A DDS secure communication middleware implementation method and device

Abstract

The application discloses a DDS security communication middleware implementation method and device, the method comprises the following steps: adding a security detection component and an authentication service component in an original DDS middleware model; using the security detection component to perform bidirectional security access authentication between a publisher and a subscriber; the bidirectional security access authentication comprises permission access control and transmission data encryption; using the authentication service component to perform identity authentication on a remote participant. The security detection component and the authentication service component are comprehensively used to realize authenticity, availability and confidentiality of a publishing and subscribing process. In combination with a discovery mechanism and a QoS negotiation mechanism of the DDS, security protection levels and encryption algorithms can be self-defined, so that the flexibility and high efficiency requirements of an upper application can be met.

Description

Technical Field

[0001] The present invention relates to the field of secure communication technology, and in particular to a method and device for implementing DDS secure communication middleware. Background Art

[0002] The Data Distribution Service (DDS) is a communication middleware specification developed by the OMG organization. It uses the data-centric publish-subscribe (DCPS) model as its basic communication mechanism and controls service behavior through Quality of Service (QoS). It provides a loosely coupled, high-performance, highly reliable, and scalable solution for data transmission in distributed real-time systems.

[0003] To address security threats such as unauthorized subscriptions, unauthorized publications, and insecure channel transmission faced by DDS, the current main approaches are to expand DDS built-in topics, DH-based key exchange, security domain division methods, QoS policy configuration methods, and dynamic access control methods for participants. These related methods still have some problems: 1) They only involve a single element of the DDS security service and lack an overall data distribution security service solution that integrates multiple elements such as identity authentication, permission control, and data encryption and decryption, making it difficult to meet the security needs of actual engineering applications. 2) User configuration of security services is not flexible enough, and the usage habits of DDS application developers need to be changed. 3) The security elements are not closely integrated with the original implementation mechanism of DDS, and a security handshake protocol needs to be added after the DDS discovery process to achieve identity authentication and security negotiation, which increases the complexity of system implementation and reduces the performance of DDS. Summary of the Invention

[0004] The technical problem to be solved by this invention is to provide a method and apparatus for implementing DDS secure communication middleware. Building on existing DDS communication middleware and based on the DDS security specification, this paper proposes a DDS secure communication middleware model that includes identity authentication, permission control, and data encryption and decryption functions. This model, relying on a plug-in design, enables flexible configuration of security services. By integrating the secure handshake protocol with the DDS discovery process, the DDS secure communication middleware's identity authentication, permission control, and key negotiation mechanisms are designed and implemented.

[0005] In order to solve the above technical problems, the first aspect of the embodiment of the present invention discloses a method for implementing DDS secure communication middleware, the method comprising:

[0006] S1, adding security detection components and authentication service components to the original DDS middleware model;

[0007] S2, using the security detection component, performing bidirectional secure access authentication between the publisher and the subscriber; the bidirectional secure access authentication comprises permission access control and transmission data encryption;

[0008] S3, using the authentication service component, performing identity verification on the remote participant.

[0009] As an optional implementation, in the first aspect of the embodiment of the present application, the bidirectional secure access authentication between the publisher and the subscriber using the security detection component comprises:

[0010] S21, using a first authentication model, performing permission access control between the publisher and the subscriber to obtain a permission access control result;

[0011] S22, using a second authentication model, performing transmission data encryption between the publisher and the subscriber to obtain encrypted data.

[0012] As an optional implementation, in the first aspect of the embodiment of the present application, the permission access control between the publisher and the subscriber using the first authentication model to obtain a permission access control result comprises:

[0013] S211, the publisher sends an authentication instruction to the subscriber;

[0014] S212, after receiving the authentication instruction, the subscriber generates a first random number and sends it to the publisher;

[0015] S213, the publisher generates a second random number, encrypts the first random number and the second random number using a personalized key of the subscriber to obtain encrypted information, and the publisher sends the encrypted information to the subscriber;

[0016] S214, the subscriber decrypts the encrypted information using the personalized key to obtain a third random number and a fourth random number;

[0017] S215, when the third random number is equal to the first random number, the subscriber sends the fourth random number to the publisher;

[0018] S216, when the second random number is equal to the fourth random number, the permission access control result is bidirectional passing.

[0019] As an optional implementation, in the first aspect of the embodiment of the present application, the transmission data encryption between the publisher and the subscriber using the second authentication model to obtain encrypted data comprises:

[0020] S221, processing the transmission data between the publisher and the subscriber to obtain time-frequency information;

[0021] S222, transform the time-frequency information to obtain transformed time-frequency information and abbreviated time-frequency information;

[0022] S223, encrypt the transformed time-frequency information to obtain an encrypted sequence;

[0023] S224, encrypt the abbreviated time-frequency information to obtain encrypted abbreviated time-frequency information;

[0024] S225, splice the encrypted abbreviated time-frequency information and the encrypted sequence to obtain encrypted data.

