A marine multi-link fusion communication method and system

Abstract

The present application provides a method and system for ship-borne multi-link fusion communication, which belongs to the field of communication technology and is used to divert access through access rights to effectively ensure the security of ship network data access. Applied to ship equipment, the method includes: when a terminal device needs to access a ship network, the control device obtains the identity information of the terminal device; the control device determines the designated network in the ship network that the terminal device has the right to access based on the identity information of the terminal device; when there are multiple terminal devices, the data stream of each terminal device in the multiple terminal devices is used as a link, with a total of multiple links, and the control device sends the data streams of multiple links to the designated network by fusing the multiple links.

Description

Technical Field

[0001] The present application relates to the field of communications, and in particular to a ship-based multi-link fusion communication method and system. Background Art

[0002] With the development of information technology, the electronic and information systems of ships have become more and more complex and important. These systems not only support basic communication and navigation functions, but also involve the control and monitoring of ships. Ship networks usually consist of multiple layers, including user networks and general application layers, integrated management and monitoring layers, and ship control network layers. Each layer is connected through security measures such as firewalls.

[0003] It can be seen that the ship network structure is relatively complex, and the connections between the network layers are usually equipped with firewalls to ensure the security of data transmission. Due to the long overall design and construction cycle of ships and the low frequency of hardware upgrades, the ship network is prone to insufficient software and hardware maintenance and upgrades. With the intelligence of ships and the use of various communication methods, such as wireless LAN (802.11p), WiFi, LTE / 4G, 5G, VHF, HF, etc., network security risks are also increasing.

[0004] In summary, how to ensure the security of ship network data access is a current research issue. Summary of the invention

[0005] The embodiments of the present application provide a method and system for multi-link fusion communication on a ship, which are used to divert access by access rights to effectively ensure the security of ship network data access.

[0006] In order to achieve the above objectives, this application adopts the following technical solutions:

[0007] In a first aspect, a shipborne multi-link fusion communication method is provided, which is applied to a ship's control device, the method comprising: when a terminal device needs to access a ship's network, the control device obtains identity information of the terminal device; the control device determines, based on the identity information of the terminal device, a designated network in the ship's network that the terminal device has access to; when there are multiple terminal devices, the data stream of each of the multiple terminal devices is used as a link, with a total of multiple links, and the control device sends the data streams of the multiple links to the designated network by fusing the multiple links.

[0008] Optionally, the ship network includes M ship local area networks, the M ship local area networks refer to local area networks deployed on the ship, and the control device determines the designated network in the ship network that the terminal device has the authority to access based on the identity information of the terminal device, including: the control device determines the ship local area network associated with the identity information of the terminal device from the M ship local area networks based on the identity information of the terminal device, the ship local area network associated with the identity information of the terminal device is the designated network that the terminal device has the authority to access, and M is an integer greater than 2.

[0009] Optionally, the control device obtains the identity information of the terminal device, including: the control device obtains the identity information of the terminal device from the data stream of the terminal device; one of the following items in the identity information of the terminal device: the IP address of the terminal device, the MAC address of the terminal device, or the authentication account of the terminal device; accordingly, the control device determines the ship local area network associated with the identity information of the terminal device from M ship local area networks according to the identity information of the terminal device, including: the control device verifies the authentication account of the terminal device; when the authentication account of the terminal device is verified, the control device determines the ship local area network that the authentication account of the terminal device is authorized to access from the M ship local area networks according to the authentication account of the terminal device; the control device determines the terminal Whether the IP address of the device belongs to the IP address segment allowed to access the ship's local area network accessed by the authentication account of the authorized terminal device, or whether the MAC address of the terminal device belongs to the MAC address segment allowed to access the ship's local area network accessed by the authentication account of the authorized terminal device; if the IP address of the terminal device belongs to the IP address segment allowed to access the ship's local area network accessed by the authentication account of the authorized terminal device, or the MAC address of the terminal device belongs to the MAC address segment allowed to access the ship's local area network accessed by the authentication account of the authorized terminal device, then the ship's local area network accessed by the authentication account of the authorized terminal device is determined to be the ship's local area network associated with the identity information of the terminal device, otherwise, the terminal device's request to access the ship's network is rejected.

[0010] Optionally, the control device sends data streams of multiple links to a designated network by fusing multiple links, including: for any terminal device among multiple terminal devices, the control device encrypts the data stream of the terminal device by means of network packet encryption to obtain an encrypted data stream; the control device packages and fuses the encrypted data streams of multiple terminal devices respectively, and sends them to a gateway interface in the designated network, and the packaged and fused data streams are the data streams of multiple links.

