1553B pseudo terminal testing device

Abstract

The invention relates to a 1553B bus security testing device. The 1553B bus security testing device comprises a BC node, two RT nodes, an MT node and a camouflage node. The camouflage node is connected to the bus, the camouflage node can dynamically switch between a BC mode and an RT mode, and in the BC mode, the camouflage node sends out data different from that of a normal BC node and initiates a bus control behavior; in the RT mode, the disguised node address is configured as an existing RT node address in the bus, and the RT node function is simulated to access the bus. The device provided by the invention can be used for evaluating the security of the 1553B bus protocol architecture, detecting whether security vulnerabilities exist in the 1553B bus, and verifying whether malicious attack nodes can be embedded in the bus or not and whether key nodes in the bus can be maliciously utilized by attackers or not, so that consequences such as key information leakage or system abnormity and the like are caused.

Description

Technical Field

[0001] The invention relates to a 1553B pseudo terminal testing device, belonging to the technical field of aerospace component quality assurance and testing. Background Art

[0002] The military standard data bus 1553B is widely used for its high reliability and real-time performance. It uses shielded twisted pair cables to interconnect three terminal devices with different functions: bus controller (BC), remote terminal (RT) and bus monitor (MT), forming a half-duplex transmission network with two-way transmission capability and a rate of 1Mbps, which greatly improves the system's centralized control, distributed processing and implementation response capabilities.

[0003] However, in this bus architecture, all nodes face the following typical security issues. Lack of authentication: Only a legal address and a legal message format are needed to establish an RT and participate in bus communication. Lack of authorization: Without an access control mechanism, an attacker can easily disguise himself as a BC to obtain system privileges, execute arbitrary functions, and access all devices. Lack of encryption: Addresses, commands, and data are transmitted in plain text and can be easily captured and parsed, allowing attackers to easily understand the current status and control methods of the system.

[0004] Based on the above problems, it is not difficult to find that the 1553B bus system may be attacked by tampering with instructions to steal information, blocking bus transmission, etc.

[0005] (1) Tampering with instructions to steal information, resulting in data transmission errors between subsystems and causing system chaos. If an illegal device has physical access to the bus, it can detect the idle time when the bus is not occupied and initiate malicious information exchange during this time interval. Each subsystem device will assume that the communication on the bus is initiated by a legitimate BC, and thus respond to instructions to cause information leakage.

[0006] (2) Blocking bus transmission and causing system paralysis. If an illegal device sets an existing RT address, then responding to the command word regularly transmitted by the BC will cause a conflict with the original RT response. The BC may notice that there is no communication on the bus and switch transmission on a redundant channel. However, if the illegal device can access each channel, it can attack each channel at the same time. Summary of the invention

[0007] The purpose of the present invention is to overcome the shortcomings of the prior art and propose a 1553B pseudo terminal test device, which mainly solves the following problems: verifying whether the bus will be seized by a disguised BC and then control the entire bus transmission; verifying whether the bus transmission will be interfered by a disguised RT.

[0008] The technical solution adopted by the present invention is:

[0009] A 1553B pseudo terminal test device, comprising: a BC node, two RT nodes, an MT node and a camouflage node;

[0010] The BC node is used to control the bus and is responsible for initiating transactions when transmitting information. The RT node is commanded and regulated by the BC node. Each RT node is assigned a unique address for communication. The MT node does not respond to any commands and is only used to monitor and record commands and data on the bus.

[0011] The camouflaged node is connected to the bus, and the camouflaged node can dynamically switch between BC mode and RT mode. In BC mode, the camouflaged node sends data different from the normal BC node and initiates bus control behavior; in RT mode, the camouflaged node address will be configured as the RT node address that already exists in the bus, simulating the RT node function to access the bus.

[0012] Furthermore, the BC node is a bus controller node, the RT node is a remote terminal node, and the MT node is a bus monitor node.

[0013] Furthermore, there can be only one BC node on one bus, and the data words sent and received by the BC node under normal circumstances are limited to 0x1111 and 0x2222.

[0014] 4. A 1553B pseudo terminal test device according to claim 1, characterized in that: the MT node does not need to be assigned an address, and multiple MT nodes can be mounted on the bus as needed.

[0015] Furthermore, the 1553B pseudo terminal test device uses FPGA as a main control device, and the interface protocol chip adopts a configurable circuit supporting three modes: BC, RT, and MT.

[0016] Furthermore, the entire network adopts a transformer-coupled bus connection mode, and the BC nodes, RT nodes, MT nodes, and camouflage nodes are all connected to the bus through couplers.

[0017] Furthermore, when the camouflage terminal is dynamically configured to the BC mode, when the normal BC node is idle, it seizes the bus control right and transmits information with the remote terminal of the bus.