[0025] As an optional implementation, in the first aspect of the embodiment of the present application, the transforming the time-frequency information to obtain transformed time-frequency information and abbreviated time-frequency information comprises:

[0026] S2221, transform the time-frequency information to obtain transformed time-frequency information;

[0027] S2222, process the transformed time-frequency information to obtain abbreviated time-frequency information.

[0028] As an optional implementation, in the first aspect of the embodiment of the present application, the encrypting the transformed time-frequency information to obtain an encrypted sequence comprises:

[0029] S2231, expand the transformed time-frequency information to obtain one-dimensional information;

[0030] S2232, encode the one-dimensional information to obtain encoded information;

[0031] S2233, encrypt the encoded information to obtain an encrypted sequence.

[0032] As an optional implementation, in the first aspect of the embodiment of the present application, the encrypting the abbreviated time-frequency information to obtain encrypted abbreviated time-frequency information comprises:

[0033] S2241, transform the abbreviated time-frequency information to obtain a first sub-band, a second sub-band, a third sub-band and a fourth sub-band;

[0034] S2242, perform first encryption processing on the first sub-band to obtain a first encrypted sub-band;

[0035] S2243, perform second encryption processing on the second sub-band, the third sub-band and the fourth sub-band to obtain a second encrypted sub-band;

[0036] S2244, transform the first encrypted sub-band and the second encrypted sub-band to obtain encrypted abbreviated time-frequency information.

[0037] The second aspect of the embodiment of the present application discloses a DDS secure communication middleware implementation device, the device comprises:

[0038] a component adding module, configured to add a security detection component and an authentication service component in the original DDS middleware model;

[0039] a bidirectional secure access authentication module, configured to perform bidirectional secure access authentication between the publisher and the subscriber by using the security detection component; the bidirectional secure access authentication comprises permission access control and transmission data encryption;

[0040] a remote participant authentication module, configured to perform identity verification on a remote participant by using the authentication service component.

[0041] As an optional implementation, in the second aspect of the embodiment of the present application, the bidirectional secure access authentication between the publisher and the subscriber by using the security detection component comprises:

[0042] S21, performing permission access control between the publisher and the subscriber by using a first authentication model to obtain a permission access control result;

[0043] S22, performing transmission data encryption between the publisher and the subscriber by using a second authentication model to obtain encrypted data.

[0044] As an optional implementation, in the second aspect of the embodiment of the present application, the permission access control between the publisher and the subscriber by using the first authentication model to obtain the permission access control result comprises:

[0045] S211, the publisher sends an authentication instruction to the subscriber;

[0046] S212, the subscriber generates a first random number after receiving the authentication instruction and sends the first random number to the publisher;

[0047] S213, the publisher generates a second random number, encrypts the first random number and the second random number by using a personalized key of the subscriber to obtain encrypted information, and sends the encrypted information to the subscriber;

[0048] S214, the subscriber decrypts the encrypted information by using the personalized key to obtain a third random number and a fourth random number;

[0049] S215, when the third random number is equal to the first random number, the subscriber sends the fourth random number to the publisher;

[0050] S216, when the second random number is equal to the fourth random number, the permission access control result is bidirectional passing.

[0051] As an optional implementation, in the second aspect of the embodiment of the present application, the encryption of the transmission data between the publisher and the subscriber by using the second authentication model to obtain encrypted data comprises:

[0052] S221, processing the transmission data between the publisher and the subscriber to obtain time-frequency information;

[0053] S222, transforming the time-frequency information to obtain transformed time-frequency information and abbreviated time-frequency information;

[0054] S223, performing encryption processing on the transformed time-frequency information to obtain an encrypted sequence;

[0055] S224, encrypting the abbreviated time-frequency information to obtain encrypted abbreviated time-frequency information;

[0056] S225, splicing the encrypted abbreviated time-frequency information and the encrypted sequence to obtain encrypted data.

[0057] As an optional implementation, in the second aspect of the embodiment of the present application, the transforming the time-frequency information to obtain transformed time-frequency information and abbreviated time-frequency information comprises:

[0058] S2221, transforming the time-frequency information to obtain transformed time-frequency information;

[0059] S2222, processing the transformed time-frequency information to obtain abbreviated time-frequency information.

