Airborne system virtual partition safety communication device and method

Abstract

The invention discloses an airborne system virtual partition safety communication device and method, and defines an airborne virtual partition safety communication device. Comprising a virtual partition security communication initialization module, a virtual partition security token authentication module, a virtual partition security communication strategy check module, a virtual partition security communication transmission module and a virtual partition security communication interface service module. According to the method, security authentication and strong access control of airborne virtual partition communication are realized by using an airborne virtual partition security token creation and mapping process and an airborne virtual partition data security communication control process, and a solution is provided for communication security between airborne virtual partitions.

Description

Technical Field

[0001] The present invention belongs to the technical field of airborne system virtual partitions, and in particular relates to an airborne system virtual partition security communication device and method. Background Art

[0002] With the development of information technology and the promotion of digital aviation technology, airborne subsystems such as airborne information systems, airborne maintenance systems, and cabin systems in civil aircraft are developing towards integration. The airborne computing platform with integrated design can integrate multiple airborne subsystems into one computing platform. In order to improve performance and efficiency, multi-core technology and virtualization technology are increasingly widely used in airborne systems. Airborne computing platforms now use virtual partitioning technology to store different applications in different virtual partitions, and realize data interaction between applications through communication between virtual partitions. However, due to the different security levels of applications, there are security risks in the communication between high-security virtual partitions and low-security virtual partitions. How to ensure the security of communication so that the communication of low-security virtual partitions does not reduce the security level of high-security virtual partitions is an important issue facing communication between airborne virtual partitions. Summary of the invention

[0003] In view of this, the airborne system virtual partition secure communication device of the present invention solves the problem that there is no secure communication between airborne virtual partitions.

[0004] An onboard system virtual partition security communication device is applicable to an onboard virtual partition computer. The onboard virtual partition computer is equipped with a communication management unit and a virtual partition, including:

[0005] Virtual partition security communication initialization module 101: runs in the communication management unit, and is used for the onboard virtual partition computer to create an onboard virtual partition security token, an inter-virtual partition access control policy rule set and a virtual partition data communication control token in the initialization phase, and to establish a virtual partition and security token mapping table;

[0006] The virtual partition security token authentication and identification module 102 is run in the communication management unit, and is used for the onboard virtual partition computer to authenticate the virtual partition identifier of the data packet during the working phase, and to verify and identify the onboard virtual partition security token, and to generate an authentication result. The data packet is the data sent by the virtual partition security communication interface service module 105 in the source virtual partition during the working phase of the onboard virtual partition computer;

[0007] Virtual partition security communication policy checking module 103: runs in the communication management unit, and is used to check the virtual partition communication access control policy of the data packet and generate a check result;

[0008] The virtual partition security communication transmission module 104 is executed in the communication management unit, receives the data packet, calls the virtual partition security token authentication and identification module 102 and the virtual partition security communication policy checking module 103 to check, and sends the data packet that passes the check to the virtual partition security communication interface service module 105 in the destination virtual partition of the onboard virtual partition computer;

[0009] Virtual partition security communication interface service module 105: runs in the virtual partition, provides a calling interface to the application in the virtual partition of the onboard virtual partition computer, is responsible for receiving and sending data packets with the virtual partition security communication transmission module 104, receives data packets that have passed the inspection of the virtual partition security communication transmission module 104, and sends the data packets.

[0010] The technical beneficial effects of the present invention are:

[0011] The virtual partition safety communication interface service module and the virtual partition safety communication transmission module in the airborne system virtual partition safety communication device can solve the problem of safety communication interface between virtual partition and communication management unit.

[0012] The virtual partition security token authentication and identification module and the virtual partition security communication strategy checking module in the composition of the airborne system virtual partition security communication device in the method of the present invention can solve the problem of lack of communication security control of communication data packets between virtual partitions. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0014] Figure 1 It is the system composition of the present invention. DETAILED DESCRIPTION

[0015] The embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

[0016] The following describes the embodiments of the present disclosure through specific examples, and those skilled in the art can easily understand other advantages and effects of the present disclosure from the contents disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of the present disclosure, rather than all of the embodiments. The present disclosure can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present disclosure. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present disclosure.

