Method for secure transmission of data in a TSN network based on a nationalized data distribution service

Abstract

The application relates to a TSN network data security transmission method based on a localization data distribution service, and belongs to the distributed communication field. The application deeply customizes the communication mode of a DDS protocol, a publishing end sets a TSN transmission bus and an OpenSSL data transmission signature encryption mode through self-defined QoS of the DDS, encapsulates DDS transmission data content according to an RTPS specification, uses a TSN network bus IP address after QoS configuration and a transmission channel used, publishes the data with the signature and the encryption, a subscribing end opens the corresponding TSN network bus IP address and the transmission channel used according to the QoS setting of the DDS, receives the subscribed data, and performs signature verification and data decryption on the data through the signature and the encryption set by the QoS, so that the data cannot be eavesdropped, tampered with and falsely published, the safety of data transmission is guaranteed, and the decrypted and verified data is handed over to the DDS protocol for data subscription.

Description

Technical Field

[0001] This invention belongs to the field of distributed communication, specifically relating to a method for secure data transmission in a TSN network based on a domestically developed data distribution service. Background Technology

[0002] DDS (Data Distribution Service) is a middleware protocol and API standard defined by OMG (Object Management Group) based on the DCPS (Data-Centric Publish-Subscribe) model. This specification emphasizes technical characteristics such as data-centricity and loose coupling between modules, making it very suitable for open and dynamic distributed application systems. It integrates system components to provide the low-latency data connectivity, high reliability, and scalability required by business and task applications.

[0003] In distributed systems, domestically developed DDS middleware acts as a software layer between the operating system and applications. It enables the various components of the system to communicate and share data more easily. It simplifies the development of distributed systems by allowing software developers to focus solely on the specifics of their applications, without needing to understand the mechanisms for passing information between applications and the system.

[0004] TSN is a set of IEEE standards designed to provide time-sensitive data transmission over Ethernet, making it ideal for the communication requirements of real-time systems that need to send periodic information in a deterministic manner. TSN can provide the foundation for real-time communication for entirely new applications that were previously unable to run on Ethernet.

[0005] TSN offers an excellent technology for delivering real-time data over Ethernet. It allows defining timing requirements for each flow and configuring network paths (including switches) to ensure those requirements are met. It also provides isolation between different data flows, so real-time traffic is not interfered with by other communications occurring on the same network. However, because this technology is at a lower level in the configuration stack, applications must configure flows, packet sizes, frequencies, priorities, network endpoints, etc.

[0006] Both DDS and TSN are designed for time-sensitive applications. Both are horizontal standards applicable to many vertical markets. Software components use data types and Quality of Service (QoS) policies defined by DDS, such as latency, transmission priority, and resource limits. These limits are directly mapped to the parameters required to configure a TSN network, thus greatly improving data transmission efficiency.

[0007] Because DDS data is transmitted over the TSN network using the RTPS protocol, during transmission, the data can be intercepted, eavesdropped on, tampered with, or falsely published data can be received by unauthorized users. If sensitive data is eavesdropped on, tampered with, or falsely published data is received, it poses a significant security risk to the network, with potentially disastrous consequences.

[0008] The introduction of OpenSSL provides a mechanism to protect data confidentiality. Through the asymmetric encryption algorithm RSA, it enables data signature verification and data content protection, ensuring that data cannot be eavesdropped on, tampered with, or falsely published. Summary of the Invention

[0009] (a) Technical problems to be solved

[0010] The technical problem this invention aims to solve is how to provide a method for secure data transmission on a TSN network based on a domestically developed data distribution service. This method addresses the issue that when DDS data is transmitted on a TSN network using the RTPS protocol, unauthorized users may intercept, eavesdrop, tamper with, or receive false data during transmission. If sensitive data is eavesdropped on, tampered with, or receives false data, it poses a significant security risk to the network.

[0011] (II) Technical Solution

[0012] To address the aforementioned technical issues, this invention proposes a method for secure data transmission over a TSN network based on a domestically developed data distribution service. This method includes: connecting publisher and subscriber devices via a TSN physical network to achieve TSN physical transmission; in the software component, the publisher and subscriber terminals comprise six modules: a domestically developed DDS protocol layer, a DDS communication adaptation layer, a data signature and encryption layer, a TSN network adaptation layer, a TSN network bus layer, and a QoS configuration module.

[0013] A domestically developed DDS protocol layer, used to encapsulate standard DDS middleware protocols;

[0014] The QoS configuration module is used to configure the peer-to-peer signature method, signature key, encryption method, encryption key, enable TSN network, and TSN network address to ensure that the publisher and subscriber have consistent configurations.

[0015] The other modules of the publishing and subscription sides are described below:

[0016] The DDS communication adaptation layer enables the acquisition of domestically produced DDS protocol layer published data, and converts the DDS protocol layer data into DDS raw data according to QoS configuration, and sends the DDS raw data to the data signature encryption layer.

[0017] The data signature encryption layer, based on the QoS configuration, performs signature and encryption on the raw DDS data.

[0018] The TSN network adaptation layer enables the data from the data signature and encryption layer to be repackaged in a custom way. Based on the QoS configuration of the TSN network, the repackaged data is sent to the TSN network bus layer, or the DDS default transmission method is used.

[0019] The TSN network bus layer is used for communication between TSN hardware network devices and the software layer; the publishing end sends TSN formatted data to the TSN network transmission device, and the TSN network transmission device sends the data to the subscription end device according to the address specified by the TSN network bus layer.