[0060] As an optional implementation, in the second aspect of the embodiment of the present application, the performing encryption processing on the transformed time-frequency information to obtain an encrypted sequence comprises:

[0061] S2231, unfolding the transformed time-frequency information to obtain one-dimensional information;

[0062] S2232, encoding the one-dimensional information to obtain encoded information;

[0063] S2233, encrypting the encoded information to obtain an encrypted sequence.

[0064] As an optional implementation, in the second aspect of the embodiment of the present application, the encrypting the abbreviated time-frequency information to obtain encrypted abbreviated time-frequency information comprises:

[0065] S2241, transforming the abbreviated time-frequency information into a first sub-band, a second sub-band, a third sub-band and a fourth sub-band;

[0066] S2242, performing first encryption processing on the first sub-band to obtain a first encrypted sub-band;

[0067] S2243, performing a second encryption process on the second subband, the third subband and the fourth subband to obtain a second encrypted subband;

[0068] S2244, performing a transformation on the first encrypted subband and the second encrypted subband to obtain encrypted thumbnail time-frequency information.

[0069] A third aspect of the present application discloses another DDS secure communication middleware implementation device, the device comprises:

[0070] a memory storing executable program codes;

[0071] a processor coupled with the memory;

[0072] The processor invokes the executable program codes stored in the memory to execute part or all of the steps of the DDS secure communication middleware implementation method disclosed in the first aspect of the present application.

[0073] A fourth aspect of the present application discloses a computer storage medium, the computer storage medium stores computer instructions, when the computer instructions are invoked, part or all of the steps of the DDS secure communication middleware implementation method disclosed in the first aspect of the present application are executed.

[0074] Compared with the prior art, the embodiments of the present application have the following beneficial effects:

[0075] The present application comprehensively utilizes the security detection component and the authentication service component to realize the authenticity, availability and confidentiality of the publishing and subscribing process. Combined with the discovery mechanism and the QoS negotiation mechanism of DDS, the self-defined configuration of the security protection level and the encryption algorithm is realized, and the flexibility and efficiency requirements of the upper application are met. The following will be described in detail. BRIEF DESCRIPTION OF DRAWINGS

[0076] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiment description. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can also be obtained by those skilled in the art without creative labor.

[0077] Figure 1 is a flow diagram of a DDS secure communication middleware implementation method disclosed by the embodiments of the present application;

[0078] Figure 2 is a schematic diagram of a time-frequency information transformation method disclosed by the embodiments of the present application;

[0079] Figure 3is a non-authorized publish / subscribe schematic diagram disclosed by the embodiment of the present application;

[0080] Figure 4 is a security negotiation publish / subscribe schematic diagram disclosed by the embodiment of the present application;

[0081] Figure 5 is a schematic diagram of adding a security detection component and an authentication service component in a DDS middleware model disclosed by the embodiment of the present application;

[0082] Figure 6 is a structural schematic diagram of a DDS security communication middleware implementation device disclosed by the embodiment of the present application;

[0083] Figure 7 is a structural schematic diagram of another DDS security communication middleware implementation device disclosed by the embodiment of the present application. DETAILED DESCRIPTION

[0084] In order to make the personnel in the technical field better understand the present application scheme, the technical scheme in the embodiment of the present application will be described clearly and completely below in combination with the drawings in the embodiment of the present application. Obviously, the described embodiment is only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by the person skilled in the art without creative labor fall within the scope of protection of the present application.

[0085] The terms "first", "second", and the like in the specification of the present application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, device, product or equipment including a series of steps or units is not limited to the listed steps or units, but can optionally include steps or units not listed, or can optionally include other steps or units inherent to the process, method, product or equipment.

[0086] In this paper, the phrase "embodiment" means that the specific features, structures or characteristics described in combination with the embodiment can be included in at least one embodiment of the present application. The phrase appears at various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment to other embodiments. The person skilled in the art explicitly and implicitly understands that the embodiments described herein can be combined with other embodiments.

[0087] The application discloses a DDS secure communication middleware implementation method and device, and relates to the security communication technical field.

[0088] Embodiment one

[0089] Please refer to Figure 1 , Figure 1 is a flowchart of a DDS secure communication middleware implementation method disclosed by the embodiment of the application. Wherein, Figure 1 The DDS secure communication middleware implementation method described in the embodiment of the application is applied to the security communication technical field, and the embodiment of the application is not limited. As shown in Figure 1 The DDS secure communication middleware implementation method can include the following operations:

[0090] S1, a security detection component and an authentication service component are added in a DDS middleware model;

[0091] The original DDS middleware model is prior art in the field;

[0092] S2, the security detection component is used to perform bidirectional secure access authentication between a publisher and a subscriber; the bidirectional secure access authentication includes permission access control and transmission data encryption;

[0093] S3, the authentication service component is used to perform identity authentication on a remote participant.

