SOME / IP protocol data secure transmission method and device based on TLS / DTLS, and electronic equipment

Abstract

The invention provides an SOME / IP protocol data secure transmission method and device based on TLS / DTLS and electronic equipment, and in the method, when an SOME / IP protocol transmits data through a TCP / IP or UDP / IP network protocol, the data of the TCP / IP or UDP / IP network protocol can be encrypted, so that the security of a vehicle application during multi-ECU data exchange through the SOME / IP protocol is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of vehicle-mounted communications, and in particular to a method, device and electronic equipment for secure transmission of SOME / IP protocol data based on TLS / DTLS. Background Art

[0002] AUTOSAR AP (Adaptive Platform) middleware is widely used in vehicle-mounted ECU devices. The CM (Communication Management) module of AUTOSAR AP is used for communication between programs. Therefore, the CM module is widely used in AUTOSAR AP applications.

[0003] The communication protocols managed by the CM module include: SOME / IP protocol (Scalable service-oriented Middleware over IP), DDS protocol (Data Distribution Service), SHM protocol (shared memory communication), etc.

[0004] The SOME / IP protocol is an in-vehicle network communication protocol that is widely used for its efficient and flexible service communication. Currently, vehicles usually communicate with multiple ECUs. When multiple ECUs communicate with each other, the data sent by the application is packaged in the format of the SOME / IP protocol and then sent through the TCP / IP or UDP / IP network transmission protocol. Since the SOME / IP protocol is an open protocol specification, the data sent by the application can be parsed by simply capturing the ECU network information, which seriously affects the security of data exchange between multiple ECUs in the vehicle.

[0005] In summary, in order to ensure the security of data exchange between multiple ECUs in the vehicle during the mass production stage, how to encrypt data transmitted by the SOME / IP protocol through the TCP / IP or UDP / IP network protocol has become a technical problem that needs to be solved urgently. Summary of the invention

[0006] In view of this, the purpose of the present invention is to provide a method, device and electronic device for secure transmission of SOME / IP protocol data based on TLS / DTLS, so as to alleviate the technical problem that traditional technology cannot encrypt data transmitted by SOME / IP protocol through TCP / IP or UDP / IP network protocol.

[0007] In a first aspect, an embodiment of the present invention provides a method for secure transmission of SOME / IP protocol data based on TLS / DTLS, comprising:

[0008] When an application based on the SOME / IP protocol is started, the SOME / IP protocol stack reads a configuration file of the application and saves private information in the configuration file, wherein the private information includes: a name of the encryption suite, a name of the root certificate, a slot number of the private key, and a name of the user certificate;

[0009] The SOME / IP protocol stack determines the type of the application and determines whether the TLS / DTLS encryption function has been enabled for the application, wherein the type includes: a server application and a client application;

[0010] If enabled, the SOME / IP protocol stack creates a TCP / IP or UDP / IP connection with the peer application based on the configuration file, and after establishing the TCP / IP or UDP / IP connection with the peer application, the SOME / IP protocol stack calls the interface of the OpenSSL library to associate the created SSL object with the network file descriptor of the client;

[0011] The SOME / IP protocol stack calls the interface of the OpenSSL library to establish a TLS or DTLS connection with the peer application, wherein when establishing the TLS or DTLS connection, the OpenSSL library verifies the private information carried in the connection request, and if the verification is successful, the TLS or DTLS connection is successful;

[0012] When the application calls the interface of the SOME / IP protocol to send the first data, the SOME / IP protocol stack calls the interface of the OpenSSL library, so that the OpenSSL library encrypts the first data and sends the encrypted first data to the peer application through TCP / IP or UDP / IP;

[0013] When the SOME / IP protocol stack receives the second data sent by the peer application through the interface of the OpenSSL library, the second data is parsed and the parsed second data is sent to the application.

[0014] Furthermore, the SOME / IP protocol stack creates a TCP / IP or UDP / IP connection with a peer application based on the configuration file, including:

[0015] The SOME / IP protocol stack calls the OpenSSL interface to initialize the OpenSSL library;

[0016] The SOME / IP protocol stack calls the OpenSSL interface to load all OpenSSL algorithms;

[0017] The SOME / IP protocol stack calls the OpenSSL interface to create an OpenSSL context object;

[0018] The SOME / IP protocol stack calls the OpenSSL interface to register the name of the encryption suite to the OpenSSL context object;

[0019] The SOME / IP protocol stack calls the interface of the encryption module to obtain the root certificate information according to the name of the root certificate, and then the SOME / IP protocol stack calls the interface of OpenSSL to pass in the root certificate information;

[0020] The SOME / IP protocol stack calls the interface of the encryption module to obtain user certificate information according to the name of the user certificate, and then the SOME / IP protocol stack calls the interface of OpenSSL to pass in the user certificate information;

[0021] The SOME / IP protocol stack calls the interface of the encryption module to obtain the private key information according to the slot number of the private key, and then the SOME / IP protocol stack calls the interface of OpenSSL to pass in the private key information;

[0022] The SOME / IP protocol stack calls the interface of the OpenSSL library to set a callback function for checking the certificate information, and after the OpenSSL library checks the certificate information, the OpenSSL library calls the callback function, and then the SOME / IP protocol stack determines whether the certificate information is correct according to the information returned by the callback function;

[0023] If correct, the SOME / IP protocol stack creates the SSL object according to the OpenSSL context object;

[0024] The SOME / IP protocol stack creates a corresponding network file descriptor according to the IP address and port in the configuration file;

[0025] If the application is a server application, the SOME / IP protocol stack waits for the TCP / IP or UDP / IP connection of the client application, and when the client application connects to the server, obtains the network file descriptor of the client;

[0026] If the application is a client application, the SOME / IP protocol stack establishes a TCP / IP or UDP / IP connection with the server.

[0027] Furthermore, the SOME / IP protocol stack calls the interface of the OpenSSL library to establish a TLS or DTLS connection with the peer application, including:

[0028] If the application is a server application, the SOME / IP protocol stack calls the interface of the OpenSSL library to wait for receiving the SSL connection request of the client application, wherein when the client application connects to the server application, a TLS / DLTS handshake is performed, and data can be sent and received only after the handshake is successful, otherwise an error log is printed and the connection of the client application is removed;

[0029] If the application is a client application, the SOME / IP protocol stack calls the interface of the OpenSSL library to connect to the server application, wherein when the client application connects to the server application, a TLS / DLTS handshake is performed. Data can be sent and received only after the handshake is successful, otherwise an error log is printed and the connection of the client application is removed.

