Gateway, data transmission method, flight equipment communication system, aircraft and hovercar

Abstract

The invention provides a gateway, a data transmission method, a flight equipment communication system, an aircraft and a hovercar, and relates to the technical field of communication. The gateway comprises a non-security domain subsystem and a security domain subsystem, the non-security domain subsystem is in communication connection with the security domain subsystem, the non-security domain subsystem is in communication connection with a non-security domain system of the flight equipment, and the security domain subsystem is in communication connection with a security domain system of the flight equipment. The non-security domain subsystem is used for performing first protection detection on to-be-transmitted data from the non-security domain subsystem and sending the to-be-transmitted data passing the first protection detection to the security domain subsystem; and the security domain subsystem is used for performing second protection detection on the received to-be-transmitted data and sending the to-be-transmitted data passing the second protection detection to the security domain system. According to the invention, the isolation and communication between the security domain system and the non-security domain system are realized through the gateway, the design of equipment in the security domain system and the non-security domain system is simplified, and the cost is saved.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a gateway, a data transmission method, a flight equipment communication system, an aircraft and a flying car. Background Art

[0002] In aircraft, flying cars that combine flying and land travel, etc., they are usually composed of multiple devices, which may have different safety levels and can be roughly divided into two categories, namely safety domain devices and non-safety domain devices. Among them, safety domain devices have high requirements for safety and reliability, while non-safety domain devices have relatively low requirements for safety and reliability. The functional failure of non-safety domain devices has little or no impact on the entire machine.

[0003] Since the security levels of security domain devices and non-security domain devices are different, they need to maintain their independence in network communication. At the same time, there are some interactive network communication requirements between the two. To achieve this goal, the usual way is to add an additional non-security network on the basis of the original independent network communication of the security domain to realize the communication between the security domain and the non-security domain. However, this method has the following disadvantages: First, all security domain devices need to add additional network communication interfaces to support the new non-security network, resulting in an increase in the cost of the whole machine; second, all security domain devices need to be equipped with special hardware and software isolation devices to prevent the spread of non-security network failures and information security attacks from invading the security domain, thereby threatening the functional safety and information security of the whole machine; finally, if the security of the interactive network between the security domain and the non-security domain is to be ensured without isolating or protecting the security domain devices, it is necessary to increase the R&D guarantee level of the non-security domain devices, which will increase the cost and development cost of the non-security domain devices. Summary of the invention

[0004] In view of this, the purpose of the present invention is to provide a gateway, a data transmission method, a flight equipment communication system, an aircraft and a flying car, which can realize isolation and communication between the security domain system and the non-security domain system through the gateway, simplify the design of equipment in the security domain system and the non-security domain system, and save costs.

[0005] In order to achieve the above purpose, the technical solution adopted by the embodiment of the present invention is as follows:

[0006] In a first aspect, the present invention provides a gateway, applied to an aircraft device, the aircraft device including a safety domain system and a non-safety domain system, the gateway including a non-safety domain subsystem and a safety domain subsystem, the non-safety domain subsystem and the safety domain subsystem are communicatively connected, the non-safety domain subsystem and the non-safety domain system are communicatively connected, the safety domain subsystem and the safety domain system are communicatively connected, and the safety level of the safety domain system is higher than the safety level of the non-safety domain system;

[0007] The non-secure domain subsystem is used to perform a first protection detection on the data to be transmitted from the non-secure domain system, and send the data to be transmitted that passes the first protection detection to the secure domain subsystem; the data to be transmitted is data transmitted from the non-secure domain system to the secure domain system across domains;

[0008] The security domain subsystem is used to perform a second protection detection on the received data to be transmitted, and send the data to be transmitted that passes the second protection detection to the security domain system.

[0009] In an optional implementation, the non-security domain subsystem is used to authenticate a target device that sends the data to be transmitted in the non-security domain system; when the authentication of the target device is successful, determine whether the data to be transmitted is abnormal data; if the data to be transmitted is abnormal data, filter the data to be transmitted; if the data to be transmitted is not abnormal data, verify the data to be transmitted, and when the verification of the data to be transmitted is successful, determine that the data to be transmitted passes the first protection detection.

[0010] In an optional implementation manner, the non-secure domain subsystem is further configured to, when authentication of the target device fails, send an alarm message to the secure domain subsystem and filter the data to be transmitted.

[0011] In an optional embodiment, the non-security domain subsystem is used to generate a random code, and generate a first result corresponding to the random code according to a preset algorithm; send the random code to the target device so that the target device generates a second result corresponding to the random code according to the preset algorithm; receive the second result returned by the target device; if the second result is the same as the first result, determine that the authentication of the target device is successful; if the second result is different from the first result, determine that the authentication of the target device has failed.

[0012] In an optional implementation, the non-security domain subsystem includes a first main control unit and a first communication unit, the first main control unit is communicatively connected to the first communication unit, the first main control unit is also communicatively connected to the security domain subsystem, and the first communication unit is also communicatively connected to the non-security domain system;

[0013] The first main control unit is used to receive the data to be transmitted through the first communication unit, and perform a first protection detection on the data to be transmitted.

[0014] In an optional implementation, the security domain subsystem is used to determine whether the data to be transmitted is abnormal data; if the data to be transmitted is abnormal data, the data to be transmitted is filtered; if the data to be transmitted is not abnormal data, the data to be transmitted is verified, and if the verification of the data to be transmitted is successful, it is determined that the data to be transmitted has passed the second protection detection.

[0015] In an optional implementation, the security domain subsystem includes a second main control unit and a second communication unit, the second main control unit is communicatively connected to the second communication unit, the second main control unit is also communicatively connected to the non-security domain subsystem, and the second communication unit is also communicatively connected to the security domain system;

[0016] The second main control unit is used to receive the data to be transmitted through the second communication unit, and perform a second protection detection on the data to be transmitted.

[0017] In an optional implementation, the hardware in the non-secure domain subsystem and the secure domain subsystem are independent of each other, and an isolation device is provided between the non-secure domain subsystem and the secure domain subsystem.