[0094] The implementation method of S3 is that the authentication service component verifies the publishing and subscribing permissions of the remote participant according to the access control permission file issued by the CA center.

[0095] Optionally, the security detection component is used to perform bidirectional secure access authentication between the publisher and the subscriber, including:

[0096] S21, a first authentication model is used to perform permission access control between the publisher and the subscriber, and a permission access control result is obtained;

[0097] S22, a second authentication model is used to perform transmission data encryption between the publisher and the subscriber, and encrypted data is obtained.

[0098] Optionally, the first authentication model is used to perform access control between the publisher and the subscriber, and an access control result is obtained, including:

[0099] S211, the publisher sends an authentication instruction to the subscriber;

[0100] The subscriber sets a personalized key K first;

[0101] S212, the subscriber generates a first random number after receiving the authentication instruction and sends the first random number to the publisher;

[0102] S213, the publisher generates a second random number, encrypts the first random number and the second random number using the personalized key of the subscriber to obtain encrypted information, and sends the encrypted information to the subscriber;

[0103] The specific encryption method is not limited in the embodiment, such as SM1 symmetric encryption algorithm, etc.

[0104] S214, the subscriber decrypts the encrypted information using the personalized key to obtain a third random number and a fourth random number;

[0105] S215, when the third random number is equal to the first random number, the subscriber sends the fourth random number to the publisher;

[0106] S216, when the second random number is equal to the fourth random number, the access control result is bidirectional.

[0107] Steps S211-S216 are the working process of the first authentication model.

[0108] Optionally, the second authentication model is used to encrypt transmission data between the publisher and the subscriber, and encrypted data is obtained, including:

[0109] S221, the transmission data between the publisher and the subscriber is processed to obtain time-frequency information;

[0110] The specific method is

[0111]

[0112] Wherein, C x is time-frequency information, the integral range is -∞-∞, u and t are time variables, τ is a time shift variable, Ω is a frequency variable corresponding to u, θ is a frequency variable corresponding to τ, k(θ,τ)=A x (θ,τ)g(θ,τ), k(θ,τ) is an optimized kernel function, g(θ,τ) is a preset kernel function, x(t) is the data transmitted between the publisher and the subscriber, A x (θ, τ) is the fuzzy parameter information, t is the time variable, τ is the displacement variable, θ is the frequency variable corresponding to τ, and * indicates conjugation.

[0113] S222, transforming the time-frequency information to obtain transformed time-frequency information and abbreviated time-frequency information;

[0114] 1) Divide the time-frequency information digital image of size M×N into 8×8 blocks. If M or N is not divisible by 8, fill the rows or columns that are not divisible by 8 with 0 until they are divisible by 8.

[0115] 2) Press Figure 2 Subtract the direction of the arrow in (a) and we get Figure 2 (b), then rearrange the difference results, that is, Figure 2 Pixels of the same color in (b) are arranged together to obtain Figure 2 (c).

[0116] 3) In Figure 2 On the yellow sub-block in (d), we make a difference in the direction of the arrow and get Figure 2 (e), and then rearrange the difference results to get Figure 2 (f).

[0117] 4) Finally press Figure 2 Subtract the arrow direction in (f) to get the final result Figure 2 (g), where the upper left 4×4 sub-block is LT, the upper right sub-block is RT, the lower left sub-block is LB, and the lower right sub-block is RB.

[0118] Transform the time-frequency information Y1 into Figure 3 As shown in (g), there is an unchanged pixel in the LT subband. By extracting all the pixels in all 8×8 blocks of the image, we can obtain the abbreviated time-frequency information Y2 with a size of one-eighth of the original image.

[0119] S223, encrypting the transformed time-frequency information to obtain an encrypted sequence;

[0120] S224, encrypting the abbreviated time-frequency information to obtain encrypted abbreviated time-frequency information;

[0121] S225: Concatenate the encrypted abbreviated time-frequency information and the encrypted sequence to obtain encrypted data.

[0122] Optionally, transforming the time-frequency information to obtain transformed time-frequency information and abbreviated time-frequency information includes:

[0123] S2221, transform the time-frequency information to obtain transformed time-frequency information;

[0124] S2222, processing the transformed time-frequency information to obtain thumbnail time-frequency information.

[0125] Optionally, the encrypted processing of the transformed time-frequency information to obtain an encrypted sequence comprises:

[0126] S2231, unfolding the transformed time-frequency information to obtain one-dimensional information;

[0127] Unfolding the transformed time-frequency information Y1 from left to right and from top to bottom into a one-dimensional sequence to obtain Y11;

[0128] S2232, encoding the one-dimensional information to obtain encoded information;

[0129] DC encoding Y11 to obtain encoded information;

[0130] S2233, encrypting the encoded information to obtain an encrypted sequence.

