Method, apparatus and electronic device for secure transmission of some / ip protocol data based on tls / dtls

Abstract

The application provides a method, device and electronic equipment for secure transmission of SOME / IP protocol data based on TLS / DTLS, wherein when SOME / IP protocol transmits data through TCP / IP or UDP / IP network protocol, the data of TCP / IP or UDP / IP network protocol can be encrypted, so that the security of vehicle application in the process of data exchange among multiple ECUs through SOME / IP protocol is improved.

Description

Technical Field

[0001] This invention relates to the technical field of vehicle communication, and in particular to a method, apparatus, and electronic device for secure data transmission based on the SOME / IP protocol using TLS / DTLS. Background Technology

[0002] AUTOSAR AP (Adaptive Platform) middleware is widely used in automotive ECU devices. The CM (Communication Management) module of AUTOSAR AP is used for communication between programs. Therefore, the CM module is widely used in AUTOSAR AP applications.

[0003] The communication protocols managed by the CM module include: SOME / IP (Scalable service-oriented middleware over IP), DDS (Data Distribution Service), and SHM (Shared Memory Communication).

[0004] SOME / IP is an in-vehicle network communication protocol widely used due to its efficient and flexible service communication. Currently, vehicles typically communicate between multiple ECUs. When communicating between multiple ECUs, the data sent by the application is packaged according to the SOME / IP protocol format and then transmitted via TCP / IP or UDP / IP network protocols. Because SOME / IP is a publicly available protocol specification, the data sent by the application can be parsed simply by capturing ECU network information, which seriously compromises the security of data exchange between multiple ECUs within the vehicle.

[0005] In summary, to ensure the security of data exchange between multiple ECUs within a vehicle during the mass production stage, encrypting data transmitted via TCP / IP or UDP / IP network protocols using the SOME / IP protocol has become a pressing technical problem that needs to be solved. Summary of the Invention

[0006] In view of this, the purpose of the present invention is to provide a method, apparatus and electronic device for secure data transmission of the SOME / IP protocol based on TLS / DTLS, so as to alleviate the technical problem that traditional technologies cannot encrypt data transmitted by the SOME / IP protocol through TCP / IP or UDP / IP network protocols.

[0007] In a first aspect, embodiments of the present invention provide a method for secure data transmission based on the SOME / IP protocol using TLS / DTLS, comprising:

[0008] When an application based on the SOME / IP protocol starts, the SOME / IP protocol stack reads the application's configuration file and saves the private information in the configuration file. The private information includes: the name of the encryption suite, the name of the root certificate, the slot number of the private key, and the name of the user certificate.

[0009] The SOME / IP protocol stack determines the type of the application and whether the application has enabled TLS / DTLS encryption. The types include: server-side applications and client-side applications.

[0010] If enabled, the SOME / IP protocol stack creates a TCP / IP or UDP / IP connection with the peer application based on the configuration file. After establishing the TCP / IP or UDP / IP connection with the peer application, the SOME / IP protocol stack calls the OpenSSL library interface to associate the created SSL object with the client's network file descriptor.

[0011] The SOME / IP protocol stack calls the OpenSSL library interface to establish a TLS or DTLS connection with the peer application. When establishing a TLS or DTLS connection, the OpenSSL library verifies the private information carried in the connection request. If the verification is successful, the TLS or DTLS connection is successful.

[0012] When the application calls the interface of the SOME / IP protocol to send the first data, the SOME / IP protocol stack calls the interface of the OpenSSL library so that the OpenSSL library encrypts the first data and sends the encrypted first data to the peer application via TCP / IP or UDP / IP.

[0013] When the SOME / IP protocol stack receives the second data sent by the peer application through the OpenSSL library interface, it parses the second data and sends the parsed second data to the application.

[0014] Furthermore, the SOME / IP protocol stack creates a TCP / IP or UDP / IP connection with the peer application based on the configuration file, including:

[0015] The SOME / IP protocol stack calls the OpenSSL interface to initialize the OpenSSL library;

[0016] The SOME / IP protocol stack calls the OpenSSL interface to load all OpenSSL algorithms;

[0017] The SOME / IP protocol stack calls the OpenSSL interface to create an OpenSSL context object;

[0018] The SOME / IP protocol stack calls the OpenSSL interface to register the name of the cipher suite with the OpenSSL context object;

[0019] The SOME / IP protocol stack calls the encryption module's interface to obtain the root certificate information based on the name of the root certificate, and then the SOME / IP protocol stack calls the OpenSSL interface to pass in the root certificate information;

[0020] The SOME / IP protocol stack calls the encryption module's interface to obtain user certificate information based on the name of the user certificate, and then the SOME / IP protocol stack calls the OpenSSL interface to pass in the user certificate information;

[0021] The SOME / IP protocol stack calls the encryption module's interface to obtain the private key information based on the private key's slot number, and then the SOME / IP protocol stack calls the OpenSSL interface to pass in the private key information;

[0022] The SOME / IP protocol stack calls the OpenSSL library's interface to set a callback function to check certificate information. After the OpenSSL library checks the certificate information, it calls the callback function, and then the SOME / IP protocol stack determines whether the certificate information is correct based on the information returned by the callback function.

[0023] If correct, the SOME / IP protocol stack creates the SSL object based on the OpenSSL context object;

[0024] The SOME / IP protocol stack creates a corresponding network file descriptor based on the IP address and port in the configuration file;

[0025] If the application is a server-side application, the SOME / IP protocol stack waits for the client application's TCP / IP or UDP / IP connection, and obtains the client's network file descriptor when the client application connects to the server.

[0026] If the application is a client application, then the SOME / IP protocol stack establishes a TCP / IP or UDP / IP connection with the server.

[0027] Furthermore, the SOME / IP protocol stack calls the OpenSSL library interface to establish a TLS or DTLS connection with the peer application, including:

[0028] If the application is a server-side application, the SOME / IP protocol stack calls the OpenSSL library interface to wait for receiving SSL connection requests from client applications. When a client application connects to a server-side application, a TLS / DLTS handshake is performed. Data can only be sent and received after the handshake is successful; otherwise, an error log is printed and the client application's connection is removed.

[0029] If the application is a client application, the SOME / IP protocol stack calls the OpenSSL library interface to connect to the server application. When the client application connects to the server application, a TLS / DLTS handshake is performed. Data can only be sent and received after the handshake is successful; otherwise, an error log is printed and the client application's connection is removed.