[0018] Furthermore, when the masquerade terminal is configured in RT mode, the masquerade terminal and the RT node with the same address as the simulated one receive or respond to bus information at the same time.

[0019] Furthermore, it also includes an oscilloscope, which is connected to the bus and monitors the bus data status in real time together with the MT node. The MT node reflects the instructions and data information on the bus in real time. The oscilloscope detects the signal waveform on the bus when the pseudo RT and the actual RT respond together.

[0020] Second,

[0021] The present invention also proposes a test method implemented according to a 1553B pseudo terminal test device, comprising the following steps:

[0022] (1) Use a normal BC node to send a data word 0x1111 to the 1# subaddress of the RT1 node; receive a data word 0x2222 from the 2# subaddress of the RT2 node; send the RT1-RT2 instruction to let the RT1 node send the data word 0x1111 to the RT2 node;

[0023] (2) The pseudo BC node implemented by the camouflaged terminal attempts to send a data word 0x55AA to the 1# sub-address of the RT1 node to destroy the data in the 1# sub-address of the RT1 node; attempts to receive a data word 0x2222 from the 2# sub-address of the RT2 node to steal key information; and observes whether the behavior initiated by the pseudo BC node is successfully responded to through the MT node and the oscilloscope;

[0024] (3) If the attack in step (2) is successful, the pseudo BC node implemented by the camouflaged terminal sends the RT1-RT2 instruction again, causing the RT1 node to send the data word 0x55AA to the RT2 node, and observe whether the data in the RT2 node is further damaged;

[0025] (4) Configure the masquerading terminal to RT mode and assign an existing RT address. Use a normal BC node to send instructions and observe whether the pseudo RT node implemented by the masquerading terminal will also respond.

[0026] (5) When the pseudo RT node replies with the status word, observe whether the bus signal will be superimposed, resulting in bus conflict;

[0027] (6) Analyze the status word information replied by the normal RT node, take the inverted reply at the pseudo RT node end, and observe whether the bus level will be disturbed;

[0028] (7) If the observation results in steps (2) to (6) are abnormal, it indicates that there is a vulnerability in the 1553B bus system.

[0029] Compared with the prior art, the present invention has the following beneficial effects:

[0030] (1) The device of the present invention can verify whether the bus will be seized by the disguised BC and then control the entire bus transmission; and verify whether the bus transmission will be interfered by the disguised RT.

[0031] (2) The present invention deploys a standard 1553B bus monitor MT to monitor the bus status in real time. At the same time, the present invention also designs a waveform monitoring point, which can detect the bus signal transmission waveform in real time by connecting a high-precision oscilloscope. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 The figure is a schematic diagram of the composition of a 1553B pseudo terminal test device. DETAILED DESCRIPTION

[0033] In order to better understand the above technical solution, the specific implementation of the present invention is further described in detail below with reference to the accompanying drawings.

[0034] The present invention proposes a 1553B pseudo terminal testing device, which is used to verify whether a bus will be seized by a disguised BC to control the entire bus transmission; and verify whether the bus transmission will be interfered by a disguised RT.

[0035] Under normal circumstances, there can only be one valid BC and multiple RTs on the 1553B protocol bus. The BC controls all transactions of the entire bus, and each RT is assigned a unique address for node communication. In the present invention, an attacker is simulated to launch an attack and a node in the control network is disguised as a BC or RT.

[0036] (1) Disguise BC. When the real BC does not occupy the bus, configure the pseudo terminal as BC, use the pseudo BC to control the bus, and use the pseudo BC terminal to send BC-RT, RT-BC, and RT-RT instructions to detect whether the attack is successful.

[0037] (2) Disguise RT. Configure the pseudo terminal address to the RT address that already exists in the network. Use BC to send instructions to this address to detect whether both the pseudo terminal and the corresponding normal terminal respond. In addition, analyze the data word sent by the normal RT, invert it bit by bit and use it as the data word of the pseudo RT terminal to detect the bus status and waveform.

[0038] (3) Monitoring function. The present invention deploys a standard 1553B bus monitor MT to monitor the bus status in real time. At the same time, the present invention also designs a waveform monitoring point, which can detect the bus signal transmission waveform in real time by connecting a high-precision oscilloscope.

[0039] like Figure 1 As shown, the present invention proposes a 1553B pseudo terminal test device, including: a BC node, two RT nodes, an MT node and a camouflage node;

[0040] The BC node is used to control the bus and is responsible for initiating transactions when transmitting information. The RT node is commanded and regulated by the BC node. Each RT node is assigned a unique address for communication. The MT node does not respond to any commands and is only used to monitor and record commands and data on the bus.

