A secure Ethernet communication method based on IP-RAW protocol

Abstract

This invention discloses a secure Ethernet communication method based on the IP-RAW protocol, which relates to the field of rail transit train control technology. The method includes the following steps: initiating periodic communication, fully receiving IP-RAW data packets from all boards and buffering them on a main control board, and then checking whether a minimum set of IP-RAW data packets has been received. The device uses Ethernet for internal communication, offering data transmission rates and throughput far exceeding those of traditional communication methods such as CAN and RS485. Furthermore, Ethernet technology continues to advance and evolve, with transmission bandwidth and switching methods expanding and improving according to application requirements, facilitating the practical application of the present invention's technical solution.

Description

Technical Field

[0001] The present invention relates to the technical field of rail transit train control, and in particular to an Ethernet security communication method based on the IP-RAW protocol. Background Art

[0002] Compared with the CAN and 485 buses used on the chassis backplane, the advantages of the Ethernet bus lie in the transmission rate and data flow, but the disadvantage is that the real-time and security of the data often require the introduction of more software and hardware strategies to ensure.

[0003] Existing technology supports the use of Ethernet buses for secure communication equipment. High-performance industrial switch modules or PHYs (Ethernet physical layer chips) are already mature hardware options. However, the main challenges in developing secure communication equipment lie in software, including porting the protocol stack and designing secure communication protocols for specific hardware environments. Using mature protocol stack libraries provided by foreign manufacturers often requires large amounts of code, consumes memory resources during runtime, and does not utilize all the service interfaces provided by the TCP / IP protocol stack in practical applications. Therefore, the Ethernet protocol stack must be customized and tailored to meet the application requirements of secure communication equipment's intranet communications, such as communication handshake methods, data transmission mechanisms, data frame structures, and encryption methods. Summary of the Invention

[0004] The present invention provides an Ethernet security communication method based on IP-RAW protocol to solve the problems existing in the above-mentioned prior art.

[0005] In order to achieve the above object, the technical solution adopted by the present invention is:

[0006] An Ethernet secure communication method based on the IP-RAW protocol comprises the following steps:

[0007] Step 1) Periodic communication begins;

[0008] Step 2) The main control board receives all IP-RAW data packets from all boards and caches them;

[0009] Step 3) Check whether the minimum set IP-RAW data packet is received completely. If it is received completely, proceed to step 4. If it is not received completely after the timeout, the platform is directed to safety.

[0010] Step 4) storing the IP-RAW data packets according to the user device number, including the location and length of the IP-RAW data packet content;

[0011] Step 5) The application layer software of the main control board receives the complete unparsed IP-RAW data packet through the API interface;

[0012] Step 6) The application layer software unpacks the data according to the User Data Segment Protocol;

[0013] Step 7) The application layer software performs vehicle control logic operations based on the unpacked data;

[0014] Step 8) The application layer software fills in the user data segment based on the result of the logic operation and packages the result of the logic operation and the data output for external communication;

[0015] Step 9) The two main control boards cross-compare the output control data packets. If the comparison fails, the platform is directed to safety; if the comparison succeeds, proceed to step 10;

[0016] Step 10) The main system platform layer software sends the cross-checked packaged data to the external board;

[0017] Step 11) The periodic communication ends.

[0018] In step 1, before periodic communication begins, Ethernet initialization configuration is performed, including the following steps:

[0019] S1) Ethernet PHY is initialized successfully and a unique MAC address is configured;

[0020] S2) Each board sets its own IP;

[0021] S3) The main control board sends an ARP request message to each board;

[0022] S4) Each board replies with an ARP message to the main control board;

[0023] S5) The main control board creates a complete ARP table after receiving the reply;

[0024] S6) Determine the configuration requests received from all boards. If no configuration requests are received within a timeout, the platform is directed to safety. If a configuration request is received, the two main control boards cross-compare the configuration information to be issued.

[0025] S7) If the comparison fails, the platform is directed to safety; if the comparison succeeds, both main control boards of the two systems send configuration information to each board;

[0026] S8) The two system main control boards determine whether they have received the configuration success information of the minimum set unit. If not received within a timeout, the platform is directed to safety; if received, the platform Ethernet configuration is completed.