[0030] Furthermore, the method also includes:

[0031] If not enabled, the SOME / IP protocol stack creates a corresponding TCP / IP or UDP / IP communication link based on the IP address and port in the configuration file;

[0032] When the application calls the interface of the SOME / IP protocol to send the first data, the SOME / IP protocol stack encapsulates the first data and sends the encapsulated first data through the established TCP / IP or UDP / IP communication link.

[0033] Furthermore, the method also includes:

[0034] If incorrect, the SOME / IP protocol stack will print an error message and cease communication.

[0035] Secondly, embodiments of the present invention provide an apparatus for secure data transmission based on the SOME / IP protocol using TLS / DTLS, comprising:

[0036] The read and save unit is used when the application based on the SOME / IP protocol starts up. The SOME / IP protocol stack reads the configuration file of the application and saves the private information in the configuration file. The private information includes: the name of the encryption suite, the name of the root certificate, the slot number of the private key, and the name of the user certificate.

[0037] The judgment unit is used by the SOME / IP protocol stack to determine the type of the application and whether the application has enabled TLS / DTLS encryption, wherein the type includes: server-side application and client-side application;

[0038] The creation and association unit, if enabled, allows the SOME / IP protocol stack to create a TCP / IP or UDP / IP connection with the peer application based on the configuration file. After establishing the TCP / IP or UDP / IP connection with the peer application, the SOME / IP protocol stack calls the OpenSSL library interface to associate the created SSL object with the client's network file descriptor.

[0039] The connection unit is used by the SOME / IP protocol stack to call the OpenSSL library interface to establish a TLS or DTLS connection with the peer application. When establishing a TLS or DTLS connection, the OpenSSL library verifies the private information carried in the connection request. After successful verification, the TLS or DTLS connection is successful.

[0040] The data sending unit is configured to, when the application calls the interface of the SOME / IP protocol to send the first data, have the SOME / IP protocol stack call the interface of the OpenSSL library so that the OpenSSL library encrypts the first data and sends the encrypted first data to the peer application via TCP / IP or UDP / IP.

[0041] The data receiving unit is used to parse the second data sent by the peer application when the SOME / IP protocol stack receives the second data through the interface of the OpenSSL library, and then send the parsed second data to the application.

[0042] Furthermore, the creation and association unit is also used for:

[0043] The SOME / IP protocol stack calls the OpenSSL interface to initialize the OpenSSL library;

[0044] The SOME / IP protocol stack calls the OpenSSL interface to load all OpenSSL algorithms;

[0045] The SOME / IP protocol stack calls the OpenSSL interface to create an OpenSSL context object;

[0046] The SOME / IP protocol stack calls the OpenSSL interface to register the name of the cipher suite with the OpenSSL context object;

[0047] The SOME / IP protocol stack calls the encryption module's interface to obtain the root certificate information based on the name of the root certificate, and then the SOME / IP protocol stack calls the OpenSSL interface to pass in the root certificate information;

[0048] The SOME / IP protocol stack calls the encryption module's interface to obtain user certificate information based on the name of the user certificate, and then the SOME / IP protocol stack calls the OpenSSL interface to pass in the user certificate information;

[0049] The SOME / IP protocol stack calls the encryption module's interface to obtain the private key information based on the private key's slot number, and then the SOME / IP protocol stack calls the OpenSSL interface to pass in the private key information;

[0050] The SOME / IP protocol stack calls the OpenSSL library's interface to set a callback function to check certificate information. After the OpenSSL library checks the certificate information, it calls the callback function, and then the SOME / IP protocol stack determines whether the certificate information is correct based on the information returned by the callback function.

[0051] If correct, the SOME / IP protocol stack creates the SSL object based on the OpenSSL context object;

[0052] The SOME / IP protocol stack creates a corresponding network file descriptor based on the IP address and port in the configuration file;

[0053] If the application is a server-side application, the SOME / IP protocol stack waits for the client application's TCP / IP or UDP / IP connection, and obtains the client's network file descriptor when the client application connects to the server.

[0054] If the application is a client application, then the SOME / IP protocol stack establishes a TCP / IP or UDP / IP connection with the server.

[0055] Furthermore, the connection unit is also used for:

[0056] If the application is a server-side application, the SOME / IP protocol stack calls the OpenSSL library interface to wait for receiving SSL connection requests from client applications. When a client application connects to a server-side application, a TLS / DLTS handshake is performed. Data can only be sent and received after the handshake is successful; otherwise, an error log is printed and the client application's connection is removed.

[0057] If the application is a client application, the SOME / IP protocol stack calls the OpenSSL library interface to connect to the server application. When the client application connects to the server application, a TLS / DLTS handshake is performed. Data can only be sent and received after the handshake is successful; otherwise, an error log is printed and the client application's connection is removed.

[0058] Thirdly, embodiments of the present invention also provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the method described in any of the first aspects above.

[0059] Fourthly, embodiments of the present invention also provide a computer-readable storage medium storing machine-executable instructions, which, when invoked and executed by a processor, cause the processor to perform the method described in any of the first aspects above.

[0060] In this embodiment of the invention, a method for secure data transmission based on the SOME / IP protocol using TLS / DTLS is provided, comprising: when an application based on the SOME / IP protocol starts, the SOME / IP protocol stack reads the application's configuration file and saves the private information in the configuration file, wherein the private information includes: the name of the cipher suite, the name of the root certificate, the slot number of the private key, and the name of the user certificate; the SOME / IP protocol stack determines the type of the application and whether the application has enabled TLS / DTLS encryption, wherein the type includes: a server application and a client application; if enabled, the SOME / IP protocol stack creates a TCP / IP or UDP / IP connection with the peer application based on the configuration file, and after establishing the TCP / IP or UDP / IP connection with the peer application, the SOME / IP protocol stack calls the interface of the OpenSSL library. The SOME / IP protocol stack associates the created SSL object with the client's network file descriptor; it then calls the OpenSSL library's interface to establish a TLS or DTLS connection with the peer application. During the establishment of the TLS or DTLS connection, the OpenSSL library verifies the private information carried in the connection request. Upon successful verification, the TLS or DTLS connection is established. When the application calls the SOME / IP protocol interface to send the first data, the SOME / IP protocol stack calls the OpenSSL library's interface to encrypt the first data before sending it to the peer application via TCP / IP or UDP / IP. When the SOME / IP protocol stack receives the second data sent by the peer application through the OpenSSL library's interface, it parses the second data and sends the parsed second data back to the application. As described above, the method for secure data transmission of the SOME / IP protocol based on TLS / DTLS of the present invention can encrypt the data transmitted by the SOME / IP protocol through TCP / IP or UDP / IP network protocols when the SOME / IP protocol transmits data. This improves the security of vehicle applications when exchanging data between multiple ECUs via the SOME / IP protocol, and alleviates the technical problem that traditional technologies cannot encrypt data transmitted by the SOME / IP protocol through TCP / IP or UDP / IP network protocols. Attached Figure Description