[0020] Next, based on the data flow direction of the subscription module, the functions of the receiving process module are described as follows:

[0021] The TSN network bus layer is used for communication between TSN hardware network devices and the software layer; the receiving end forwards the TSN format data sent by the publishing end to the TSN network adaptation layer through the TSN network transmission device for further parsing.

[0022] The TSN network adaptation layer, based on QoS configuration, parses data repackaged in a custom format to obtain signature data, encrypted data, or DDS raw data.

[0023] The data signature encryption layer is a module that performs signature verification and data decryption on the raw DDS data according to the QoS configuration.

[0024] The DDS communication adaptation layer, based on QoS configuration, converts the raw DDS data parsed from the data signature encryption layer into data in a domestically produced DDS subscription format, and then transmits the domestically produced DDS subscription format data to the domestically produced DDS protocol layer to complete the data reception and subscription function.

[0025] (III) Beneficial Effects

[0026] This invention proposes a method for secure data transmission over a TSN network based on a domestically developed data distribution service. Based on the OSI network model, this invention addresses several key limitations. First, traditional network devices using only the QoS configuration of the DDS itself cannot overcome the limitations of hardware real-time transmission and throughput. This invention introduces the TSN physical transmission method, leveraging the real-time and throughput advantages of the TSN network at the physical layer to significantly improve the real-time performance, efficiency, and data throughput of DDS data transmission in traditional networks. Second, the DDS module, TSN transmission module, and OpenSSL security module are designed independently, reducing coupling between modules and simplifying development and maintenance. Third, it uses the standard QoS configuration method of DDS, allowing flexible configuration of whether to enable the TSN network and the secure network transmission module. QoS configuration can also utilize the default DDS transmission method, achieving these functions with simple QoS parameter configuration, greatly reducing development and usage difficulty.

[0027] This invention proposes a method for secure data transmission over a TSN network based on a domestically developed data distribution service. Since the DDS protocol resides at the application layer of the OSI network model, existing QoS strategies alone cannot overcome the limitations of traditional Ethernet data transmission in terms of real-time performance and throughput for improving DDS publish / subscribe capabilities. However, TSN network transmission equipment, located at the data link and physical layers of the OSI network model, is specifically designed for time-sensitive data transmission. Therefore, this invention replaces existing Ethernet communication equipment with TSN network equipment to significantly improve the real-time performance and throughput of DDS data communication.

[0028] Regarding data transmission security, since DDS data is transmitted over the TSN network using the RTPS protocol, unauthorized users can intercept, eavesdrop, tamper with, or receive falsely published data during transmission. If sensitive data is eavesdropped on, tampered with, or falsely published data is received, it poses a significant security risk to the network, potentially with catastrophic consequences. This invention introduces OpenSSL to provide a mechanism for protecting data confidentiality. Through the asymmetric encryption algorithm RSA, it achieves data signature verification and data content protection, ensuring that data cannot be eavesdropped on, tampered with, or falsely published, thus completely solving the data transmission security problem. Attached Figure Description

[0029] Figure 1 This invention relates to a DDS-based TSN network data security transmission model;

[0030] Figure 2 Flowchart of secure TSN data transmission for DDS publisher;

[0031] Figure 3 A flowchart illustrating the secure data transmission process for DDS subscribers using TSN. Detailed Implementation

[0032] To make the objectives, contents, and advantages of the present invention clearer, the specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples.

[0033] The technical problem to be solved by this invention is how to provide a method for secure data transmission on a TSN network based on a domestically developed data distribution service, so as to solve how a domestically developed DDS middleware can achieve efficient, real-time, and multi-concurrency transmission through TSN network data communication, and provide a method to prevent data from being eavesdropped, tampered with, and falsely published during the transmission process.

[0034] This invention, based on the DDS protocol, TSN network communication bus, and OpenSSL data transmission signature encryption method, provides a method for rapid publish / subscribe data transmission while ensuring data transmission security, thus improving the real-time performance and security of DDS transmission. On the TSN network communication bus hardware platform, the communication method of the DDS protocol is deeply customized for domestic use. The publishing end configures the TSN transmission bus and OpenSSL data transmission signature encryption method through customized DDS QoS settings, encapsulating the DDS transmitted data content according to the RTPS specification. Using the QoS-configured TSN network bus IP address and transmission channel, the signed and encrypted data is published. The subscribing end, according to the DDS QoS settings, opens the corresponding TSN network bus IP address and transmission channel, receives the subscribed data, and verifies and decrypts the data using the QoS-configured signature and encryption, preventing eavesdropping, tampering, and fraudulent publication, ensuring data transmission security. The successfully decrypted and verified data is then submitted to the DDS protocol for subscription.

[0035] To address the aforementioned technical issues, this invention proposes a method for secure data transmission over a TSN network based on a domestically developed data distribution service. This method references the OSI network model and, based on the domestically developed DDS protocol, employs TSN network transmission for data communication between the publisher and subscriber ends to improve transmission efficiency. Furthermore, it uses the OpenSSL module to sign and encrypt the transmitted data, preventing eavesdropping, tampering, and fraudulent publication.

[0036] The publishing and subscribing devices are connected via TSN network devices.

[0037] The publishing and subscription terminals consist of six modules: the domestic DDS protocol layer, the DDS communication adaptation layer, the data signature encryption layer, the TSN network adaptation layer, the TSN network bus layer, and the QoS configuration module.