[0018] In a second aspect, the present invention provides a data transmission method, applied to the gateway described in any one of the aforementioned implementations, the method comprising:

[0019] The non-secure domain subsystem performs a first protection detection on the data to be transmitted from the non-secure domain system, and sends the data to be transmitted that passes the first protection detection to the secure domain subsystem; the data to be transmitted is data transmitted from the non-secure domain system to the secure domain system across domains;

[0020] The security domain subsystem performs a second protection check on the received data to be transmitted, and sends the data to be transmitted that passes the second protection check to the security domain system.

[0021] In a third aspect, the present invention provides a flight equipment communication system, including a non-safety domain system, a safety domain system and a gateway, wherein the gateway includes a non-safety domain subsystem and a safety domain subsystem, the non-safety domain subsystem is communicatively connected to the safety domain subsystem, the non-safety domain subsystem is communicatively connected to the non-safety domain system, the safety domain subsystem is communicatively connected to the safety domain system, and the safety level of the safety domain system is higher than the safety level of the non-safety domain system;

[0022] The non-secure domain subsystem is used to perform a first protection detection on the data to be transmitted from the non-secure domain system, and send the data to be transmitted that passes the first protection detection to the secure domain subsystem; the data to be transmitted is data transmitted from the non-secure domain system to the secure domain system across domains;

[0023] The security domain subsystem is used to perform a second protection detection on the received data to be transmitted, and send the data to be transmitted that passes the second protection detection to the security domain system.

[0024] In an optional implementation, the non-security domain subsystem is used to authenticate a target device that sends the data to be transmitted in the non-security domain system; when the authentication of the target device is successful, determine whether the data to be transmitted is abnormal data; if the data to be transmitted is abnormal data, filter the data to be transmitted; if the data to be transmitted is not abnormal data, verify the data to be transmitted, and when the verification of the data to be transmitted is successful, determine that the data to be transmitted has passed the first protection detection; when the authentication of the target device fails, send an alarm message to the security domain subsystem, and filter the data to be transmitted.

[0025] In an optional embodiment, the non-security domain subsystem is used to generate a random code, and generate a first result corresponding to the random code according to a preset algorithm; send the random code to the target device so that the target device generates a second result corresponding to the random code according to the preset algorithm; receive the second result returned by the target device; if the second result is the same as the first result, determine that the authentication of the target device is successful; if the second result is different from the first result, determine that the authentication of the target device has failed.

[0026] In an optional implementation, the security domain subsystem is used to determine whether the data to be transmitted is abnormal data; if the data to be transmitted is abnormal data, the data to be transmitted is filtered; if the data to be transmitted is not abnormal data, the data to be transmitted is verified, and if the verification of the data to be transmitted is successful, it is determined that the data to be transmitted has passed the second protection detection.

[0027] In an optional implementation, the non-safety domain system includes cockpit entertainment equipment and driving assistance equipment, and the safety domain system includes flight control equipment, navigation equipment, power equipment, and operating equipment.

[0028] In a fourth aspect, the present invention provides an aircraft, comprising a non-safety domain system, a safety domain system and a gateway as described in any one of the aforementioned embodiments, wherein the non-safety domain system and the safety domain system communicate through the gateway.

[0029] In a fifth aspect, the present invention provides a flying car, comprising a terrestrial body and a flying body, the terrestrial body and the flying body are communicatively connected, the flying body comprises a flying body system and a flying body gateway, the flying body system comprises a safety domain system and a non-safety domain system, the flying body gateway comprises a non-safety domain subsystem and a safety domain subsystem, the non-safety domain subsystem and the safety domain subsystem are communicatively connected, the non-safety domain subsystem is communicatively connected with the non-safety domain system, the safety domain subsystem is communicatively connected with the safety domain system, and the safety level of the safety domain system is higher than the safety level of the non-safety domain system;

[0030] The non-secure domain subsystem is used to perform a first protection detection on first data to be transmitted from the non-secure domain system, and send the first data to be transmitted that passes the first protection detection to the secure domain subsystem; the first data to be transmitted is data transmitted from the non-secure domain system to the secure domain system across domains;

[0031] The security domain subsystem is used to perform a second protection detection on the received first data to be transmitted, and send the first data to be transmitted that passes the second protection detection to the security domain system.

[0032] In an optional implementation, the land body includes a land body system and a land body gateway, the land body system is communicatively connected to the land body gateway, and the land body gateway is also communicatively connected to the non-security domain subsystem;

[0033] The terrestrial gateway is used to perform a first protection detection on the second data to be transmitted from the terrestrial system, and send the second data to be transmitted that passes the first protection detection to the non-safety domain subsystem; the second data to be transmitted is data transmitted from the terrestrial system across domains to the safety domain system or the non-safety domain system of the flying body system;

[0034] The non-security domain subsystem is further used to perform a first protection detection on the received second data to be transmitted, and when the second data to be transmitted is data transmitted from the land body system to the non-security domain system across domains, the second data to be transmitted that passes the first protection detection is sent to the non-security domain system; when the second data to be transmitted is data transmitted from the land body system to the security domain system across domains, the second data to be transmitted that passes the first protection detection is sent to the security domain subsystem;

[0035] The security domain subsystem is further configured to perform a second protection detection on the received second data to be transmitted, and send the second data to be transmitted that passes the second protection detection to the security domain system.

[0036] The embodiments of the present invention provide a gateway, a data transmission method, a flight equipment communication system, an aircraft and a flying car. The gateway is applied to the flight equipment. The flight equipment includes a security domain system and a non-security domain system. The gateway includes a non-security domain subsystem and a security domain subsystem. The non-security domain subsystem and the security domain subsystem are communicatively connected. The non-security domain subsystem is communicatively connected with the non-security domain system, and the security domain subsystem is communicatively connected with the security domain system. The security level of the security domain system is higher than the security level of the non-security domain system. The non-security domain subsystem is used to perform a first protection detection on the data to be transmitted from the non-security domain system, and send the data to be transmitted that passes the first protection detection to the security domain subsystem. The data to be transmitted is data transmitted across domains from the non-security domain system to the security domain system. The security domain subsystem is used to perform a second protection detection on the received data to be transmitted, and send the data to be transmitted that passes the second protection detection to the security domain system. The present invention realizes isolation and communication between the security domain system and the non-security domain system through a gateway. For data that needs to be transmitted across domains from the non-security domain system to the security domain system, the data will enter the security domain system only after passing through the two-level protection detection of the gateway, thereby ensuring the independence, reliability and security of the security domain system and will not be affected by the non-security domain system. This simplifies the design of equipment in the security domain system and the non-security domain system and saves costs.