[0061] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0062] Figure 1A flowchart illustrating a method for secure data transmission based on the SOME / IP protocol using TLS / DTLS, provided as an embodiment of the present invention;

[0063] Figure 2 A timing diagram for establishing a communication link and data communication provided for embodiments of the present invention;

[0064] Figure 3 A schematic diagram of a device for secure data transmission based on the SOME / IP protocol using TLS / DTLS, provided as an embodiment of the present invention;

[0065] Figure 4 This is a schematic diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0066] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0067] Traditional technologies cannot encrypt data transmitted via TCP / IP or UDP / IP network protocols using the SOME / IP protocol.

[0068] Based on this, in the method for secure data transmission of the SOME / IP protocol based on TLS / DTLS of the present invention, when the SOME / IP protocol transmits data through the TCP / IP or UDP / IP network protocol, the data of the TCP / IP or UDP / IP network protocol can be encrypted to improve the security of vehicle applications when exchanging data between multiple ECUs through the SOME / IP protocol.

[0069] To facilitate understanding of this embodiment, a method for secure data transmission based on the SOME / IP protocol using TLS / DTLS, as disclosed in this embodiment of the invention, will first be described in detail.

[0070] Example 1:

[0071] According to an embodiment of the present invention, an embodiment of a method for secure data transmission based on the SOME / IP protocol using TLS / DTLS is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0072] Figure 1This is a flowchart illustrating a method for secure data transmission based on the SOME / IP protocol using TLS / DTLS according to an embodiment of the present invention. Figure 1 As shown, the method includes the following steps:

[0073] In step S102, when the application based on the SOME / IP protocol starts, the SOME / IP protocol stack reads the application's configuration file and saves the private information in the configuration file. The private information includes: the name of the encryption suite, the name of the root certificate, the slot number of the private key, and the name of the user certificate.

[0074] In this embodiment of the invention, data from the TCP / IP network protocol is encrypted using the TLS (Transport Layer Security) protocol. Data from the UDP / IP network protocol is encrypted using the DTLS (Datagram Transport Layer Security) protocol. Since the TLS / DTLS protocol requires a key during communication, the encrypted data cannot be decrypted without the key.

[0075] In implementation, developers first assign the slot numbers required by the TLS / DTLS protocol (i.e., the slot numbers for the private key), the name of the root certificate, and the name of the user certificate (i.e., private information) to the in-vehicle applications. The principle is as follows: since data encrypted via the TLS / DTLS protocol can be deciphered with just the key, storing the key content, root certificate information, and user certificate information in the encryption module's database ensures that private information is not stolen. Different keys are stored in different slot numbers in the encryption module's database, allowing the key to be retrieved from the database using the slot number. For example, slot 100 stores key 1, slot 200 stores key 2, and so on.

[0076] The private information allocated to the application is written into the application's configuration file based on the SOME / IP protocol. The configuration file is a JSON file with the following format: neusomeip.json.

[0077] {

[0078] "applications":[

[0079] {

[0080] "name":"myServer",

[0081] "id":"0x8ea2"

[0082] }

[0083] ],

[0084] "routing":"vsomeipd",

[0085] "services":[

[0086] {

[0087] "service":"0x58",

[0088]

[0089]

[0090]

[0091] As can be seen from the above configuration files:

[0092] The application myServer contains two service instances (the first service instance has service equal to 0x58 and instance equal to 99; the second service instance has service equal to 0x58 and instance equal to 100);

[0093] Each service instance contains a TCP / IP-based node reliable-security-channel. The contents of this reliable-security-channel are used for TLS encryption protection of data over TCP / IP communication links. The value corresponding to "ciphersuite" is the name of the cipher suite (ECDHE-RSA-AES256-GCM-SHA384), the value corresponding to "root-certificate" is the name of the root certificate (GACServerRoot.crt), the value corresponding to "user-certificate" is the name of the user certificate (GACServerUser.crt), and the value corresponding to "private-certificate" is the slot number (196) of the private key.

[0094] Each service instance contains a node called `unreliable-security-channel` for UDP / IP communication. The content of this `unreliable-security-channel` is used for DTLS to encrypt and protect data over UDP / IP communication links. The meanings of "ciphersuite", "root-certificate", "user-certificate", and "private-certificate" are the same as above.

[0095] Each service can use the same "ciphersuite", "root-certificate", "user-certificate", and "private-certificate", or it can be assigned different values.

[0096] When an application based on the SOME / IP protocol starts, the SOME / IP protocol stack reads the application's configuration file and saves the "ciphersuite", "root-certificate", "user-certificate", and "private-certificate" entries from the reliable-security-channel and unreliable-security-channel. This SOME / IP-based application can be either a server-side application or a client-side application.

[0097] In step S104, the SOME / IP protocol stack determines the type of the application and whether the application has enabled TLS / DTLS encryption. The types include: server-side applications and client-side applications.

[0098] Specifically, the application type can be determined by the identifier carried by the application. The application type is essentially configured in advance by the developers. That is, the developers will pre-configure the corresponding application type for each application in the vehicle. When determining whether the application has enabled TLS / DTLS encryption, it can be determined by whether the configuration file contains the reliable-security-channel and unreliable-security-channel fields. If the above fields are included, it is determined that TLS / DTLS encryption is enabled; otherwise, it is not enabled.