[0017] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein can be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on the present disclosure, it should be understood by those skilled in the art that an aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects described herein can be used to implement the device and / or practice the method. In addition, other structures and / or functionalities other than one or more of the aspects described herein can be used to implement this device and / or practice this method.

[0018] like Figure 1 The airborne system virtual partition security communication device shown is suitable for an airborne virtual partition computer. The airborne virtual partition computer is equipped with a communication management unit and a virtual partition, which includes:

[0019] Virtual partition security communication initialization module 101: runs in the communication management unit, and is used for the onboard virtual partition computer to create an onboard virtual partition security token, an inter-virtual partition access control policy rule set and a virtual partition data communication control token in the initialization phase, and to establish a virtual partition and security token mapping table;

[0020] Virtual partition security token authentication and identification module 102: runs in the communication management unit, and is used for the onboard virtual partition computer to authenticate the virtual partition identifier of the data packet during the working phase, and to verify and identify the onboard virtual partition security token, and generate an identification result. The data packet is the data sent by the onboard virtual partition computer in the working phase by the virtual partition security communication interface service module 105 in the source virtual partition (the sending end of the communication is generally used as the source end);

[0021] Virtual partition security communication policy checking module 103: runs in the communication management unit, and is used to check the virtual partition communication access control policy of the data packet and generate the check result;

[0022] The virtual partition security communication transmission module 104 is executed in the communication management unit, receives data packets, calls the virtual partition security token authentication and identification module 102 and the virtual partition security communication policy inspection module 103 to perform inspections, and sends the data packets that pass the inspections to the virtual partition security communication interface service module 105 in the destination virtual partition of the onboard virtual partition computer;

[0023] Virtual partition security communication interface service module 105: runs in the virtual partition, provides a calling interface to the application in the virtual partition of the onboard virtual partition computer, and is responsible for receiving and sending data packets with the virtual partition security communication transmission module 104. It receives data packets that have passed the inspection of the virtual partition security communication transmission module 104 and sends data packets.

[0024] Technical effect: The device can ensure the communication security between virtual partitions in an onboard virtual partition computer, so that the communication of virtual partitions with low security levels will not reduce the security level of virtual partitions with high security levels.

[0025] Secondly, a method for secure communication of virtual partitions of an airborne system is provided, which is applicable to an airborne virtual partition computer, wherein the airborne virtual partition computer is equipped with a communication management unit and a virtual partition, and the method comprises:

[0026] S1: During the initialization phase of the airborne system virtual partition security communication device, the airborne virtual partition security token creation and mapping process is executed. Specifically,

[0027] Step 1.1: The virtual partition security communication initialization module 101 generates a virtual partition security token;

[0028] Step 1.2: The virtual partition security communication initialization module 101 generates an access control policy rule set between virtual partitions;

[0029] Step 1.3: The virtual partition security communication initialization module 101 generates a virtual partition data communication control token;

[0030] Step 1.4: The virtual partition security communication initialization module 101 uses the virtual partition identifier of the onboard virtual partition computer, the virtual partition security token, and the virtual partition data communication control token to establish a virtual partition and security token mapping table. Step S1 ends the process.

[0031] S2: During the working phase of the airborne system virtual partition security communication device, the airborne virtual partition data security communication control process is executed. Specifically,

[0032] Step 2.1: The application in the source virtual partition of the onboard virtual partition computer uses the virtual partition secure communication interface service module 105 to send the onboard original data to be sent, where the onboard original data to be sent is the communication data of the application in the source virtual partition;

[0033] Step 2.2: the virtual partition security communication interface service module 105 packages the onboard virtual partition identifier, the onboard virtual partition security token and the original data to be sent together to form a data packet and sends it to the virtual partition security communication transmission module 104;