[0038] When DDS sends data, it first enables the TSN network through the DDS communication adaptation layer and QoS configuration module, then connects the data to the data signature and encryption layer to sign and encrypt the data content, and then transfers the signed and encrypted data to the TSN network adaptation layer. The data is then sent according to the TSN network sending interface, and finally sent to the TSN network through the TSN network bus layer.

[0039] When DDS receives data, it activates the TSN network through the DDS communication adaptation layer and QoS configuration module, receives TSN network physical layer data, passes it to the TSN bus layer, and then receives the data in the TSN network adaptation layer. Through the signature and key configuration of the QoS configuration module, it performs signature verification and data decryption in the data signature encryption layer. After successful signature verification and decryption, the data is sent to the DDS communication adaptation layer and finally passed to the domestic DDS protocol layer to realize the data reception function.

[0040] Both the publisher and subscriber can configure the TSN network using DDS's custom QoS settings, specifying the TSN network address required for communication.

[0041] The publisher and subscriber can configure keys for data signing, data signature verification, data encryption, and data decryption using DDS's custom QoS.

[0042] Furthermore, QoS can be configured to enable or disable data signing or data signature verification functions, determining at the data signature encryption layer whether data signing or data signature verification is required.

[0043] Furthermore, QoS can configure data signature key or data signature verification key information to perform data signing or data signature verification at the data signature encryption layer.

[0044] Furthermore, QoS can be configured with data encryption or decryption functions, and the data signature encryption layer can determine whether data encryption or decryption is required.

[0045] Furthermore, QoS can configure data encryption or decryption key information to perform data encryption or decryption at the data signature encryption layer.

[0046] Furthermore, in order to ensure data security, the data signature encryption layer uses RSA encryption for data signing, data signature verification, data encryption, and data decryption.

[0047] Furthermore, the signing and data encryption processes used to securely send DDS data are as follows:

[0048] S11. When the domestically produced DDS protocol layer needs to send data, the publishing device will send the data to the DDS communication adaptation layer. The DDS communication adaptation layer will obtain whether to enable the TSN network through the QoS configuration parameters.

[0049] S12. When the TSN network is enabled, the DDS communication adaptation layer will send the DDS data to the data signature encryption layer.

[0050] S13. The data signature encryption layer receives DDS data, calls the QoS configuration, and determines whether to enable the signature function and data encryption function.

[0051] S14. When the data signature function is enabled, the data signature encryption layer will perform RSA signature on the DDS data; otherwise, the data signature function will not be performed.

[0052] S15. When data encryption is enabled, the data signature encryption layer will encrypt all DDS data using RSA; otherwise, data encryption will not be performed.

[0053] S16. After signing and encryption are completed, the data signature encryption layer combines the signed data content and the encrypted data content into new data according to the data transmission format, and then sends the data to the TSN network adaptation layer.

[0054] S17. The TSN network adaptation layer calls the TSN network transmission interface to obtain the QoS network address of the signed and encrypted data, and sends the data to the receiving TSN physical device.

[0055] Furthermore, the process of securely receiving DDS data signature verification and data decryption is as follows:

[0056] S21. The subscriber reads the QoS configuration parameters, obtains the TSN network address configuration, enables the TSN physical network of the receiving device, receives TSN data, and sends the received data to the TSN network adaptation layer.

[0057] S22, the TSN network adaptation layer then sends the TSN data to the data signature encryption layer through the TSN data receiving interface;

[0058] S23. The data signature encryption layer uses QoS configuration information to determine whether to enable signature verification and data decryption functions.

[0059] S24. Through QoS signature verification and data decryption configuration, the TSN data is split into two parts: signature data and encryption data.

[0060] S25. When the data signature verification function is enabled, the data signature encryption layer performs RSA signature verification on the signed data. If the signature verification fails, it means that the data has been tampered with and cannot be used. Then the data is discarded and the process returns to S1. If the verification passes, the next step is performed.

[0061] S26. After successful signature verification, perform data decryption. When the data decryption function is enabled, the data signature encryption layer will perform RSA data decryption on the encrypted data. If decryption fails, it means that the data has been tampered with and cannot be used. Then discard the data and return to the S1 operation. If decryption is successful, the data is restored to the original DDS data and proceed to the next step.

[0062] S27. After successful data decryption, the DDS data communication adaptation layer sends the decrypted DDS data to the domestically produced DDS protocol layer to complete the signature verification and decryption process of the TSN data.

[0063] Example 1:

[0064] The purpose of this invention is to propose a method for secure data transmission over a TSN network based on a domestically developed data distribution service. This invention improves data transmission efficiency while ensuring data transmission security. By combining DDS and TSN, based on the OSI network model, the timeliness and determinism of data are improved. Furthermore, OpenSSL is used to sign and encrypt the data, ensuring the security of data transmission.

[0065] like Figure 1 This is a network system model diagram of the present invention. The network model refers to the OSI network model. The publisher and subscriber devices are connected through the TSN physical network to realize TSN physical transmission. The software part implements 6 parts: QoS configuration, domestic DDS protocol layer, DDS communication adaptation layer, data signature encryption layer, TSN network adaptation layer, and TSN network bus layer module.

[0066] The domestically developed DDS protocol layer is mainly used to encapsulate the standard DDS middleware protocol. DDS (Data Distribution Service) is a middleware protocol and API standard defined by OMG (Object Management Group) based on the DCPS (Data-Centric Publish-Subscribe) model. In distributed systems, DDS middleware is a software layer located between the operating system and applications.