[0030] Furthermore, the method further comprises:

[0031] If not enabled, the SOME / IP protocol stack creates a corresponding TCP / IP or UDP / IP communication link according to the IP address and port in the configuration file;

[0032] When the application calls the interface of the SOME / IP protocol to send the first data, the SOME / IP protocol stack encapsulates the first data and sends the encapsulated first data through the established TCP / IP or UDP / IP communication link.

[0033] Furthermore, the method further comprises:

[0034] If it is incorrect, the SOME / IP protocol stack prints an error message and no longer communicates.

[0035] In a second aspect, an embodiment of the present invention provides a device for secure transmission of SOME / IP protocol data based on TLS / DTLS, including:

[0036] A reading and saving unit, configured to enable the SOME / IP protocol stack to read a configuration file of the application when the application based on the SOME / IP protocol is started, and to save private information in the configuration file, wherein the private information includes: a name of the encryption suite, a name of the root certificate, a slot number of the private key, and a name of the user certificate;

[0037] A determination unit, used for the SOME / IP protocol stack to determine the type of the application and whether the TLS / DTLS encryption function has been enabled for the application, wherein the type includes: a server application and a client application;

[0038] a creation and association unit, which is used to, if enabled, cause the SOME / IP protocol stack to create a TCP / IP or UDP / IP connection with a peer application based on the configuration file, and after establishing the TCP / IP or UDP / IP connection with the peer application, cause the SOME / IP protocol stack to call an interface of the OpenSSL library to associate the created SSL object with a network file descriptor of the client;

[0039] A connection unit, configured for the SOME / IP protocol stack to call an interface of an OpenSSL library to establish a TLS or DTLS connection with the peer application, wherein when establishing a TLS or DTLS connection, the OpenSSL library verifies the private information carried in the connection request, and if the verification is successful, the TLS or DTLS connection is successful;

[0040] a data sending unit, configured to, when the application calls the interface of the SOME / IP protocol to send the first data, cause the SOME / IP protocol stack to call the interface of the OpenSSL library, so that the OpenSSL library encrypts the first data and then sends the encrypted first data to the peer application through TCP / IP or UDP / IP;

[0041] The data receiving unit is used to parse the second data sent by the opposite application when the SOME / IP protocol stack receives the second data sent by the opposite application through the interface of the OpenSSL library, and send the parsed second data to the application.

[0042] Furthermore, the creating and associating unit is also used for:

[0043] The SOME / IP protocol stack calls the OpenSSL interface to initialize the OpenSSL library;

[0044] The SOME / IP protocol stack calls the OpenSSL interface to load all OpenSSL algorithms;

[0045] The SOME / IP protocol stack calls the OpenSSL interface to create an OpenSSL context object;

[0046] The SOME / IP protocol stack calls the OpenSSL interface to register the name of the encryption suite to the OpenSSL context object;

[0047] The SOME / IP protocol stack calls the interface of the encryption module to obtain the root certificate information according to the name of the root certificate, and then the SOME / IP protocol stack calls the interface of OpenSSL to pass in the root certificate information;

[0048] The SOME / IP protocol stack calls the interface of the encryption module to obtain user certificate information according to the name of the user certificate, and then the SOME / IP protocol stack calls the interface of OpenSSL to pass in the user certificate information;

[0049] The SOME / IP protocol stack calls the interface of the encryption module to obtain the private key information according to the slot number of the private key, and then the SOME / IP protocol stack calls the interface of OpenSSL to pass in the private key information;

[0050] The SOME / IP protocol stack calls the interface of the OpenSSL library to set a callback function for checking the certificate information, and after the OpenSSL library checks the certificate information, the OpenSSL library calls the callback function, and then the SOME / IP protocol stack determines whether the certificate information is correct according to the information returned by the callback function;

[0051] If correct, the SOME / IP protocol stack creates the SSL object according to the OpenSSL context object;

[0052] The SOME / IP protocol stack creates a corresponding network file descriptor according to the IP address and port in the configuration file;

[0053] If the application is a server application, the SOME / IP protocol stack waits for the TCP / IP or UDP / IP connection of the client application, and when the client application connects to the server, obtains the network file descriptor of the client;

[0054] If the application is a client application, the SOME / IP protocol stack establishes a TCP / IP or UDP / IP connection with the server.

[0055] Furthermore, the connection unit is also used for:

[0056] If the application is a server application, the SOME / IP protocol stack calls the interface of the OpenSSL library to wait for receiving the SSL connection request of the client application, wherein when the client application connects to the server application, a TLS / DLTS handshake is performed, and data can be sent and received only after the handshake is successful, otherwise an error log is printed and the connection of the client application is removed;

[0057] If the application is a client application, the SOME / IP protocol stack calls the interface of the OpenSSL library to connect to the server application, wherein when the client application connects to the server application, a TLS / DLTS handshake is performed. Data can be sent and received only after the handshake is successful, otherwise an error log is printed and the connection of the client application is removed.

[0058] In a third aspect, an embodiment of the present invention further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of any one of the methods described in the first aspect when executing the computer program.

[0059] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores machine-executable instructions. When the machine-executable instructions are called and executed by a processor, the machine-executable instructions prompt the processor to execute any method described in the first aspect above.

[0060] In an embodiment of the present invention, a method for secure transmission of SOME / IP protocol data based on TLS / DTLS is provided, comprising: when an application based on the SOME / IP protocol is started, the SOME / IP protocol stack reads a configuration file of the application and saves private information in the configuration file, wherein the private information includes: the name of the encryption suite, the name of the root certificate, the slot number of the private key, and the name of the user certificate; the SOME / IP protocol stack determines the type of application and determines whether the TLS / DTLS encryption function is enabled for the application, wherein the types include: a server application and a client application; if enabled, the SOME / IP protocol stack creates a TCP / IP or UDP / IP connection with the peer application based on the configuration file, and after establishing the TCP / IP or UDP / IP connection with the peer application, the SOME / IP protocol stack calls an interface of the OpenSSL library The created SSL object is associated with the network file descriptor of the client; the SOME / IP protocol stack calls the interface of the OpenSSL library to establish a TLS or DTLS connection with the peer application, wherein, when establishing the TLS or DTLS connection, the OpenSSL library verifies the private information carried in the connection request, and after the verification is successful, the TLS or DTLS connection is successful; when the application calls the interface of the SOME / IP protocol to send the first data, the SOME / IP protocol stack calls the interface of the OpenSSL library, so that the OpenSSL library encrypts the first data and sends the encrypted first data to the peer application through TCP / IP or UDP / IP; when the SOME / IP protocol stack receives the second data sent by the peer application through the interface of the OpenSSL library, the second data is parsed and the parsed second data is sent to the application. From the above description, it can be known that in the method for secure transmission of SOME / IP protocol data based on TLS / DTLS of the present invention, when the SOME / IP protocol transmits data through the TCP / IP or UDP / IP network protocol, the data of the TCP / IP or UDP / IP network protocol can be encrypted to improve the security of vehicle applications when performing multi-ECU data exchange through the SOME / IP protocol, thereby alleviating the technical problem that traditional technologies cannot encrypt data transmitted by the SOME / IP protocol through the TCP / IP or UDP / IP network protocol. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0062] Figure 1A flowchart of a method for secure transmission of SOME / IP protocol data based on TLS / DTLS provided in an embodiment of the present invention;

