Vehicle-mounted data acquisition and transmission system based on security mechanism and working method

Abstract

The invention provides a vehicle-mounted data acquisition and transmission system based on a security mechanism and a working method, and the system comprises a data acquisition unit, a network security unit, a data encryption unit, a bus interface unit, an Ethernet switch, an IO expansion unit, and a central control unit. The data acquisition unit acquires real-time fault data and normal operation data of the metro vehicle through the bus interface unit, performs data fusion, cleaning and feature extraction processing on the system state information and the fault data, and stores the system state information and the fault data; the network security unit is provided with redundancy measures and a relay function, and is used for protecting the data acquisition unit and establishing a data protection defense line; the data encryption unit performs data transmission with the data acquisition unit and is used for receiving and sending data; when the data are received, the received data are decrypted and then transmitted to the data acquisition unit; when the data is sent, the data of the data acquisition unit is encrypted and then sent out. According to the invention, the security of metro vehicle data transmission is improved.

Description

Technical Field

[0001] The present invention relates to the field of data communication technology, and in particular to a vehicle-mounted data acquisition and transmission system and a working method based on a safety mechanism. Background Art

[0002] As an important part of modern urban transportation, it is becoming increasingly important for people to understand the operation of the subway system and the passenger flow trend. In order to achieve efficient operation and intelligent management, data collection and transmission play a key role in the subway system. Data collection in the subway system involves various aspects, including vehicle operation status, station passenger flow, passenger travel time and location, etc. Through modern sensor technology and metering equipment, a large amount of data can be obtained in real time. Through the data transmission bus, the internal data of each control device is obtained according to a certain time period, forming orderly and dense data.

[0003] The Train Control and Management System (TCMS) is a platform for data transmission of each subsystem of a subway vehicle. It is the center for the vehicle control unit to control, monitor and diagnose each subsystem, which is equivalent to the brain of the subway vehicle. In order to ensure the safe, stable and efficient operation of subway vehicles, the network control system will monitor the working status of each subsystem of the vehicle, diagnose the fault in time when a fault occurs, and feedback the fault information to the driver through the display unit. The organization and transmission of network control system data will seriously affect the performance of subway vehicles.

[0004] The data transmission of the subway vehicle network control system mainly includes the physical layer, data link layer, application layer, etc., and the transmitted data mainly includes process data, message data and monitoring data. At present, the data transmission organization of the subway vehicle data acquisition system is complex, which is not conducive to the analysis of operation and maintenance personnel, and lacks network security protection measures, and cannot guarantee the security of vehicle data. Therefore, the field urgently needs an on-board data acquisition and transmission system for subway vehicle data acquisition, which can solve the problems of lack of security protection and complex data analysis in the existing technology based on a security mechanism. Summary of the invention

[0005] According to the technical problems raised above, a vehicle-mounted data acquisition and transmission system and working method based on a security mechanism are provided. The present invention mainly utilizes a data acquisition unit, a network security unit, a data encryption unit, a bus interface unit, an Ethernet switch, an IO expansion unit and a central control unit to reduce the complexity of data and improve the security of subway vehicle data transmission.

[0006] The technical means adopted by the present invention are as follows:

[0007] A vehicle-mounted data acquisition and transmission system based on a security mechanism includes: a data acquisition unit, a network security unit, a data encryption unit, a bus interface unit, an Ethernet switch, an IO expansion unit and a central control unit, wherein:

[0008] The data acquisition unit acquires real-time fault data and normal operation data of the subway vehicle through the bus interface unit, performs data fusion, cleaning and feature extraction processing on the system status information and fault data, and stores the data;

[0009] The network security unit is provided with redundancy measures and relay functions for protecting the data acquisition unit and establishing a data protection line of defense. The redundancy measures are used to switch to redundant equipment when equipment fails to maintain normal operation of the system;

[0010] The data encryption unit performs data transmission with the data collection unit and is used for receiving and sending data; when receiving data, the received data is decrypted and then passed to the data collection unit; when sending data, the data of the data collection unit is encrypted and then sent to the outside;

[0011] The bus interface unit is used to convert and configure relevant protocols and transmit data in a transparent manner;

[0012] The Ethernet switch has a unique Ethernet communication transmission channel, and the security of data transmission is ensured by the network security unit;

[0013] The IO expansion unit includes a digital quantity input module and a digital quantity output module, wherein the digital quantity input module is responsible for collecting digital quantity signals, and the digital quantity output module is responsible for outputting voltage signals;

[0014] The central control unit is used to organize and manage the communication of subsystems in the vehicle-mounted data acquisition and transmission system, and the subsystems include a traction system, a braking system, a door system and an air conditioning system.