[0037] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, preferred embodiments are given below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0039] Figure 1 A schematic diagram showing a composition of a flight equipment communication system provided by an embodiment of the present invention is shown;

[0040] Figure 2 A schematic diagram showing a composition of a gateway provided by an embodiment of the present invention is shown;

[0041] Figure 3 A schematic diagram showing the structure of a non-security domain subsystem and a security domain subsystem in a gateway provided by an embodiment of the present invention is shown;

[0042] Figure 4 A schematic diagram of a functional module in a first main control unit in a gateway provided by an embodiment of the present invention is shown;

[0043] Figure 5 A schematic diagram of a functional module in a second main control unit in a gateway provided by an embodiment of the present invention is shown;

[0044] Figure 6 A schematic diagram of a flow chart of a data transmission method provided by an embodiment of the present invention is shown;

[0045] Figure 7 A schematic diagram of the composition of an aircraft provided by an embodiment of the present invention is shown;

[0046] Figure 8 A schematic diagram of the composition of a flying car provided by an embodiment of the present invention is shown.

[0047] Icons: 10-flying equipment communication system; 100-gateway; 200-safety domain system; 300-non-safety domain system; 700-aircraft; 800-flying car; 110-non-safety domain subsystem; 120-safety domain subsystem; 130-fused data bus; 111-first main control unit; 112-first communication unit; 121-second main control unit; 122-second communication unit; 1111-device authentication module; 1112-first data monitoring module; 1113-first data filtering module; 1114-first data verification module; 1211-second data monitoring module; 1212-second data filtering module; 1213-second data verification module; 810-land body; 811-land body system; 812-land body gateway; 820-flying body; 821-flying body system; 822-flying body gateway. DETAILED DESCRIPTION

[0048] The following will be combined with the accompanying drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0049] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making creative work are within the scope of protection of the present invention.

[0050] It should be noted that relational terms such as "first" and "second" are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0051] Please refer to Figure 1 , which is a schematic diagram of a composition of a flight equipment communication system 10 provided in an embodiment of the present invention. The flight equipment communication system 10 can be applied to a flight equipment, which can be an aircraft, a flying car that combines flying and land travel, and other equipment. The flight equipment communication system 10 includes a gateway 100, a security domain system 200, and a non-security domain system 300. The non-security domain system 300 and the security domain system 200 communicate through the gateway 100, and the security level of the security domain system 200 is higher than the security level of the non-security domain system 300.

[0052] In this embodiment, the safety domain system 200 may include flight control equipment, navigation equipment, power equipment, control equipment, etc. These equipment have development support level requirements, and data communication also has reliability requirements. The non-safety domain system 300 may include cockpit entertainment equipment, driving assistance equipment, etc. The failure of these equipment functions will not cause a major level or above of damage to the whole machine operation.

[0053] In this embodiment, the safety domain system 200 and the non-safety domain system 300 do not communicate directly, but are isolated and forwarded through the gateway 100. It can be understood that when the flight equipment communication system 10 is applied to an aircraft, the safety domain system 200 and the non-safety domain system 300 can be obtained according to the safety level of each device on the aircraft; when the flight equipment communication system 10 is applied to a flying car, the safety domain system 200 and the non-safety domain system 300 can be obtained according to the safety level of each device on the flying body of the flying car.

[0054] Please refer to Figure 2 , which is a schematic diagram of a composition of a gateway 100 provided in an embodiment of the present invention. The gateway 100 is applied to an aircraft device, the aircraft device includes a safety domain system 200 and a non-safety domain system 300, the gateway 100 includes a non-safety domain subsystem 110 and a safety domain subsystem 120, the non-safety domain subsystem 110 and the safety domain subsystem 120 are communicatively connected, the non-safety domain subsystem 110 is communicatively connected to the non-safety domain system 300, and the safety domain subsystem 120 is communicatively connected to the safety domain system 200.

[0055] In this embodiment, the non-safety domain subsystem 110 and the safety domain subsystem 120 can communicate with each other through the fusion data bus 130. The fusion data bus 130 can be of various types, such as PCIe (Peripheral Component Interconnect Express), SPI (Serial Peripheral Interface), RGMI (Reduced Gigabit Media Independent Interface), CAN (Controller Area Network) bus and other methods, and one or more redundancies can be set, or even different types of bus methods for heterogeneous redundant communication.

[0056] The non-secure domain subsystem 110 is used to perform a first protection check on the data to be transmitted from the non-secure domain system 300, and send the data to be transmitted that passes the first protection check to the secure domain subsystem 120; the data to be transmitted is data transmitted across domains from the non-secure domain system 300 to the secure domain system 200.

[0057] In this embodiment, for the data to be transmitted that needs to be transmitted across domains from the non-security domain system 300 to the security domain system 200, it will first pass through the non-security domain subsystem 110 of the gateway 100, and the non-security domain subsystem 110 will perform a first protection detection to determine whether there are data errors or unexpected data storms. When it is detected that the data to be transmitted is erroneous data or unexpected data, it is determined that the data to be transmitted has not passed the first protection detection. The data to be transmitted that has not passed the first protection detection will be filtered or discarded, and only the data to be transmitted that has passed the first protection detection can be sent to the security domain subsystem 120 for further processing.

[0058] The security domain subsystem 120 is used to perform a second protection detection on the received data to be transmitted, and send the data to be transmitted that passes the second protection detection to the security domain system.

[0059] In this embodiment, the security domain subsystem 120 will perform a second protection check on the data to be transmitted sent by the non-security domain subsystem 110 to determine whether there are data errors or unexpected data storms. When it is detected that the data to be transmitted is erroneous data or unexpected data, it is determined that the data to be transmitted has not passed the second protection check. The data to be transmitted that has not passed the second protection check will be filtered or discarded. Only the data to be transmitted that has passed the second protection check can be sent to the security domain system 200.