[0067] The QoS configuration module is used to configure the peer-to-peer signing method, signing key, encryption method, encryption key, enabling TSN network, and TSN network address to ensure consistent configuration between the publisher and subscriber. Both the publisher and subscriber programs use the TSN network for data transmission; the same key is used during signing and signature verification; and the same key is used for encrypting and decrypting data.

[0068] The domestically developed DDS protocol layer and QoS configuration module have the same functions on both the publisher and subscriber sides. Next, based on the data flow, the functions of other modules on the publisher and subscriber sides will be described separately.

[0069] The functional description of the publishing end sending process module is as follows:

[0070] The DDS communication adaptation layer acquires the data published by the domestic DDS protocol layer, converts the DDS protocol layer data into DDS raw data according to the QoS configuration, and sends the DDS raw data to the data signature encryption layer.

[0071] The data signature and encryption layer is a module that, based on the QoS configuration, performs signature and encryption functions on the raw DDS data. The publishing end retrieves the QoS configuration to determine whether to sign. If signing is required, it uses OpenSSL's RSA asymmetric encryption method to sign the data, obtaining the signed data. After signing, it retrieves the QoS configuration again to determine whether encryption is required. If encryption is required, it uses OpenSSL's RSA asymmetric encryption method to encrypt the raw DDS data, obtaining the encrypted data content. If signing and encryption are not required, the raw DDS data is directly sent to the TSN network adaptation layer.

[0072] The TSN network adaptation layer implements a custom repackaging method for data from the data signature and encryption layer. Based on the TSN network's QoS configuration, it sends the repackaged data to the TSN network bus layer, or uses the DDS default transmission method. First, the publishing end receives the data from the data signature and encryption layer and repackages it according to the custom method. Then, based on the QoS configuration, it determines whether the TSN network is being used. If the TSN network is used, it calls the TSN send API interface to send the repackaged data to the TSN network bus layer; if the TSN network is not used, it directly calls the DDS default transmission method API interface to send the data.

[0073] The TSN network bus layer is the main module for communication between TSN hardware network devices and the software layer. The publishing end sends TSN-formatted data to the TSN network transmission device, which then sends the data to the subscription end device according to the address specified by the TSN network bus layer.

[0074] Next, based on the data flow direction of the subscription module, the functions of the receiving process module are described as follows:

[0075] The TSN network bus layer is the module that enables communication between TSN hardware network devices and the software layer. The receiving end forwards the TSN-formatted data sent by the publishing end to the TSN network adaptation layer through the TSN network transmission device for further parsing.

[0076] The TSN network adaptation layer, based on QoS configuration, parses data repackaged in a custom format using custom methods to obtain signed data, encrypted data, or raw DDS data. First, it determines whether signing and encryption operations have been performed according to the QoS configuration. If so, it parses the repackaged data using the custom method to obtain signed and encrypted data; otherwise, it directly obtains the raw DDS data. If parsing is successful, the data is sent to the data signing and encryption layer; if parsing fails, it indicates the data is not valid, the data is discarded, and the receiving process terminates.

[0077] The data signature and encryption layer, based on the QoS configuration, implements signature verification and decryption of the raw DDS data. After receiving data from the TSN network adaptation layer, the subscriber checks the QoS configuration to determine whether signature verification and decryption are required. If so, it first performs decryption by calling OpenSSL's RSA asymmetric encryption method to obtain the raw DDS data. Next, it performs signature verification by calling OpenSSL's RSA asymmetric encryption method to verify the data signature and obtain the verification result to determine if the data has been tampered with. If the signature verification or decryption passes, the raw DDS data is obtained and sent to the DDS communication adaptation layer. If the signature verification or decryption fails, it indicates data abnormality, the data is discarded, and the receiving process terminates. If no signature verification or decryption is performed, the raw DDS data sent by the TSN network adaptation layer is directly delivered to the DDS communication adaptation layer.

[0078] The DDS communication adaptation layer, based on QoS configuration, converts the raw DDS data parsed from the data signature encryption layer into data in a domestically produced DDS subscription format, and then transmits the domestically produced DDS subscription format data to the domestically produced DDS protocol layer to complete the data reception and subscription function.

[0079] Figure 2 This is a flowchart of the DDS publisher's TSN data security transmission process, such as... Figure 2 As shown, the DDS data publishing process describes in detail the secure and efficient transmission process using the TSN network and OpenSSL. The specific process is as follows.

[0080] S31. Start the domestically produced DDS module and use the DDS standard interface.

[0081] After starting the domestically produced DDS module, DDS_DomainParticipantFactory_create_participant() reads the QoS configuration.

[0082] S32. Read the QoS configuration to determine whether TSN is enabled and whether signature encryption is enabled. If TSN is enabled, initiate the creation operation for the TSN module.

[0083] The CreateTsnTransportPlugin() interface starts the TSN network; if signature encryption is enabled, it initializes OpenSSL, uses the GetSignPriKey() and GetSignPubKey() interfaces to obtain the public and private keys, and stores them in the publishing program; if TSN and signature encryption are not enabled, the default domestic DDS transmission process is used.

[0084] After S33 and QoS reading are completed, use the standard interface of the domestically produced DDS module.

[0085] `DDS_DomainPart icipant_create_datawriter()` creates and starts the publishing module to perform data publishing functionality; the publishing module is the standard interface of the DDS module.