[0015] The present invention also includes a working method of a vehicle-mounted data acquisition and transmission system based on a safety mechanism, and the specific steps include:

[0016] S1. Collecting process data, message data and monitoring data of subway vehicles during operation through a data acquisition unit, and performing data processing and storage;

[0017] S2, organize the data in S1 into data messages using a communication protocol;

[0018] S3, organize and manage the communication of subsystems in the vehicle data acquisition and transmission system through the central control unit;

[0019] S4. Conduct security monitoring and protection of the audit function in the vehicle data collection and transmission system through the network security unit;

[0020] S5. Use the data encryption unit to encrypt the output data and output it to the external environment.

[0021] Furthermore, the process data includes: real-time location of the vehicle, current speed, ambient temperature, and operating conditions; the message data includes: functional messages and service messages, the functional messages are used for network control of subsystems by the on-board data acquisition and transmission system, and the service messages are used to manage the on-board data acquisition and transmission system; the monitoring data is used to monitor and verify the status of subsystem equipment.

[0022] Furthermore, the data message is organized as follows: message header + type + message ID + subject content + reserved field + message tail;

[0023] The vehicle-mounted data acquisition and transmission system interacts with each unit through the MVB network to obtain data from the data acquisition unit, organizes the data, and transmits the organized data to the ground operation and maintenance system through wireless communication between the vehicle and the ground.

[0024] Furthermore, the central control unit transmits data with the subsystem via the MVB network, and configures the data transmission cycle according to the communication data requirements of the subsystem; the central control unit transmits data to the braking system in a transparent manner, and receives data from the braking system for mapping.

[0025] Furthermore, the audit functions include: session access control, session monitoring, static routing and NAT and global anti-DOS attack; the network security unit is provided with regional security protection and boundary protection, the regional security protection means that the equipment and data in each area are protected to different degrees, and the boundary protection means the security measures taken at the boundary of the network or system to prevent unauthorized access and attacks.

[0026] Furthermore, the data encryption unit uses an algorithm that combines asymmetric encryption and symmetric encryption to encrypt and decrypt data. The symmetric encryption means that the sender and receiver use the same key password, and the asymmetric encryption means the process of encryption and decryption using a pair of different keys.

[0027] Compared with the prior art, the present invention has the following advantages:

[0028] The vehicle-mounted data acquisition and transmission system and working method based on the security mechanism provided by the present invention have a simple data organization method, which is convenient for operation and maintenance personnel to analyze and process; the data transmission mechanism is efficient, which can effectively reduce the vehicle communication load and ensure the robustness of data transmission; and the network security protection function can effectively protect the data security of subway vehicles.

[0029] Based on the above reasons, the present invention can be widely promoted in fields such as data communication. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0031] Figure 1 It is a structural diagram of the vehicle-mounted data acquisition and transmission system based on the safety mechanism in the present invention. DETAILED DESCRIPTION

[0032] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0033] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0034] like Figure 1 As shown, the present invention provides a vehicle-mounted data acquisition and transmission system based on a security mechanism, including: a data acquisition unit, a network security unit, a data encryption unit, a bus interface unit, an Ethernet switch, an IO expansion unit and a central control unit, wherein:

[0035] The data acquisition unit obtains the real-time fault data and normal operation data of the subway vehicle through the bus interface unit, performs data fusion, cleaning and feature extraction processing on the system status information and fault data, and stores the data;

[0036] In implementation, the software architecture of the data acquisition unit mainly consists of four parts, namely the driver layer, middleware, application layer and execution layer. Here, the driver layer mainly implements the driver function of the hardware interface; the middleware mainly provides the interface functions and library files required for the operation of the host computer, and implements software communication protocols such as the multi-function vehicle bus (MVB); the application layer mainly completes the function function, and interacts with the middleware by calling the shared library during operation; the execution layer mainly implements the relevant control logic of data processing and completes the relevant configuration of the network port.

[0037] After the data acquisition unit is powered on, the system initializes the system through the initialization function and performs initial configuration. After the system initialization is completed, application layer related tasks will be created, mainly including: indicator light task, communication task, operation record task, and fault record task.