[0131] SM7 encrypting the encoded information to obtain Y12;

[0132] The secret key used in this embodiment is:

[0133] Taking the SHA-256 hash value of the time-frequency information, which has 256 bits, dividing it into 32 parts, each part has 8 bits, denoted as k1, k2, …, k 32 , calculation:

[0134] x0=mod((h1+h2)×10 14 ) / 255

[0135] y0=mod((h3+h2)×10 14 ) / 255

[0136] z0=mod((h3+h4)×10 14 ) / 255

[0137] h0=mod((h1+h2+h3+h4)×10 14 ) / 255

[0138]

[0139] where, is the XOR operation, LC t is the left cyclic shift t bits, mod is the modulo 256 operation. Using a fractional order chaotic system, h1, h2, h3, h4 are processed to obtain a chaotic sequence H, and H is converted to obtain H1:

[0140] H1=floor(mod((H×1016 ),256))

[0141] wherein floor represents rounding;

[0142] XOR operation is performed on H1 and Y12 to obtain an encrypted sequence Y13.

[0143] Optionally, the encrypted thumbnail time-frequency information is obtained by encrypting the thumbnail time-frequency information, comprising:

[0144] S2241, transforming the thumbnail time-frequency information, a first sub-band, a second sub-band, a third sub-band and a fourth sub-band;

[0145] The thumbnail time-frequency information is divided into four sub-blocks, and discrete cosine transform is performed on each sub-block to obtain a first sub-band L1, a second sub-band T1, a third sub-band B1 and a fourth sub-band R1;

[0146] S2242, performing first encryption processing on the first sub-band to obtain a first encrypted sub-band;

[0147] The calculation is:

[0148] L2=boxr(boxr((L1,T1)B1),R1)

[0149] T2=boxr(boxr(L2,T1)

[0150] B2=boxr(boxr(L2,B1)

[0151] R2=boxr(boxr(L2,R1)

[0152] wherein bxor represents bitwise XOR operation. L2 is DC encoded by using H1 to obtain a first encrypted sub-band L3.

[0153] S2243, performing second encryption processing on the second sub-band, the third sub-band and the fourth sub-band to obtain a second encrypted sub-band;

[0154] T2, B2 and R2 are combined into a sequence W2, and W2 is DNA encrypted by using H1 to obtain a second encrypted sub-band W3;

[0155] S2244, transforming the first encrypted sub-band and the second encrypted sub-band to obtain encrypted thumbnail time-frequency information.

[0156] After diffusion, permutation and scrambling of L3 and W3, and then performing parity exchange, encrypted thumbnail time-frequency information is obtained.

[0157] The decryption process is the opposite process of encryption.

[0158] It can be seen that the application realizes the authenticity, availability and confidentiality of the publishing and subscribing process by comprehensively utilizing the security detection component and the authentication service component. In combination with the discovery mechanism and the QoS negotiation mechanism of DDS, the self-defined configuration of the security protection level and the encryption algorithm is realized, so that the flexibility and high efficiency requirement of the upper application is met. The following will be described in detail.

[0159] Embodiment two

[0160] The embodiment is based on the existing DDS communication middleware and the DDS security specification, and proposes a DDS security communication middleware model containing identity authentication, permission control and data encryption and decryption functions. The model realizes the flexible configuration of the security service by relying on the plug-in design, and designs and realizes the identity authentication, permission control and key negotiation mechanism of the DDS security communication middleware by combining the security handshake protocol with the DDS discovery process. Figure 4 is an unlicensed publishing and subscribing schematic diagram disclosed by the embodiment of the application; Figure 5 is a security negotiation publishing and subscribing schematic diagram disclosed by the embodiment of the application; Figure 6 is a schematic diagram of adding a security detection component and an authentication service component in the original DDS middleware model disclosed by the embodiment of the application;

[0161] The CA center is a trusted third party outside the DDS, is the basis of the security communication, issues digital certificates for each participant through a secure channel, and distributes the access control permission file with the CA integrity signature prepared by the system administrator in the DDS domain to each participant in the domain. The remaining modules are in the form of service plug-ins inside the DDS communication middleware and cooperate with the DDS entity to provide the user program with complete data distribution security services.

[0162] The identity authentication component performs identity authentication on the remote participant.

[0163] The security detection component performs bidirectional security access authentication between the publisher and the subscriber; the bidirectional security access authentication includes permission access control and transmission data encryption.