[0063] Figure 2 A timing diagram for establishing a communication link and data communication provided by an embodiment of the present invention;

[0064] Figure 3 A schematic diagram of a device for secure transmission of SOME / IP protocol data based on TLS / DTLS provided in an embodiment of the present invention;

[0065] Figure 4 A schematic diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0066] The technical solution of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0067] Traditional technologies cannot encrypt data transmitted by the SOME / IP protocol through the TCP / IP or UDP / IP network protocols.

[0068] Based on this, in the method for secure transmission of SOME / IP protocol data based on TLS / DTLS of the present invention, when the SOME / IP protocol transmits data through the TCP / IP or UDP / IP network protocol, the data of the TCP / IP or UDP / IP network protocol can be encrypted to improve the security of vehicle applications when exchanging multi-ECU data through the SOME / IP protocol.

[0069] To facilitate understanding of this embodiment, a method for secure transmission of SOME / IP protocol data based on TLS / DTLS disclosed in an embodiment of the present invention is first introduced in detail.

[0070] Embodiment 1:

[0071] According to an embodiment of the present invention, an embodiment of a method for secure transmission of SOME / IP protocol data based on TLS / DTLS is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0072] Figure 1is a flow chart of a method for secure transmission of SOME / IP protocol data based on TLS / DTLS according to an embodiment of the present invention. Figure 1 As shown, the method comprises the following steps:

[0073] Step S102, when the application based on the SOME / IP protocol is started, the SOME / IP protocol stack reads the configuration file of the application and saves the private information in the configuration file, wherein the private information includes: the name of the encryption suite, the name of the root certificate, the slot number of the private key and the name of the user certificate;

[0074] In the embodiment of the present invention, the data of the TCP / IP network protocol is encrypted by the TLS (Transport Layer Security) protocol. The data of the UDP / IP network protocol is encrypted by the DTLS (Datagram Transport Layer Security) protocol. Since the TLS / DTLS protocol requires a secret key during communication, the encrypted data cannot be parsed without the secret key.

[0075] When implementing, the developer first allocates the slot number (i.e. the slot number of the private key), the name of the root certificate, and the name of the user certificate (i.e. private information) required by the TLS / DTLS protocol to the in-vehicle application. Principle: Since the data encrypted by the TLS / DTLS protocol can be parsed as long as there is a secret key, the secret key content, root certificate information, and user certificate information are stored in the database of the encryption module, so that private information can be prevented from being stolen; different secret keys are stored in different slot numbers of the encryption module database, so that the secret key can be obtained from the encryption module database through the slot number. For example: slot number 100 stores secret key 1, slot number 200 stores secret key 2, etc.

[0076] The private information allocated to the application is written into the configuration file of the application based on the SOME / IP protocol. The configuration file is a json file, and the configuration file is in the following format: neusomeip.json.

[0077] {

[0078] "applications":[

[0079] {

[0080] "name":"myServer",

[0081] "id":"0x8ea2"

[0082] }

[0083] ],

[0084] "routing":"vsomeipd",

[0085] "services":[

[0086] {

[0087] "service":"0x58",

[0088]

[0089]

[0090]

[0091] From the above configuration files, we can see that:

[0092] The application myServer contains two service instances (the first service instance has service equal to 0x58 and instance equal to 99; the second service instance has service equal to 0x58 and instance equal to 100);

[0093] Each service instance contains a reliable-security-channel node based on TCP / IP communication. The content of this reliable-security-channel is used for TLS to encrypt data based on TCP / IP communication links. The value corresponding to "ciphersuite" is the name of the encryption suite (ECDHE-RSA-AES256-GCM-SHA384), the value corresponding to "root-certificate" is the name of the root certificate (GACServerRoot.crt), the value corresponding to "user-certificate" is the name of the user certificate (GACServerUser.crt), and the value corresponding to "private-certificate" is the slot number of the private key (196);

[0094] Each service instance contains a node unreliable-security-channel based on UDP / IP communication. The content of the unreliable-security-channel is used for DTLS to encrypt and protect data based on UDP / IP communication links. The meanings of "ciphersuite", "root-certificate", "user-certificate", and "private-certificate" are the same as above;

[0095] Each service can use the same "ciphersuite", "root-certificate", "user-certificate", and "private-certificate", or assign different values ​​to them.

[0096] When an application based on the SOME / IP protocol is started, the SOME / IP protocol stack reads the configuration file of the application and saves the "ciphersuite", "root-certificate", "user-certificate", and "private-certificate" in the reliable-security-channel and unreliable-security-channel. The above-mentioned application based on the SOME / IP protocol can be a server application or a client application.

[0097] Step S104, the SOME / IP protocol stack determines the type of application and determines whether the TLS / DTLS encryption function is enabled for the application, where the types include: server-side application and client-side application;

[0098] Specifically, the type of application can be determined by the identifier carried by the application. The type of application is essentially configured in advance by the developer, that is, the developer will pre-configure the corresponding application type for each application in the vehicle. When judging whether the application has enabled the TLS / DTLS encryption function, it can be judged by whether the configuration file contains the reliable-security-channel and unreliable-security-channel fields. If the above fields are included, it is determined that the TLS / DTLS encryption function has been enabled, otherwise, it is not enabled.

[0099] In addition, if the TLS / DTLS encryption function is not enabled, the SOME / IP protocol stack creates a corresponding TCP / IP or UDP / IP communication link according to the IP address and port in the configuration file (if it is a server application, the corresponding TCP / IP or UDP / IP communication link is the TCP / IP or UDP / IP communication link of the server; if it is a client application, the corresponding TCP / IP or UDP / IP communication link is the TCP / IP or UDP / IP communication link of the client); when the application calls the interface of the SOME / IP protocol to send the first data, the SOME / IP protocol stack encapsulates the first data and sends the encapsulated first data through the established TCP / IP or UDP / IP communication link.