[0038] As shown in Table 1, the data acquisition unit uses an Intel processor as the core processor. The processor has the characteristics of high frequency and large memory. Its main frequency is 500MHz and the memory size is 256MB. In terms of storage, an onboard 8GB SSD is used to store the embedded system and data files, ensuring that the device has sufficient storage space. The power-off retention storage space is configured, and 1MB of space is allocated to store the key parameters of the subway vehicle.

[0039] The data acquisition unit obtains the real-time fault data and normal operation data of each subsystem of the subway vehicle through the Ethernet bus, and performs real-time data fusion, cleaning and feature extraction on the status information and fault data of each subsystem before saving the data.

[0040] Table 1 Technical parameters of data acquisition unit

[0041]

[0042]

[0043] The network security unit is equipped with redundancy measures and relay functions to protect the data acquisition unit and establish a data protection line of defense. The redundancy measures are used to switch to redundant equipment in case of equipment failure to maintain the normal operation of the system.

[0044] The network security unit of subway vehicles is equipped with Gigabit and 100M ports, of which there are up to 8 100M ports and 2 Gigabit ports. Security monitoring and protection functions are set for audit functions such as session access control, session monitoring, static routing and NAT, and global anti-DOS attack, so that the equipment can ensure data security when collecting data. Provide regional security protection and border protection, and establish a data protection line to resist border security threats by protecting the data collection unit, making equipment security protection more intelligent. The design of redundant measures ensures the robustness of data transmission. When the faulty device switches to the redundant device, the network security unit can function normally. To ensure the normal redundancy switching, the network security unit has two By-Pass bypass relay functions.

[0045] The technical parameters of the network security unit are shown in Table 2.

[0046] Table 2 Technical parameters of network security unit

[0047]

[0048] During implementation, network security and protection adopts a five-tuple based on transport layer protocol, source IP address, destination IP address, source port and destination port. In terms of security strategy, time-defined packets and MAC address filtering are used. For access control, a strategy based on state detection technology is used. In IPv6, IPv6 and IPv4 mixed network environments, ARP attacks can be defended by using IP / MAC address binding rules.

[0049] In order to strengthen the data security of subway vehicles, the on-board data acquisition device also protects key data in terms of network security and protection. By using the secure data protocol SDTv2 based on TRDP at the communication protocol level to transmit key data, and using multiple checks and handshakes to process important vehicle process data, the security of on-board data is effectively guaranteed to prevent data from being tampered with during transmission.

[0050] The data encryption unit transmits data with the data collection unit and is used to receive and send data; when receiving data, the received data is decrypted and then passed to the data collection unit; when sending data, the data of the data collection unit is encrypted and then sent out;

[0051] In implementation, as shown in Table 3, the method for data encryption unit and data acquisition unit to transmit data is to design a communication interface on the backplane, and use an independent backplane Ethernet interface and RS485 interface to send and receive data.

[0052] Table 3 Encryption board technical indicators

[0053]

[0054] The bus interface unit is used to convert and configure related protocols and transmit data in a transparent manner. During implementation, in order to enable the on-board data acquisition and transmission system to obtain more detailed data of subway vehicles, the bus interface unit is configured to convert related protocols and transmit data in a transparent manner.

[0055] The Ethernet switch has a unique Ethernet communication transmission channel, which ensures the security of data transmission through the network security unit. During implementation, the vehicle-mounted data acquisition and transmission system only has one transmission channel for external Ethernet communication, which ensures that the network security unit serves as the only Ethernet data input channel, thereby ensuring the security of data transmission.

[0056] The IO expansion unit includes a digital input module and a digital output module, wherein the digital input module is responsible for collecting 110V digital signals, and the digital output module is responsible for outputting 110V voltage signals;

[0057] The central control unit is used to organize and manage the communication of subsystems in the vehicle data acquisition and transmission system, including the traction system, braking system, door system and air conditioning system.

[0058] In practice, the traction system refers to the system that pulls the vehicle through electricity or other means during the operation of the subway train. The braking system refers to the system that controls the braking of the vehicle during the operation of the subway train. The door system refers to the system that controls the opening and closing of the vehicle doors during the operation of the subway train. The air conditioning system can realize multiple functions such as cooling, heating and ventilation of the air inside the vehicle to meet the comfort requirements of passengers in their travel life.