[0041] The camouflaged node is connected to the bus, and the camouflaged node can dynamically switch between BC mode and RT mode. In BC mode, the camouflaged node sends data different from the normal BC node and initiates bus control behavior; in RT mode, the camouflaged node address will be configured as the RT node address that already exists in the bus, simulating the RT node function to access the bus.

[0042] The bus controller (BC), remote terminal (RT) and bus monitor (MT) can realize the functions required by the 1553B bus; the camouflage terminal can be configured in BC mode to initiate bus control behavior; the camouflage terminal can be configured in RT mode to simulate RT function to access the bus; the bus monitor and oscilloscope can monitor the bus signal transmission and signal waveform in real time.

[0043] BC controls the entire 1553B bus and is responsible for initiating information transmission and other transactions; RT provides an interface between the relevant units or subsystems and the 1553B bus, is controlled by BC, and responds to BC instructions; MT does not respond to any instructions, but only monitors and records commands and data on the bus.

[0044] The camouflage terminal can be dynamically configured to BC mode. When the normal BC is idle, it can seize the bus control and transmit information with the remote terminal of the bus.

[0045] The masquerade terminal can be configured in RT mode, in which the masquerade terminal can be configured as an existing RT address in the network and can receive or respond to bus information at the same time.

[0046] The bus monitor and oscilloscope can monitor the bus signal transmission and signal waveform in real time. The bus monitor MT can reflect the command and data information on the bus in real time. The oscilloscope can detect the signal waveform on the bus when the pseudo RT and the actual RT respond together.

[0047] Example:

[0048] A 1553B pseudo terminal test device mainly includes: 1. a BC node; 2. two RT nodes; 3. an MT node; 4. a camouflage node. The functions and implementation methods of each part are as follows:

[0049] A BC node: In theory, there can be only one BC on a bus, which has a master control role on the bus and is responsible for starting all transactions when transmitting information. The RT is commanded and regulated by the BC. In the present invention, FPGA and 1553B bus interface circuit are used to construct a BC terminal. For the convenience of detection, the data words sent and received by the BC under normal circumstances are limited to 0x1111 and 0x2222.

[0050] Two RT nodes: RT is a general node in the 1553B bus. A bus can accommodate 31 RTs, and each RT must be assigned a unique address to communicate. In the present invention, the same type of FPGA is used as the main control chip, the 1553B interface circuit is configured as the RT terminal, and a unique address is assigned to each RT terminal.

[0051] One MT node: MT does not respond to any command, and is only used to monitor and record the commands and data on the bus. MT does not need to be assigned an address, and multiple MT nodes can be mounted as needed. In the present invention, only a standard 1553B function board is used to implement one MT for test data monitoring.

[0052] A camouflage node. The camouflage node is the core of the present invention. The camouflage node needs to be connected to the bus like an ordinary node. At the same time, the camouflage node can dynamically switch between BC and RT modes. In BC mode, it sends data different from normal BC; in RT mode, its address will be configured as the RT address already existing in the bus to achieve the purpose of bus information security detection. In the present invention, FPGA is used as the main control device, and the interface protocol chip adopts a circuit that supports BC, RT, and MT modes.

[0053] The entire network uses a transformer-coupled bus connection method, and each terminal is mounted on the bus coupler as a sub-node. A high-precision oscilloscope is also connected to the bus to monitor the bus data status in real time together with the MT.

[0054] When testing, the test method implemented by the 1553B pseudo terminal test device includes the following steps:

[0055] (1) Use a normal BC node to send a data word 0x1111 to the 1# subaddress of the RT1 node; receive a data word 0x2222 from the 2# subaddress of the RT2 node; send the RT1-RT2 instruction to let the RT1 node send the data word 0x1111 to the RT2 node;

[0056] (2) The pseudo BC node implemented by the camouflaged terminal attempts to send a data word 0x55AA to the 1# sub-address of the RT1 node to destroy the data in the 1# sub-address of the RT1 node; attempts to receive a data word 0x2222 from the 2# sub-address of the RT2 node to steal key information; and observes whether the behavior initiated by the pseudo BC node is successfully responded to through the MT node and the oscilloscope;

[0057] (3) If the attack in step (2) is successful, the pseudo BC node implemented by the camouflaged terminal sends the RT1-RT2 instruction again, causing the RT1 node to send the data word 0x55AA to the RT2 node, and observe whether the data in the RT2 node is further damaged;

[0058] (4) Configure the masquerading terminal to RT mode and assign an existing RT address. Use a normal BC node to send instructions and observe whether the pseudo RT node implemented by the masquerading terminal will also respond.