[0060] It can be understood that the reliability and security requirements of the security domain subsystem 120 in the gateway 100 are consistent with the requirements of the devices in the security domain system. From the perspective of the security domain and non-security domain of the entire machine, the security domain subsystem 120 can be considered to belong to the security domain. Similarly, the non-security domain subsystem 110 in the gateway 100 can be considered to belong to the non-security domain. Since the gateway 100 integrates the security domain subsystem 120 belonging to the security domain and the non-security domain subsystem 110 belonging to the non-security domain, the gateway 100 acts as an edge node of the security domain system and the non-security domain system of the entire machine, centrally processing the cross-domain communication requirements of the security domain system and the non-security domain system to achieve cross-domain communication integration.

[0061] It can be seen that the gateway provided in the embodiment of the present invention will perform two-level protection detection on data that needs to be transmitted across domains from the non-security domain system to the security domain system. Only data that has passed the two-level protection detection will enter the security domain system, ensuring the independence, reliability and security of the security domain system, and will not be affected by the non-security domain system. This simplifies the design of equipment in the security domain system and the non-security domain system, and saves costs.

[0062] In one embodiment, see Figure 3The non-security domain subsystem 110 includes a first main control unit 111 and a first communication unit 112. The first main control unit 111 is communicatively connected to the first communication unit 112. The first main control unit 111 is also communicatively connected to the security domain subsystem 120. The first communication unit 112 is also communicatively connected to the non-security domain system 300. The first main control unit 111 is used to receive the data to be transmitted through the first communication unit 112, and perform a first protection detection on the data to be transmitted.

[0063] The security domain subsystem 120 includes a second main control unit 121 and a second communication unit 122. The second main control unit 121 is communicatively connected to the second communication unit 122. The second main control unit 121 is also communicatively connected to the non-security domain subsystem 110. The second communication unit 122 is also communicatively connected to the security domain system 200. The second main control unit 121 is used to receive the data to be transmitted through the second communication unit 122, and perform a second protection detection on the data to be transmitted.

[0064] In this embodiment, the first main control unit 111 and the second main control unit 121 can be an MCU (Microcontroller Unit), or a SOC (System on Chip) chip, a PowerPC central processing unit, an FPGA (Field-Programmable Gate Array), etc., which can be selected according to the business processing performance requirements of the gateway 100.

[0065] The first communication unit 112 and the first communication unit 112 can adopt a communication interface group, including various types of communication interfaces, for example, serial interfaces such as UART, SPI, I2C, parallel interfaces such as PCI, PCIe, network interfaces such as Ethernet, CAN, USB, wireless communication interfaces such as Wi-Fi, Bluetooth, etc.

[0066] In one implementation, in order to prevent the hardware failure of the non-secure domain subsystem 110 in the gateway 100 from affecting the secure domain subsystem 120, the hardware in the non-secure domain subsystem 110 and the secure domain subsystem 120 can be set to be independent of each other. That is to say, in the hardware design of the gateway 100, the non-secure domain subsystem 110 and the secure domain subsystem 120 maintain completely independent designs in terms of power supply design, data storage, and operating system, thereby preventing the hardware failure in the non-secure domain subsystem 110 from spreading to the secure domain subsystem 120, and achieving hardware failure isolation.

[0067] In one implementation, in order to further improve the isolation security between the non-security domain subsystem 110 and the security domain subsystem 120 in the gateway 100, an isolation device is provided between the non-security domain subsystem 110 and the security domain subsystem 120. In other words, a physical isolation method such as an optical coupling device can be added to the fusion data bus 130 between the non-security domain subsystem 110 and the security domain subsystem 120, thereby achieving a complete physical isolation effect in hardware.

[0068] In one embodiment, when the non-secure domain subsystem 110 performs the first protection detection on the received data to be transmitted, it mainly includes processing such as device authentication, data anomaly monitoring, data filtering and data verification. The non-secure domain subsystem 110 is used to authenticate the target device that sends the data to be transmitted in the non-secure domain system 300; when the authentication of the target device is successful, it is determined whether the data to be transmitted is abnormal data; if the data to be transmitted is abnormal data, the data to be transmitted is filtered; if the data to be transmitted is not abnormal data, the data to be transmitted is verified, and when the verification of the data to be transmitted is successful, it is determined that the data to be transmitted passes the first protection detection. The non-secure domain subsystem 110 is also used to send an alarm message to the secure domain subsystem 120 and filter the data to be transmitted when the authentication of the target device fails.

[0069] Among them, when authenticating the target device, the non-security domain subsystem 110 is specifically used to generate a random code, and generate a first result corresponding to the random code according to a preset algorithm; send the random code to the target device so that the target device generates a second result corresponding to the random code according to the preset algorithm; receive the second result returned by the target device; if the second result is the same as the first result, it is determined that the authentication of the target device is successful; if the second result is different from the first result, it is determined that the authentication of the target device has failed.

[0070] In this embodiment, after the device authentication begins, the non-security domain subsystem 110 generates a random code and sends it to the target device, and at the same time generates a first result R1 based on the built-in algorithm (preset algorithm) and the random code; after the target device receives the random code, it calculates the second result R2 based on the built-in algorithm and the random code, and sends the second result R2 to the non-security domain subsystem 110; after the non-security domain subsystem 110 receives the second result R2, it compares it with the first result R1. When the comparison results are consistent, the authentication is determined to be successful; when the comparison results are inconsistent, the authentication is determined to have failed.

[0071] The preset algorithm may be a hash algorithm, a symmetric encryption algorithm, an asymmetric encryption algorithm, etc., which is not limited in this embodiment.

[0072] Please refer to Figure 4The first main control unit 111 in the non-security domain subsystem 110 may include a device authentication module 1111, a first data monitoring module 1112, a first data filtering module 1113 and a first data verification module 1114. The device authentication module 1111, the first data monitoring module 1112, the first data filtering module 1113 and the first data verification module 1114 may be understood as software function modules running in the first main control unit 111, and are respectively used to implement the above-mentioned device authentication, data abnormality monitoring, data filtering and data verification and other processing.