[0086] S34. When publishing data, enter the DDS communication adaptation layer to determine whether the signature encryption method is enabled. If the signature encryption method is enabled, first sign the published DDS data to obtain signed data; then encrypt the published DDS data to obtain encrypted data, and proceed to step S35; if the signature encryption method is not enabled, proceed directly to step S36.

[0087] S35. Next, the signed data and the encrypted data will be organized into a new data segment according to a specific format;

[0088] S36. Determine whether the TSN network is enabled. If the TSN network is enabled, use the TSN network and call the TSN network sending interface to send the data out. If the TSN network is not enabled, send the data out according to the DDS default communication method.

[0089] Figure 3 This is a flowchart of the DDS subscriber's TSN data security transmission process, such as... Figure 3 As shown, the DDS data subscription process describes in detail the secure and efficient transmission process using the TSN network and OpenSSL. The specific process is as follows.

[0090] S41. Start the DDS module and use the DDS standard interface.

[0091] After starting the DDS module, DDS_DomainParticipantFactory_create_participant() reads the QoS configuration.

[0092] S42. Read the QoS configuration to determine whether TSN is enabled and whether signature encryption is enabled. If TSN is enabled, initiate the creation operation for the TSN module.

[0093] The CreateTsnTransportPlugin() interface starts the TSN network; if signature encryption is enabled, it initializes OpenSSL, uses the GetSignPriKey() and GetSignPubKey() interfaces to obtain the public and private keys, and stores them in the publishing program; if TSN and signature encryption are not enabled, the default domestic DDS transmission process is used.

[0094] After S43 and QoS reading are completed, use the standard interface of the domestically produced DDS module.

[0095] `DDS_DomainParticipantFactory_create_participant()` creates and starts a subscription module to enable data subscription functionality; the subscription module is the standard interface for DDS modules.

[0096] S44. Enable TSN network data receiving function to receive TSN data sent from the publishing end;

[0097] S45. After receiving the TSN data, perform TSN data parsing to extract the signature data and encrypted data content;

[0098] S46. Next, decrypt the encrypted data. If decryption is successful, proceed to step S47. Otherwise, consider the data to have been tampered with or to be abnormal, discard the data, and re-enter step S44.

[0099] S47. After successful data decryption, the decrypted data is signed and verified. If the signature verification is successful, it means that the data has not been tampered with, and the decryption and signature verification are successful. Proceed to the next step S48. If the signature verification fails, the data may have been tampered with or is abnormal. Discard the data and re-enter step S44.

[0100] S48. The decrypted encrypted data, i.e. the original DDS data sent by the publishing end, is placed into the receiving interface of the subscription module of the standard interface of the domestic DDS module to complete the DDS subscription operation.

[0101] This invention is based on the OSI network model. Firstly, traditional network devices, relying solely on the QoS configuration of the DDS itself, cannot overcome the limitations of hardware transmission real-time performance and throughput. This invention introduces the TSN physical transmission method, leveraging the advantages of TSN network's real-time and throughput transmission at the physical layer, significantly improving the real-time performance, timeliness, and data throughput of DDS data transmission in traditional networks. Secondly, the DDS module, TSN transmission module, and OpenSSL security module are designed independently, reducing coupling between modules and providing a clear hierarchy for easier development and maintenance. Thirdly, it uses the standard DDS QoS configuration method, allowing flexible configuration of whether to enable the TSN network and the network security transmission module. It also allows the use of the default DDS transmission method through QoS configuration. These functions can be achieved simply by configuring QoS parameters, greatly reducing the difficulty of development and use.

[0102] Example 2:

[0103] A method for secure data transmission over a TSN network based on a domestically developed data distribution service is proposed. This method refers to the OSI network model and uses a domestically developed DDS protocol middleware module on the basis of the DDS protocol. In order to improve transmission efficiency, TSN network transmission is used for data communication between the publisher and subscriber, and the transmitted data is signed and encrypted to prevent data from being eavesdropped, tampered with, or falsely published.

[0104] The publishing and subscription terminals include six modules: the domestic DDS protocol layer, the DDS communication adaptation layer, the data signature encryption layer, the TSN network adaptation layer, the TSN network bus layer, and the QoS configuration module.

[0105] When the DDS sends data, it first enables the TSN network through the DDS communication adaptation layer and QoS configuration module, then connects the data to the data signature and encryption layer to sign and encrypt the data content, then transfers the signed and encrypted data to the TSN network adaptation layer, sends the data according to the TSN network sending interface, and sends the TSN data to the TSN network through the TSN network bus layer.

[0106] When the DDS receives data, it activates the TSN network through the DDS communication adaptation layer and QoS configuration module, receives TSN network physical layer data, passes it to the TSN bus layer, and then receives the data in the TSN network adaptation layer. Through the signature and key configuration of the QoS configuration module, it performs signature verification and data decryption in the data signature encryption layer. After successful signature verification and decryption, the data is sent to the DDS communication adaptation layer and finally passed to the domestic DDS protocol layer to realize the data reception function.

[0107] Furthermore, the DDS communication adaptation layer, based on the domestically developed DDS middleware framework and utilizing OpenSSL and TSN networks, performs functions such as signing, signature verification, data encryption, data decryption, TSN data transmission, and TSN data reception for DDS data.

[0108] Furthermore, the TSN network can be configured through DDS's custom QoS settings, allowing you to configure the TSN network addresses required for communication.

