0030] Furthermore, in step S5, the insecure scheduler switches the execution of insecure real-time tasks according to the round-robin scheduling algorithm, including the kWh counter monitoring task, the real-time I / O driving task, and the real-time network transmission task.
[0031] Further, in step S6, the task context is a structure, including task period, task budget, task deadline, supplementary area length, supplementary area header, supplementary area tail, and execution budget supplementary part, wherein the length of the execution budget supplementary part is variable, and the lengths of other parameters are fixed.
[0032] The beneficial effects of this invention are as follows:
[0033] This invention employs a two-layer design to decouple security and real-time performance. A security scheduler and an environment scheduler are implemented separately in the security environment, reducing the complexity of the TCB (Tracking Control Block). The security scheduler schedules real-time tasks solely based on priority, ensuring the system's real-time availability. The environment scheduler restores either the security or non-security environment, reducing interaction between the two environments while the system works collaboratively, thus improving system security. Appropriately setting security timers based on predictable scheduling events significantly reduces the number of interrupts and lowers interrupt overhead during system scheduling. Attached Figure Description
[0034] Figure 1 A flowchart illustrating a real-time hierarchical scheduling method for an embedded TEE (Technical Equipment Environment) in an industrial control system, according to an embodiment of the present invention.
[0035] Figure 2 This is an API execution flow diagram of a real-time hierarchical scheduling method for an embedded TEE in an industrial control system according to an embodiment of the present invention;
[0036] Figure 3This is a supplementary budget flowchart for step S2 in a real-time hierarchical scheduling method for an embedded device TEE in an industrial control system according to an embodiment of the present invention.
[0037] Figure 4 This is a scheduling architecture diagram of a real-time hierarchical scheduling method for an embedded TEE in an industrial control system according to an embodiment of the present invention. Detailed Implementation
[0038] To better understand the technical solution of this application, the embodiments of this application will be described in detail below with reference to the accompanying drawings.
[0039] like Figure 1 As shown, the present invention proposes a real-time hierarchical scheduling method for an embedded device TEE in an industrial control system, comprising the following steps:
[0040] S1: In this embodiment, a TEE is implemented on a substation RTU based on the ARMv8 architecture, and the operating system for the safe environment is implemented by an OP-TEE. In the non-safe environment (RTU execution environment), the parameters for both the safe and non-safe environments are initialized, real-time task parameters are initialized, user tasks are loaded, and the environment scheduler in the safe environment is started, such as... Figure 2 As shown. Environmental parameters include the environment budget, environment deadline, environment cycle, and environment status for both safe and unsafe environments; environment status includes four types: running, runnable (environment has budget but is not running), insufficient budget, and idle (environment has budget but no tasks are running), initially in the insufficient budget state. Initializing real-time task parameters specifically includes the following steps:
[0041] S11: Determine the real-time task model for secure and unsecured environments;
[0042] S12: Perform a comprehensive schedulable analysis on the real-time task model obtained in step S11;
[0043] S13: Generate real-time task parameters, including task budget, task execution time, task deadline, task cycle, and task priority.
[0044] S2: The environment scheduler, based on the current environment parameters, supplements the budget and update deadlines for both the secure and insecure environments, setting both environments to a runnable state. During embedded device initialization, the environment parameters are the initialization parameters from step S1. After initialization, the environment parameter updates are performed by the environment scheduler in the secure environment. For example... Figure 3 As shown, the supplementary budget includes the following steps:
[0045] S21: Update the execution budget. If the execution budget is less than the consumption, proceed to step S22; if the execution budget is not less than the consumption, proceed to step S24.
[0046] S22: Compare the replenishment area header budget with the consumption amount. If the replenishment area header budget is less than the consumption amount, proceed to step S23; otherwise, proceed to step S24.
[0047] S23: Subtract the head budget of the replenishment area from the consumption, assign the original head budget of the replenishment area to the tail, shift the overall replenishment area budget upward, and jump to step S22.
[0048] S24: Merge the execution budget with the head budget to complete the budget supplementation.
[0049] S3: The environment scheduler sets a safety timer based on the next scheduling event, which includes high-priority tasks entering the queue, budget replenishment, and task completion. Then, according to the Delay Monotonic Rate (DRM) algorithm, it jumps to either the safety scheduler in step S4 (safe environment) or the scheduler in step S5 (unsafe environment). Current task τ i Delayed preemption state time t i for:
[0050] t i ≤D1-T-e1-COUT i -CIN i
[0051] Where D1 is the deadline of the preempted task τ1, T is the current time, e1 is the running time of task τ1, and COUT is the timeout. i and CIN i Task τ i The cut-out and cut-in times.
[0052] S4: The safety scheduler consumes the budget supplemented in step S2 to update the budget for safety real-time tasks. It switches the execution of safety real-time tasks according to the monotonic rate (RM) algorithm, including RTU management and control tasks, real-time I / O interrupt tasks, excess analog input reporting tasks, and state change reporting tasks. Safety task τ i Priority P i The calculation method is as follows:
[0053]
[0054] Among them W i For safety weighting, reflecting the safety importance of the task, T i The task cycle is defined as the time period, with shorter cycles indicating higher priority. k is the urgency coefficient, which can be set to 1.
[0055] S5: The insecure scheduler switches between insecure real-time tasks based on the round-robin scheduling algorithm built into the Linux system scheduler. These tasks include the kWh counter monitoring task, the real-time I / O driver task, and the real-time network transmission task.