[0011] Optionally, M ship local area networks provide different local area network services for the ship, and the M ship local area networks are divided into N ship local area network groups, N is an integer greater than 1, and the networks contained in any two of the N ship local area network groups are different; on this basis, the control device uses network group encryption to encrypt the data stream of the terminal device to obtain an encrypted data stream, including: the control device determines the target ship local area network group to which the designated network belongs in the N ship local area network groups; the control device uses the security key of the target ship local area network group to encrypt the data stream of the terminal device to obtain an encrypted data stream.

[0012] Optionally, M=N, any ship local area network among the M ship local area networks belongs to at least two ship local area network groups, and is only the main network member of one ship local area network group among the at least two ship local area network groups; the designated network is the main network member in the target ship local area network group; the control device uses the security key of the target ship local area network group to encrypt the data stream of the terminal device to obtain an encrypted data stream, including: the control device uses the key of the designated network to encrypt the first data to obtain the encrypted first data; the data stream of the terminal device includes the first data and the second data; the control device uses the key of at least one ship local area network randomly selected from the target ship local area network to encrypt the encrypted first data and the second data to obtain an encrypted data stream.

[0013] Optionally, the length of the key of the designated network is k1, k1 is an integer greater than 1, the length of the data stream of the terminal device is k2, k2 is an integer greater than k1, and the control device encrypts the first data using the key of the designated network to obtain the encrypted first data, including: the control device determines that the y1th bit in the data stream of the terminal device is the starting position of the data according to k2modk1=y1; if the freshness random number R1 is greater than the freshness random number R2, the control device determines that the y1+R2th bit in the data stream of the terminal device is the end position of the data, or if the freshness random number R2 is greater than the freshness random number R1, the control device determines that the y1+R1th bit in the data stream of the terminal device is the end position of the data, wherein the freshness random number R1 is a random positive integer randomly generated in advance by the gateway interface in the designated network and sent to the control device, and the freshness random number R2 ... An integer randomly selected in the range of y1+1 to k2; the control device determines the data from the starting position of the data to the ending position of the data in the data stream of the terminal device as the first data, and the data other than the first data in the data stream of the terminal device is the second data; the control device encrypts the first data using the key of the designated network to obtain the encrypted first data; the control device packages and merges the encrypted data streams of multiple terminal devices respectively, and sends them to the gateway interface in the designated network, including: for any terminal device among the multiple terminal devices, the control device packages the encrypted data stream of the terminal device, the freshness random number R2, and the information indicating that the length of the data stream of the terminal device is k2 to obtain the packaged data stream of the terminal device; the control device repackages the packaged data streams of the multiple terminal devices respectively to obtain a packaged and merged data stream; the control device sends the packaged and merged data stream to the gateway interface in the designated network.

[0014] Optionally, the control device uses keys of at least two ship local area networks randomly selected from the target ship local area network to encrypt the encrypted first data and the second data to obtain an encrypted data stream, including: the control device randomly selects at least two ship local area networks from the target ship local area network, and uses the keys of the at least two ship local area networks to derive a new key; the control device uses the new key to encrypt the encrypted first data and the second data to obtain an encrypted data stream.

[0015] Optionally, the method further includes: if the terminal device needs to access an external network other than the ship network, the control device sends the data stream of the terminal device to the interface of the external network, and the external network refers to a non-local area network that is not deployed on the ship.

[0016] According to a second aspect, a shipborne multi-link fusion communication system is provided, which includes a control device applied to a ship, and the control device is configured as follows: when a terminal device needs to access a shipborne network, the control device obtains identity information of the terminal device; the control device determines, based on the identity information of the terminal device, a designated network in the shipborne network that the terminal device has access to; when there are multiple terminal devices, the data stream of each of the multiple terminal devices is used as a link, for a total of multiple links, and the control device sends the data streams of the multiple links to the designated network by fusing the multiple links.

[0017] The system described in the second aspect is specifically configured to implement the method described in the first aspect above. Please refer to the introduction of the method described in the first aspect for details, which will not be repeated here.

[0018] In a third aspect, an embodiment of the present invention provides a readable storage medium having a program or instruction stored thereon, wherein the program or instruction, when executed by a processor, implements the steps in the above-mentioned shipborne multi-link fusion communication method.

[0019] In a fourth aspect, an embodiment of the present invention provides an electronic device, comprising a processor, wherein the processor is coupled to a memory and a transceiver, and the processor executes the ship multi-link fusion communication method described in the first aspect by running or executing a software program stored in the memory and calling data stored in the memory.