[0099] Additionally, if TLS / DTLS encryption is not enabled, the SOME / IP protocol stack creates a corresponding TCP / IP or UDP / IP communication link based on the IP address and port in the configuration file (for server-side applications, the corresponding TCP / IP or UDP / IP communication link is the server-side TCP / IP or UDP / IP communication link; for client-side applications, the corresponding TCP / IP or UDP / IP communication link is the client-side TCP / IP or UDP / IP communication link). When the application calls the SOME / IP protocol interface to send the first data, the SOME / IP protocol stack encapsulates the first data and sends the encapsulated first data through the established TCP / IP or UDP / IP communication link.

[0100] Step S106: If enabled, the SOME / IP protocol stack creates a TCP / IP or UDP / IP connection with the peer application based on the configuration file. After establishing the TCP / IP or UDP / IP connection with the peer application, the SOME / IP protocol stack calls the OpenSSL library interface to associate the created SSL object with the client's network file descriptor.

[0101] In step S108, the SOME / IP protocol stack calls the OpenSSL library interface to establish a TLS or DTLS connection with the peer application. When establishing a TLS or DTLS connection, the OpenSSL library verifies the private information carried in the connection request. If the verification is successful, the TLS or DTLS connection is successful.

[0102] Step S110: When the application calls the interface of the SOME / IP protocol to send the first data, the SOME / IP protocol stack calls the interface of the OpenSSL library so that the OpenSSL library encrypts the first data and sends the encrypted first data to the peer application via TCP / IP or UDP / IP.

[0103] Step S112: When the SOME / IP protocol stack receives the second data sent by the peer application through the interface of the OpenSSL library, it parses the second data and sends the parsed second data to the application.

[0104] Specifically, the OpenSSL library's interface decrypts the encrypted second data, obtains the second data, and then sends the second data to the SOME / IP protocol stack, so that the SOME / IP protocol stack receives the second data sent by the peer application.

[0105] In this embodiment of the invention, a method for secure data transmission based on the SOME / IP protocol using TLS / DTLS is provided, comprising: when an application based on the SOME / IP protocol starts, the SOME / IP protocol stack reads the application's configuration file and saves the private information in the configuration file, wherein the private information includes: the name of the cipher suite, the name of the root certificate, the slot number of the private key, and the name of the user certificate; the SOME / IP protocol stack determines the type of the application and whether the application has enabled TLS / DTLS encryption, wherein the type includes: a server application and a client application; if enabled, the SOME / IP protocol stack creates a TCP / IP or UDP / IP connection with the peer application based on the configuration file, and after establishing the TCP / IP or UDP / IP connection with the peer application, the SOME / IP protocol stack calls the interface of the OpenSSL library. The SOME / IP protocol stack associates the created SSL object with the client's network file descriptor; it then calls the OpenSSL library's interface to establish a TLS or DTLS connection with the peer application. During the establishment of the TLS or DTLS connection, the OpenSSL library verifies the private information carried in the connection request. Upon successful verification, the TLS or DTLS connection is established. When the application calls the SOME / IP protocol interface to send the first data, the SOME / IP protocol stack calls the OpenSSL library's interface to encrypt the first data before sending it to the peer application via TCP / IP or UDP / IP. When the SOME / IP protocol stack receives the second data sent by the peer application through the OpenSSL library's interface, it parses the second data and sends the parsed second data back to the application. As described above, the method for secure data transmission of the SOME / IP protocol based on TLS / DTLS of the present invention can encrypt the data transmitted by the SOME / IP protocol through TCP / IP or UDP / IP network protocols when the SOME / IP protocol transmits data. This improves the security of vehicle applications when exchanging data between multiple ECUs via the SOME / IP protocol, and alleviates the technical problem that traditional technologies cannot encrypt data transmitted by the SOME / IP protocol through TCP / IP or UDP / IP network protocols.

[0106] The above provides a brief overview of the method for secure data transmission using the SOME / IP protocol based on TLS / DTLS of the present invention. The specific details involved are described in detail below.

[0107] In an optional embodiment of the present invention, the SOME / IP protocol stack creates a TCP / IP or UDP / IP connection with the peer application based on a configuration file, specifically including the following steps:

[0108] (1) The SOME / IP protocol stack calls the OpenSSL interface to initialize the OpenSSL library;

[0109] (2) The SOME / IP protocol stack calls the OpenSSL interface to load all OpenSSL algorithms;

[0110] (3) The SOME / IP protocol stack calls the OpenSSL interface to create an OpenSSL context object;

[0111] (4) The SOME / IP protocol stack calls the OpenSSL interface to register the name of the cipher suite with the OpenSSL context object;

[0112] (5) The SOME / IP protocol stack calls the encryption module's interface to obtain the root certificate information based on the name of the root certificate, and then the SOME / IP protocol stack calls the OpenSSL interface to pass in the root certificate information;

[0113] (6) The SOME / IP protocol stack calls the encryption module's interface to obtain the user certificate information based on the name of the user certificate, and then the SOME / IP protocol stack calls the OpenSSL interface to pass in the user certificate information;

[0114] (7) The SOME / IP protocol stack calls the encryption module's interface to obtain the private key information based on the private key's slot number, and then the SOME / IP protocol stack calls the OpenSSL interface to pass in the private key information;

[0115] (8) The SOME / IP protocol stack calls the OpenSSL library's interface to set a callback function to check certificate information. After the OpenSSL library checks the certificate information, it calls the callback function, and then the SOME / IP protocol stack determines whether the certificate information is correct based on the information returned by the callback function.

[0116] (9) If correct, the SOME / IP protocol stack creates an SSL object based on the OpenSSL context object;

[0117] (10) The SOME / IP protocol stack creates the corresponding network file descriptor based on the IP address and port in the configuration file;

[0118] (11) If the application is a server-side application, the SOME / IP protocol stack waits for the client application's TCP / IP or UDP / IP connection, and obtains the client's network file descriptor when the client application connects to the server.

[0119] (12) If the application is a client application, the SOME / IP protocol stack establishes a TCP / IP or UDP / IP connection with the server.

[0120] (13) If incorrect, the SOME / IP protocol stack will print an error message and will no longer communicate.

[0121] In an optional embodiment of the present invention, the SOME / IP protocol stack calls the OpenSSL library interface to establish a TLS or DTLS connection with the peer application, specifically including the following steps:

[0122] (1) If the application is a server application, the SOME / IP protocol stack calls the OpenSSL library interface to wait for the client application's SSL connection request. When the client application connects to the server application, a TLS / DLTS handshake is performed. Data can only be sent and received after the handshake is successful. Otherwise, an error log is printed and the client application's connection is removed.