[0073] Specifically, the device authentication module 1111 authenticates the target device that sends the data to be transmitted, and determines whether the target device is the expected device. If it is the expected device, it indicates that the authentication is successful, and the data to be transmitted will be received and allowed to be forwarded; if it is not the expected device, it indicates that the authentication has failed, and an alarm message will be sent to the security domain subsystem 120, and the data to be transmitted sent by the target device will be filtered and processed through the first data filtering module 1113 to avoid data from unexpected devices from being input into the security domain system 200 to cause harm and impact.

[0074] The first data monitoring module 1112 can determine whether the data to be transmitted is abnormal data according to whether the data attributes of the data to be transmitted belong to the expected data attributes. For example, the monitored data attributes include ID, length, transmission cycle, transmission type, sequence number, etc. When the data attributes of the data to be transmitted do not belong to the expected data attributes, it is determined that the data to be transmitted is abnormal data, and the data to be transmitted is filtered through the first data filtering module 1113, so as to filter the received data to be transmitted according to the expected data attributes, and avoid the data with unexpected attributes from being transmitted into the security domain.

[0075] After determining that the data to be transmitted is not abnormal data, the data to be transmitted can be verified by the first data verification module 1114. The verification algorithm can be CRC8, CRC16, etc. Different verification algorithms are used according to different data lengths. When the verification of the data to be transmitted is successful, it indicates that the data to be transmitted has passed the first protection detection, and the data to be transmitted will continue to be transmitted to the security domain subsystem 120; when the verification of the data to be transmitted fails, the data to be transmitted will be discarded.

[0076] It can be seen that the non-secure domain subsystem effectively prevents data from unexpected devices, data with unexpected attributes, and data that fails verification from being transmitted into the secure domain by performing device authentication, data anomaly monitoring, data filtering, and data verification on the data to be transmitted from the non-secure domain, thereby ensuring that the secure domain is not affected by the failure of the non-secure domain.

[0077] In one embodiment, when the security domain subsystem 120 performs the second protection detection on the received data to be transmitted, it mainly includes data anomaly monitoring, data filtering, data verification, etc. Specifically, the security domain subsystem 120 is used to determine whether the data to be transmitted is abnormal data; if the data to be transmitted is abnormal data, the data to be transmitted is filtered; if the data to be transmitted is not abnormal data, the data to be transmitted is verified, and if the verification of the data to be transmitted is successful, it is determined that the data to be transmitted has passed the second protection detection.

[0078] The specific implementation of the data anomaly monitoring, data filtering and data verification of the security domain subsystem 120 for the transmitted data is similar to that of the non-security domain subsystem 110. Figure 5 The second main control unit 121 in the security domain subsystem 120 may include a second data monitoring module 1211, a second data filtering module 1212 and a second data verification module 1213. The second data monitoring module 1211, the second data filtering module 1212 and the second data verification module 1213 may be understood as software function modules running in the second main control unit 121, which are respectively used to implement the above-mentioned data abnormality monitoring, data filtering and data verification and other processing.

[0079] Specifically, the second data monitoring module 1211 also determines whether the data to be transmitted is abnormal data based on whether the data attribute of the data to be transmitted belongs to the expected data attribute. When the data attribute of the data to be transmitted does not belong to the expected data attribute, it is determined that the data to be transmitted is abnormal data, and the data to be transmitted is filtered by the second data filtering module 1212, so as to filter the received data to be transmitted according to the expected data attribute, and avoid the data of unexpected attributes from being transmitted into the security domain.

[0080] After determining that the data to be transmitted is not abnormal data, the data to be transmitted can be verified by the second data verification module 1213. When the verification of the data to be transmitted is successful, it indicates that the data to be transmitted has passed the second protection detection, and the data to be transmitted will continue to be transmitted to the security domain system 200; when the verification of the data to be transmitted fails, the data to be transmitted will be discarded.

[0081] Since the non-security domain subsystem 110 belongs to the non-security domain, the security domain subsystem 120 performs data anomaly monitoring, data filtering, and data verification on the data to be transmitted from the non-security domain subsystem 110, further avoiding data with unexpected attributes and data that fails verification from being transmitted to the security domain, thereby ensuring that the security domain is not affected by the failure of the non-security domain.

[0082] Please refer to Figure 6, is a flow chart of a data transmission method provided by an embodiment of the present invention. The data transmission method is applied to the above-mentioned gateway 100, and specifically includes the following steps:

[0083] Step S601, the non-secure domain subsystem performs a first protection check on the data to be transmitted from the non-secure domain system, and sends the data to be transmitted that passes the first protection check to the secure domain subsystem; the data to be transmitted is data transmitted across domains from the non-secure domain system to the secure domain system.

[0084] Step S602: The security domain subsystem performs a second protection check on the received data to be transmitted, and sends the data to be transmitted that passes the second protection check to the security domain system.

[0085] Optionally, in the above step S601, the non-secure domain subsystem performs a first protection check on the data to be transmitted from the non-secure domain system, which may include: the non-secure domain subsystem authenticates the target device that sends the data to be transmitted in the non-secure domain system; when the authentication of the target device is successful, determines whether the data to be transmitted is abnormal data; if the data to be transmitted is abnormal data, filters the data to be transmitted; if the data to be transmitted is not abnormal data, verifies the data to be transmitted, and when the verification of the data to be transmitted is successful, determines that the data to be transmitted has passed the first protection check; when the authentication of the target device fails, sends an alarm message to the secure domain subsystem, and filters the data to be transmitted.

[0086] Optionally, in the above steps, the non-security domain subsystem authenticates the target device that sends the data to be transmitted in the non-security domain system, which may specifically include: generating a random code, and generating a first result corresponding to the random code according to a preset algorithm; sending the random code to the target device so that the target device generates a second result corresponding to the random code according to the preset algorithm; receiving the second result returned by the target device; if the second result is the same as the first result, determining that the authentication of the target device is successful; if the second result is different from the first result, determining that the authentication of the target device has failed.

[0087] Optionally, in the above step S602, the security domain subsystem performs a second protection check on the received data to be transmitted, which may include: the security domain subsystem determines whether the data to be transmitted is abnormal data; if the data to be transmitted is abnormal data, filtering the data to be transmitted; if the data to be transmitted is not abnormal data, verifying the data to be transmitted, and when the verification of the data to be transmitted is successful, it is determined that the data to be transmitted has passed the second protection check.