[0034] Step 2.3: The virtual partition security communication transmission module 104 receives the data packet, calls the virtual partition security token authentication and identification module 102 to verify the virtual partition security token in the data packet, and generates an authentication result;

[0035] Step 2.4: The authentication result is judged by the virtual partition security token authentication and authentication module 102 to determine whether the authentication result of the onboard virtual partition security token is the same as the comparison result generated in step 1.1. If yes, proceed to step 2.5; if not, the process ends;

[0036] Step 2.5: The virtual partition security communication transmission module 104 calls the virtual partition security communication policy inspection module 103 to perform a virtual partition communication access control policy inspection on the data packet and generate an inspection result. If the inspection result is passed, the process proceeds to step 2.6. If the inspection result is not passed, the process ends.

[0037] Step 2.6: The virtual partition secure communication transmission module 104 sends the data packet that has passed the check in step 2.5 to the virtual partition secure communication interface service module 105 of the destination virtual partition (destination reception), and the virtual partition secure communication interface service module 105 of the destination virtual partition sends the data in the data packet to the application (application at the receiving end), thus ending the process.

[0038] Operation process

[0039] The present invention defines a method for secure data communication between airborne virtual partitions.

[0040] Step 1: During the device initialization phase, the onboard virtual partition security token creation and mapping process is executed.

[0041] Step 1.1: The virtual partition security communication initialization module 101 generates a virtual partition security token.

[0042] Step 1.2: The virtual partition security communication initialization module 101 generates an inter-virtual partition access control policy rule set.

[0043] Step 1.3: The virtual partition security communication initialization module 101 generates a virtual partition data communication control token.

[0044] Step 1.4: The virtual partition security communication initialization module 101 uses the virtual partition identifier, the virtual partition security token, and the virtual partition data communication control token to establish a virtual partition and security token mapping table, and ends the process.

[0045] Step 2: During the device working phase, execute the data security communication control process between the onboard virtual partitions.

[0046] Step 2.1: The application in the source virtual partition uses the virtual partition secure communication interface service module 105 to send data.

[0047] Step 2.2: The virtual partition secure communication interface service module 105 packages the virtual partition identifier, the virtual partition security token and the data together and sends them to the virtual partition secure communication transmission module 104 .

[0048] Step 2.3: The virtual partition security communication transmission module 104 receives the data packet sent by the virtual partition security communication interface service module 105, and calls the virtual partition security token authentication and identification module 102 to verify the virtual partition security token in the data packet.

[0049] Step 2.4: The virtual partition security token authentication and identification module 102 authenticates the virtual partition identifier, verifies and identifies the virtual partition security token, and if it passes, executes step 2.5, otherwise terminates this process.

[0050] Step 2.5: The virtual partition secure communication transmission module 104 calls the virtual partition secure communication policy checking module 103 to perform a virtual partition communication access control policy check on the data packet. If the check passes, step 2.6 is executed, otherwise the process ends.

[0051] Step 2.6: The virtual partition secure communication transmission module 104 sends the data packet to the virtual partition secure communication interface service module 105 of the destination virtual partition.

[0052] Step 2.7: The virtual partition security communication interface service module 105 of the destination virtual partition sends the data in the data packet to the application, and the process ends.

[0053] The airborne virtual partition security token creation and mapping process and the airborne virtual partition data security communication control process are used to achieve the security authentication and strong access control of airborne virtual partition communication. Through the above method, a solution is provided for the security of airborne virtual partition communication.

[0054] The above are only specific embodiments of the present disclosure, but the protection scope of the present disclosure is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present disclosure should be included in the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure should be based on the protection scope of the claims.

