Real-time encrypted collaborative scheduling method, system, device and medium for TSN

Abstract

This application relates to the technical field of time-sensitive networking (TSN), and more particularly to a real-time encryption collaborative scheduling method, system, device, and medium for TSN. The method includes utilizing a TSN dynamic time slot allocation module to adjust the proportion of encryption time slots, implementing multi-protocol compatibility encapsulation through a protocol-independent middleware layer, and combining an FPGA hardware acceleration module for parallel encryption and decapsulation processing. This application can dynamically optimize encryption scheduling strategies based on network load, improving security and network utilization while ensuring real-time performance, effectively resolving the conflict between real-time and security in TSN and meeting the demand for efficient and flexible solutions in industrial scenarios.

Description

Technical Field

[0001] The present invention belongs to the technical field of time-sensitive networks (TSNs), and specifically relates to a real-time encrypted collaborative scheduling method, system, device, and medium for TSNs. Background Art

[0002] With the rapid development of Industry 4.0 and smart manufacturing, Time-Sensitive Networking (TSN) is increasingly being used in industrial communications. By providing deterministic, low-latency data transmission, TSN meets the real-time and high-reliability requirements of industrial scenarios, becoming a key technology in industrial automation, smart manufacturing, and the Internet of Things. However, in industrial TSN environments, the conflict between data encryption and real-time performance has become increasingly prominent, becoming a key issue hindering its further adoption. Traditional encryption schemes (such as AES-GCM), while ensuring data security, introduce additional computational latency (≥1.5μs), resulting in control instruction cycles failing to meet the stringent requirement of ≤50μs, leading to increased control errors (for example, measured data from ASMPacific bonding machines show Z-axis positioning errors of up to 5μm). Furthermore, the existing TSN protocol lacks dynamic encryption mechanisms, making it difficult to meet the diverse needs of industrial scenarios and vulnerable to man-in-the-middle (MitM) attacks (for example, Huawei production lines experience an average of 1,502 attack attempts per day). At the same time, the fragmentation of industrial communication protocols (such as the incompatibility between EtherCAT and Profinet) further exacerbates the complexity of the problem. Equipment from multiple manufacturers requires customized security solutions, and deployment costs increase by 60%.

[0003] A search revealed that patent publication number CN109450943B proposes a method based on priority allocation and multi-level secure queue scheduling. By dividing the buffer queue into four levels of encryption waiting queues and internally scheduling data frames based on their overall priority, this method meets the deterministic data transmission requirements of industrial wireless networks and the real-time performance requirements of high-priority data transmission. However, this technical solution still has significant shortcomings: First, the static mapping of encryption strength and priority cannot adapt to dynamic network load changes, resulting in wasted encryption resources (bandwidth utilization <40%) under low loads and reduced real-time performance under high loads. Second, the solution lacks a protocol-agnostic middleware layer, requiring the encryption module to deeply parse specific protocol fields (such as EtherCAT email addresses), adding additional latency (≥0.3μs) and making it difficult to be compatible with multiple industrial communication protocols. Finally, hardware acceleration support is insufficient, failing to fully utilize hardware resources such as FPGAs for efficient parallel processing, limiting overall performance improvements.

[0004] The above issues indicate that existing multi-level secure data scheduling methods for industrial time-sensitive networks (TSNs) still have certain deficiencies in dynamic encryption scheduling, protocol compatibility, and hardware acceleration support. Therefore, a real-time encryption collaborative scheduling method, system, device, and media for TSN are urgently needed. By dynamically adjusting the proportion of encryption time slots, designing a protocol-independent middleware layer, and introducing an FPGA hardware acceleration mechanism, this approach can resolve the conflict between real-time performance and security in TSN networks and meet the demand for efficient, flexible, and low-cost TSN solutions in industrial scenarios. Summary of the Invention

[0005] The present invention provides a TSN-oriented real-time encrypted collaborative scheduling method, system, device and medium, the main purpose of which is to resolve the contradiction between real-time performance and security in time-sensitive networks (TSNs) while improving network utilization and multi-protocol compatibility.

[0006] To achieve the above objectives, the present invention provides a TSN-oriented real-time encryption collaborative scheduling method, comprising:

[0007] Using a pre-built TSN timeslot dynamic allocation module, the proportion of encrypted timeslots is adjusted according to the real-time network load rate, and the adjustment result is sent to a pre-built TSN switching matrix, wherein the TSN switching matrix includes a data queue management unit and an encryption processing unit;

[0008] Obtaining data frames to be encrypted and their priority information from the data queue management unit, and obtaining encryption resource status information from the encryption processing unit, wherein the data frames to be encrypted include control instruction data and ordinary service data, and the encryption resource status information includes hardware acceleration module availability and key cache status;

[0009] Using a pre-built protocol-independent middleware layer, performing a protocol type identification operation on the data frame to be encrypted to obtain a protocol identifier, and encapsulating the data frame to be encrypted in a unified format according to the protocol identifier to obtain a standardized data frame;

[0010] Configuring an optimized encryption scheduling strategy based on the standardized data frame and encryption resource status information;

[0011] Utilizing the optimized encryption scheduling strategy, encrypting the standardized data frame to obtain an encrypted data frame;

[0012] The encrypted data frames are decapsulated in parallel using a pre-built FPGA hardware acceleration module, and the decapsulated data frames are sent to the target device through the TSN switching matrix.