[0020] The above method and system have the following technical effects:

[0021] When a terminal device needs to access a shipboard network, the control device can obtain the identity information of the terminal device to determine the designated network in the shipboard network that the terminal device has access to based on the identity information of the terminal device. If the terminal device does not have access to the network, access is not allowed, thereby diverting access by access rights to effectively ensure the security of ship network data access. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 A schematic diagram of the architecture of a communication system provided in an embodiment of the present application;

[0023] Figure 2 A schematic diagram of a process flow of a marine multi-link fusion communication method provided in an embodiment of the present application;

[0024] Figure 3 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0025] The technical solution in this application will be described below in conjunction with the accompanying drawings.

[0026] The technical solutions of the embodiments of the present application can be applied to various communication systems, such as wireless network (Wi-Fi) systems, vehicle to everything (V2X) communication systems, device-to-device (D2D) communication systems, Internet of Vehicles communication systems, fourth generation (4G) mobile communication systems, such as long term evolution (LTE) systems, worldwide interoperability for microwave access (WiMAX) communication systems, fifth generation (5G) systems, such as new radio (NR) systems, and future communication systems.

[0027] The present application will present various aspects, embodiments or features around a system that may include multiple devices, components, modules, etc. It should be understood and appreciated that each system may include additional devices, components, modules, etc., and / or may not include all of the devices, components, modules, etc. discussed in conjunction with the figures. In addition, combinations of these schemes may also be used.

[0028] In addition, in the embodiments of the present application, words such as "exemplary" and "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "exemplary" in the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of the word "exemplary" is intended to present concepts in a concrete way.

[0029] In the embodiments of the present application, "information", "signal", "message", "channel" and "signaling" can sometimes be used interchangeably. It should be noted that when the distinction between them is not emphasized, the meanings they intend to express are matched. "Corresponding, relevant" and "corresponding" can sometimes be used interchangeably. It should be noted that when the distinction between them is not emphasized, the meanings they intend to express are matched. In addition, the " / " mentioned in the present application can be used to express an "or" relationship.

[0030] The network architecture and business scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. A person of ordinary skill in the art can appreciate that with the evolution of the network architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0031] To facilitate understanding of the embodiments of the present application, first Figure 1 The communication system shown in the figure is used as an example to describe in detail the communication system applicable to the embodiments of the present application.

[0032] Figure 1 A schematic diagram of the architecture of a communication system applicable to the ship-based multi-link fusion communication method provided in the embodiment of the present application. Figure 1 As shown, the communication system includes: a control device and a network device.

[0033] Among them, the control device can be understood as the ship's intelligent brain device, which is responsible for processing and distributing data. The control device can be a terminal-shaped device, such as a terminal device with transceiver and processing functions, or a chip or chip system that can be set in the terminal device. The terminal device can also be called user equipment (UE), access terminal equipment, subscriber unit, user station, mobile station (MS), mobile station, remote station, remote terminal equipment, mobile device, user terminal equipment, terminal equipment, wireless communication equipment, user agent or user device. The terminal device in the embodiments of the present application can be a mobile phone, a cellular phone, a smart phone, a tablet computer, a wireless data card, a personal digital assistant (PDA), a wireless modem, a handset, a laptop computer, a machine type communication (MTC) terminal device, a computer with wireless transceiver function, a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, a wireless terminal device in industrial control, a wireless terminal device in self driving, a wireless terminal device in remote medical, a wireless terminal device in a smart grid, a wireless terminal device in transportation safety, a wireless terminal device in a smart city, a wireless terminal device in a smart home, a vehicle-mounted terminal device, a road side unit (RSU) with terminal device function, etc. The terminal device of the present application may also be a vehicle-mounted module, a vehicle-mounted module, a vehicle-mounted component, a vehicle-mounted chip or a vehicle-mounted unit built into a vehicle as one or more components or units. Or the terminal device may also be a customer-premises equipment (CPE).

[0034] There may be multiple network devices, such as gateway interfaces and routing nodes in each ship's local area network.

[0035] Understandably, Figure 1The simplified schematic diagram is provided for ease of understanding. The communication system may also include other network devices and / or other terminal devices. Figure 1 Not drawn.

[0036] For ease of understanding, the following will combine Figure 2 The shipborne multi-link fusion communication method provided in the embodiment of the present application is specifically described.

[0037] For example, Figure 2 The embodiment of the present application provides a flow chart of a method for multi-link fusion communication for ships. The method can be applied to the communication between the network device and the terminal device in the above communication system.