[0164] Embodiment three

[0165] Please refer to Figure 6 , Figure 6 is a structural schematic diagram of a DDS security communication middleware implementation device disclosed by the embodiment of the application. Among them, Figure 6 The described DDS security communication middleware implementation device is applied to the technical field of security communication, and the embodiment of the application is not limited. As Figure 7 shown, the DDS security communication middleware implementation device can include the following operations:

[0166] S301, a component adding module, configured to add a security probe component and an authentication service component in a DDS middleware model;

[0167] S302, a bidirectional security access authentication module, configured to perform bidirectional security access authentication between a publisher and a subscriber by using the security probe component; the bidirectional security access authentication comprises permission access control and transmission data encryption;

[0168] S303, a remote participant authentication module, configured to perform identity verification on a remote participant by using the authentication service component.

[0169] Embodiment four

[0170] Please refer to Figure 7 , Figure 7 is another structure diagram of a DDS security communication middleware implementation device disclosed by the embodiments of the present application. Wherein, Figure 7 The DDS security communication middleware implementation device described is applied to the technical field of security communication, and the embodiments of the present application are not limited. As shown in ​ The DDS security communication middleware implementation device can include the following operations:

[0171] The memory 401 stores executable program codes;

[0172] The processor 402 is coupled with the memory 401;

[0173] The processor 402 calls the executable program codes stored in the memory 401, and is configured to execute the steps in the DDS security communication middleware implementation method described in Embodiment one and Embodiment two.

[0174] Embodiment five

[0175] The embodiments of the present application disclose a computer readable storage medium storing a computer program for electronic data exchange, wherein the computer program causes a computer to execute the steps in the DDS security communication middleware implementation method described in Embodiment one and Embodiment two.

[0176] The device embodiments described above are only schematic, wherein the modules illustrated as separate components can or can not be physically separated, and the components illustrated as modules can or can not be physical modules, that is, they can be located in one place, or distributed on multiple network modules. According to actual needs, some or all of the modules can be selected to achieve the purpose of the present embodiment scheme. Those skilled in the art can understand and implement without creative labor.

[0177] Those skilled in the art can clearly understand the implementation of the various embodiments by means of software and necessary general hardware platforms through the above specific description of the embodiments, and of course, the embodiments can also be implemented by hardware. Based on such understanding, the above technical solutions, essentially or in other words, the part of the prior art that makes a contribution, can be embodied in the form of a software product. The computer software product can be stored in a computer readable storage medium, and the storage medium includes a read-only memory (ROM), a random access memory (RAM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), a one-time programmable read-only memory (OTPROM), an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disk storage, a magnetic disk storage, a magnetic tape storage, or any other computer readable medium that can be used to carry or store data.