[0088] Optionally, see Figure 7The embodiment of the present invention further provides an aircraft 700, which includes a non-safety domain system 300, a safety domain system 200, and the gateway 100 in the above-mentioned embodiment, and the non-safety domain system 300 and the safety domain system 200 communicate through the gateway 100. The safety domain system 200 of the aircraft 700 includes flight control equipment, navigation equipment, power equipment, control equipment and other equipment, and the non-safety domain system 300 of the aircraft 700 includes cockpit entertainment equipment, driving assistance equipment and other equipment.

[0089] It can be seen that the aircraft realizes cross-domain communication between the security domain system and the non-security domain system through the gateway, which can not only simplify the design of equipment in the security domain system and the non-security domain system, thereby saving costs, but also ensure that the reliability and security of the security domain system are not affected by the non-security domain system, thereby improving the reliability and security of the aircraft's security domain system.

[0090] Optionally, see Figure 8 The embodiment of the present invention further provides a flying car 800, which includes a land body 810 and a flying body 820, the land body 810 and the flying body 820 are communicatively connected, the flying body 820 includes a flying body system 821 and a flying body gateway 822, the flying body system 821 includes a safety domain system 200 and a non-safety domain system 300, the flying body gateway 822 includes a non-safety domain subsystem 110 and a safety domain subsystem 120, the non-safety domain subsystem 110 and the safety domain subsystem 120 are communicatively connected, the non-safety domain subsystem 110 is communicatively connected to the non-safety domain system 300, the safety domain subsystem 120 is communicatively connected to the safety domain system 200, and the safety level of the safety domain system 200 is higher than the safety level of the non-safety domain system 300.

[0091] The non-security domain subsystem 110 is used to perform a first protection check on the first data to be transmitted from the non-security domain system 300, and send the first data to be transmitted that passes the first protection check to the security domain subsystem 120; the first data to be transmitted is data transmitted across domains from the non-security domain system 300 to the security domain system 200.

[0092] The security domain subsystem 120 is used to perform a second protection detection on the received first data to be transmitted, and send the first data to be transmitted that passes the second protection detection to the security domain system 200 .

[0093] In this embodiment, the flying car 800 distinguishes between a land part and a flying part, namely a land body 810 and a flying body 820, wherein the equipment in the flying body 820 is divided into a safety domain system 200 and a non-safety domain system 300 according to the safety level, and the isolation and communication between the safety domain system 200 and the non-safety domain system 300 are realized through the flying body gateway 822. The safety domain system 200 of the flying body 820 may include flight control equipment, navigation equipment, power equipment, control equipment and other equipment, and the non-safety domain system 300 of the flying body 820 may include cockpit entertainment equipment, driving assistance equipment and other equipment.

[0094] It should be noted that the specific structure and function of the flying body gateway 822 in this embodiment are the same as the structure and function of the gateway 100 in the aforementioned embodiment. Therefore, for matters not mentioned in this embodiment, reference may be made to the corresponding contents of the aforementioned gateway 100, and no further details will be given here.

[0095] It can be seen that the flying car uses the flying body gateway to realize cross-domain communication between the non-safety domain system and the non-safety domain system of the flying body, which can not only simplify the design of equipment in the safety domain system and the non-safety domain system, thereby saving costs, but also ensure that the reliability and safety of the safety domain system are not affected by the non-safety domain system, thereby improving the reliability and safety of the safety domain system of the flying body.

[0096] In one embodiment, please continue to refer to Figure 8 The land body 810 includes a land body system 811 and a land body gateway 812. The land body system 811 and the land body gateway 812 are in communication connection. The land body gateway 812 is also in communication connection with the non-safety domain subsystem 110. Among them, the land body gateway 812 and the non-safety domain subsystem 110 of the flying body gateway 822 can be connected by wire or wireless. The land body system 811 may include devices such as a central domain control, a left domain control, a right domain control, and a self-driving domain control. The central domain control may be a central processing unit of the vehicle, the left domain control may be a control system responsible for the functions related to the left side of the vehicle, the right domain control may be a control system responsible for the functions related to the right side of the vehicle, and the self-driving domain control may be a control system responsible for the automatic driving function.

[0097] The terrestrial body gateway 812 is used to perform a first protection check on the second data to be transmitted from the terrestrial body system 811, and send the second data to be transmitted that passes the first protection check to the non-safety domain subsystem 110; the second data to be transmitted is data transmitted across domains from the terrestrial body system 811 to the safety domain system 200 or the non-safety domain system 300 of the flying body system 821.

[0098] In this embodiment, for data that needs to be transmitted across domains from the terrestrial body system 811 to the flying body system 821 (i.e., the second data to be transmitted), the terrestrial body gateway 812 is similar to the non-security domain subsystem 110 in the flying body gateway 822, and will perform a first protection check on the data. The first protection check also includes processing operations such as device authentication, data anomaly monitoring, data filtering, and data verification. The specific processing flow can refer to the corresponding content of the aforementioned embodiment, which will not be repeated here.

[0099] After the second data to be transmitted passes the first protection detection, the land-based gateway 812 sends the second data to be transmitted to the non-safety domain subsystem 110 of the flying-based gateway 822 .

[0100] The non-security domain subsystem 110 is also used to perform a first protection check on the received second data to be transmitted. When the second data to be transmitted is data transmitted across domains from the land body system 811 to the non-security domain system 300, the second data to be transmitted that passes the first protection check will be sent to the non-security domain system 300; when the second data to be transmitted is data transmitted across domains from the land body system 811 to the security domain system 200, the second data to be transmitted that passes the first protection check will be sent to the security domain subsystem 120.

[0101] The security domain subsystem 120 is further configured to perform a second protection check on the received second data to be transmitted, and send the second data to be transmitted that passes the second protection check to the security domain system 200 .