[0038] like Figure 2 As shown, the process of the ship-based multi-link fusion communication method is as follows:

[0039] S201, when the terminal device needs to access the ship network, the control device obtains the identity information of the terminal device.

[0040] The terminal device may be a user terminal on a ship, such as a UE. For example, when the terminal device needs to access a ship network, the terminal device may send a data stream of the terminal device to the control device, such as a data stream consisting of multiple data packets. The control device may obtain the identity information of the terminal device from the data stream of the terminal device; the identity information of the terminal device may include one of the following: the IP address of the terminal device, the MAC address of the terminal device, or the authentication account of the terminal device. The authentication account of the terminal device is the information after the terminal device signs the account of the terminal device using the signature of the terminal device.

[0041] S202, the control device determines, based on the identity information of the terminal device, a designated network in the ship network that the terminal device has permission to access.

[0042] The ship network may include M ship local area networks, which are local area networks deployed on the ship and provide different local area network services for the ship. For example, ship local area network #1 is a network that provides monitoring and security services, ship local area network #2 is a network that provides ship control services, and ship local area network #3 is a network that provides ship application services.

[0043] The control device can determine the ship local area network associated with the identity information of the terminal device from M ship local area networks based on the identity information of the terminal device. The ship local area network associated with the identity information of the terminal device is the designated network that the terminal device has permission to access, and M is an integer greater than 2.

[0044] Specifically, the control device may verify the authentication account of the terminal device, such as verifying the signature of the authentication account of the terminal device to determine whether it is a signature made by a trusted terminal. When the authentication account of the terminal device is verified (i.e., the signature is verified), the control device determines, based on the authentication account of the terminal device, the ship local area network that the authentication account of the terminal device is authorized to access from the M ship local area networks, i.e., the ship local area network corresponding to the authentication account.

[0045] The control device determines whether the IP address of the terminal device belongs to the IP address segment that is allowed to access the ship's local area network that the authentication account of the authorized terminal device accesses, or whether the MAC address of the terminal device belongs to the MAC address segment that is allowed to access the ship's local area network that the authentication account of the authorized terminal device accesses. If the IP address of the terminal device belongs to the IP address segment that is allowed to access the ship's local area network that the authentication account of the authorized terminal device accesses, or the MAC address of the terminal device belongs to the MAC address segment that is allowed to access the ship's local area network that the authentication account of the authorized terminal device accesses, then it is determined that the ship's local area network that the authentication account of the authorized terminal device accesses is the ship's local area network associated with the identity information of the terminal device, otherwise, the terminal device's request to access the ship's network is rejected.

[0046] In other words, by verifying the signature, it is possible to effectively determine the ship's local area network that a terminal can access, thereby determining whether the IP address or MAC address currently accessed by the terminal belongs to the address segment of the ship's local area network, thereby ensuring data security. If a terminal forges an IP address or MAC address, the terminal's access will be denied.

[0047] S203, when there are multiple terminal devices, the data flow of each terminal device in the multiple terminal devices is used as a link, and there are multiple links in total. The control device sends the data flow of the multiple links to the designated network by fusing the multiple links.

[0048] For any terminal device among the multiple terminal devices, the control device may encrypt the data stream of the terminal device in a network packet encryption manner to obtain an encrypted data stream.

[0049] Among them, M ship local area networks are divided into N ship local area network groups, N is an integer greater than 1, and the networks contained in any two ship local area network groups in the N ship local area network groups are different. For example, M=N, any ship local area network in the M ship local area networks belongs to at least two ship local area network groups, and is only the main network member of one ship local area network group in at least two ship local area network groups. The key of the main network member can be used for the first encryption in data transmission, and the key of other members is used for re-encryption after the first encryption, so as to further ensure data security in the scenario of high data security of ships. Among them, the N ship local area network groups can be configured by the staff according to actual needs in actual applications, and the embodiments of this application are not limited. For example, M ship local area networks include: ship local area network #1, ship local area network #2, ship local area network #3, ship local area network #4, and N ship local area network groups can be respectively: ship local area network group #1 includes: ship local area network #1 (main network member), ship local area network #2 and ship local area network #3. Ship local area network group #2 includes: ship local area network #2 (main network member), ship local area network #3 and ship local area network #4. Ship local area network group #3 includes: ship local area network #3 (main network member), ship local area network #4 and ship local area network #1. Ship local area network group #4 includes: ship local area network #4 (main network member), ship local area network #1 and ship local area network #2. Alternatively, there are other grouping methods, which are only examples.

