A method, device and medium for implementing an RSSP-II security communication protocol

Abstract

The application relates to an RSSP-II safety communication protocol implementation method, equipment and medium, wherein a 2oo2 combination-fault safety system comprises an operation unit and a communication unit, the operation unit is composed of two CPUs, the operation unit is used for RSSP-II safety communication protocol data frame and safety code calculation, 2oo2 comparison, and the operation result is sent to the communication unit, the communication unit merges the received data into a complete RSSP-II message frame and sends the complete RSSP-II message frame to an external device, the method divides the complete RSSP-II message frame into two parts of data and safety code, and only one CPU in the calculation channel of the operation unit is used to calculate the safety code. Compared with the prior art, the application has the advantages of reduced CPU resource consumption, high safety, no need of packet disassembly and packet assembly and the like.

Description

Technical Field

[0001] This invention relates to train signal control systems, and more particularly to a method, device, and medium for implementing the RSSP-II secure communication protocol in a 2oo2 combined-fail-safe system. Background Technology

[0002] The RSSP-II secure communication protocol is designed for open transmission systems and meets the requirements of the EN50159 standard for the authenticity, integrity, real-time performance, and orderliness of transmitted messages. It is widely used in communication between railway safety systems.

[0003] In combinatorial fail-safe systems, a single computing channel should not output a complete, security-verifiable message. The implementation of the RSSP-II security communication protocol in existing 2oo2 security systems is as follows: Figure 1 As shown in the diagram, the two CPUs in the processing unit each calculate a complete RSSP-II secure communication protocol data frame. After the 2oo2 comparison matches, CPU1 sends the odd-numbered bytes of the data frame, and CPU2 sends the even-numbered bytes, as shown in the diagram above. The communication unit receives the two parts of data and then merges them into a complete RSSP-II data frame for transmission to external devices.

[0004] This implementation method has the following drawbacks:

[0005] (1) The security code (MAC) of the message authentication security layer is repeatedly calculated by CPU1 and CPU2, which consumes a lot of CPU resources;

[0006] (2) The logic of splitting the data in the arithmetic unit and recombining the data in the communication unit is complex and prone to errors.

[0007] CN108933788A discloses a fast MAC code verification device based on the RSSP-II protocol using FPGA. Both FPGA1 and FPGA2 are hardware-programmed with the following modules: a data interface module, a MAC scheduling module, a DES module, and a dual-channel comparison module. The dual-channel comparison module is used for communication between the two FPGAs, forming a two-out-of-two structure. When the results from the two FPGAs are inconsistent, a dual-channel comparison status flag is sent to the CPU through the data interface module. If the dual-channel comparison passes, subsequent message transmission proceeds; otherwise, an error handling procedure is entered. This device only provides a two-out-of-two dual-channel comparison method to achieve fast MAC code verification, but it does not solve the problems of repeated calculation of security codes and the complex logic of splitting and combining data. Summary of the Invention

[0008] The purpose of this invention is to overcome the defects of the prior art by providing a method, device and medium for implementing the RSSP-II secure communication protocol in a 2oo2 combined-fail-safe system. This method utilizes only one CPU to calculate the security code, reducing CPU resource consumption and simplifying the logic of splitting and combining data, thereby reducing the error rate.

[0009] The objective of this invention can be achieved through the following technical solutions:

[0010] According to a first aspect of the present invention, a method for implementing the RSSP-II secure communication protocol in a 2oo2 combined-fail-safe system is provided. The 2oo2 combined-fail-safe system includes a computing unit and a communication unit. The computing unit consists of two CPUs. The computing unit is used to calculate RSSP-II secure communication protocol data frames and security codes, perform 2oo2 comparisons, and send the calculation results to the communication unit. The communication unit merges the received data into a complete RSSP-II message frame and sends it to an external device. This method divides the complete RSSP-II message frame into two parts: data and security codes. The security code is calculated by only one CPU of one computing channel in the computing unit.