[0027] In the above steps, independent processors are used for both internal and external network communications on the platform. External network data is first converted into internal network protocols by independent processors, including physical communication and channel isolation.

[0028] In the above steps, the application layer software directly accesses the native data packets of the IP layer. The software adopts a layered structure of platform layer software packaging and application layer software parsing. The platform layer software forwards the IP-RAW data packets from each board to the application layer software. The user data segment in the IP-RAW data packet adopts the rail transit closed network security communication protocol RSSP-I, and the RSSP-I protocol is carried on the UDP protocol.

[0029] In the above steps, the IP-RAW protocol used after communication is established is a native transport layer protocol built on the IP protocol. The software customizes the IP header and data part to form an IP message array; the application layer software protocol is UDP, and the protocol's unique encryption verification data is all in the UDP data segment.

[0030] Compared with the prior art, the present invention has the following beneficial effects:

[0031] 1. The internal communication of the equipment adopts Ethernet, and the data transmission rate and throughput are much higher than those of traditional communication forms such as CAN and RS485. In addition, Ethernet technology is constantly advancing and evolving, and the transmission bandwidth and exchange method are constantly expanding and improving according to application requirements, which facilitates the practical application of the technical solution of the present invention.

[0032] 2. The present invention does not adopt the complete Ethernet TCP-IP\UDP protocol, but instead cuts down the relevant protocols. The cut-down protocol stack only needs to meet the ARP table building and UDP communication under the known IP, which greatly reduces the code volume of the complete TCP-IP\UDP protocol, reduces the file size of compilation and burning during application, reduces the probability of errors during compilation and application, and reduces the hardware storage carrier requirements and application costs.

[0033] 3. The present invention can currently be used as an internal bus of a redundant system. It optimizes the master-slave architecture of the redundant system and takes into account the master-slave mode within a single-system device. Not only does it have a better transmission bandwidth than bus modes such as CAN and RS485, but its actual effects, such as the number of slave devices it can support and the communication packet loss rate, are also better than existing buses. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 This is a schematic diagram of the structure of the train control and monitoring system platform in the form of single-ended redundancy;

[0035] Figure 2 This is a flow chart of Ethernet initialization configuration of the present invention;

[0036] Figure 3 This is a flow chart of Ethernet security communication of the present invention;

[0037] Figure 4 Schematic diagram of two Ethernet frame types used in the present invention. DETAILED DESCRIPTION

[0038] The following is a clear and complete description of the technical solutions implemented in the present invention in conjunction with the accompanying drawings. The embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0039] like Figures 1 to 4 As shown, an embodiment of the present invention provides an Ethernet security communication method based on the IP-RAW protocol, which can be applied to a single-ended redundant train control and monitoring system platform. This train control and monitoring system platform has two systems on a single end, and the equipment chassis consists of two sets of systems I and II. The functional boards of each system include but are not limited to the main control board, communication board, recording board, IO board and switch board. One of the two systems serves as the main system. The functional boards and switch boards within the system communicate with each other through the backplane Ethernet bus. The main control boards of the two systems can communicate through the backplane Ethernet bus or through the switch boards of each system. All boards are intelligent boards with Ethernet physical chips and independent processor chips (except for the switch board and power board).

[0040] The communication board mainly realizes the platform's internal and external Ethernet communication functions, and serves as the communication interface between the platform and the vehicle-mounted network equipment.

[0041] The recording board is an important maintenance function module of the platform, which stores and records important data according to project needs. The recording board also uses the Ethernet communication protocol proposed by the present invention to receive data from the backplane.

[0042] The main control board serves as the control board of the platform. Its software is divided into platform layer software and application layer software. The platform layer software provides board-level driver support, performs board self-test, and realizes external data reception and transmission. The application layer software is a link called during the execution of the platform layer software. It performs logical operations based on the input data of the platform layer software. Finally, the platform layer software outputs configuration information and control data to the outside. There is an Ethernet direct connection between the main control boards, and an Ethernet backup path is provided between the main control board and the switch.