[0100] Step S106, if enabled, the SOME / IP protocol stack creates a TCP / IP or UDP / IP connection with the peer application based on the configuration file, and after establishing the TCP / IP or UDP / IP connection with the peer application, the SOME / IP protocol stack calls the interface of the OpenSSL library to associate the created SSL object with the network file descriptor of the client;

[0101] Step S108, the SOME / IP protocol stack calls the interface of the OpenSSL library to establish a TLS or DTLS connection with the peer application. When establishing the TLS or DTLS connection, the OpenSSL library verifies the private information carried in the connection request. If the verification is successful, the TLS or DTLS connection is successful.

[0102] Step S110, when the application calls the interface of the SOME / IP protocol to send the first data, the SOME / IP protocol stack calls the interface of the OpenSSL library, so that the OpenSSL library encrypts the first data and sends the encrypted first data to the peer application through TCP / IP or UDP / IP;

[0103] Step S112: When the SOME / IP protocol stack receives the second data sent by the peer application through the interface of the OpenSSL library, the second data is parsed and the parsed second data is sent to the application.

[0104] Specifically, the interface of the OpenSSL library decrypts the encrypted second data to obtain the second data, and then sends the second data to the SOME / IP protocol stack, so that the SOME / IP protocol stack receives the second data sent by the peer application.

[0105] In an embodiment of the present invention, a method for secure transmission of SOME / IP protocol data based on TLS / DTLS is provided, comprising: when an application based on the SOME / IP protocol is started, the SOME / IP protocol stack reads a configuration file of the application and saves private information in the configuration file, wherein the private information includes: the name of the encryption suite, the name of the root certificate, the slot number of the private key, and the name of the user certificate; the SOME / IP protocol stack determines the type of application and determines whether the TLS / DTLS encryption function is enabled for the application, wherein the types include: a server application and a client application; if enabled, the SOME / IP protocol stack creates a TCP / IP or UDP / IP connection with the peer application based on the configuration file, and after establishing the TCP / IP or UDP / IP connection with the peer application, the SOME / IP protocol stack calls an interface of the OpenSSL library The created SSL object is associated with the network file descriptor of the client; the SOME / IP protocol stack calls the interface of the OpenSSL library to establish a TLS or DTLS connection with the peer application, wherein, when establishing the TLS or DTLS connection, the OpenSSL library verifies the private information carried in the connection request, and after the verification is successful, the TLS or DTLS connection is successful; when the application calls the interface of the SOME / IP protocol to send the first data, the SOME / IP protocol stack calls the interface of the OpenSSL library, so that the OpenSSL library encrypts the first data and sends the encrypted first data to the peer application through TCP / IP or UDP / IP; when the SOME / IP protocol stack receives the second data sent by the peer application through the interface of the OpenSSL library, the second data is parsed and the parsed second data is sent to the application. From the above description, it can be known that in the method for secure transmission of SOME / IP protocol data based on TLS / DTLS of the present invention, when the SOME / IP protocol transmits data through the TCP / IP or UDP / IP network protocol, the data of the TCP / IP or UDP / IP network protocol can be encrypted to improve the security of vehicle applications when performing multi-ECU data exchange through the SOME / IP protocol, thereby alleviating the technical problem that traditional technologies cannot encrypt data transmitted by the SOME / IP protocol through the TCP / IP or UDP / IP network protocol.

[0106] The above content briefly introduces the method for secure transmission of SOME / IP protocol data based on TLS / DTLS of the present invention. The specific contents involved are described in detail below.

[0107] In an optional embodiment of the present invention, the SOME / IP protocol stack creates a TCP / IP or UDP / IP connection with a peer application based on a configuration file, specifically comprising the following steps:

[0108] (1) The SOME / IP protocol stack calls the OpenSSL interface to initialize the OpenSSL library;

[0109] (2) The SOME / IP protocol stack calls the OpenSSL interface to load all OpenSSL algorithms;

[0110] (3) The SOME / IP protocol stack calls the OpenSSL interface to create an OpenSSL context object;

[0111] (4) The SOME / IP protocol stack calls the OpenSSL interface to register the name of the encryption suite to the OpenSSL context object;

[0112] (5) The SOME / IP protocol stack calls the interface of the encryption module to obtain the root certificate information according to the name of the root certificate, and then the SOME / IP protocol stack calls the interface of OpenSSL to pass in the root certificate information;

[0113] (6) The SOME / IP protocol stack calls the interface of the encryption module to obtain the user certificate information according to the name of the user certificate, and then the SOME / IP protocol stack calls the OpenSSL interface to pass in the user certificate information;

[0114] (7) The SOME / IP protocol stack calls the interface of the encryption module to obtain the private key information according to the slot number of the private key, and then the SOME / IP protocol stack calls the interface of OpenSSL to pass in the private key information;

[0115] (8) The SOME / IP protocol stack calls the interface of the OpenSSL library to set a callback function for checking the certificate information. After the OpenSSL library checks the certificate information, the OpenSSL library calls the callback function, and then the SOME / IP protocol stack determines whether the certificate information is correct based on the information returned by the callback function.

[0116] (9) If correct, the SOME / IP protocol stack creates an SSL object based on the OpenSSL context object;

[0117] (10) The SOME / IP protocol stack creates a corresponding network file descriptor based on the IP address and port in the configuration file;

[0118] (11) If the application is a server application, the SOME / IP protocol stack waits for the TCP / IP or UDP / IP connection of the client application, and when the client application connects to the server, obtains the client's network file descriptor;

[0119] (12) If the application is a client application, the SOME / IP protocol stack establishes a TCP / IP or UDP / IP connection with the server.

[0120] (13) If it is incorrect, the SOME / IP protocol stack prints an error message and no longer communicates.

[0121] In an optional embodiment of the present invention, the SOME / IP protocol stack calls the interface of the OpenSSL library to establish a TLS or DTLS connection with the peer application, specifically including the following steps:

[0122] (1) If the application is a server application, the SOME / IP protocol stack calls the interface of the OpenSSL library to wait for receiving the SSL connection request of the client application. When the client application connects to the server application, a TLS / DLTS handshake is performed. Data can be sent and received only after the handshake is successful. Otherwise, an error log is printed and the connection of the client application is removed.