[0050] On this basis, the control device can determine the target ship local area network group to which the designated network belongs in the N ship local area network groups, specifically, the target ship local area network group where the designated network is a main network member. The control device can use the security key of the target ship local area network group to encrypt the data stream of the terminal device to obtain an encrypted data stream.

[0051] For example, the control device may use a key of a designated network to encrypt the first data to obtain the encrypted first data; and the data stream of the terminal device includes the first data and the second data.

[0052] Specifically, the length of the key of the designated network is k1, k1 is an integer greater than 1, the length of the data stream of the terminal device is k2, k2 is an integer greater than k1, and the control device can determine that the y1th bit in the data stream of the terminal device is the starting position of the data according to k2modk1=y1. If the freshness random number R1 is greater than the freshness random number R2, the control device determines that the y1+R2th bit in the data stream of the terminal device is the end position of the data, or if the freshness random number R2 is greater than the freshness random number R1, the control device determines that the y1+R1th bit in the data stream of the terminal device is the end position of the data. The freshness random number R1 is a random positive integer randomly generated in advance by the gateway interface in the designated network and sent to the control device, wherein the gateway interface in each ship local area network periodically generates the latest freshness random number and sends it to the control device. The control device can save the latest freshness random number, determine that the historically saved freshness random number is invalid, and discard the historically saved freshness random number. The freshness random number R2 is an integer randomly selected by the control device in the range of y1+1 to k2, that is, the control device can determine the freshness random number R2 according to the starting position of the currently determined data and the data range thereafter.

[0053] It can be understood that since the data length of each communication may be different, the starting position of the data determined each time may be different, thereby further improving data security. In addition, the key of the designated network may be a symmetric encryption key, which is a key pre-configured and aligned between the designated network and the control device. The same is true for other ship local area networks, which can be understood by reference and will not be repeated here.

[0054] The control device may determine the data from the starting position of the data to the ending position of the data in the data stream of the terminal device as the first data, and the data in the data stream of the terminal device other than the first data as the second data.

[0055] Then, the control device uses the key of at least one ship local area network randomly selected from the target ship local area network to encrypt the encrypted first data and the second data to obtain an encrypted data stream. For example, the control device randomly selects at least two ship local area networks from the target ship local area network, and uses the keys of the at least two ship local area networks to derive and obtain a new key. For example, the control device can use a key derivation algorithm pre-configured and aligned with the control device and the specified network, and use the keys of the at least two ship local area networks as input parameters to derive and obtain a new key. The control device encrypts the encrypted first data and the second data using the new key to obtain an encrypted data stream.

[0056] Finally, the encrypted data streams of multiple terminal devices of the control device are packaged and merged, and sent to the gateway interface in the specified network. The packaged and merged data streams are the data streams of multiple links.

[0057] Specifically, for any terminal device among the multiple terminal devices, the control device packages (or compresses) the encrypted data stream of the terminal device, the freshness random number R2, and the information indicating that the length of the data stream of the terminal device is k2 to obtain the packaged data stream of the terminal device. The control device repackages (or compresses) the packaged data streams of the multiple terminal devices to obtain a packaged and fused data stream; the control device sends the packaged and fused data stream to the gateway interface in the designated network, which can improve the transmission efficiency, that is, the data of multiple terminal devices can be safely transmitted at one time.

[0058] The gateway interface can perform the reverse process of the above encryption. Specifically, the gateway interface is pre-configured with the key of each ship local area network in the target ship local area network group. The gateway interface can first unpack (or decompress) the packaged and fused data stream to obtain the packaged data streams of multiple terminal devices, and then unpack (or decompress) the packaged data streams of multiple terminal devices respectively to obtain the encrypted data stream of each terminal device, the freshness random number R2, and the information indicating that the length of the data stream of the terminal device is k2. It can be understood that the freshness random number R2 and the length K2 of the data stream of each terminal device can be different, and the above is named R2 and K2. On this basis, for any terminal device, the gateway interface can try to deduce the key combination of each ship local area network, and use the deduced new key to decrypt the encrypted data stream. If the decryption fails, continue to try other combinations and perform key derivation, and then repeat this process until the decryption is successful. Since the gateway interface knows that the length of the data stream of the terminal device is k2, and also knows that the length of the key of the designated network is k1, the gateway interface can also determine the starting position of the data according to k2modk1=y1, and determine the end position of the data according to the freshness random number R1 and the freshness random number R2, so as to extract the encrypted first data from the decrypted data, and decrypt the encrypted first data to obtain the first data and the second data. Finally, the gateway interface can use the security protocol inside the network to send the data stream of the terminal device to the designated network.