[0011] As a preferred technical solution, the RSSP-II secure communication protocol adopts a layered design. Based on user data, the operation unit adds a SAI frame header to the security application intermediate sub-layer, adds a MASL frame header and security code to the message authentication security layer, and adds an ALE frame header to the adaptation and redundancy management layer.

[0012] As a preferred technical solution, the data portion of the complete RSSP-II message frame consists of an ALE frame header, a MASL frame header, a SAI frame header, and user data in sequence.

[0013] As a preferred technical solution, the 2oo2 comparison specifically involves the two CPUs performing a 2oo2 comparison only on the data portion of the RSSP-II message frame.

[0014] As a preferred technical solution, the CPU calculates the security code in a dedicated memory area, and the calculation result of the security code is stored in the dedicated memory area, which is physically isolated from the data memory area.

[0015] As a preferred technical solution, in the aforementioned processing unit, the CPU that does not need to calculate the security code only sends the data portion to the communication unit, and the CPU that needs to calculate the security code only sends the security code portion to the communication unit.

[0016] As a preferred technical solution, the communication unit splices the received data and security code to form a complete RSSP-II message frame.

[0017] As a preferred technical solution, the method includes the following steps:

[0018] S1. The second CPU that needs to calculate the security code requests memory for calculating the security code and storing the results;

[0019] S2, Data Frame and Security Code Calculation: The two CPUs in the arithmetic unit add SAI, MASL and ALE layer frame headers to the user data according to the RSSP-II security communication protocol standard to form the data part. The first CPU, which does not need to calculate the security code, does not calculate the security code, and the second CPU calculates the security code.

[0020] S3, 2oo2 comparison: The first CPU and the second CPU perform a 2oo2 comparison of the data part. If the comparison is consistent, proceed to step S4 to send the data.

[0021] S4. Data transmission: The arithmetic unit sends data to the communication unit through the internal bus. The first CPU only sends the data part, and the second CPU only sends the security code part.

[0022] S5. The communication unit receives and groups the received data and security code into a complete RSSP-II secure communication protocol message frame, and sends it to the external device through the TCP layer.

[0023] As a preferred technical solution, the security code is calculated using the 3DES or SM4 algorithm.

[0024] According to a second aspect of the present invention, an electronic device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the program to implement the method described thereon.

[0025] According to a third aspect of the present invention, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the method described thereon.

[0026] Compared with the prior art, the present invention has the following beneficial effects:

[0027] (1) The present invention uses only one CPU channel to calculate the security code, which greatly reduces the resource consumption of the other CPU.

[0028] (2) The computing unit of the present invention does not require unpacking.

[0029] (3) The communication units of the present invention only need to be spliced ​​to form a complete RSSP-II secure communication protocol data frame, without the need for complex packet assembly operations, thus reducing the probability of errors.

[0030] (4) The calculation process and storage location of the security code (MAC) are physically isolated from the storage location of the data, which improves the security of the system. Attached Figure Description

[0031] Figure 1 This is a schematic diagram illustrating the implementation method of the RSSP-II secure communication protocol in an existing 2oo2 security system.

[0032] Figure 2 A complete schematic diagram of RSSP-II secure communication protocol message frames;

[0033] Figure 3 This is a schematic diagram illustrating the implementation method of the RSSP-II secure communication protocol of the present invention. Detailed Implementation

[0034] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0035] This embodiment provides a method for implementing the RSSP-II secure communication protocol in a 2oo2 combined-fail-safe system. The 2oo2 combined-fail-safe system includes a computing unit and a communication unit. The computing unit consists of two CPUs (referred to as CPU1 and CPU2). The computing unit is used for calculating RSSP-II secure communication protocol data frames and security codes, performing 2oo2 comparisons, and sending the calculation results to the communication unit. The communication unit merges the received data into a complete RSSP-II message frame and sends it to an external device.