Claims

1. An onboard system virtual partition security communication device, suitable for an onboard virtual partition computer, the onboard virtual partition computer is equipped with a communication management unit and a virtual partition, characterized in that: include, Virtual partition security communication initialization module 101: runs in the communication management unit, and is used for the onboard virtual partition computer to create an onboard virtual partition security token, an inter-virtual partition access control policy rule set and a virtual partition data communication control token in the initialization phase, and to establish a virtual partition and security token mapping table; The virtual partition security token authentication and identification module 102 is run in the communication management unit, and is used for the onboard virtual partition computer to authenticate the virtual partition identifier of the data packet during the working phase, and to verify and identify the onboard virtual partition security token, and to generate an authentication result. The data packet is the data sent by the virtual partition security communication interface service module 105 in the source virtual partition during the working phase of the onboard virtual partition computer; Virtual partition security communication policy checking module 103: runs in the communication management unit, and is used to check the virtual partition communication access control policy of the data packet and generate a check result; The virtual partition security communication transmission module 104 is executed in the communication management unit, receives the data packet, calls the virtual partition security token authentication and identification module 102 and the virtual partition security communication policy checking module 103 to check, and sends the data packet that passes the check to the virtual partition security communication interface service module 105 in the destination virtual partition of the onboard virtual partition computer; Virtual partition security communication interface service module 105: runs in the virtual partition, provides a calling interface to the application in the virtual partition of the onboard virtual partition computer, is responsible for receiving and sending data packets with the virtual partition security communication transmission module 104, receives data packets that have passed the inspection of the virtual partition security communication transmission module 104, and sends the data packets.

2. A method for secure communication of virtual partitions of an airborne system, applicable to an airborne virtual partition computer, wherein the airborne virtual partition computer is equipped with a communication management unit and a virtual partition, characterized in that: The methods include: S1: During the initialization phase of the airborne system virtual partition security communication device, executing an airborne virtual partition security token creation and mapping process; S2: During the working phase of the airborne system virtual partition security communication device, execute the airborne virtual partition data security communication control process.

3. The airborne system virtual partition secure communication method according to claim 2, characterized in that: S1 includes: Step 1.1: The virtual partition security communication initialization module 101 generates the virtual partition security token; Step 1.2: the virtual partition security communication initialization module 101 generates an access control policy rule set between virtual partitions; Step 1.3: The virtual partition security communication initialization module 101 generates the virtual partition data communication control token; Step 1.4: The virtual partition security communication initialization module 101 uses the virtual partition identifier of the onboard virtual partition computer and the virtual partition security token and virtual partition data communication control token to establish a virtual partition and security token mapping table, and step S1 ends the process.

4. The airborne system virtual partition secure communication method according to claim 3, characterized in that: S2 includes Step 2.1: The application in the source virtual partition of the onboard virtual partition computer uses the virtual partition secure communication interface service module 105 to send the onboard original data to be sent, where the onboard original data to be sent is the communication data of the application in the source virtual partition; Step 2.2: the virtual partition security communication interface service module 105 packages the onboard virtual partition identifier, the onboard virtual partition security token and the original data to be sent together to form the data packet and sends it to the virtual partition security communication transmission module 104; Step 2.3: The virtual partition security communication transmission module 104 receives the data packet, calls the virtual partition security token authentication and identification module 102 to verify the virtual partition security token in the data packet, and generates an authentication result; Step 2.4: The authentication result is judged by the virtual partition security token authentication and authentication module 102 to determine whether the authentication result of the onboard virtual partition security token is the same as the comparison result generated in step 1.

1. If so, proceed to step 2.5; if not, the process ends.

5. The airborne system virtual partition secure communication method according to claim 4, characterized in that: S2 also includes, Step 2.5: The virtual partition secure communication transmission module 104 calls the virtual partition secure communication policy checking module 103 to perform a virtual partition communication access control policy check on the data packet and generate a check result. If the check result is passed, the process proceeds to step 2.

6. If the check result is not passed, the process ends. Step 2.6: The virtual partition secure communication transmission module 104 sends the data packet that has passed the check in step 2.5 to the virtual partition secure communication interface service module 105 of the destination virtual partition, and the virtual partition secure communication interface service module 105 of the destination virtual partition sends the data in the data packet to the application, ending the process.

Images