[0123] (2) If the application is a client application, the SOME / IP protocol stack calls the OpenSSL library interface to connect to the server application. When the client application connects to the server application, a TLS / DLTS handshake is performed. Data can only be sent and received after the handshake is successful. Otherwise, an error log is printed and the connection of the client application is removed.

[0124] The processes of establishing a communication link and data communication are described below:

[0125] If the application is a server-side application and TLS / DTLS encryption is enabled, the SOME / IP protocol stack will create a TCP / IP or UDP / IP-based TLS or DTLS communication link on the server side based on the server's IP address, port, and reliable or unreliable security channel information in the configuration file, and then conduct data communication. Figure 2 As shown, the details are as follows:

[0126] (1) The SOME / IP protocol stack calls the OpenSSL interface to initialize the OpenSSL library;

[0127] (2) The SOME / IP protocol stack calls the OpenSSL interface to load all OpenSSL algorithms;

[0128] (3) The SOME / IP protocol stack calls the OpenSSL interface to create an OpenSSL context object ctx;

[0129] (4) The SOME / IP protocol stack will call the OpenSSL interface to register the value of "ciphersuite" (the name of the cipher suite) to the OpenSSL context object ctx;

[0130] (5) The SOME / IP protocol stack calls the encryption module's interface to obtain the root certificate information based on the value of "root-certificate". The SOME / IP protocol stack calls the OpenSSL interface to pass in the root certificate information.

[0131] (6) The SOME / IP protocol stack calls the encryption module's interface to obtain the user certificate information based on the value of "user-certificate". The SOME / IP protocol stack then calls the OpenSSL interface to pass in the user certificate information.

[0132] (7) The SOME / IP protocol stack calls the encryption module's interface to obtain the private key information based on the value of "private-certificate". The SOME / IP protocol stack will call the OpenSSL interface to pass in the private key information.

[0133] (8) The SOME / IP protocol stack calls the OpenSSL library's interface to set a callback function to check certificate information. After the OpenSSL library checks the certificate information, it will call the callback function. The SOME / IP protocol stack will know whether the certificate information is correct based on the information returned by the callback function. If the certificate information is correct, the following process can continue. Otherwise, the SOME / IP protocol stack will print an error message indicating that the certificate information is incorrect and communication can no longer be carried out.

[0134] (9) The SOME / IP protocol stack creates an SSL object based on the OpenSSL context object ctx;

[0135] (10) The SOME / IP protocol stack will create a TCP / IP or UDP / IP network file descriptor (or socket file descriptor) for the server based on the IP address and port information in the configuration file, and wait for the client to connect. When the client connects to this server, it will return a new socket file descriptor (the client's network file descriptor) and call the OpenSSL library interface to associate the SSL object with the new socket file descriptor.

[0136] (11) The SOME / IP protocol stack calls the connection interface of the OpenSSL library to wait for SSL connection requests from clients. When a client connects to the server, a TLS / DLTS handshake is performed. Data can only be sent and received after the handshake is successful; otherwise, an error log is printed and the client's connection is removed.

[0137] (12) When a server application based on the SOME / IP protocol calls the interface of the SOME / IP protocol to send the first data, the SOME / IP protocol stack will call the interface of the OpenSSL library to send the first data;

[0138] (13) When the SOME / IP protocol stack receives the second data through the OpenSSL interface, the SOME / IP protocol stack will parse it and return it to the application on the server side based on the SOME / IP protocol.

[0139] If the application is a client-side application and TLS / DTLS encryption is enabled, the SOME / IP protocol stack will create a TCP / IP or UDP / IP-based TLS or DTLS communication link for the client based on the client's IP address, port, and reliable or unreliable security channel information in the configuration file, and then conduct data communication. Figure 2 As shown, the details are as follows:

[0140] (1) The SOME / IP protocol stack calls the OpenSSL interface to initialize the OpenSSL library;

[0141] (2) The SOME / IP protocol stack calls the OpenSSL interface to load all OpenSSL algorithms;

[0142] (3) The SOME / IP protocol stack calls the OpenSSL interface to create an OpenSSL context object ctx;

[0143] (4) The SOME / IP protocol stack calls the OpenSSL interface to register the value of "ciphersuite" (the name of the cipher suite) to the OpenSSL context object ctx;

[0144] (5) The SOME / IP protocol stack calls the encryption module's interface to obtain the root certificate information based on the value of "root-certificate". The SOME / IP protocol stack calls the OpenSSL interface to pass in the root certificate information.

[0145] (6) The SOME / IP protocol stack calls the encryption module's interface to obtain the user certificate information based on the value of "user-certificate". The SOME / IP protocol stack then calls the OpenSSL interface to pass in the user certificate information.

[0146] (7) The SOME / IP protocol stack calls the encryption module's interface to obtain the private key information based on the value of "private-certificate". The SOME / IP protocol stack will call the OpenSSL interface to pass in the private key information.

[0147] (8) The SOME / IP protocol stack calls the OpenSSL library's interface to set a callback function to check certificate information. After the OpenSSL library checks the certificate information, it will call the callback function. The SOME / IP protocol stack will know whether the certificate information is correct based on the information returned by the callback function. If the certificate information is correct, the following process can continue. Otherwise, the SOME / IP protocol stack will print an error message indicating that the private key information is incorrect and communication can no longer be carried out.

[0148] (9) The SOME / IP protocol stack creates an SSL object based on the OpenSSL context object ctx;

[0149] (10) The SOME / IP protocol stack will create a TCP / IP or UDP / IP network file descriptor for the client based on the IP address and port information in the configuration file to connect to the server. At the same time, the SOME / IP protocol stack will call the OpenSSL library interface to associate the SSL object with the client's network file descriptor.

[0150] (11) The SOME / IP protocol stack calls the OpenSSL library interface to connect to the server. When the client connects to the server, a TLS / DLTS handshake is performed. Data can only be sent and received after the handshake is successful. Otherwise, the SOME / IP protocol stack prints an error log and closes the client's network file descriptor.