[0059] Optionally, if the terminal device needs to access an external network other than the ship network, the control device sends the data stream of the terminal device to the interface of the external network, where the external network refers to a non-local area network that is not deployed on the ship.

[0060] In summary, when a terminal device needs to access a shipboard network, the control device can obtain the identity information of the terminal device to determine the designated network in the shipboard network that the terminal device has access to based on the identity information of the terminal device. If the terminal device does not have access to the network, access is not allowed, thereby diverting access by access rights to effectively ensure the security of ship network data access.

[0061] Combination of the above Figure 2 The shipboard multi-link fusion communication method provided in the embodiment of the present application is described in detail. The following is a detailed description of a shipboard multi-link fusion communication system for executing the shipboard multi-link fusion communication method provided in the embodiment of the present application, which includes a control device applied to a ship. The control device is configured to: when the terminal device needs to access the shipboard network, the control device obtains the identity information of the terminal device; the control device determines the designated network in the shipboard network that the terminal device has the authority to access based on the identity information of the terminal device; the control device sends the data stream of the terminal device to the designated network. The control device is configured specifically for executing the above Figure 2 For the specific process of the method described, please refer to the relevant introduction of the above method, which will not be repeated here.

[0062] Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. For example, the electronic device may be a terminal, or a chip (system) or other components or assemblies that may be provided in a terminal. Figure 3 As shown, the electronic device 400 may include a processor 401. Optionally, the electronic device 400 may further include a memory 402 and / or a transceiver 403. The processor 401 is coupled with the memory 402 and the transceiver 403, such as being connected via a communication bus.

[0063] Combine the following Figure 3 The components of the electronic device 400 are described in detail:

[0064] The processor 401 is the control center of the electronic device 400, and may be a processor or a general term for multiple processing elements. For example, the processor 401 is one or more central processing units (CPUs), or may be application specific integrated circuits (ASICs), or may be one or more integrated circuits configured to implement the embodiments of the present application, such as one or more microprocessors (digital signal processors, DSPs), or one or more field programmable gate arrays (FPGAs).

[0065] Optionally, the processor 401 can execute various functions of the electronic device 400 by running or executing the software program stored in the memory 402 and calling the data stored in the memory 402, such as executing the above Figure 2 The shipborne multi-link fusion communication method is shown.

[0066] In a specific implementation, as an embodiment, the processor 401 may include one or more CPUs, such as Figure 3 CPU0 and CPU1 are shown in FIG.

[0067] In a specific implementation, as an embodiment, the electronic device 400 may also include multiple processors. Each of these processors may be a single-core processor (single-CPU) or a multi-core processor (multi-CPU). The processor here may refer to one or more devices, circuits, and / or processing cores for processing data (such as computer program instructions).

[0068] The memory 402 is used to store the software program for executing the solution of the present application, and the execution is controlled by the processor 401. The specific implementation method can refer to the above method embodiment, which will not be repeated here.

[0069] Optionally, the memory 402 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 402 may be integrated with the processor 401, or may exist independently and access the computer through the interface circuit ( Figure 3 (not shown) is coupled to the processor 401, which is not specifically limited in this embodiment of the present application.

[0070] The transceiver 403 is used for communication with other electronic devices. For example, if the electronic device 400 is a terminal, the transceiver 403 can be used to communicate with a network device, or with another terminal device. For another example, if the electronic device 400 is a network device, the transceiver 403 can be used to communicate with a terminal, or with another network device.

[0071] Optionally, the transceiver 403 may include a receiver and a transmitter ( Figure 3 The receiver is used to implement a receiving function, and the transmitter is used to implement a sending function.

[0072] Optionally, the transceiver 403 may be integrated with the processor 401, or may exist independently and communicate with the electronic device 400 through an interface circuit ( Figure 3 (not shown) is coupled to the processor 401, which is not specifically limited in this embodiment of the present application.

[0073] Understandably, Figure 3 The structure of the electronic device 400 shown in the figure does not constitute a limitation on the electronic device, and the actual electronic device may include more or fewer components than those shown in the figure, or combine certain components, or arrange the components differently.

[0074] In addition, the technical effects of the electronic device 400 can refer to the technical effects of the methods described in the above method embodiments, which will not be repeated here.

[0075] It should be understood that the processor in the embodiments of the present application may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0076] It should also be understood that the memory in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link DRAM (SLDRAM), and direct rambus RAM (DR RAM).