[0059] During implementation, the vehicle-mounted data acquisition and transmission system based on the safety mechanism also includes a power supply unit. The power supply unit adopts DC110V input and DC5V output, wherein the input interface is located on the front panel and the output interface is located on the backplane connector of the power board, and power is output to other circuit boards through the backplane.

[0060] The present invention also includes a working method of a vehicle-mounted data acquisition and transmission system based on a safety mechanism, and the specific steps include:

[0061] S1. Collecting process data, message data and monitoring data of subway vehicles during operation through a data acquisition unit, and performing data processing and storage;

[0062] In specific implementation, as a preferred embodiment of the present invention, the process data includes: real-time vehicle position, current speed, ambient temperature, and operating conditions; the message data includes: functional messages and service messages, functional messages are used for network control of subsystems by the on-board data acquisition and transmission system, and service messages are used to manage the on-board data acquisition and transmission system; monitoring data is used to monitor and verify the status of subsystem equipment.

[0063] S2, organize the data in S1 into data messages using a communication protocol;

[0064] In specific implementation, as a preferred implementation of the present invention, as shown in Table 4, the organization of the data message is: message header + type + message ID + subject content + reserved field + message tail;

[0065] Table 4 Data packet format

[0066] Message Header type Message ID Subject content Reserved fields Message tail 3 bytes 1 byte 4 bytes N bytes 2 bytes 3 bytes

[0067] The message header is represented by the fixed filling bytes 0xAA, 0xAB, and 0xAC; the type is represented by the fixed 0x01; the message ID is used to mark the number of the message, which starts from 0 and increases by 1 for each new message sent, and keeps accumulating until the maximum value is reached and then loops; the data area is filled with all the status data and fault data, and a fixed size area is divided for the status data and fault data respectively. The reserved field is fixedly represented by 0x00 and 0x00; the message tail is filled with the fixed filling bytes 0xBA, 0xBB, and 0xBC.

[0068] The vehicle-mounted data acquisition and transmission system interacts with each unit through the MVB network to obtain data from the data acquisition unit, organizes the data, and transmits the organized data to the ground operation and maintenance system through wireless communication between the vehicle and the ground.

[0069] S3, organize and manage the communication of subsystems in the vehicle data acquisition and transmission system through the central control unit;

[0070] In specific implementation, as a preferred embodiment of the present invention, the central control unit transmits data with the subsystem through the MVB network, and configures the data transmission cycle according to the communication data requirements of the subsystem; the central control unit transmits data to the braking system in a transparent manner, and receives data from the braking system for mapping.

[0071] During implementation, the braking system needs to directly obtain the original data of the subway vehicle traction system. The braking system exchanges data with the on-board data acquisition and transmission system through the MVB bus, but the on-board data acquisition and transmission system only acts as a medium for data transmission and does not perform logical control on the data. It transmits the data to the braking system in a transparent manner. The central control unit receives the MVB network data of the braking system and maps the data. The MVB network central control unit, human-machine interface unit and braking system receive and process the data. There is data interaction between the traction system, the central control unit and the braking system.

[0072] S4. Conduct security monitoring and protection of the audit function in the vehicle data collection and transmission system through the network security unit;

[0073] In specific implementation, as a preferred implementation mode of the present invention, the audit functions include: session access control, session monitoring, static routing and NAT and global anti-DOS attack; the network security unit is provided with regional security protection and boundary protection, and regional security protection means that the equipment and data in each area are protected to different degrees, and boundary protection means the security measures taken at the boundary of the network or system to prevent unauthorized access and attacks.

[0074] In implementation, session access control refers to the control of the session between the server and the client, and determines who the two parties in the session are; session monitoring refers to monitoring the content of the session; static routing refers to a routing method that is manually configured. Static NAT refers to a technology that maps network addresses during network address conversion. Global anti-DOS attack refers to the establishment of a comprehensive security system, with multiple protection measures from the network infrastructure to the application level.

[0075] S5. Use the data encryption unit to encrypt the output data and output it to the external environment.

[0076] In specific implementation, as a preferred embodiment of the present invention, the data encryption unit adopts an algorithm that combines asymmetric encryption and symmetric encryption to encrypt and decrypt data. Symmetric encryption means that the sender and receiver use the same key password, and asymmetric encryption means the process of encryption and decryption using a pair of different keys.