[0013] Optionally, obtaining the data frames to be encrypted and their priority information in the data queue management unit, and obtaining encryption resource status information in the encryption processing unit, includes:

[0014] Using a pre-built AXI4 bus, the data frames to be encrypted and their priority information in the data queue management unit are sent to the protocol-independent middleware layer;

[0015] The encryption resource status information in the encryption processing unit is sent to the TSN time slot dynamic allocation module using a pre-built PCIe interface.

[0016] Optionally, performing a protocol type identification operation on the data frame to be encrypted to obtain a protocol identifier includes:

[0017] Analyzing the header field of the data frame to be encrypted to obtain a protocol signature code;

[0018] Using a pre-built pattern matching engine, a rapid comparison operation is performed on the protocol feature code to obtain a protocol matching result;

[0019] According to the protocol matching result, a corresponding protocol identifier is determined, wherein the protocol identifier supports mainstream industrial communication protocols such as EtherCAT and Profinet.

[0020] Optionally, configuring an optimized encryption scheduling strategy according to the standardized data frame and encryption resource status information includes:

[0021] Determining the availability of the current hardware acceleration module according to the encryption resource status information;

[0022] When the hardware acceleration module is available, determining that the optimized encryption scheduling strategy is a first-category strategy;

[0023] When the hardware acceleration module is unavailable, determining that the optimized encryption scheduling strategy is a second type of strategy;

[0024] The first type of strategy includes using the FPGA hardware acceleration module to perform parallel encryption processing on the standardized data frame;

[0025] The second type of strategy includes using a pre-built software encryption queue to perform batch encryption processing on the standardized data frames.

[0026] Optionally, the utilizing the optimized encryption scheduling strategy to encrypt the standardized data frame to obtain an encrypted data frame includes:

[0027] Performing a priority-based queue reordering operation on the standardized data frame;

[0028] Selecting a corresponding encryption execution path according to the optimized encryption scheduling strategy;

[0029] The encryption execution path is used to perform an encryption operation on the standardized data frame to generate the encrypted data frame, and the encrypted data frame is stored in a pre-built encryption buffer area.

[0030] Optionally, the utilizing a pre-built FPGA hardware acceleration module to perform a parallel decapsulation operation on the encrypted data frame includes:

[0031] Utilizing the parallel decapsulation unit in the FPGA hardware acceleration module to perform a protocol header parsing operation on the encrypted data frame;

[0032] Extracting payload information from the encrypted data frame according to the parsing result;

[0033] The payload information is repackaged into a target protocol format using a pre-built multiplexer and sent to a target device through the TSN switching matrix.

[0034] To achieve the above objectives, the present invention further provides a TSN-oriented real-time encryption collaborative scheduling system, comprising:

[0035] A data acquisition module is configured to use a pre-built TSN time slot dynamic allocation module to adjust the proportion of encryption time slots according to the real-time network load rate, and send the adjustment result to a pre-built TSN switching matrix, wherein the TSN switching matrix includes a data queue management unit and an encryption processing unit, and obtain the data frames to be encrypted and their priority information from the data queue management unit, and obtain the encryption resource status information from the encryption processing unit;

[0036] A protocol encapsulation module is used to use a pre-built protocol-independent middleware layer to perform a protocol type identification operation on the data frame to be encrypted to obtain a protocol identifier, and encapsulate the data frame to be encrypted in a unified format according to the protocol identifier to obtain a standardized data frame;

[0037] An encryption scheduling module, configured to obtain an optimized encryption scheduling strategy based on the standardized data frame and encryption resource status information;

[0038] An encryption processing module, configured to perform encryption processing on the standardized data frame using the optimized encryption scheduling strategy to obtain an encrypted data frame;

[0039] The hardware acceleration module is used to use a pre-built FPGA hardware acceleration module to perform a parallel decapsulation operation on the encrypted data frame, and send the decapsulated data frame to the target device through the TSN switching matrix.

[0040] In order to solve the above problem, the present invention further provides an electronic device, comprising:

[0041] a memory storing at least one instruction;

[0042] The processor executes the instructions stored in the memory to implement the above-mentioned TSN-oriented real-time encryption collaborative scheduling method.

[0043] In order to solve the above problems, the present invention also provides a computer-readable storage medium, which stores at least one instruction, and the at least one instruction is executed by a processor in an electronic device to implement the above-mentioned TSN-oriented real-time encryption collaborative scheduling method.