[0036] The RSSP-II secure communication protocol employs a layered design. The processing unit adds a SAI frame header to the user data, the security application intermediate layer adds a MASL frame header and a security code (MAC), and the adaptation and redundancy management layer adds an ALE frame header, thus forming a complete RSSP-II secure message frame. Figure 2 As shown.

[0037] In the RSSP-II secure communication protocol, the Message Authentication Security Layer Security Code (MAC) is used to ensure data integrity. It is generally implemented using the 3DES or SM4 algorithm, which is computationally complex and has a high CPU utilization rate.

[0038] like Figure 3As shown, this invention divides a complete RSSP-II message frame into two parts: data (including the ALE, MASL, and SAI frame headers and user data) and a security code (MAC). The calculation of the security code (MAC) is separated and implemented only by the CPU of one computing channel in the arithmetic unit; in this embodiment, it is implemented by CPU2. Simultaneously, the two CPUs only perform a 2oo2 comparison on the data portion (including the frame headers and user data) of the RSSP-II message frame. CPU1, which does not need to calculate the security code, sends only the data portion (including the frame headers and user data) to the communication unit; CPU2, which needs to calculate the security code, sends only the security code portion to the communication unit. After receiving the data and security code, the communication unit only needs to perform a simple concatenation to form a complete RSSP-II secure communication protocol message frame.

[0039] Based on the above description, in one embodiment, the RSSP-II secure communication protocol implementation method in a 2oo2 combined-fail-safe system includes the following steps:

[0040] S1 and CPU2 request memory for calculating and storing the results of the security code (MAC);

[0041] S2. Data frame and security code calculation: CPU1 and CPU2 respectively add SAI layer, MASL layer and ALE layer frame headers to the user data according to the RSSP-II security communication protocol standard to form the data part. CPU1 does not calculate the security code, while CPU2 calculates the security code.

[0042] S3, 2oo2 comparison: CPU1 and CPU2 perform a 2oo2 comparison of the data part (including frame headers and user data of each layer). If the comparison is consistent, proceed to step S4 to send the data.

[0043] S4. Data transmission: The arithmetic unit sends data to the communication unit through the internal bus. CPU1 only sends the data part (including frame headers and user data at each layer), while CPU2 only sends the security code (MAC).

[0044] S5. The communication unit receives and groups the data received from CPU1 and the MAC address of CPU2 into a complete RSSP-II secure communication protocol message frame, and sends it to the external device through the TCP layer.

[0045] Furthermore, to further enhance system security, the CPU2 performs the calculation of the security code in a dedicated memory area, and the calculation result of the security code is stored in the dedicated memory area, which is physically isolated from the data memory area.

[0046] The electronic device of this invention includes a central processing unit (CPU), which can perform various appropriate actions and processes according to computer program instructions stored in read-only memory (ROM) or loaded from a storage unit into random access memory (RAM). The RAM may also store various programs and data required for device operation. The CPU, ROM, and RAM are interconnected via a bus. Input / output (I / O) interfaces are also connected to the bus.

[0047] Multiple components in the device are connected to the I / O interface, including: input units such as keyboards and mice; output units such as various types of displays and speakers; storage units such as disks and optical discs; and communication units such as network interface cards (NICs), modems, and wireless transceivers. The communication unit allows the device to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0048] The processing unit executes the various methods and processes described above, such as methods S1 to S5. For example, in some embodiments, methods S1 to S5 may be implemented as computer software programs tangibly contained in a machine-readable medium, such as a storage unit. In some embodiments, part or all of the computer program may be loaded and / or installed on the device via ROM and / or a communication unit. When the computer program is loaded into RAM and executed by the CPU, one or more steps of methods S1 to S5 described above may be performed. Alternatively, in other embodiments, the CPU may be configured to execute methods S1 to S5 by any other suitable means (e.g., by means of firmware).