[0056] S6: When the safety timer set in step S3 expires, interrupt the current task execution and save the task context, such as... Figure 4 As shown, the process jumps to the environment scheduler in step S2. The task context is a structure, including the task period, task budget, task deadline, supplementary area length, supplementary area header, supplementary area tail, and execution budget supplementary part, wherein the length of the execution budget supplementary part is variable, and the lengths of other parameters are fixed.
[0057] This embodiment describes a real-time hierarchical scheduling method for an embedded TEE (Transmission Equipment) in an industrial control system. It employs a two-layer design to decouple security and real-time performance. A security scheduler and an environment scheduler are implemented separately in a secure environment, reducing the complexity of the TCB (Transmission Control Block). The environment scheduler restores either the secure or non-secure environment, reducing interaction between the two environments while ensuring system collaboration and improving system security. The security scheduler schedules real-time tasks solely based on priority, guaranteeing real-time system availability. Appropriately setting security timers based on predictable scheduling events significantly reduces the number of interrupts and lowers interrupt overhead during system scheduling.
[0058] Obviously, the above embodiments are merely illustrative examples for clear explanation and are not intended to limit the implementation. Those skilled in the art will recognize that other variations or modifications can be made based on the above description. It is neither necessary nor possible to exhaustively list all possible implementations here. However, obvious variations or modifications derived therefrom are still within the scope of protection of this invention.
Claims
1. A real-time hierarchical scheduling method for a TEE (Transmission Equipment) embedded device in an industrial control system, characterized in that, Includes the following steps: S1: In the non-safe environment of the embedded device of the industrial control system with TEE already deployed, initialize the safe and non-safe environment parameters, initialize the real-time task parameters, load the user task, and start the environment scheduler in the safe environment; S2: The environment scheduler supplements the budget and update the deadline for the safe environment and the unsafe environment based on the current environment parameters, and sets both environments to a runnable state; S3: The environment scheduler sets a safety timer based on the next scheduling event, and then jumps to the safety scheduler in the safe environment (step S4) or the scheduler in the insecure environment (step S5) according to the environment priority algorithm; the next scheduling event includes high-priority tasks entering the queue, budget replenishment, and task completion; the environment priority algorithm used is the delay monotonic rate algorithm, and the current task... Delayed preemption state time for: in For the mission that was seized Task deadline For the current moment, For the task Task runtime, and Tasks The cut-out and cut-in times; S4: The safety scheduler consumes the budget supplemented in step S2, updates the budget for the safety real-time task, and switches the execution of the safety real-time task according to the safety scheduling algorithm; S5: The insecure scheduler switches the execution of insecure real-time tasks according to the insecure scheduling algorithm; S6: When the safety timer set in step S3 expires, interrupt the execution of the current task, save the task context, and jump to the environment scheduler in step S2.
2. The real-time hierarchical scheduling method for embedded TEE devices in industrial control systems according to claim 1, characterized in that, In step S1, the environmental parameters include environmental budget, environmental deadline, environmental cycle, and environmental status for both safe and unsafe environments; the environmental status includes four types: running, runnable, budget insufficient, and idle, with the initial state being budget insufficient.
3. The real-time hierarchical scheduling method for embedded TEE devices in industrial control systems according to claim 1, characterized in that, In step S1, the initialization of real-time task parameters specifically includes the following steps: S11: Determine the real-time task model for secure and unsecured environments; S12: Perform a comprehensive schedulable analysis on the real-time task model obtained in step S11; S13: Generate real-time task parameters, including task budget, task execution time, task deadline, task cycle, and task priority.
4. The real-time hierarchical scheduling method for embedded TEE devices in industrial control systems according to claim 1, characterized in that, In step S2, when the embedded device is initialized, the environment parameters are the initialization parameters in step S1. After initialization, the environment parameters are updated by the environment scheduler in a secure environment.
5. The real-time hierarchical scheduling method for embedded TEE devices in industrial control systems according to claim 1, characterized in that, The supplementary budget in step S2 specifically includes the following steps: S21: Update the execution budget. If the execution budget is less than the consumption, proceed to step S22; if the execution budget is not less than the consumption, proceed to step S24. S22: Compare the replenishment area header budget with the consumption amount. If the replenishment area header budget is less than the consumption amount, proceed to step S23; otherwise, proceed to step S24. S23: Subtract the head budget of the replenishment area from the consumption, assign the original head budget of the replenishment area to the tail, shift the overall replenishment area budget upward, and jump to step S22. S24: Merge the execution budget with the head budget to complete the budget supplementation.
6. The real-time hierarchical scheduling method for embedded TEE devices in industrial control systems according to claim 1, characterized in that, In step S4, the safety scheduler switches the execution of real-time safety tasks according to a monotonic rate algorithm, including RTU management and control tasks, real-time I / O interrupt tasks, excess analog input reporting tasks, and status change reporting tasks; safety tasks priority The calculation method is as follows: in The safety weight reflects the safety importance of the mission. The shorter the task cycle, the higher the priority. This represents the urgency coefficient.
7. The real-time hierarchical scheduling method for embedded TEE devices in industrial control systems according to claim 1, characterized in that, In step S5, the insecure scheduler switches the execution of insecure real-time tasks according to the round-robin scheduling algorithm, including the kWh counter monitoring task, the real-time I / O drive task, and the real-time network transmission task.
8. The real-time hierarchical scheduling method for embedded TEE devices in industrial control systems according to claim 1, characterized in that, In step S6, the task context is a structure, including task period, task budget, task deadline, supplementary area length, supplementary area header, supplementary area tail, and execution budget supplementary part, wherein the length of the execution budget supplementary part is variable, and the lengths of other parameters are fixed.