[0043] The IO board collects the switch signals in the vehicle as the input data of the platform, and provides dry contact output for the vehicle according to the logical business processing of the platform. Specifically, the Ethernet communication method of the present invention is carried out according to the following steps:

[0044] Step 1) Periodic communication begins;

[0045] Step 2) The main control board receives all IP-RAW data packets from all boards and caches them;

[0046] Step 3) Check whether the minimum set of IP-RAW data packets (the minimum set of IP-RAW data packets refers to the functional board data packets that the platform layer software can maintain operation. This platform has a redundant architecture, and the minimum set of IP-RAW data packets refers to the board IP-RAW data packets received by the main control when at least one of all functional boards exists) is received completely. If it is received completely, proceed to step 4. If it is not received completely after the timeout, the platform is safe.

[0047] Step 4) storing the IP-RAW data packets according to the user device number, including the location and length of the IP-RAW data packet content;

[0048] Step 5) The application layer software of the main control board receives the complete unparsed IP-RAW data packet through the API interface;

[0049] Step 6) The application layer software unpacks the data according to the User Data Segment Protocol;

[0050] Step 7) The application layer software performs vehicle control logic operations based on the unpacked data;

[0051] Step 8) The application layer software fills in the user data segment based on the result of the logic operation and packages the result of the logic operation and the data output for external communication;

[0052] Step 9) The two main control boards cross-compare the output control data packets. If the comparison fails, the platform is directed to safety; if the comparison succeeds, proceed to step 10;

[0053] Step 10) The main system platform layer software sends the cross-checked packaged data to the external board;

[0054] Step 11) The periodic communication ends.

[0055] In step 1, before the periodic communication begins, Ethernet initialization configuration is performed, including the following steps:

[0056] S1) Ethernet PHY is initialized successfully and a unique MAC address is configured;

[0057] S2) Each board sets its own IP;

[0058] S3) The main control board sends an ARP request message to each board;

[0059] S4) Each board replies with an ARP message to the main control board;

[0060] S5) The main control board creates a complete ARP table after receiving the reply;

[0061] S6) Determine the configuration requests received from all boards. If no configuration requests are received within a timeout, the platform is directed to safety. If a configuration request is received, the two main control boards cross-compare the configuration information to be issued.

[0062] S7) If the comparison fails, the platform is directed to safety; if the comparison succeeds, both main control boards of the two systems send configuration information to each board;

[0063] S8) The two system main control boards determine whether they have received the configuration success information of the minimum set unit. If not received within a timeout, the platform is directed to safety; if received, the platform Ethernet configuration is completed.

[0064] The present invention adopts a secure communication protocol based on the TCP / IP protocol stack, which can resist the seven communication risk threats specified in EN50159 for closed networks through defense measures.

[0065] To prevent external environmental hazards, the platform's internal and external network communications all use an independent processor format. External network data must first be converted into an internal network protocol by an independent processor, including physical communication channel isolation, such as the controller's data reception optical coupler isolation through the PHY chip and hardware security guidance for the controller to receive external abnormal data injection.

[0066] At the network layer, since unauthorized access to backplane communications is impossible, spoofing threats are not a concern. The Ethernet protocol stack enables application-layer software to directly access native IP-layer data packets. The software employs a layered structure consisting of platform-layer software assembly and application-layer software parsing. The platform-layer software is responsible for accurately forwarding IP-RAW data packets from each board to the application-layer software. The user data segment in the IP-RAW data packet utilizes the Rail Transit Closed Network Secure Communication Protocol (RSSP-I). RSSP-I operates on top of the UDP protocol. Although the UDP protocol itself carries the risk of packet loss, the RSSP-I protocol's sequence number and timestamp verification ensures the protocol's accuracy and timeliness, preventing UDP's inherent flaws from impacting the application-layer software.

[0067] The present invention is only applicable to the scenario where the IP of each board is known when establishing a communication object. The IP can be read by the board itself after powering on, or the board can find its own IP by parsing the configuration data packet received for the first time according to the slot information.

[0068] The Ethernet frame type used in the present invention is Ethernet II. At the beginning of communication establishment, the software customizes the ARP message array and establishes the ARP table of all boards in the chassis.