[0109] Furthermore, DDS allows for custom QoS configuration of keys for data signing, data signature verification, data encryption, and data decryption, including:

[0110] The data signing or data signature verification can be configured via QoS to determine whether the signing function is enabled, and the data signing encryption layer will determine whether data signing or data signature verification is required.

[0111] The data signature key or data signature verification key information can be configured with QoS to perform data signing or data signature verification at the data signature encryption layer;

[0112] The data encryption or decryption can be configured via QoS to determine whether data encryption or decryption is required at the data signature encryption layer.

[0113] The data encryption or decryption key information can be configured via QoS to perform data encryption or decryption at the data signature encryption layer.

[0114] Furthermore, the domestically produced DDS protocol layer data can be sent to the other end of the TSN network via the interface of the TSN network adapter layer, and the data can be signed and encrypted. Alternatively, the TSN network adapter layer can receive data sent from the other end of the TSN network, then pass the data to the data signature and encryption layer for signature verification and data decryption, and then transfer the data to the domestically produced DDS protocol layer.

[0115] Furthermore, the data signature encryption layer uses RSA encryption for signing and signature verification.

[0116] Furthermore, in the data signature encryption layer, data is encrypted and decrypted using RSA encryption.

[0117] Furthermore, the DDS data signing and encryption process is as follows:

[0118] S1. When the domestically produced DDS protocol layer needs to send data, the publishing device will send the data to the DDS communication adaptation layer. The DDS communication adaptation layer will obtain whether to enable the TSN network through the QoS configuration parameters.

[0119] S2. When the TSN network is enabled, the DDS communication adaptation layer will send the DDS data to the data signature encryption layer.

[0120] S3. The data signature encryption layer receives DDS data, calls the QoS configuration, and determines whether to enable the signature function and data encryption function.

[0121] S4. When the data signature function is enabled, the data signature encryption layer will perform RSA signature on the DDS data; otherwise, the data signature function will not be performed.

[0122] S5. When data encryption is enabled, the data signature encryption layer will encrypt all DDS data using RSA; otherwise, data encryption will not be performed.

[0123] S6. After signing and encryption are completed, the data signature encryption layer combines the signed data content and the encrypted data content into new data according to the data transmission format, and then sends the data to the TSN network adaptation layer.

[0124] The S7 and TSN network adaptation layers call the TSN network transmission interface to obtain the QoS network address of the signed and encrypted data, and then send the data to the receiving TSN physical device.

[0125] Furthermore, the process of securely receiving DDS data signature verification and data decryption is as follows:

[0126] S1. The subscriber reads the QoS configuration parameters, obtains the TSN network address configuration, enables the TSN physical network of the receiving device, receives TSN data, and sends the received data to the TSN network adaptation layer.

[0127] The S2 and TSN network adaptation layers then send the TSN data to the data signature and encryption layer through the TSN data receiving interface.

[0128] S3. The data signature encryption layer uses QoS configuration information to determine whether to enable signature verification and data decryption functions.

[0129] S4. Through QoS signature verification and data decryption configuration, TSN data is split into two parts: signature data and encryption data.

[0130] S4. When the data signature verification function is enabled, the data signature encryption layer will perform RSA signature verification on the signed data. If the signature verification fails, it means that the data has been tampered with and cannot be used. Then the data is discarded and the process returns to S1. If the verification passes, the next step is performed.

[0131] S5. After successful signature verification, perform data decryption. When the data decryption function is enabled, the data signature encryption layer will perform RSA data decryption on the encrypted data. If decryption fails, it means that the data has been tampered with and cannot be used. Then discard the data and return to the S1 operation. If decryption is successful, the data is restored to the original DDS data and proceed to the next step.

[0132] S6. After successful data decryption, the DDS data communication adaptation layer sends the decrypted DDS data to the domestically produced DDS protocol layer to complete the signature verification and decryption process of the TSN data.

[0133] Furthermore, data transmission and reception are achieved through TSN hardware devices.

[0134] This invention proposes a method for secure data transmission over a TSN network based on a domestically developed data distribution service. Since the DDS protocol resides at the application layer of the OSI network model, existing QoS strategies alone cannot overcome the limitations of traditional Ethernet data transmission in terms of real-time performance and throughput for improving DDS publish / subscribe capabilities. However, TSN network transmission equipment, located at the data link and physical layers of the OSI network model, is specifically designed for time-sensitive data transmission. Therefore, this invention replaces existing Ethernet communication equipment with TSN network equipment to significantly improve the real-time performance and throughput of DDS data communication.

[0135] Regarding data transmission security, since DDS data is transmitted over the TSN network using the RTPS protocol, unauthorized users can intercept, eavesdrop, tamper with, or receive falsely published data during transmission. If sensitive data is eavesdropped on, tampered with, or falsely published data is received, it poses a significant security risk to the network, potentially with catastrophic consequences. This invention introduces OpenSSL to provide a mechanism for protecting data confidentiality. Through the asymmetric encryption algorithm RSA, it achieves data signature verification and data content protection, ensuring that data cannot be eavesdropped on, tampered with, or falsely published, thus completely solving the data transmission security problem.