[0151] (12) When a client application based on the SOME / IP protocol calls the interface of the SOME / IP protocol to send the first data, the SOME / IP protocol stack will call the interface of the OpenSSL library to send the first data;

[0152] (13) When the SOME / IP protocol stack receives the second data through the OpenSSL interface, the SOME / IP protocol stack will parse it and return it to the application of the client based on the SOME / IP protocol.

[0153] When TLS / DTLS is enabled, the SOME / IP messages will be encrypted after the above process, ensuring the security of application data based on the SOME / IP protocol.

[0154] Example 2:

[0155] This invention also provides an apparatus for secure data transmission of the SOME / IP protocol based on TLS / DTLS. This apparatus is mainly used to execute the method for secure data transmission of the SOME / IP protocol based on TLS / DTLS provided in Embodiment 1 of this invention. The apparatus for secure data transmission of the SOME / IP protocol based on TLS / DTLS provided in this invention will be described in detail below.

[0156] Figure 3 This is a schematic diagram of an apparatus for secure data transmission using the SOME / IP protocol based on TLS / DTLS according to an embodiment of the present invention, as shown below. Figure 3 As shown, the device mainly includes: a reading and saving unit 10, a judging unit 20, a creation and association unit 30, a connection unit 40, a data sending unit 50, and a data receiving unit 60, wherein:

[0157] The read and save unit is used when an application based on the SOME / IP protocol starts up. The SOME / IP protocol stack reads the application's configuration file and saves the private information in the configuration file. The private information includes: the name of the encryption suite, the name of the root certificate, the slot number of the private key, and the name of the user certificate.

[0158] The judgment unit is used by the SOME / IP protocol stack to determine the type of the application and whether the application has enabled TLS / DTLS encryption. The types include: server-side applications and client-side applications.

[0159] The creation and association unit, if enabled, allows the SOME / IP protocol stack to create a TCP / IP or UDP / IP connection with the peer application based on the configuration file. After establishing the TCP / IP or UDP / IP connection with the peer application, the SOME / IP protocol stack calls the OpenSSL library's interface to associate the created SSL object with the client's network file descriptor.

[0160] The connection unit is used by the SOME / IP protocol stack to call the OpenSSL library interface to establish a TLS or DTLS connection with the peer application. When establishing a TLS or DTLS connection, the OpenSSL library verifies the private information carried in the connection request. If the verification is successful, the TLS or DTLS connection is successful.

[0161] The data sending unit is used to call the interface of the OpenSSL library when the application calls the interface of the SOME / IP protocol to send the first data. This allows the OpenSSL library to encrypt the first data and send the encrypted first data to the peer application via TCP / IP or UDP / IP.

[0162] The data receiving unit is used to parse the second data sent by the peer application when the SOME / IP protocol stack receives the second data through the interface of the OpenSSL library, and then send the parsed second data to the application.

[0163] In this embodiment of the invention, a method for secure data transmission based on the SOME / IP protocol using TLS / DTLS is provided, comprising: when an application based on the SOME / IP protocol starts, the SOME / IP protocol stack reads the application's configuration file and saves the private information in the configuration file, wherein the private information includes: the name of the cipher suite, the name of the root certificate, the slot number of the private key, and the name of the user certificate; the SOME / IP protocol stack determines the type of the application and whether the application has enabled TLS / DTLS encryption, wherein the type includes: a server application and a client application; if enabled, the SOME / IP protocol stack creates a TCP / IP or UDP / IP connection with the peer application based on the configuration file, and after establishing the TCP / IP or UDP / IP connection with the peer application, the SOME / IP protocol stack calls the interface of the OpenSSL library. The SOME / IP protocol stack associates the created SSL object with the client's network file descriptor; it then calls the OpenSSL library's interface to establish a TLS or DTLS connection with the peer application. During the establishment of the TLS or DTLS connection, the OpenSSL library verifies the private information carried in the connection request. Upon successful verification, the TLS or DTLS connection is established. When the application calls the SOME / IP protocol interface to send the first data, the SOME / IP protocol stack calls the OpenSSL library's interface to encrypt the first data before sending it to the peer application via TCP / IP or UDP / IP. When the SOME / IP protocol stack receives the second data sent by the peer application through the OpenSSL library's interface, it parses the second data and sends the parsed second data back to the application. As described above, the method for secure data transmission of the SOME / IP protocol based on TLS / DTLS of the present invention can encrypt the data transmitted by the SOME / IP protocol through TCP / IP or UDP / IP network protocols when the SOME / IP protocol transmits data. This improves the security of vehicle applications when exchanging data between multiple ECUs via the SOME / IP protocol, and alleviates the technical problem that traditional technologies cannot encrypt data transmitted by the SOME / IP protocol through TCP / IP or UDP / IP network protocols.

[0164] Optionally, the creation and association unit is also used for: the SOME / IP protocol stack calling the OpenSSL interface to initialize the OpenSSL library; the SOME / IP protocol stack calling the OpenSSL interface to load all OpenSSL algorithms; the SOME / IP protocol stack calling the OpenSSL interface to create an OpenSSL context object; the SOME / IP protocol stack calling the OpenSSL interface to register the cipher suite name to the OpenSSL context object; the SOME / IP protocol stack calling the encryption module interface to obtain the root certificate information based on the root certificate name, and then the SOME / IP protocol stack calling the OpenSSL interface to pass the root certificate information; the SOME / IP protocol stack calling the encryption module interface to obtain the user certificate information based on the user certificate name, and then the SOME / IP protocol stack calling the OpenSSL interface to pass the user certificate information; and the SOME / IP protocol stack calling the encryption module interface to obtain the user certificate information based on the private key slot number. The SOME / IP protocol stack takes the private key information and calls the OpenSSL interface to pass it in. The SOME / IP protocol stack then calls the OpenSSL library's interface to set a callback function to check the certificate information. After the OpenSSL library checks the certificate information, it calls the callback function, and the SOME / IP protocol stack determines whether the certificate information is correct based on the information returned by the callback function. If correct, the SOME / IP protocol stack creates an SSL object based on the OpenSSL context object. The SOME / IP protocol stack creates the corresponding network file descriptor based on the IP address and port in the configuration file. If the application is a server-side application, the SOME / IP protocol stack waits for a TCP / IP or UDP / IP connection from the client application, and obtains the client's network file descriptor when the client application connects to the server. If the application is a client-side application, the SOME / IP protocol stack establishes a TCP / IP or UDP / IP connection with the server.