[0178] Finally, it should be noted that: the DDS secure communication middleware implementation method and device disclosed by the embodiments of the present application are only the preferred embodiments of the present application, and are used to illustrate the technical solutions of the present application, but not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that; the technical solutions recorded in the foregoing embodiments can still be modified, or some technical features can be replaced by equivalents; and these modifications or replacements do not make the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A DDS secure communication middleware implementation method, characterized in that: The method comprises: S1, adding security detection components and authentication service components to the original DDS middleware model; S2, using the security detection component to perform bidirectional security access authentication between the publisher and the subscriber; the bidirectional security access authentication includes permission access control and transmission data encryption, including: S21, using the first authentication model, performing permission access control between the publisher and the subscriber, and obtaining a permission access control result; S22, using the second authentication model, encrypting the data transmitted between the publisher and the subscriber to obtain encrypted data, including: S221, processing the transmission data between the publisher and the subscriber to obtain time-frequency information; S222, transforming the time-frequency information to obtain transformed time-frequency information and abbreviated time-frequency information, including: S2221, transform the time-frequency information to obtain transformed time-frequency information; The specific method is Among them, C x is the time-frequency information, the integration range is -∞~∞, u, t are time variables, τ is the time shift variable, Ω is the frequency variable corresponding to u, θ is the frequency variable corresponding to τ, k(θ,τ)=A x (θ,τ)g(θ,τ), k(θ,τ) is the optimization kernel function, g(θ,τ) is the preset kernel function, a=0.001,β=50, x(t) is the data transmitted between the publisher and the subscriber, A x (θ, τ) is the fuzzy parameter information, t is the time variable, τ is the displacement variable, θ is the frequency variable corresponding to τ, and * indicates conjugation; S2222, processing the transformed time-frequency information to obtain abbreviated time-frequency information; 1) Divide the time-frequency information digital image of size M×N into 8×8 blocks. If M or N is not divisible by 8, fill the rows or columns that are not divisible by 8 with 0 until they are divisible by 8. 2) Subtract the image blocks and rearrange the subtraction results, where the upper left 4×4 subblock is LT, the upper right subblock is RT, the lower left subblock is LB, and the lower right subblock is RB; There is an unchanged pixel in the LT subband. By extracting all the pixels in all 8×8 blocks of the image, we can obtain the abbreviated time-frequency information Y2 with a size of one-eighth of the original image. S223, encrypting the transformed time-frequency information to obtain an encrypted sequence, including: S2231, expanding the transformed time-frequency information to obtain one-dimensional information; Expand the transformed time-frequency information Y1 from left to right and from top to bottom into a one-dimensional sequence to obtain Y11; S2232, encoding the one-dimensional information to obtain encoded information; Perform DC encoding on Y11 to obtain encoding information; S2233, encrypting the coded information to obtain an encrypted sequence; Perform SM7 encryption on the encoded information to obtain Y12; The secret key used is: Take the SHA-256 hash value of the time-frequency information, which is 256 bits in total, and divide it into 32 parts, each with 8 bits, represented as k1, k2, ..., k 32 , calculated: x0=mod((h1+h2)×10 14 ) / 255 y0=mod((h3+h2)×10 14 ) / 255 z0=mod((h3+h4)×10 14 ) / 255 h0=mod((h1+h2+h3+h4)×10 14 ) / 255 in, For XOR operation, LC t is a t-bit cyclic shift to the left, and mod is a modulo-256 operation. Using the fractional-order chaotic system, h1, h2, h3, and h4 are processed to obtain the chaotic sequence H. H is transformed to obtain H1: H1=floor(mod((H×10 16 ),256)) Among them, floor means rounding; Perform XOR calculation on H1 and Y12 to obtain the encrypted sequence Y13; S224, encrypting the abbreviated time-frequency information to obtain encrypted abbreviated time-frequency information, including: S2241, transforming the abbreviated time-frequency information into a first sub-band, a second sub-band, a third sub-band, and a fourth sub-band; Divide the abbreviated time-frequency information into blocks to obtain four sub-blocks, and perform discrete cosine transform on each sub-block to obtain a first sub-band L1, a second sub-band T1, a third sub-band B1, and a fourth sub-band R1; S2242: Perform a first encryption process on the first subband to obtain a first encrypted subband; The calculation is: L2=bxor(bxor((L1,T1)B1),R1) T2=bxor(bxor(L2,T1) B2=bxor(bxor(L2,B1) R2=bxor(bxor(L2,R1) Wherein, bxor represents a bitwise exclusive OR operation, and L2 is DC-encoded using H1 to obtain the first encrypted sub-band L3; S2243: Perform a second encryption process on the second sub-band, the third sub-band, and the fourth sub-band to obtain a second encrypted sub-band; Combine T2, B2 and R2 into sequence W2, and use H1 to perform DNA encryption on W2 to obtain the second encrypted sub-band W3; S2244: transform the first encrypted sub-band and the second encrypted sub-band to obtain encrypted abbreviated time-frequency information; After spreading, scrambling and scrambling, L3 and W3 are parity swapped to obtain encrypted abbreviated time-frequency information; S225, concatenating the encrypted abbreviated time-frequency information and the encrypted sequence to obtain encrypted data; S3: Authenticate the remote participant using the authentication service component.

2. The DDS secure communication middleware implementation method according to claim 1, characterized in that: The first authentication model is used to perform permission access control between the publisher and the subscriber, and the permission access control result is obtained, including: S211, the publisher sends an authentication instruction to the subscriber; S212, after receiving the authentication instruction, the subscriber generates a first random number and sends it to the publisher; S213: The publisher generates a second random number, encrypts the first random number and the second random number using the subscriber's personalized key to obtain encrypted information, and sends the encrypted information to the subscriber. S214, the subscriber decrypts the encrypted information using the personalized key to obtain a third random number and a fourth random number; S215, when the third random number is equal to the first random number, the subscriber sends the fourth random number to the publisher; S216: When the second random number is equal to the fourth random number, the permission access control result is bidirectional pass.