[0136] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for secure data transmission in a TSN network based on domestically developed data distribution services, characterized in that, The method includes: connecting the publisher and subscriber devices through the TSN physical network to achieve TSN physical transmission; in the software part, the publisher and subscriber include 6 modules, namely the domestic DDS protocol layer, the DDS communication adaptation layer, the data signature encryption layer, the TSN network adaptation layer, the TSN network bus layer, and the QoS configuration module. A domestically developed DDS protocol layer, used to encapsulate standard DDS middleware protocols; The QoS configuration module is used to configure the peer-to-peer signature method, signature key, encryption method, encryption key, enable TSN network, and TSN network address to ensure that the publisher and subscriber have consistent configurations. The other modules of the publishing and subscription sides are described below: The DDS communication adaptation layer enables the acquisition of domestically produced DDS protocol layer published data, and converts the DDS protocol layer data into DDS raw data according to QoS configuration, and sends the DDS raw data to the data signature encryption layer. The data signature encryption layer, based on the QoS configuration, performs signature and encryption on the raw DDS data; The TSN network adaptation layer enables the data from the data signature and encryption layer to be repackaged in a custom way. Based on the QoS configuration of the TSN network, the repackaged data is sent to the TSN network bus layer, or the DDS default transmission method is used. The TSN network bus layer is used for communication between TSN hardware network devices and the software layer; the publishing end sends TSN formatted data to the TSN network transmission device, and the TSN network transmission device sends the data to the subscription end device according to the address specified by the TSN network bus layer. Next, based on the data flow direction of the subscription module, the functions of the receiving process module are described as follows: The TSN network bus layer is used for communication between TSN hardware network devices and the software layer; the receiving end forwards the TSN format data sent by the publishing end to the TSN network adaptation layer through the TSN network transmission device for further parsing. The TSN network adaptation layer, based on QoS configuration, parses data repackaged in a custom format to obtain signature data, encrypted data, or DDS raw data. The data signature encryption layer is a module that performs signature verification and data decryption on the raw DDS data according to the QoS configuration. The DDS communication adaptation layer, based on QoS configuration, converts the raw DDS data parsed from the data signature encryption layer into data in the domestic DDS subscription format, and then transmits the domestic DDS subscription format data to the domestic DDS protocol layer to complete the data reception and subscription function. in, In the data signature and encryption layer of the publishing end, the publishing end obtains whether to sign from the QoS configuration. If signing is required, it calls OpenSSL's RSA asymmetric encryption method to sign the data and obtain the signed data. After signing, it obtains whether to encrypt from the QoS configuration. If encryption is required, it calls OpenSSL's RSA asymmetric encryption method to encrypt the original DDS data and obtain the encrypted data content. If signing and encryption are not required, the original DDS data is directly sent to the TSN network adaptation layer. In the TSN network adaptation layer of the publishing end, firstly, the publishing end obtains the data from the data signature encryption layer and repackages the data according to a custom method; then, through QoS configuration, it determines whether the TSN network is being used. If the TSN network is being used, the TSN sending API interface is called to send the data repackaged in the custom method to the TSN network bus layer; if the TSN network is not being used, the DDS default transmission method API interface is called directly to send the data. In the data signature encryption layer of the subscriber, after receiving data sent by the TSN network adaptation layer, the subscriber obtains whether to perform signature verification and decryption operations from the QoS configuration. If necessary, it first performs decryption by calling OpenSSL's RSA asymmetric encryption method to obtain the original DDS data; then it performs signature verification by calling OpenSSL's RSA asymmetric encryption method to verify the data signature, obtains the verification result, and determines whether it has been tampered with; if the signature verification or decryption passes, the original DDS data is obtained and sent to the DDS communication adaptation layer; if the signature verification or decryption fails, it indicates that the data is abnormal, the data is discarded, and the receiving process terminates; if no signature verification and decryption operations are performed, the original DDS data sent by the TSN network adaptation layer is directly handed over to the DDS communication adaptation layer.

2. The method for secure data transmission over a TSN network based on domestically produced data distribution services as described in claim 1, characterized in that, In the TSN network adaptation layer of the subscription terminal, firstly, based on the QoS configuration, it is determined whether signing and encryption operations have been performed. If so, the data in the custom repackage format is parsed to obtain the signature data and encrypted data. If no signature and encryption operations are used, the raw DDS data is obtained directly; if the parsing is successful, the data is sent to the data signature encryption layer; if the parsing fails, it means that the data is not valid, the data is discarded, and the receiving process terminates.

3. The method for secure data transmission over a TSN network based on domestically produced data distribution services as described in claim 1, characterized in that, Both the publisher and subscriber can configure the TSN network using DDS's custom QoS settings, specifying the TSN network address required for communication. They can also configure keys for data signing, data signature verification, data encryption, and data decryption using DDS's custom QoS settings.

4. The method for secure data transmission over a TSN network based on domestically produced data distribution services as described in claim 1, characterized in that, QoS can configure whether to enable data signing or data signature verification functions, determining whether data signing or data signature verification is required at the data signature encryption layer; QoS can configure data signing key or data signature verification key information, performing data signing or data signature verification at the data signature encryption layer; QoS can configure data encryption or data decryption functions, determining whether data encryption or data decryption is required at the data signature encryption layer; QoS can configure data encryption or data decryption key information, performing data encryption or data decryption at the data signature encryption layer.