[0123] (2) If the application is a client application, the SOME / IP protocol stack calls the interface of the OpenSSL library to connect to the server application. When the client application connects to the server application, a TLS / DLTS handshake is performed. Data can be sent and received only after the handshake is successful. Otherwise, an error log is printed and the connection of the client application is removed.

[0124] The following describes the process of establishing a communication link and data communication:

[0125] If the application is a server application and the TLS / DTLS encryption function is enabled, the SOME / IP protocol stack will create a TCP / IP or UDP / IP-based TLS or DTLS communication link for the server according to the server IP address, server port, server reliable-security-channel or unreliable-security-channel and other information in the configuration file, and perform data communication. Figure 2 As shown, the details are as follows:

[0126] (1) The SOME / IP protocol stack calls the OpenSSL interface to initialize the OpenSSL library;

[0127] (2) The SOME / IP protocol stack calls the OpenSSL interface to load all OpenSSL algorithms;

[0128] (3) The SOME / IP protocol stack calls the OpenSSL interface to create an OpenSSL context object ctx;

[0129] (4) The SOME / IP protocol stack calls the OpenSSL interface to register the value of "ciphersuite" (the name of the encryption suite) to the OpenSSL context object ctx;

[0130] (5) The SOME / IP protocol stack calls the interface of the encryption module to obtain the root certificate information according to the value of "root-certificate", and the SOME / IP protocol stack calls the interface of OpenSSL to pass in the root certificate information;

[0131] (6) The SOME / IP protocol stack calls the interface of the encryption module to obtain the user certificate information according to the value of "user-certificate", and the SOME / IP protocol stack calls the interface of OpenSSL to pass in the user certificate information;

[0132] (7) The SOME / IP protocol stack calls the interface of the encryption module to obtain the private key information according to the value of "private-certificate". The SOME / IP protocol stack calls the interface of OpenSSL to pass in the private key information;

[0133] (8) The SOME / IP protocol stack calls the interface of the OpenSSL library to set a callback function to check the certificate information. After the OpenSSL library checks the certificate information, it calls the callback function. The SOME / IP protocol stack can determine whether the certificate information is correct based on the information returned by the callback function. If the certificate information is correct, the following process can be continued. Otherwise, the SOME / IP protocol stack will print an error message indicating that the certificate information is incorrect and communication is no longer possible.

[0134] (9) The SOME / IP protocol stack creates an SSL object based on the OpenSSL context object ctx;

[0135] (10) The SOME / IP protocol stack will create a TCP / IP or UDP / IP network file descriptor (or socket file descriptor) on the server side according to the IP address and port information in the configuration file, and wait for the client to connect. When the client connects to the server, it will return a new socket file descriptor (the client's network file descriptor) and call the OpenSSL library interface to associate the SSL object with the new socket file descriptor.

[0136] (11) The SOME / IP protocol stack calls the connection interface of the OpenSSL library to wait for the client's SSL connection request. When the client connects to the server, a TLS / DLTS handshake will be performed. Data can only be sent and received after the handshake is successful. Otherwise, an error log will be printed and the client's connection will be removed.

[0137] (12) When the application on the server side based on the SOME / IP protocol calls the interface of the SOME / IP protocol to send the first data, the SOME / IP protocol stack calls the interface of the OpenSSL library to send the first data;

[0138] (13) When the SOME / IP protocol stack receives the second data through the OpenSSL interface, the SOME / IP protocol stack parses the second data and returns the second data to the application on the server side based on the SOME / IP protocol.

[0139] If the application is a client application and the TLS / DTLS encryption function is enabled, the SOME / IP protocol stack will create a TCP / IP or UDP / IP-based TLS or DTLS communication link for the client based on the client's IP address, client port, client reliable-security-channel or unreliable-security-channel and other information in the configuration file, and perform data communication, such as Figure 2 As shown, the details are as follows:

[0140] (1) The SOME / IP protocol stack calls the OpenSSL interface to initialize the OpenSSL library;

[0141] (2) The SOME / IP protocol stack calls the OpenSSL interface to load all OpenSSL algorithms;

[0142] (3) The SOME / IP protocol stack calls the OpenSSL interface to create the OpenSSL context object ctx;

[0143] (4) The SOME / IP protocol stack calls the OpenSSL interface to register the value of "ciphersuite" (the name of the encryption suite) to the OpenSSL context object ctx;

[0144] (5) The SOME / IP protocol stack calls the interface of the encryption module to obtain the root certificate information according to the value of "root-certificate", and the SOME / IP protocol stack calls the interface of OpenSSL to pass in the root certificate information;

[0145] (6) The SOME / IP protocol stack calls the interface of the encryption module to obtain the user certificate information according to the value of "user-certificate". The SOME / IP protocol stack calls the interface of OpenSSL to pass in the user certificate information;

[0146] (7) The SOME / IP protocol stack calls the interface of the encryption module to obtain the private key information according to the value of "private-certificate". The SOME / IP protocol stack calls the interface of OpenSSL to pass in the private key information;

[0147] (8) The SOME / IP protocol stack calls the interface of the OpenSSL library to set a callback function to check the certificate information. After the OpenSSL library checks the certificate information, it calls the callback function. The SOME / IP protocol stack can determine whether the certificate information is correct based on the information returned by the callback function. If the certificate information is correct, the following process can be continued. Otherwise, the SOME / IP protocol stack will print an error message indicating that the private key information is incorrect and communication is no longer possible.

[0148] (9) The SOME / IP protocol stack creates an SSL object based on the OpenSSL context object ctx;

[0149] (10) The SOME / IP protocol stack will create the client's TCP / IP or UDP / IP network file descriptor based on the IP address and port information in the configuration file to connect to the server. At the same time, the SOME / IP protocol stack will call the interface of the OpenSSL library to associate the SSL object with the client's network file descriptor;

[0150] (11) The SOME / IP protocol stack will call the interface of the OpenSSL library to connect to the server. When the client connects to the server, a TLS / DLTS handshake will be performed. Data can only be sent and received after the handshake is successful. Otherwise, the SOME / IP protocol stack will print an error log and close the network file descriptor of the client.

[0151] (12) When the client application based on the SOME / IP protocol calls the interface of the SOME / IP protocol to send the first data, the SOME / IP protocol stack calls the interface of the OpenSSL library to send the first data;

[0152] (13) When the SOME / IP protocol stack receives the second data through the OpenSSL interface, the SOME / IP protocol stack parses the second data and returns the second data to the client application based on the SOME / IP protocol.

[0153] When TLS / DTLS is enabled, the SOME / IP message will be encrypted after the above process, ensuring the security of application data based on the SOME / IP protocol.