[0077] An embodiment of the present invention provides a readable storage medium on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps in the above-mentioned ship multi-link fusion communication method are implemented.

[0078] The above embodiments can be implemented in whole or in part by software, hardware (such as circuits), firmware or any other combination. When implemented using software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired (such as infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (for example, a floppy disk, a hard disk, a tape), an optical medium (for example, a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0079] It should be understood that the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. A and B can be singular or plural. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship, but it may also indicate an "and / or" relationship. Please refer to the context for specific understanding.

[0080] In this application, "at least one" means one or more, and "plurality" means two or more. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple.

[0081] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0082] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0083] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0084] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0085] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0086] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0087] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, and other media that can store program codes.

[0088] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A marine multi-link fusion communication method, characterized in that: A control device applied to a ship, the method comprising: In the case where the terminal device needs to access the marine network, the control device obtains the identity information of the terminal device; The control device determines, based on the identity information of the terminal device, a designated network in the marine network to which the terminal device has permission to access; In the case where there are multiple terminal devices, the data flow of each of the multiple terminal devices is used as a link, and there are multiple links in total. The control device sends the data flow of the multiple links to the designated network by fusing the multiple links; The ship network includes M ship local area networks, and the M ship local area networks refer to local area networks deployed on the ship; The control device sends the data streams of the multiple links to the designated network by fusing the multiple links, including: For any terminal device among the plurality of terminal devices, the control device encrypts the data stream of the terminal device in a network packet encryption manner to obtain an encrypted data stream; The control device packages and merges the encrypted data streams of the multiple terminal devices, and sends them to the gateway interface in the designated network, where the packaged and merged data streams are the data streams of the multiple links; The M ship local area networks provide different local area network services for the ship, the M ship local area networks are divided into N ship local area network groups, N is an integer greater than 1, and the networks contained in any two ship local area network groups in the N ship local area network groups are different; On this basis, the control device encrypts the data stream of the terminal device in a network packet encryption manner to obtain an encrypted data stream, including: The control device determines a target ship local area network group to which the designated network belongs among the N ship local area network groups; The control device encrypts the data stream of the terminal device using the security key of the target ship local area network group to obtain the encrypted data stream; M=N, any ship local area network in the M ship local area networks belongs to at least two ship local area network groups, and is only a primary network member of one ship local area network group in the at least two ship local area network groups; the designated network is a primary network member in the target ship local area network group; The control device encrypts the data stream of the terminal device using the security key of the target ship local area network group to obtain the encrypted data stream, including: The control device encrypts the first data using the key of the designated network to obtain the encrypted first data; the data stream of the terminal device includes the first data and the second data; The control device uses a key of at least one ship local area network randomly selected from the target ship local area network group to encrypt the encrypted first data and the second data to obtain the encrypted data stream.

2. The method according to claim 1, characterized in that The control device determines, according to the identity information of the terminal device, a designated network in the marine network to which the terminal device has permission to access, including: The control device determines, based on the identity information of the terminal device, the ship local area network associated with the identity information of the terminal device from the M ship local area networks, the ship local area network associated with the identity information of the terminal device is the designated network that the terminal device has access rights to, and M is an integer greater than 2.

3. The method according to claim 2, characterized in that The control device obtains the identity information of the terminal device, including: The control device obtains the identity information of the terminal device from the data stream of the terminal device; the identity information of the terminal device is one of the following: the IP address of the terminal device, the MAC address of the terminal device, or the authentication account of the terminal device; Correspondingly, the control device determines, according to the identity information of the terminal device, from the M ship local area networks, a ship local area network associated with the identity information of the terminal device, including: The control device verifies the authentication account of the terminal device; When the authentication account of the terminal device is verified to be passed, the control device determines, according to the authentication account of the terminal device, from the M ship local area networks, a ship local area network that is authorized to be accessed by the authentication account of the terminal device; The control device determines whether the IP address of the terminal device belongs to the IP address segment that the authentication account of the terminal device is authorized to access, or whether the MAC address of the terminal device belongs to the MAC address segment that the authentication account of the terminal device is authorized to access; If the IP address of the terminal device belongs to the IP address segment allowed to access the ship's local area network authorized for access by the authentication account of the terminal device, or the MAC address of the terminal device belongs to the MAC address segment allowed to access the ship's local area network authorized for access by the authentication account of the terminal device, then the ship's local area network authorized for access by the authentication account of the terminal device is determined to be the ship's local area network associated with the identity information of the terminal device; otherwise, the terminal device's request to access the ship's network is rejected.