[0165] Optionally, the connection unit is further configured to: if the application is a server-side application, the SOME / IP protocol stack calls the OpenSSL library interface to wait for and receive SSL connection requests from client applications. When a client application connects to a server-side application, a TLS / DLTS handshake is performed. Data transmission and reception can only proceed after a successful handshake; otherwise, an error log is printed and the client application's connection is removed. Alternatively, if the application is a client-side application, the SOME / IP protocol stack calls the OpenSSL library interface to connect to a server-side application. When a client application connects to a server-side application, a TLS / DLTS handshake is performed. Data transmission and reception can only proceed after a successful handshake; otherwise, an error log is printed and the client application's connection is removed.

[0166] Optionally, the device is also used to: if not enabled, the SOME / IP protocol stack creates a corresponding TCP / IP or UDP / IP communication link based on the IP address and port in the configuration file; when the application calls the interface of the SOME / IP protocol to send the first data, the SOME / IP protocol stack encapsulates the first data and sends the encapsulated first data through the established TCP / IP or UDP / IP communication link.

[0167] Optionally, the device is also used to: if incorrect, the SOME / IP protocol stack prints an error message and stops communication.

[0168] The device provided in this embodiment of the invention has the same implementation principle and technical effect as the aforementioned method embodiment. For the sake of brevity, any parts not mentioned in the device embodiment can be referred to the corresponding content in the aforementioned method embodiment.

[0169] like Figure 4 As shown in the embodiment of this application, an electronic device 600 includes a processor 601, a memory 602, and a bus. The memory 602 stores machine-readable instructions executable by the processor 601. When the electronic device is running, the processor 601 communicates with the memory 602 via the bus. The processor 601 executes the machine-readable instructions to perform the steps of the method for secure data transmission based on the SOME / IP protocol using TLS / DTLS as described above.

[0170] Specifically, the memory 602 and processor 601 mentioned above can be general-purpose memory and processor, without any specific limitations. When the processor 601 runs the computer program stored in the memory 602, it can execute the above-mentioned method for secure data transmission based on the SOME / IP protocol of TLS / DTLS.

[0171] The processor 601 may be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed by the integrated logic circuitry in the hardware of the processor 601 or by instructions in software form. The processor 601 may be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it may also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly manifested as execution by a hardware decoding processor, or execution by a combination of hardware and software modules in the decoding processor. The software module can reside in a mature storage medium in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory 602, and processor 601 reads the information from memory 602 and, in conjunction with its hardware, completes the steps of the above method.

[0172] Corresponding to the above-described method for secure data transmission using the SOME / IP protocol based on TLS / DTLS, this application also provides a computer-readable storage medium storing machine-executable instructions. When these machine-executable instructions are invoked and executed by a processor, they cause the processor to perform the steps of the above-described method for secure data transmission using the SOME / IP protocol based on TLS / DTLS.

[0173] The device for secure data transmission based on the SOME / IP protocol using TLS / DTLS provided in this application embodiment can be specific hardware on a device or software or firmware installed on the device. The implementation principle and technical effects of the device provided in this application embodiment are the same as those in the foregoing method embodiments. For the sake of brevity, any parts not mentioned in the device embodiment can be referred to the corresponding content in the foregoing method embodiments. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can all be referred to the corresponding processes in the above method embodiments, and will not be repeated here.

[0174] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some communication interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0175] For example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0176] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0177] In addition, the functional units in the embodiments provided in this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0178] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause an electronic device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method for secure data transmission based on the SOME / IP protocol using TLS / DTLS described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0179] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. In addition, the terms "first", "second", "third", etc. are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0180] Finally, it should be noted that the above-described embodiments are merely specific implementations of this application, used to illustrate the technical solutions of this application, and not to limit them. The protection scope of this application is not limited thereto. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some of the technical features, within the scope of the technology disclosed in this application; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application. All should be covered within the protection scope of this application. Therefore, the protection scope of this application should be determined by the protection scope of the claims.

Claims

1. A method for secure data transmission based on the SOME / IP protocol using TLS / DTLS, characterized in that, include: When an application based on the SOME / IP protocol starts, the SOME / IP protocol stack reads the application's configuration file and saves the private information in the configuration file. The private information includes: the name of the encryption suite, the name of the root certificate, the slot number of the private key, and the name of the user certificate. The SOME / IP protocol stack determines the type of the application and whether the application has enabled TLS / DTLS encryption. The types include: server-side applications and client-side applications. If enabled, the SOME / IP protocol stack creates a TCP / IP or UDP / IP connection with the peer application based on the configuration file. After establishing the TCP / IP or UDP / IP connection with the peer application, the SOME / IP protocol stack calls the OpenSSL library interface to associate the created SSL object with the client's network file descriptor. The SOME / IP protocol stack calls the OpenSSL library interface to establish a TLS or DTLS connection with the peer application. When establishing a TLS or DTLS connection, the OpenSSL library verifies the private information carried in the connection request. If the verification is successful, the TLS or DTLS connection is successful. When the application calls the interface of the SOME / IP protocol to send the first data, the SOME / IP protocol stack calls the interface of the OpenSSL library so that the OpenSSL library encrypts the first data and sends the encrypted first data to the peer application via TCP / IP or UDP / IP. When the SOME / IP protocol stack receives the second data sent by the peer application through the OpenSSL library interface, it parses the second data and sends the parsed second data to the application.