[0154] Embodiment 2:

[0155] The embodiment of the present invention also provides a device for secure transmission of SOME / IP protocol data based on TLS / DTLS. The device for secure transmission of SOME / IP protocol data based on TLS / DTLS is mainly used to execute the method for secure transmission of SOME / IP protocol data based on TLS / DTLS provided in the first embodiment of the present invention. The device for secure transmission of SOME / IP protocol data based on TLS / DTLS provided in the embodiment of the present invention is specifically introduced below.

[0156] Figure 3 is a schematic diagram of a device for secure transmission of SOME / IP protocol data based on TLS / DTLS according to an embodiment of the present invention, such as Figure 3 As shown, the device mainly includes: a reading and saving unit 10, a judging unit 20, a creating and associating unit 30, a connecting unit 40, a data sending unit 50 and a data receiving unit 60, wherein:

[0157] A reading and saving unit, used for the SOME / IP protocol stack to read the configuration file of the application when the application based on the SOME / IP protocol is started, and save the private information in the configuration file, wherein the private information includes: the name of the encryption suite, the name of the root certificate, the slot number of the private key and the name of the user certificate;

[0158] A determination unit, used for the SOME / IP protocol stack to determine the type of application and whether the application has enabled the TLS / DTLS encryption function, wherein the types include: server-side application and client-side application;

[0159] A creation and association unit, which is used for, if enabled, the SOME / IP protocol stack to create a TCP / IP or UDP / IP connection with the peer application based on the configuration file, and after establishing the TCP / IP or UDP / IP connection with the peer application, the SOME / IP protocol stack calls the interface of the OpenSSL library to associate the created SSL object with the network file descriptor of the client;

[0160] A connection unit, used for the SOME / IP protocol stack to call the interface of the OpenSSL library to establish a TLS or DTLS connection with the peer application, wherein when establishing the TLS or DTLS connection, the OpenSSL library verifies the private information carried in the connection request, and after the verification is successful, the TLS or DTLS connection is successful;

[0161] A data sending unit, configured to, when the application calls the interface of the SOME / IP protocol to send the first data, cause the SOME / IP protocol stack to call the interface of the OpenSSL library, so that the OpenSSL library encrypts the first data and sends the encrypted first data to the peer application through TCP / IP or UDP / IP;

[0162] The data receiving unit is used to parse the second data sent by the opposite application when the SOME / IP protocol stack receives the second data sent by the opposite application through the interface of the OpenSSL library, and send the parsed second data to the application.

[0163] In an embodiment of the present invention, a method for secure transmission of SOME / IP protocol data based on TLS / DTLS is provided, comprising: when an application based on the SOME / IP protocol is started, the SOME / IP protocol stack reads a configuration file of the application and saves private information in the configuration file, wherein the private information includes: the name of the encryption suite, the name of the root certificate, the slot number of the private key, and the name of the user certificate; the SOME / IP protocol stack determines the type of application and determines whether the TLS / DTLS encryption function is enabled for the application, wherein the types include: a server application and a client application; if enabled, the SOME / IP protocol stack creates a TCP / IP or UDP / IP connection with the peer application based on the configuration file, and after establishing the TCP / IP or UDP / IP connection with the peer application, the SOME / IP protocol stack calls an interface of the OpenSSL library The created SSL object is associated with the network file descriptor of the client; the SOME / IP protocol stack calls the interface of the OpenSSL library to establish a TLS or DTLS connection with the peer application, wherein, when establishing the TLS or DTLS connection, the OpenSSL library verifies the private information carried in the connection request, and after the verification is successful, the TLS or DTLS connection is successful; when the application calls the interface of the SOME / IP protocol to send the first data, the SOME / IP protocol stack calls the interface of the OpenSSL library, so that the OpenSSL library encrypts the first data and sends the encrypted first data to the peer application through TCP / IP or UDP / IP; when the SOME / IP protocol stack receives the second data sent by the peer application through the interface of the OpenSSL library, the second data is parsed and the parsed second data is sent to the application. From the above description, it can be known that in the method for secure transmission of SOME / IP protocol data based on TLS / DTLS of the present invention, when the SOME / IP protocol transmits data through the TCP / IP or UDP / IP network protocol, the data of the TCP / IP or UDP / IP network protocol can be encrypted to improve the security of vehicle applications when performing multi-ECU data exchange through the SOME / IP protocol, thereby alleviating the technical problem that traditional technologies cannot encrypt data transmitted by the SOME / IP protocol through the TCP / IP or UDP / IP network protocol.

[0164] Optionally, the creation and association unit is also used for: the SOME / IP protocol stack calls the interface of OpenSSL to initialize the OpenSSL library; the SOME / IP protocol stack calls the interface of OpenSSL to load all OpenSSL algorithms; the SOME / IP protocol stack calls the interface of OpenSSL to create the context object of OpenSSL; the SOME / IP protocol stack calls the interface of OpenSSL to register the name of the encryption suite to the context object of OpenSSL; the SOME / IP protocol stack calls the interface of the encryption module to obtain the root certificate information according to the name of the root certificate, and then the SOME / IP protocol stack calls the interface of OpenSSL to pass in the root certificate information; the SOME / IP protocol stack calls the interface of the encryption module to obtain the user certificate information according to the name of the user certificate, and then the SOME / IP protocol stack calls the interface of OpenSSL to pass in the user certificate information; the SOME / IP protocol stack calls the interface of the encryption module to obtain the private key according to the slot number of the private key. Private key information, and then the SOME / IP protocol stack calls the OpenSSL interface to pass in the private key information; the SOME / IP protocol stack calls the OpenSSL library interface to set a callback function to check the certificate information, and when the OpenSSL library checks the certificate information, the OpenSSL library calls the callback function, and then the SOME / IP protocol stack determines whether the certificate information is correct according to the information returned by the callback function; if correct, the SOME / IP protocol stack creates an SSL object according to the OpenSSL context object; the SOME / IP protocol stack creates a corresponding network file descriptor according to the IP address and port in the configuration file; if the application is a server application, the SOME / IP protocol stack waits for the TCP / IP or UDP / IP connection of the client application, and when the client application connects to the server, obtains the client's network file descriptor; if the application is a client application, the SOME / IP protocol stack establishes a TCP / IP or UDP / IP connection with the server.