5. The method for secure data transmission over a TSN network based on a domestically produced data distribution service as described in any one of claims 1-4, characterized in that, The signing and data encryption process used by this method to securely send DDS data is as follows: S11. When the domestically produced DDS protocol layer needs to send data, the publishing device will send the data to the DDS communication adaptation layer. The DDS communication adaptation layer will obtain whether to enable the TSN network through the QoS configuration parameters. S12. When the TSN network is enabled, the DDS communication adaptation layer will send the DDS data to the data signature encryption layer. S13. The data signature encryption layer receives DDS data, calls the QoS configuration, and determines whether to enable the signature function and data encryption function. S14. When the data signature function is enabled, the data signature encryption layer will perform RSA signature on the DDS data; otherwise, the data signature function will not be performed. S15. When data encryption is enabled, the data signature encryption layer will encrypt all DDS data using RSA; otherwise, data encryption will not be performed. S16. After signing and encryption are completed, the data signature encryption layer combines the signed data content and the encrypted data content into new data according to the data transmission format, and then sends the data to the TSN network adaptation layer. S17. The TSN network adaptation layer calls the TSN network transmission interface to obtain the QoS network address of the signed and encrypted data, and sends the data to the receiving TSN physical device.

6. The method for secure data transmission over a TSN network based on domestically produced data distribution services as described in claim 5, characterized in that, The process of securely receiving DDS data signature verification and data decryption using this method is as follows: S21. The subscriber reads the QoS configuration parameters, obtains the TSN network address configuration, enables the TSN physical network of the receiving device, receives TSN data, and sends the received data to the TSN network adaptation layer. S22, the TSN network adaptation layer then sends the TSN data to the data signature encryption layer through the TSN data receiving interface; S23. The data signature encryption layer uses QoS configuration information to determine whether to enable signature verification and data decryption functions. S24. Through QoS signature verification and data decryption configuration, the TSN data is split into two parts: signature data and encryption data. S25. When the data signature verification function is enabled, the data signature encryption layer performs RSA signature verification on the signed data. If the signature verification fails, it means that the data has been tampered with and cannot be used. Then the data is discarded and the process returns to S1. If the verification passes, the next step is performed. S26. After successful signature verification, perform data decryption. When the data decryption function is enabled, the data signature encryption layer will perform RSA data decryption on the encrypted data. If decryption fails, it means that the data has been tampered with and cannot be used. Then discard the data and return to the S1 operation. If decryption is successful, the data is restored to the original DDS data and proceed to the next step. S27. After successful data decryption, the DDS data communication adaptation layer sends the decrypted DDS data to the domestically produced DDS protocol layer to complete the signature verification and decryption process of the TSN data.

7. The method for secure data transmission over a TSN network based on domestically produced data distribution services as described in claim 1, characterized in that, The process for secure TSN data transmission at the publishing end includes: S31. Start the domestic DDS module. After starting the domestic DDS module using the DDS standard interface DDS_DomainParticipantFactory_create_participant(), read the QoS configuration. S32. Read the QoS configuration to determine whether TSN and signature encryption are enabled. If TSN is enabled, start the TSN module creation operation and use the CreateTsnTransportPlugin() interface to start the TSN network. If signature encryption is enabled, initialize OpenSSL, use the GetSignPriKey() and GetSignPubKey() interfaces to obtain the public and private keys, and store them in the publishing program. If neither TSN nor signature encryption is enabled, use the default domestic DDS transmission process. S33. After QoS reading is completed, use the standard interface of the domestic DDS module, DDS_DomainParticipant_create_datawriter(), to create and start the publishing module to perform data publishing function; the publishing module is the standard interface of the DDS module. S34. When publishing data, enter the DDS communication adaptation layer to determine whether the signature encryption method is enabled. If the signature encryption method is enabled, first sign the published DDS data to obtain signed data. Then encrypt the published DDS data to obtain encrypted data and execute step S35. If the signature encryption method is not enabled, proceed directly to step S36. S35. Next, the signed data and the encrypted data will be organized into a new data segment according to a specific format; S36. Determine whether the TSN network is enabled. If the TSN network is enabled, use the TSN network, call the TSN network sending interface, and send the data out. If the TSN network is not enabled, send the data out according to the DDS default communication method. The TSN data security transmission process on the subscription end includes: S41. Start the DDS module. After starting the DDS module using the DDS standard interface DDS_DomainParticipantFactory_create_participant(), read the QoS configuration. S42. Read the QoS configuration to determine whether TSN and signature encryption are enabled. If TSN is enabled, start the TSN module creation operation and use the CreateTsnTransportPlugin() interface to start the TSN network. If signature encryption is enabled, initialize OpenSSL, use the GetSignPriKey() and GetSignPubKey() interfaces to obtain the public and private keys, and store them in the publishing program. If neither TSN nor signature encryption is enabled, use the default domestic DDS transmission process. S43. After QoS reading is completed, use the standard interface of the domestic DDS module, DDS_DomainParticipantFactory_create_participant(), to create and start the subscription module to perform data subscription; the subscription module is the standard interface of the DDS module. S44. Enable TSN network data receiving function to receive TSN data sent from the publishing end; S45. After receiving the TSN data, perform TSN data parsing to extract the signature data and encrypted data content; S46. Next, decrypt the encrypted data. If decryption is successful, proceed to step S47. Otherwise, consider the data to have been tampered with or to be abnormal, discard the data, and re-enter step S44. S47. After successful data decryption, the decrypted data is signed and verified. If the signature verification is successful, it means that the data has not been tampered with, and the decryption and signature verification are successful. Proceed to the next step S48. If the signature verification fails, the data may have been tampered with or is abnormal. Discard the data and re-enter step S44. S48. The decrypted encrypted data, i.e. the original DDS data sent by the publishing end, is placed into the receiving interface of the subscription module of the standard interface of the domestic DDS module to complete the DDS subscription operation.

Images