2. The method according to claim 1, characterized in that, The SOME / IP protocol stack creates a TCP / IP or UDP / IP connection with the peer application based on the configuration file, including: The SOME / IP protocol stack calls the OpenSSL interface to initialize the OpenSSL library; The SOME / IP protocol stack calls the OpenSSL interface to load all OpenSSL algorithms; The SOME / IP protocol stack calls the OpenSSL interface to create an OpenSSL context object; The SOME / IP protocol stack calls the OpenSSL interface to register the name of the cipher suite with the OpenSSL context object; The SOME / IP protocol stack calls the encryption module's interface to obtain the root certificate information based on the name of the root certificate, and then the SOME / IP protocol stack calls the OpenSSL interface to pass in the root certificate information; The SOME / IP protocol stack calls the encryption module's interface to obtain user certificate information based on the name of the user certificate, and then the SOME / IP protocol stack calls the OpenSSL interface to pass in the user certificate information; The SOME / IP protocol stack calls the encryption module's interface to obtain the private key information based on the private key's slot number, and then the SOME / IP protocol stack calls the OpenSSL interface to pass in the private key information; The SOME / IP protocol stack calls the OpenSSL library's interface to set a callback function to check certificate information. After the OpenSSL library checks the certificate information, it calls the callback function, and then the SOME / IP protocol stack determines whether the certificate information is correct based on the information returned by the callback function. If correct, the SOME / IP protocol stack creates the SSL object based on the OpenSSL context object; The SOME / IP protocol stack creates a corresponding network file descriptor based on the IP address and port in the configuration file; If the application is a server-side application, the SOME / IP protocol stack waits for the client application's TCP / IP or UDP / IP connection, and obtains the client's network file descriptor when the client application connects to the server. If the application is a client application, then the SOME / IP protocol stack establishes a TCP / IP or UDP / IP connection with the server.

3. The method according to claim 1, characterized in that, The SOME / IP protocol stack calls the OpenSSL library interface to establish a TLS or DTLS connection with the peer application, including: If the application is a server-side application, the SOME / IP protocol stack calls the OpenSSL library interface to wait for receiving SSL connection requests from client applications. When a client application connects to a server-side application, a TLS / DLTS handshake is performed. Data can only be sent and received after the handshake is successful; otherwise, an error log is printed and the client application's connection is removed. If the application is a client application, the SOME / IP protocol stack calls the OpenSSL library interface to connect to the server application. When the client application connects to the server application, a TLS / DLTS handshake is performed. Data can only be sent and received after the handshake is successful; otherwise, an error log is printed and the client application's connection is removed.

4. The method according to claim 1, characterized in that, The method further includes: If not enabled, the SOME / IP protocol stack creates a corresponding TCP / IP or UDP / IP communication link based on the IP address and port in the configuration file; When the application calls the interface of the SOME / IP protocol to send the first data, the SOME / IP protocol stack encapsulates the first data and sends the encapsulated first data through the established TCP / IP or UDP / IP communication link.

5. The method according to claim 2, characterized in that, The method further includes: If incorrect, the SOME / IP protocol stack will print an error message and cease communication.

6. A device for secure data transmission based on the SOME / IP protocol using TLS / DTLS, characterized in that, include: The read and save unit is used when the application based on the SOME / IP protocol starts up. The SOME / IP protocol stack reads the configuration file of the application and saves the private information in the configuration file. The private information includes: the name of the encryption suite, the name of the root certificate, the slot number of the private key, and the name of the user certificate. The judgment unit is used by the SOME / IP protocol stack to determine the type of the application and whether the application has enabled TLS / DTLS encryption, wherein the type includes: server-side application and client-side application; The creation and association unit, if enabled, allows the SOME / IP protocol stack to create a TCP / IP or UDP / IP connection with the peer application based on the configuration file. After establishing the TCP / IP or UDP / IP connection with the peer application, the SOME / IP protocol stack calls the OpenSSL library interface to associate the created SSL object with the client's network file descriptor. The connection unit is used by the SOME / IP protocol stack to call the OpenSSL library interface to establish a TLS or DTLS connection with the peer application. When establishing a TLS or DTLS connection, the OpenSSL library verifies the private information carried in the connection request. After successful verification, the TLS or DTLS connection is successful. The data sending unit is configured to, when the application calls the interface of the SOME / IP protocol to send the first data, have the SOME / IP protocol stack call the interface of the OpenSSL library so that the OpenSSL library encrypts the first data and sends the encrypted first data to the peer application via TCP / IP or UDP / IP. The data receiving unit is used to parse the second data sent by the peer application when the SOME / IP protocol stack receives the second data through the interface of the OpenSSL library, and then send the parsed second data to the application.

7. The apparatus according to claim 6, characterized in that, The creation and association unit is also used for: The SOME / IP protocol stack calls the OpenSSL interface to initialize the OpenSSL library; The SOME / IP protocol stack calls the OpenSSL interface to load all OpenSSL algorithms; The SOME / IP protocol stack calls the OpenSSL interface to create an OpenSSL context object; The SOME / IP protocol stack calls the OpenSSL interface to register the name of the cipher suite with the OpenSSL context object; The SOME / IP protocol stack calls the encryption module's interface to obtain the root certificate information based on the name of the root certificate, and then the SOME / IP protocol stack calls the OpenSSL interface to pass in the root certificate information; The SOME / IP protocol stack calls the encryption module's interface to obtain user certificate information based on the name of the user certificate, and then the SOME / IP protocol stack calls the OpenSSL interface to pass in the user certificate information; The SOME / IP protocol stack calls the encryption module's interface to obtain the private key information based on the private key's slot number, and then the SOME / IP protocol stack calls the OpenSSL interface to pass in the private key information; The SOME / IP protocol stack calls the OpenSSL library's interface to set a callback function to check certificate information. After the OpenSSL library checks the certificate information, it calls the callback function, and then the SOME / IP protocol stack determines whether the certificate information is correct based on the information returned by the callback function. If correct, the SOME / IP protocol stack creates the SSL object based on the OpenSSL context object; The SOME / IP protocol stack creates a corresponding network file descriptor based on the IP address and port in the configuration file; If the application is a server-side application, the SOME / IP protocol stack waits for the client application's TCP / IP or UDP / IP connection, and obtains the client's network file descriptor when the client application connects to the server. If the application is a client application, then the SOME / IP protocol stack establishes a TCP / IP or UDP / IP connection with the server.

8. The apparatus according to claim 6, characterized in that, The connection unit is also used for: If the application is a server-side application, the SOME / IP protocol stack calls the OpenSSL library interface to wait for receiving SSL connection requests from client applications. When a client application connects to a server-side application, a TLS / DLTS handshake is performed. Data can only be sent and received after the handshake is successful; otherwise, an error log is printed and the client application's connection is removed. If the application is a client application, the SOME / IP protocol stack calls the OpenSSL library interface to connect to the server application. When the client application connects to the server application, a TLS / DLTS handshake is performed. Data can only be sent and received after the handshake is successful; otherwise, an error log is printed and the client application's connection is removed.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 5.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores machine-executable instructions that, when invoked and executed by a processor, cause the processor to perform the method according to any one of claims 1 to 5.

Images