[0165] Optionally, the connection unit is also used for: if the application is a server application, the SOME / IP protocol stack calls the interface of the OpenSSL library to wait for receiving the SSL connection request of the client application, wherein when the client application connects to the server application, a TLS / DLTS handshake is performed, and data can be sent and received only after the handshake is successful, otherwise an error log is printed and the connection of the client application is removed; if the application is a client application, the SOME / IP protocol stack calls the interface of the OpenSSL library to connect to the server application, wherein when the client application connects to the server application, a TLS / DLTS handshake is performed, and data can be sent and received only after the handshake is successful, otherwise an error log is printed and the connection of the client application is removed.

[0166] Optionally, the device is also used for: if it is not enabled, the SOME / IP protocol stack creates a corresponding TCP / IP or UDP / IP communication link according to the IP address and port in the configuration file; when the application calls the interface of the SOME / IP protocol to send the first data, the SOME / IP protocol stack encapsulates the first data and sends the encapsulated first data through the established TCP / IP or UDP / IP communication link.

[0167] Optionally, the device is also used for: if it is incorrect, the SOME / IP protocol stack prints an error message and no longer communicates.

[0168] The device provided in the embodiment of the present invention has the same implementation principle and technical effects as those of the aforementioned method embodiment. For the sake of brief description, for matters not mentioned in the device embodiment, reference may be made to the corresponding contents in the aforementioned method embodiment.

[0169] like Figure 4 As shown, an electronic device 600 provided in an embodiment of the present application includes: a processor 601, a memory 602 and a bus, wherein the memory 602 stores machine-readable instructions executable by the processor 601. When the electronic device is running, the processor 601 communicates with the memory 602 through the bus, and the processor 601 executes the machine-readable instructions to perform the steps of the method for secure transmission of SOME / IP protocol data based on TLS / DTLS as described above.

[0170] Specifically, the above-mentioned memory 602 and processor 601 can be general-purpose memory and processor, which are not specifically limited here. When the processor 601 runs the computer program stored in the memory 602, it can execute the above-mentioned method for secure transmission of SOME / IP protocol data based on TLS / DTLS.

[0171] The processor 601 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the processor 601. The above processor 601 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware decoding processor for execution, or a combination of hardware and software modules in the decoding processor for execution. The software module may be located in a storage medium mature in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 602, and the processor 601 reads the information in the memory 602 and completes the steps of the above method in combination with its hardware.

[0172] Corresponding to the above-mentioned method for secure transmission of SOME / IP protocol data based on TLS / DTLS, an embodiment of the present application also provides a computer-readable storage medium, which stores machine-executable instructions. When the computer-executable instructions are called and executed by a processor, the computer-executable instructions prompt the processor to execute the steps of the above-mentioned method for secure transmission of SOME / IP protocol data based on TLS / DTLS.

[0173] The device for secure transmission of SOME / IP protocol data based on TLS / DTLS provided in the embodiment of the present application can be specific hardware on the device or software or firmware installed on the device. The device provided in the embodiment of the present application, its implementation principle and the technical effect produced are the same as those in the aforementioned method embodiment. For the sake of brief description, for the parts not mentioned in the device embodiment, reference can be made to the corresponding contents in the aforementioned method embodiment. Technical personnel in the relevant field can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, devices and units described above can all refer to the corresponding processes in the aforementioned method embodiment, and will not be repeated here.

[0174] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0175] For another example, the flowchart and block diagram in the accompanying drawings show the possible architecture, function and operation of the device, method and computer program product according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of the code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or the flowchart, and the combination of the boxes in the block diagram and / or the flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0176] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0177] In addition, each functional unit in the embodiments provided in the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0178] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions to enable an electronic device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method for secure transmission of SOME / IP protocol data based on TLS / DTLS described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store program codes.

[0179] It should be noted that similar numbers and letters represent similar items in the following figures. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. In addition, the terms "first", "second", "third", etc. are only used to distinguish the description and are not to be understood as indicating or implying relative importance.

[0180] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present application, which are used to illustrate the technical solution of the present application, rather than to limit it. The protection scope of the present application is not limited thereto. Although the present application is described in detail with reference to the aforementioned embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solution recorded in the aforementioned embodiments within the technical scope disclosed in the present application, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solution deviate from the scope of the technical solution of the embodiment of the present application. They should all be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A method for secure transmission of SOME / IP protocol data based on TLS / DTLS, characterized in that: include: When an application based on the SOME / IP protocol is started, the SOME / IP protocol stack reads a configuration file of the application and saves private information in the configuration file, wherein the private information includes: a name of the encryption suite, a name of the root certificate, a slot number of the private key, and a name of the user certificate; The SOME / IP protocol stack determines the type of the application and determines whether the TLS / DTLS encryption function has been enabled for the application, wherein the type includes: a server application and a client application; If enabled, the SOME / IP protocol stack creates a TCP / IP or UDP / IP connection with the peer application based on the configuration file, and after establishing the TCP / IP or UDP / IP connection with the peer application, the SOME / IP protocol stack calls the interface of the OpenSSL library to associate the created SSL object with the network file descriptor of the client; The SOME / IP protocol stack calls the interface of the OpenSSL library to establish a TLS or DTLS connection with the peer application, wherein when establishing the TLS or DTLS connection, the OpenSSL library verifies the private information carried in the connection request, and if the verification is successful, the TLS or DTLS connection is successful; When the application calls the interface of the SOME / IP protocol to send the first data, the SOME / IP protocol stack calls the interface of the OpenSSL library, so that the OpenSSL library encrypts the first data and sends the encrypted first data to the peer application through TCP / IP or UDP / IP; When the SOME / IP protocol stack receives the second data sent by the peer application through the interface of the OpenSSL library, the second data is parsed and the parsed second data is sent to the application.

2. The method according to claim 1, characterized in that The SOME / IP protocol stack creates a TCP / IP or UDP / IP connection with a peer application based on the configuration file, including: The SOME / IP protocol stack calls the OpenSSL interface to initialize the OpenSSL library; The SOME / IP protocol stack calls the OpenSSL interface to load all OpenSSL algorithms; The SOME / IP protocol stack calls the OpenSSL interface to create an OpenSSL context object; The SOME / IP protocol stack calls the OpenSSL interface to register the name of the encryption suite to the OpenSSL context object; The SOME / IP protocol stack calls the interface of the encryption module to obtain the root certificate information according to the name of the root certificate, and then the SOME / IP protocol stack calls the interface of OpenSSL to pass in the root certificate information; The SOME / IP protocol stack calls the interface of the encryption module to obtain user certificate information according to the name of the user certificate, and then the SOME / IP protocol stack calls the interface of OpenSSL to pass in the user certificate information; The SOME / IP protocol stack calls the interface of the encryption module to obtain the private key information according to the slot number of the private key, and then the SOME / IP protocol stack calls the interface of OpenSSL to pass in the private key information; The SOME / IP protocol stack calls the interface of the OpenSSL library to set a callback function for checking the certificate information, and after the OpenSSL library checks the certificate information, the OpenSSL library calls the callback function, and then the SOME / IP protocol stack determines whether the certificate information is correct according to the information returned by the callback function; If correct, the SOME / IP protocol stack creates the SSL object according to the OpenSSL context object; The SOME / IP protocol stack creates a corresponding network file descriptor according to the IP address and port in the configuration file; If the application is a server application, the SOME / IP protocol stack waits for the TCP / IP or UDP / IP connection of the client application, and when the client application connects to the server, obtains the network file descriptor of the client; If the application is a client application, the SOME / IP protocol stack establishes a TCP / IP or UDP / IP connection with the server.