[0069] The IP-RAW protocol used in the present invention after the communication is established is a transport layer native protocol based on the IP protocol. The IP message array is formed by a software-defined IP header and data part. The application layer software protocol specified by the present invention is UDP, and the protocol-specific encryption verification data are all in the UDP data segment.

[0070] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above and that the invention can be embodied in other specific forms without departing from the spirit and essential characteristics of the invention. Therefore, the embodiments should be considered in all respects as illustrative and non-restrictive, and the scope of the invention is defined by the appended claims, not the foregoing description, and all variations within the meaning and range of equivalents of the claims are intended to be included therein. Any reference sign in a claim should not be construed as limiting the claim to which it relates.

[0071] In addition, it should be understood that although this specification is described in terms of implementation methods, not every implementation method contains only one independent technical solution. This narrative method of the specification is only for the sake of clarity. Those skilled in the art should regard the specification as a whole. The technical solutions in each embodiment can also be appropriately combined to form other implementation methods that can be understood by those skilled in the art.

Claims

1. An Ethernet secure communication method based on IP-RAW protocol, characterized in that: The following steps are involved: Step 1) Periodic communication begins; Step 2) The main control board receives all IP-RAW data packets from all boards and caches them; Step 3) Check whether the minimum set IP-RAW data packet is received completely. If it is received completely, proceed to step 4. If it is not received completely after the timeout, the platform is directed to safety. Step 4) storing the IP-RAW data packets according to the user device number, including the location and length of the IP-RAW data packet content; Step 5) The application layer software of the main control board receives the complete unparsed IP-RAW data packet through the API interface; Step 6) Application layer software unpacks data according to the User Data Segment Protocol; Step 7) The application layer software performs vehicle control logic operations based on the unpacked data; Step 8) The application layer software fills in the user data segment based on the result of the logic operation and packages the result of the logic operation and the data output for external communication; Step 9) The two main control boards cross-compare the output control data packets. If the comparison fails, the platform is directed to safety; if the comparison succeeds, proceed to step 10; Step 10) The main system platform layer software sends the cross-checked packaged data to the external board; Step 11) The periodic communication ends.

2. The Ethernet secure communication method based on IP-RAW protocol according to claim 1, wherein: In step 1, before the periodic communication begins, Ethernet initialization configuration is performed, including the following steps: S1) Ethernet PHY is initialized successfully and a unique MAC address is configured; S2) Each board sets its own IP; S3) The main control board sends an ARP request message to each board; S4) Each board replies with an ARP message to the main control board; S5) The main control board creates a complete ARP table after receiving the reply; S6) Determine the configuration requests received from all boards. If no configuration requests are received within a timeout, the platform is directed to safety. If a configuration request is received, the two main control boards cross-compare the configuration information to be issued. S7) If the comparison fails, the platform is directed to safety; If the comparison is successful, both main control boards will send configuration information to each board; S8) The two system main control boards determine whether they have received the configuration success information of the minimum set unit. If not received within a timeout, the platform is directed to safety; if received, the platform Ethernet configuration is completed.

3. The Ethernet secure communication method based on IP-RAW protocol according to claim 1, characterized in that: In the above steps, independent processors are used for both internal and external network communications on the platform. External network data is first converted into internal network protocols by independent processors, including physical communication and channel isolation.

4. The Ethernet secure communication method based on IP-RAW protocol according to claim 1, wherein: In the above steps, the application layer software directly accesses the native data packets of the IP layer. The software adopts a layered structure of platform layer software packaging and application layer software parsing. The platform layer software forwards the IP-RAW data packets from each board to the application layer software. The user data segment in the IP-RAW data packet adopts the rail transit closed network security communication protocol RSSP-I, and the RSSP-I protocol is carried on the UDP protocol.

5. The Ethernet secure communication method based on IP-RAW protocol according to claim 1, characterized in that: In the above steps, the IP-RAW protocol used after communication is established is a native transport layer protocol built on the IP protocol. The software customizes the IP header and data part to form an IP message array; the application layer software protocol is UDP, and the protocol's unique encryption verification data is all in the UDP data segment.

Images