[0077] In implementation, the data encryption unit uses an algorithm that combines asymmetric encryption and symmetric encryption, which have their own advantages. By combining the two algorithms, the security of the key during transmission is guaranteed, and the rapid encryption of data with large data packets is guaranteed, with complementary advantages.

[0078] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0079] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0080] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0081] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed over multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0082] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0083] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes.

[0084] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A vehicle-mounted data acquisition and transmission system based on a security mechanism, characterized in that: include: Data acquisition unit, network security unit, data encryption unit, bus interface unit, Ethernet switch, IO expansion unit and central control unit, including: The data acquisition unit acquires real-time fault data and normal operation data of the subway vehicle through the bus interface unit, performs data fusion, cleaning and feature extraction processing on the system status information and fault data, and stores the data; The network security unit is provided with redundancy measures and relay functions for protecting the data acquisition unit and establishing a data protection line of defense. The redundancy measures are used to switch to redundant equipment when equipment fails to maintain normal operation of the system; The data encryption unit performs data transmission with the data collection unit and is used for receiving and sending data; when receiving data, the received data is decrypted and then passed to the data collection unit; when sending data, the data of the data collection unit is encrypted and then sent to the outside; The bus interface unit is used to convert and configure relevant protocols and transmit data in a transparent manner; The Ethernet switch has a unique Ethernet communication transmission channel, and the security of data transmission is ensured by the network security unit; The IO expansion unit includes a digital quantity input module and a digital quantity output module, wherein the digital quantity input module is responsible for collecting digital quantity signals, and the digital quantity output module is responsible for outputting voltage signals; The central control unit is used to organize and manage the communication of subsystems in the vehicle-mounted data acquisition and transmission system, and the subsystems include a traction system, a braking system, a door system and an air conditioning system.

2. A working method of a vehicle-mounted data acquisition and transmission system based on a safety mechanism, characterized in that: The specific steps include: S1. Collecting process data, message data and monitoring data of subway vehicles during operation through a data acquisition unit, and performing data processing and storage; S2, organize the data in S1 into data messages using a communication protocol; S3, organize and manage the communication of subsystems in the vehicle data acquisition and transmission system through the central control unit; S4. Conduct security monitoring and protection of the audit function in the vehicle data collection and transmission system through the network security unit; S5. Use the data encryption unit to encrypt the output data and output it to the external environment.

3. The working method of the vehicle-mounted data acquisition and transmission system based on the safety mechanism according to claim 2 is characterized in that: The process data includes: real-time vehicle location, current speed, ambient temperature, and operating conditions; the message data includes: functional messages and service messages. The functional messages are used by the vehicle-mounted data acquisition and transmission system to control the network of the subsystem, and the service messages are used to manage the vehicle-mounted data acquisition and transmission system; the monitoring data is used to monitor and verify the status of the subsystem equipment.

4. The working method of the vehicle-mounted data acquisition and transmission system based on the safety mechanism according to claim 2 is characterized in that: The data message is organized as follows: message header + type + message ID + subject content + reserved field + message tail; The vehicle-mounted data acquisition and transmission system interacts with each unit through the MVB network to obtain data from the data acquisition unit, organizes the data, and transmits the organized data to the ground operation and maintenance system through wireless communication between the vehicle and the ground.

5. The working method of the vehicle-mounted data acquisition and transmission system based on the safety mechanism according to claim 2 is characterized in that: The central control unit transmits data with the subsystem via the MVB network, and configures the data transmission cycle according to the communication data requirements of the subsystem; the central control unit transmits data to the braking system in a transparent transmission manner, and receives data from the braking system for mapping.

6. The working method of the vehicle-mounted data acquisition and transmission system based on the safety mechanism according to claim 2 is characterized in that: The audit functions include: session access control, session monitoring, static routing and NAT and global anti-DOS attack; the network security unit is equipped with regional security protection and boundary protection. The regional security protection means that the equipment and data in each area are protected to different degrees, and the boundary protection means the security measures taken at the boundary of the network or system to prevent unauthorized access and attacks.

7. The working method of the vehicle-mounted data acquisition and transmission system based on the safety mechanism according to claim 2 is characterized in that: The data encryption unit uses an algorithm that combines asymmetric encryption and symmetric encryption to encrypt and decrypt data. The symmetric encryption means that the sender and receiver use the same key password, and the asymmetric encryption means the process of using a pair of different keys for encryption and decryption.

Images