[0059] (5) When the pseudo RT node replies with the status word, observe whether the bus signal will be superimposed, resulting in bus conflict;

[0060] (6) Analyze the status word information replied by the normal RT node, take the inverted reply at the pseudo RT node end, and observe whether the bus level will be disturbed;

[0061] (7) If the observation results in steps (2) to (6) are abnormal, it indicates that there is a vulnerability in the 1553B bus system.

[0062] The device of the present invention can be used for the security evaluation of the 1553B bus protocol architecture, detecting whether there are security loopholes in the 1553B bus, verifying whether malicious attack nodes can be embedded in the bus, and whether key nodes in the bus can be maliciously exploited by attackers, resulting in consequences such as key information leakage or system abnormality.

[0063] The contents not described in detail in the specification of the present invention belong to the common knowledge of those skilled in the art.

Claims

1. A 1553B pseudo terminal test device, characterized in that include: One BC node, two RT nodes, one MT node and one camouflage node; The BC node is used to control the bus and is responsible for initiating transactions when transmitting information. The RT node is commanded and regulated by the BC node. Each RT node is assigned a unique address for communication. MT nodes do not respond to any commands and are only used to monitor and record commands and data on the bus; The camouflaged node is connected to the bus, and the camouflaged node can dynamically switch between BC mode and RT mode. In BC mode, the camouflaged node sends data different from the normal BC node and initiates bus control behavior; in RT mode, the camouflaged node address will be configured as the RT node address that already exists in the bus, simulating the RT node function to access the bus.

2. A 1553B pseudo terminal testing device according to claim 1, characterized in that: The BC node is the bus controller node, the RT node is the remote terminal node, and the MT node is the bus monitor node.

3. A 1553B pseudo terminal testing device according to claim 1, characterized in that: There can be only one BC node on a bus. Under normal circumstances, the data words sent and received by the BC node are limited to 0x1111 and 0x2222.

4. A 1553B pseudo terminal testing device according to claim 1, characterized in that: MT nodes do not need to be assigned addresses, and multiple MT nodes can be mounted on the bus as needed.

5. A 1553B pseudo terminal testing device according to claim 1, characterized in that: The 1553B pseudo terminal test device uses FPGA as a main control device, and the interface protocol chip adopts a configurable circuit supporting three modes: BC, RT and MT.

6. A 1553B pseudo terminal testing device according to claim 1, characterized in that: BC nodes, RT nodes, MT nodes and camouflage nodes are all connected to the bus through couplers.

7. A 1553B pseudo terminal testing device according to claim 1, characterized in that: When the masquerading terminal is dynamically configured to BC mode, it seizes the bus control right when the normal BC node is idle and transmits information with the remote terminal of the bus.

8. A 1553B pseudo terminal testing device according to claim 1, characterized in that: When the masquerade terminal is configured in RT mode, the masquerade terminal and the RT node with the same address as the simulated one receive or respond to bus information at the same time.

9. A 1553B pseudo terminal testing device according to claim 1, characterized in that: It also includes an oscilloscope, which is connected to the bus and monitors the bus data status in real time together with the MT node. The MT node reflects the command and data information on the bus in real time. The oscilloscope detects the signal waveform on the bus when the pseudo RT and the actual RT respond together.

10. A test method implemented by a 1553B pseudo terminal test device according to any one of claims 1 to 9, characterized in that include: (1) Use a normal BC node to send a data word 0x1111 to the 1# subaddress of the RT1 node; receive a data word 0x2222 from the 2# subaddress of the RT2 node; send the RT1-RT2 instruction to let the RT1 node send the data word 0x1111 to the RT2 node; (2) The pseudo BC node implemented by the camouflaged terminal attempts to send a data word 0x55AA to the 1# sub-address of the RT1 node to destroy the data in the 1# sub-address of the RT1 node; attempts to receive a data word 0x2222 from the 2# sub-address of the RT2 node to steal key information; and observes whether the behavior initiated by the pseudo BC node is successfully responded to through the MT node and the oscilloscope; (3) If the attack in step (2) is successful, the pseudo BC node implemented by the camouflaged terminal sends the RT1-RT2 instruction again, causing the RT1 node to send the data word 0x55AA to the RT2 node, and observe whether the data in the RT2 node is further damaged; (4) Configure the masquerading terminal to RT mode and assign an existing RT address. Use a normal BC node to send instructions and observe whether the pseudo RT node implemented by the masquerading terminal will also respond. (5) When the pseudo RT node replies with the status word, observe whether the bus signal will be superimposed, resulting in bus conflict; (6) Analyze the status word information replied by the normal RT node, take the inverted reply at the pseudo RT node end, and observe whether the bus level will be disturbed; (7) If the observation results in steps (2) to (6) are abnormal, it indicates that there is a vulnerability in the 1553B bus system.

Images