[0049] The functions described above in this document can be performed, at least in part, by one or more hardware logic components. For example, exemplary types of hardware logic components that can be used, without limitation, include: Field Programmable Gate Arrays (FPGAs), Application-Specific Integrated Circuits (ASICs), Application Standard Products (ASSPs), System-on-Chip (SoCs), Complex Programmable Logic Devices (CPLDs), and so on.

[0050] The program code used to implement the methods of the present invention can be written in any combination of one or more programming languages. This program code can be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing device, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code can be executed entirely on the machine, partially on the machine, as a standalone software package partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0051] In the context of this invention, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. Machine-readable media can include, but are not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0052] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and these modifications or substitutions should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for implementing the RSSP-II secure communication protocol in a 2oo2 combined-fail-safe system, wherein, The 2oo2 combined fail-safe system includes a computing unit and a communication unit. The computing unit consists of two CPUs. The computing unit is used to calculate RSSP-II secure communication protocol data frames and security codes, perform 2oo2 comparisons, and send the calculation results to the communication unit. The communication unit merges the received data into a complete RSSP-II message frame and sends it to an external device. The method is characterized by dividing the complete RSSP-II message frame into two parts: data and security code. The security code is calculated by only one CPU of one computing channel in the computing unit. The method includes the following steps: S1. The second CPU that needs to calculate the security code requests memory for calculating the security code and storing the results; S2, Data Frame and Security Code Calculation: The two CPUs in the arithmetic unit add SAI, MASL and ALE layer frame headers to the user data according to the RSSP-II security communication protocol standard to form the data part. The first CPU, which does not need to calculate the security code, does not calculate the security code, and the second CPU calculates the security code. S3, 2oo2 comparison: The first CPU and the second CPU perform a 2oo2 comparison of the data part. If the comparison is consistent, proceed to step S4 to send the data. S4. Data transmission: The arithmetic unit sends data to the communication unit through the internal bus. The first CPU only sends the data part, and the second CPU only sends the security code part. S5. The communication unit receives and groups the received data and security code into a complete RSSP-II secure communication protocol message frame, and sends it to the external device through the TCP layer.

2. The method for implementing the RSSP-II secure communication protocol in a 2oo2 combined-fail-safe system according to claim 1, characterized in that, The RSSP-II secure communication protocol adopts a layered design. Based on user data, the operation unit adds a SAI frame header to the security application intermediate sub-layer, adds a MASL frame header and security code to the message authentication security layer, and adds an ALE frame header to the adaptation and redundancy management layer.

3. The method for implementing the RSSP-II secure communication protocol in a 2oo2 combined-fail-safe system according to claim 2, characterized in that, The data portion of a complete RSSP-II message frame consists of an ALE header, a MASL header, a SAI header, and user data, in sequence.

4. The method for implementing the RSSP-II secure communication protocol in a 2oo2 combined-fail-safe system according to claim 1, characterized in that, The 2oo2 comparison specifically refers to the two CPUs performing a 2oo2 comparison only on the data portion of the RSSP-II message frame.

5. The method for implementing the RSSP-II secure communication protocol in a 2oo2 combined-fail-safe system according to claim 1, characterized in that, The CPU performs the calculation of the security code in a dedicated memory area, and the calculation result of the security code is stored in the dedicated memory area, which is physically isolated from the data memory area.

6. The method for implementing the RSSP-II secure communication protocol in a 2oo2 combined-fail-safe system according to claim 1, characterized in that, In the aforementioned processing unit, the CPU that does not need to calculate the security code only sends the data portion to the communication unit, while the CPU that needs to calculate the security code only sends the security code portion to the communication unit.

7. The method for implementing the RSSP-II secure communication protocol in a 2oo2 combined-fail-safe system according to claim 6, characterized in that, The communication unit concatenates the received data and security code to form a complete RSSP-II message frame.

8. The method for implementing the RSSP-II secure communication protocol in a 2oo2 combined-fail-safe system according to claim 1, characterized in that, The security code is calculated using the 3DES or SM4 algorithm.

9. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the program, it implements the method as described in any one of claims 1 to 8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1 to 8.

Images