3. The method according to claim 1, characterized in that The SOME / IP protocol stack calls the interface of the OpenSSL library to establish a TLS or DTLS connection with the peer application, including: If the application is a server application, the SOME / IP protocol stack calls the interface of the OpenSSL library to wait for receiving the SSL connection request of the client application, wherein when the client application connects to the server application, a TLS / DLTS handshake is performed, and data can be sent and received only after the handshake is successful, otherwise an error log is printed and the connection of the client application is removed; If the application is a client application, the SOME / IP protocol stack calls the interface of the OpenSSL library to connect to the server application, wherein when the client application connects to the server application, a TLS / DLTS handshake is performed. Data can be sent and received only after the handshake is successful, otherwise an error log is printed and the connection of the client application is removed.

4. The method according to claim 1, characterized in that: The method further comprises: If not enabled, the SOME / IP protocol stack creates a corresponding TCP / IP or UDP / IP communication link according to the IP address and port in the configuration file; When the application calls the interface of the SOME / IP protocol to send the first data, the SOME / IP protocol stack encapsulates the first data and sends the encapsulated first data through the established TCP / IP or UDP / IP communication link.

5. The method according to claim 2, characterized in that: The method further comprises: If it is incorrect, the SOME / IP protocol stack prints an error message and no longer communicates.

6. A device for secure transmission of SOME / IP protocol data based on TLS / DTLS, characterized in that: include: A reading and saving unit, configured to enable the SOME / IP protocol stack to read a configuration file of the application when the application based on the SOME / IP protocol is started, and to save private information in the configuration file, wherein the private information includes: a name of the encryption suite, a name of the root certificate, a slot number of the private key, and a name of the user certificate; A determination unit, used for the SOME / IP protocol stack to determine the type of the application and whether the TLS / DTLS encryption function has been enabled for the application, wherein the type includes: a server application and a client application; a creation and association unit, which is used to, if enabled, cause the SOME / IP protocol stack to create a TCP / IP or UDP / IP connection with a peer application based on the configuration file, and after establishing the TCP / IP or UDP / IP connection with the peer application, cause the SOME / IP protocol stack to call an interface of the OpenSSL library to associate the created SSL object with a network file descriptor of the client; A connection unit, configured for the SOME / IP protocol stack to call an interface of an OpenSSL library to establish a TLS or DTLS connection with the peer application, wherein when establishing a TLS or DTLS connection, the OpenSSL library verifies the private information carried in the connection request, and if the verification is successful, the TLS or DTLS connection is successful; a data sending unit, configured to, when the application calls the interface of the SOME / IP protocol to send the first data, cause the SOME / IP protocol stack to call the interface of the OpenSSL library, so that the OpenSSL library encrypts the first data and then sends the encrypted first data to the peer application through TCP / IP or UDP / IP; The data receiving unit is used to parse the second data sent by the opposite application when the SOME / IP protocol stack receives the second data sent by the opposite application through the interface of the OpenSSL library, and send the parsed second data to the application.

7. The device according to claim 6, characterized in that The creating and associating unit is further configured to: The SOME / IP protocol stack calls the OpenSSL interface to initialize the OpenSSL library; The SOME / IP protocol stack calls the OpenSSL interface to load all OpenSSL algorithms; The SOME / IP protocol stack calls the OpenSSL interface to create an OpenSSL context object; The SOME / IP protocol stack calls the OpenSSL interface to register the name of the encryption suite to the OpenSSL context object; The SOME / IP protocol stack calls the interface of the encryption module to obtain the root certificate information according to the name of the root certificate, and then the SOME / IP protocol stack calls the interface of OpenSSL to pass in the root certificate information; The SOME / IP protocol stack calls the interface of the encryption module to obtain user certificate information according to the name of the user certificate, and then the SOME / IP protocol stack calls the interface of OpenSSL to pass in the user certificate information; The SOME / IP protocol stack calls the interface of the encryption module to obtain the private key information according to the slot number of the private key, and then the SOME / IP protocol stack calls the interface of OpenSSL to pass in the private key information; The SOME / IP protocol stack calls the interface of the OpenSSL library to set a callback function for checking the certificate information, and after the OpenSSL library checks the certificate information, the OpenSSL library calls the callback function, and then the SOME / IP protocol stack determines whether the certificate information is correct according to the information returned by the callback function; If correct, the SOME / IP protocol stack creates the SSL object according to the OpenSSL context object; The SOME / IP protocol stack creates a corresponding network file descriptor according to the IP address and port in the configuration file; If the application is a server application, the SOME / IP protocol stack waits for the TCP / IP or UDP / IP connection of the client application, and when the client application connects to the server, obtains the network file descriptor of the client; If the application is a client application, the SOME / IP protocol stack establishes a TCP / IP or UDP / IP connection with the server.

8. The device according to claim 6, characterized in that The connection unit is also used for: If the application is a server application, the SOME / IP protocol stack calls the interface of the OpenSSL library to wait for receiving the SSL connection request of the client application, wherein when the client application connects to the server application, a TLS / DLTS handshake is performed, and data can be sent and received only after the handshake is successful, otherwise an error log is printed and the connection of the client application is removed; If the application is a client application, the SOME / IP protocol stack calls the interface of the OpenSSL library to connect to the server application, wherein when the client application connects to the server application, a TLS / DLTS handshake is performed. Data can be sent and received only after the handshake is successful, otherwise an error log is printed and the connection of the client application is removed.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 5 are implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores machine-executable instructions. When the machine-executable instructions are called and executed by a processor, the machine-executable instructions cause the processor to execute the method according to any one of claims 1 to 5.

Images