4. The method according to claim 1, characterized in that The length of the key of the designated network is k1, k1 is an integer greater than 1, the length of the data stream of the terminal device is k2, k2 is an integer greater than k1, and the control device encrypts the first data using the key of the designated network to obtain the encrypted first data, including: The control device determines, according to k2modk1=y1, that the y1th bit in the data stream of the terminal device is the starting position of the data; If the freshness random number R1 is greater than the freshness random number R2, the control device determines that the y1+R2th bit in the data stream of the terminal device is the end position of the data, or if the freshness random number R2 is greater than the freshness random number R1, the control device determines that the y1+R1th bit in the data stream of the terminal device is the end position of the data, wherein the freshness random number R1 is a random positive integer randomly generated in advance by the gateway interface in the designated network and sent to the control device, and the freshness random number R2 is an integer randomly selected by the control device in the range of y1+1 to k2; The control device determines the data from the starting position of the data to the ending position of the data in the data stream of the terminal device as the first data, and the data other than the first data in the data stream of the terminal device as the second data; The control device encrypts the first data using the key of the designated network to obtain the encrypted first data; Correspondingly, the control device packages and merges the encrypted data streams of the multiple terminal devices, and sends them to the gateway interface in the designated network, including: For any terminal device among the plurality of terminal devices, the control device packages the encrypted data stream of the terminal device, the freshness random number R2, and information indicating that the length of the data stream of the terminal device is k2 to obtain a packaged data stream of the terminal device; The control device repacks the respective packed data streams of the plurality of terminal devices to obtain a packed and fused data stream; The control device sends the packaged and fused data stream to a gateway interface in the designated network.

5. The method according to claim 1, characterized in that The control device uses keys of at least two ship local area networks randomly selected from the target ship local area network to encrypt the encrypted first data and the second data to obtain the encrypted data stream, including: The control device randomly selects at least two ship local area networks from the target ship local area network, and uses the keys of the at least two ship local area networks to derive a new key; The control device encrypts the encrypted first data and the second data using a new key to obtain the encrypted data stream.

6. A marine multi-link fusion communication system, characterized in that: The system comprises a control device applied to a ship, wherein the control device is configured to: In the case where the terminal device needs to access the marine network, the control device obtains the identity information of the terminal device; The control device determines, based on the identity information of the terminal device, a designated network in the marine network to which the terminal device has permission to access; In the case where there are multiple terminal devices, the data flow of each of the multiple terminal devices is used as a link, and there are multiple links in total. The control device sends the data flow of the multiple links to the designated network by fusing the multiple links; The ship network includes M ship local area networks, and the M ship local area networks refer to local area networks deployed on the ship; The control device sends the data streams of the multiple links to the designated network by fusing the multiple links, including: For any terminal device among the plurality of terminal devices, the control device encrypts the data stream of the terminal device in a network packet encryption manner to obtain an encrypted data stream; The control device packages and merges the encrypted data streams of the multiple terminal devices, and sends them to the gateway interface in the designated network, where the packaged and merged data streams are the data streams of the multiple links; The M ship local area networks provide different local area network services for the ship, the M ship local area networks are divided into N ship local area network groups, N is an integer greater than 1, and the networks contained in any two ship local area network groups in the N ship local area network groups are different; On this basis, the control device encrypts the data stream of the terminal device in a network packet encryption manner to obtain an encrypted data stream, including: The control device determines a target ship local area network group to which the designated network belongs among the N ship local area network groups; The control device encrypts the data stream of the terminal device using the security key of the target ship local area network group to obtain the encrypted data stream; M=N, any ship local area network in the M ship local area networks belongs to at least two ship local area network groups, and is only a primary network member of one ship local area network group in the at least two ship local area network groups; the designated network is a primary network member in the target ship local area network group; The control device encrypts the data stream of the terminal device using the security key of the target ship local area network group to obtain the encrypted data stream, including: The control device encrypts the first data using the key of the designated network to obtain the encrypted first data; the data stream of the terminal device includes the first data and the second data; The control device uses a key of at least one ship local area network randomly selected from the target ship local area network group to encrypt the encrypted first data and the second data to obtain the encrypted data stream.

7. A readable storage medium, characterized in that: The readable storage medium stores a program or instruction, and when the program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

8. An electronic device, characterized in that: The electronic device includes a processor coupled to a memory and a transceiver. The processor executes the method as described in any one of claims 1 to 5 by running or executing a software program stored in the memory and calling data stored in the memory.

Images