3. A DDS secure communication middleware implementation device, characterized in that: The device comprises: Component addition module, used to add security detection components and authentication service components to the original DDS middleware model; A two-way security access authentication module is used to perform two-way security access authentication between the publisher and the subscriber using the security detection component; the two-way security access authentication includes permission access control and transmission data encryption, including: S21, using the first authentication model, performing permission access control between the publisher and the subscriber, and obtaining a permission access control result; S22, using the second authentication model, encrypting the data transmitted between the publisher and the subscriber to obtain encrypted data, including: S221, processing the transmission data between the publisher and the subscriber to obtain time-frequency information; S222, transforming the time-frequency information to obtain transformed time-frequency information and abbreviated time-frequency information, including: S2221, transform the time-frequency information to obtain transformed time-frequency information; The specific method is Among them, C x is the time-frequency information, the integration range is -∞~∞, u, t are time variables, τ is the time shift variable, Ω is the frequency variable corresponding to u, θ is the frequency variable corresponding to τ, k(θ,τ)=A x (θ,τ)g(θ,τ), k(θ,τ) is the optimization kernel function, g(θ,τ) is the preset kernel function, a=0.001,β=50, x(t) is the data transmitted between the publisher and the subscriber, A x (θ, τ) is the fuzzy parameter information, t is the time variable, τ is the displacement variable, θ is the frequency variable corresponding to τ, and * indicates conjugation; S2222, processing the transformed time-frequency information to obtain abbreviated time-frequency information; 1) Divide the time-frequency information digital image of size M×N into 8×8 blocks. If M or N is not divisible by 8, fill the rows or columns that are not divisible by 8 with 0 until they are divisible by 8. 2) Subtract the image blocks and rearrange the subtraction results, where the upper left 4×4 subblock is LT, the upper right subblock is RT, the lower left subblock is LB, and the lower right subblock is RB; There is an unchanged pixel in the LT subband. By extracting all the pixels in all 8×8 blocks of the image, we can obtain the abbreviated time-frequency information Y2 with a size of one-eighth of the original image. S223, encrypting the transformed time-frequency information to obtain an encrypted sequence, including: S2231, expanding the transformed time-frequency information to obtain one-dimensional information; Expand the transformed time-frequency information Y1 from left to right and from top to bottom into a one-dimensional sequence to obtain Y11; S2232, encoding the one-dimensional information to obtain encoded information; Perform DC encoding on Y11 to obtain encoding information; S2233, encrypting the coded information to obtain an encrypted sequence; Perform SM7 encryption on the encoded information to obtain Y12; The secret key used is: Take the SHA-256 hash value of the time-frequency information, which is 256 bits in total, and divide it into 32 parts, each with 8 bits, represented as k1, k2, ..., k 32 , calculated: x0=mod((h1+h2)×10 14 ) / 255 y0=mod((h3+h2)×10 14 ) / 255 z0=mod((h3+h4)×10 14 ) / 255 h0=mod((h1+h2+h3+h4)×10 14 ) / 255 in, For XOR operation, LC t is a t-bit cyclic shift to the left, and mod is a modulo-256 operation. Using the fractional-order chaotic system, h1, h2, h3, and h4 are processed to obtain the chaotic sequence H. H is transformed to obtain H1: Among them, floor means rounding; Perform XOR calculation on H1 and Y12 to obtain the encrypted sequence Y13; S224, encrypting the abbreviated time-frequency information to obtain encrypted abbreviated time-frequency information, including: S2241, transforming the abbreviated time-frequency information into a first sub-band, a second sub-band, a third sub-band, and a fourth sub-band; Divide the abbreviated time-frequency information into blocks to obtain four sub-blocks, and perform discrete cosine transform on each sub-block to obtain a first sub-band L1, a second sub-band T1, a third sub-band B1, and a fourth sub-band R1; S2242: Perform a first encryption process on the first subband to obtain a first encrypted subband; The calculation is: L2=bxor(bxor((L1,T1)B1),R1) T2=bxor(bxor(L2,T1) B2=bxor(bxor(L2,B1) R2=bxor(bxor(L2,R1) Wherein, bxor represents a bitwise exclusive OR operation, and L2 is DC-encoded using H1 to obtain the first encrypted sub-band L3; S2243: Perform a second encryption process on the second sub-band, the third sub-band, and the fourth sub-band to obtain a second encrypted sub-band; Combine T2, B2 and R2 into sequence W2, and use H1 to perform DNA encryption on W2 to obtain the second encrypted sub-band W3; S2244: transform the first encrypted sub-band and the second encrypted sub-band to obtain encrypted abbreviated time-frequency information; After spreading, scrambling and scrambling, L3 and W3 are parity swapped to obtain encrypted abbreviated time-frequency information; S225, concatenating the encrypted abbreviated time-frequency information and the encrypted sequence to obtain encrypted data; The remote participant authentication module is used to perform identity authentication on the remote participant using the authentication service component.

4. A DDS secure communication middleware implementation device, characterized in that: The device comprises: a memory storing executable program code; a processor coupled to the memory; The processor calls the executable program code stored in the memory to execute the DDS secure communication middleware implementation method according to any one of claims 1 to 2.

5. A computer storable medium, characterized in that The computer storable medium stores computer instructions, and when the computer instructions are called, they are used to execute the DDS secure communication middleware implementation method according to any one of claims 1 to 2.

Images