[0102] In this embodiment, after the non-safety domain subsystem 110 of the flying body gateway 822 receives the second data to be transmitted sent by the land body gateway 812, it continues to perform a first protection check on the second data to be transmitted. When the second data to be transmitted passes the first protection check of the non-safety domain subsystem 110 and the second data to be transmitted needs to be transmitted to the non-safety domain system 300 of the flying body 820, the second data to be transmitted is sent to the corresponding device in the non-safety domain system 300.

[0103] When the second data to be transmitted passes the first protection detection of the non-security domain subsystem 110, and the second data to be transmitted needs to be transmitted to the security domain system 200 of the flying body 820, the second data to be transmitted is sent to the security domain subsystem 120 of the flying body gateway 822, and the security domain subsystem 120 performs a second protection detection on the received second data to be transmitted. When the second data to be transmitted passes the second protection detection, the second data to be transmitted is sent to the corresponding device in the security domain system 200.

[0104] It can be understood that, for the second data to be transmitted that needs to be transmitted across domains from the terrestrial body system 811 to the non-safety domain system 300 of the flying body 820, it passes through the first protection detection of the terrestrial body gateway 812 and the first protection detection of the non-safety domain subsystem 110 of the flying body gateway 822, and finally reaches the corresponding device in the non-safety domain system 300, that is, it will undergo 2 layers of protection processing. For the second data to be transmitted that needs to be transmitted across domains from the terrestrial body system 811 to the safety domain system 200 of the flying body 820, it passes through the first protection detection of the terrestrial body gateway 812, the first protection detection of the non-safety domain subsystem 110 of the flying body gateway 822, and the second protection detection of the safety domain subsystem 120 of the flying body gateway 822, and finally reaches the corresponding device in the safety domain system 200, that is, it will undergo 3 layers of protection processing.

[0105] It should be noted that in actual applications, when the land body 810 and the flying body 820 of the flying car 800 are combined (establishing a physical connection), the land body 810 and the flying body 820 will authenticate each other through a handshake protocol to confirm the identity and status of both parties, ensure the security of the connection, and facilitate subsequent cross-domain transmission of data.

[0106] It can be seen that the flying car provided by the embodiment of the present invention, in which a land body gateway and a flying body gateway are arranged in the land body and the flying body respectively, can not only realize cross-domain communication between non-safety domain systems and non-safety domain systems in the flying body, but also realize cross-domain communication between the land body and the flying body.

[0107] In summary, the embodiments of the present invention provide a gateway, a data transmission method, a flight equipment communication system, an aircraft and a flying car, the gateway is applied to the flight equipment, the flight equipment includes a security domain system and a non-security domain system, the gateway includes a non-security domain subsystem and a security domain subsystem, the non-security domain subsystem and the security domain subsystem are communicatively connected, the non-security domain subsystem is communicatively connected to the non-security domain system, the security domain subsystem is communicatively connected to the security domain system, the security level of the security domain system is higher than the security level of the non-security domain system; the non-security domain subsystem is used to perform a first protection detection on the data to be transmitted from the non-security domain system, and send the data to be transmitted that passes the first protection detection to the security domain subsystem; the data to be transmitted is data transmitted across domains from the non-security domain system to the security domain system; the security domain subsystem is used to perform a second protection detection on the received data to be transmitted, and send the data to be transmitted that passes the second protection detection to the security domain system. The present invention realizes isolation and communication between the security domain system and the non-security domain system through a gateway. For data that needs to be transmitted across domains from the non-security domain system to the security domain system, the data will enter the security domain system only after passing through the two-level protection detection of the gateway, thereby ensuring the independence, reliability and security of the security domain system and will not be affected by the non-security domain system. This simplifies the design of equipment in the security domain system and the non-security domain system and saves costs.

[0108] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present invention. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0109] In addition, the functional modules in the various embodiments of the present invention may be integrated together to form an independent part, or each module may exist independently, or two or more modules may be integrated to form an independent part.

[0110] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0111] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A gateway, characterized in that: Applied to an aircraft device, the aircraft device includes a safety domain system and a non-safety domain system, the gateway includes a non-safety domain subsystem and a safety domain subsystem, the non-safety domain subsystem is communicatively connected to the safety domain subsystem, the non-safety domain subsystem is communicatively connected to the non-safety domain system, the safety domain subsystem is communicatively connected to the safety domain system, and the safety level of the safety domain system is higher than the safety level of the non-safety domain system; The non-secure domain subsystem is used to perform a first protection detection on the data to be transmitted from the non-secure domain system, and send the data to be transmitted that passes the first protection detection to the secure domain subsystem; The data to be transmitted is data transmitted from the non-security domain system to the security domain system across domains; The security domain subsystem is used to perform a second protection detection on the received data to be transmitted, and send the data to be transmitted that passes the second protection detection to the security domain system.

2. The gateway according to claim 1, characterized in that: The non-secure domain subsystem is used to authenticate the target device that sends the data to be transmitted in the non-secure domain system; if the authentication of the target device is successful, determine whether the data to be transmitted is abnormal data; If the data to be transmitted is abnormal data, filtering the data to be transmitted; If the data to be transmitted is not abnormal data, the data to be transmitted is verified. If the verification of the data to be transmitted is successful, it is determined that the data to be transmitted passes the first protection detection.

3. The gateway according to claim 2, characterized in that: The non-secure domain subsystem is further configured to send an alarm message to the secure domain subsystem and filter the data to be transmitted when the authentication of the target device fails.

4. The gateway according to claim 2, characterized in that: The non-security domain subsystem is used to generate a random code, and generate a first result corresponding to the random code according to a preset algorithm; send the random code to the target device so that the target device generates a second result corresponding to the random code according to the preset algorithm; and receive the second result returned by the target device; If the second result is the same as the first result, it is determined that the authentication of the target device is successful; If the second result is different from the first result, it is determined that the authentication of the target device fails.

5. The gateway according to any one of claims 1 to 4, characterized in that: The non-security domain subsystem includes a first main control unit and a first communication unit, the first main control unit is communicatively connected to the first communication unit, the first main control unit is also communicatively connected to the security domain subsystem, and the first communication unit is also communicatively connected to the non-security domain system; The first main control unit is used to receive the data to be transmitted through the first communication unit, and perform a first protection detection on the data to be transmitted.

6. The gateway according to claim 1, characterized in that: The security domain subsystem is used to determine whether the data to be transmitted is abnormal data; if the data to be transmitted is abnormal data, the data to be transmitted is filtered; If the data to be transmitted is not abnormal data, the data to be transmitted is verified. If the verification of the data to be transmitted is successful, it is determined that the data to be transmitted passes the second protection detection.

7. The gateway according to claim 1 or 6, characterized in that: The security domain subsystem includes a second main control unit and a second communication unit, the second main control unit is communicatively connected to the second communication unit, the second main control unit is also communicatively connected to the non-security domain subsystem, and the second communication unit is also communicatively connected to the security domain system; The second main control unit is used to receive the data to be transmitted through the second communication unit, and perform a second protection detection on the data to be transmitted.

8. The gateway according to claim 1, characterized in that: The hardware in the non-secure domain subsystem and the secure domain subsystem are independent of each other, and an isolation device is provided between the non-secure domain subsystem and the secure domain subsystem.

9. A data transmission method, characterized in that: Applied to the gateway according to any one of claims 1 to 8, the method comprises: The non-secure domain subsystem performs a first protection detection on the data to be transmitted from the non-secure domain system, and sends the data to be transmitted that passes the first protection detection to the secure domain subsystem; the data to be transmitted is data transmitted from the non-secure domain system to the secure domain system across domains; The security domain subsystem performs a second protection check on the received data to be transmitted, and sends the data to be transmitted that passes the second protection check to the security domain system.

10. A flight equipment communication system, characterized in that: It includes a non-security domain system, a security domain system and a gateway, wherein the gateway includes a non-security domain subsystem and a security domain subsystem, the non-security domain subsystem is communicatively connected to the security domain subsystem, the non-security domain subsystem is communicatively connected to the non-security domain system, the security domain subsystem is communicatively connected to the security domain system, and the security level of the security domain system is higher than the security level of the non-security domain system; The non-secure domain subsystem is used to perform a first protection detection on the data to be transmitted from the non-secure domain system, and send the data to be transmitted that passes the first protection detection to the secure domain subsystem; The data to be transmitted is data transmitted from the non-security domain system to the security domain system across domains; The security domain subsystem is used to perform a second protection detection on the received data to be transmitted, and send the data to be transmitted that passes the second protection detection to the security domain system.

11. The flying equipment communication system according to claim 10, characterized in that: The non-secure domain subsystem is used to authenticate the target device that sends the data to be transmitted in the non-secure domain system; if the authentication of the target device is successful, determine whether the data to be transmitted is abnormal data; If the data to be transmitted is abnormal data, filtering the data to be transmitted; If the data to be transmitted is not abnormal data, the data to be transmitted is verified. If the verification of the data to be transmitted is successful, it is determined that the data to be transmitted has passed the first protection detection. If the authentication of the target device fails, an alarm message is sent to the security domain subsystem, and the data to be transmitted is filtered.

12. The flying equipment communication system according to claim 11, characterized in that: The non-security domain subsystem is used to generate a random code, and generate a first result corresponding to the random code according to a preset algorithm; send the random code to the target device so that the target device generates a second result corresponding to the random code according to the preset algorithm; and receive the second result returned by the target device; If the second result is the same as the first result, it is determined that the authentication of the target device is successful; If the second result is different from the first result, it is determined that the authentication of the target device fails.

13. The flying equipment communication system according to claim 10, characterized in that: The security domain subsystem is used to determine whether the data to be transmitted is abnormal data; if the data to be transmitted is abnormal data, the data to be transmitted is filtered; If the data to be transmitted is not abnormal data, the data to be transmitted is verified. If the verification of the data to be transmitted is successful, it is determined that the data to be transmitted passes the second protection detection.

14. The flying equipment communication system according to any one of claims 10 to 13, characterized in that: The non-safety domain system includes cockpit entertainment equipment and driving assistance equipment, and the safety domain system includes flight control equipment, navigation equipment, power equipment, and operating equipment.

15. An aircraft, characterized in that: It comprises a non-security domain system, a security domain system and a gateway as described in any one of claims 1 to 8, and the non-security domain system and the security domain system communicate through the gateway.

16. A flying car, characterized in that: It includes a terrestrial body and a flying body, the terrestrial body and the flying body are communicatively connected, the flying body includes a flying body system and a flying body gateway, the flying body system includes a safety domain system and a non-safety domain system, the flying body gateway includes a non-safety domain subsystem and a safety domain subsystem, the non-safety domain subsystem is communicatively connected to the safety domain subsystem, the non-safety domain subsystem is communicatively connected to the non-safety domain system, the safety domain subsystem is communicatively connected to the safety domain system, and the safety level of the safety domain system is higher than the safety level of the non-safety domain system; The non-secure domain subsystem is used to perform a first protection detection on first data to be transmitted from the non-secure domain system, and send the first data to be transmitted that passes the first protection detection to the secure domain subsystem; The first data to be transmitted is data transmitted from the non-security domain system to the security domain system across domains; The security domain subsystem is used to perform a second protection detection on the received first data to be transmitted, and send the first data to be transmitted that passes the second protection detection to the security domain system.

17. The flying car according to claim 16, characterized in that: The land body includes a land body system and a land body gateway, the land body system is in communication connection with the land body gateway, and the land body gateway is also in communication connection with the non-security domain subsystem; The land-based gateway is used to perform a first protection detection on the second data to be transmitted from the land-based system, and send the second data to be transmitted that passes the first protection detection to the non-security domain subsystem; The second data to be transmitted is data transmitted across domains from the terrestrial body system to a safety domain system or a non-safety domain system of the flying body system; The non-security domain subsystem is further used to perform a first protection detection on the received second data to be transmitted, and when the second data to be transmitted is data transmitted from the land body system to the non-security domain system across domains, the second data to be transmitted that passes the first protection detection is sent to the non-security domain system; when the second data to be transmitted is data transmitted from the land body system to the security domain system across domains, the second data to be transmitted that passes the first protection detection is sent to the security domain subsystem; The security domain subsystem is further configured to perform a second protection detection on the received second data to be transmitted, and send the second data to be transmitted that passes the second protection detection to the security domain system.

Images