[0044] In order to solve the problems described in the background technology, the present invention introduces a TSN time slot dynamic allocation module, combines the protocol-independent middleware layer and the FPGA hardware acceleration module, and realizes efficient coordination of dynamic encryption scheduling and multi-protocol compatibility processing. Among them, the TSN time slot dynamic allocation module can flexibly adjust the proportion of encryption time slots according to the network load rate, thereby reducing resource waste while ensuring real-time performance; the protocol-independent middleware layer solves the multi-protocol compatibility problem through unified format encapsulation, avoiding the in-depth analysis of specific protocol fields in traditional solutions; the FPGA hardware acceleration module significantly improves the encryption and decapsulation efficiency through a parallel processing mechanism, further reducing the overall delay. Therefore, the present invention can effectively solve the contradiction between real-time performance and security in the TSN network, and meet the needs of industrial scenarios for efficient, flexible, and low-cost solutions. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 A flowchart of a TSN-oriented real-time encryption collaborative scheduling method provided by one embodiment of the present invention;

[0046] Figure 2 A functional module diagram of a TSN-oriented real-time encrypted collaborative scheduling system provided by one embodiment of the present invention;

[0047] Figure 3 A schematic structural diagram of an electronic device for implementing the TSN-oriented real-time encryption collaborative scheduling method provided in one embodiment of the present invention. DETAILED DESCRIPTION

[0048] The present invention provides a real-time encrypted collaborative scheduling method, system, device and medium for TSN. The core of the invention is to solve the contradiction between real-time performance and security in time-sensitive network (TSN) through the synergy of dynamic time slot allocation, protocol-independent middleware layer and FPGA hardware acceleration module. Figure 1 To the attached Figure 3Specific embodiments of the present invention are described in detail.

[0049] First, if Figure 1 As shown, the method proposed in the present invention includes multiple key steps, which together constitute a complete real-time encryption collaborative scheduling process. In practical applications, taking the industrial automation scenario as an example, it is assumed that a factory needs to transmit control instruction data and ordinary business data through the TSN network, and requires high real-time performance and security. At this time, the implementation process of the present invention is as follows: using the pre-built TSN time slot dynamic allocation module, the encryption time slot ratio is adjusted according to the real-time network load rate, and the adjustment result is sent to the TSN switching matrix. The TSN switching matrix consists of a data queue management unit and an encryption processing unit, wherein the data queue management unit is responsible for storing the data frames to be encrypted and their priority information, while the encryption processing unit is used to maintain encryption resource status information, including the availability of the hardware acceleration module and the key cache status.

[0050] To achieve the above functions, the TSN time slot dynamic allocation module continuously monitors changes in the network load rate. Assuming the current network load rate is L and the encrypted time slot ratio is P, the encrypted time slot ratio can be dynamically calculated using the formula P = f(L). The specific function f(L) can be designed as a linear or nonlinear relationship based on actual needs. For example, under low load conditions, the encrypted time slot ratio can be appropriately reduced to improve network utilization; under high load conditions, the encrypted time slot ratio can be increased to ensure security and real-time performance. This dynamic adjustment mechanism is implemented via the AXI4 bus and PCIe interface. The AXI4 bus is responsible for sending the encrypted data frames and their priority information from the data queue management unit to the protocol-independent middleware layer, while the PCIe interface is responsible for sending the encryption resource status information from the encryption processing unit to the TSN time slot dynamic allocation module.

[0051] Next, the protocol-agnostic middleware layer performs protocol type identification on the encrypted data frame received from the data queue management unit. Specifically, it first analyzes the header field of the encrypted data frame to extract the protocol signature code. Then, it uses a pre-built pattern matching engine to quickly compare the protocol signature code to obtain a protocol match result. Based on the protocol match result, the corresponding protocol identifier is determined. For example, if the encrypted data frame belongs to the EtherCAT protocol, the protocol identifier is 0x01; if it belongs to the Profinet protocol, the protocol identifier is 0x02. In this way, the protocol-agnostic middleware layer can support a variety of mainstream industrial communication protocols, thereby achieving multi-protocol compatibility.

[0052] After identifying the protocol type, the protocol-independent middleware layer encapsulates the encrypted data frame in a unified format based on the protocol identifier, resulting in a standardized data frame. The structure of the standardized data frame can be designed to include a fixed-length header field and a variable-length payload field. The header field includes metadata such as the protocol identifier, priority information, and frame length, while the payload field retains the original data content. This unified format encapsulation design not only simplifies the subsequent encryption processing but also avoids the in-depth parsing of specific protocol fields required in traditional solutions.

[0053] The system then configures an optimized encryption scheduling strategy based on the standardized data frames and encryption resource status information. The specific configuration process includes the following steps: First, the availability of the current hardware acceleration module is determined based on the encryption resource status information. If the hardware acceleration module is available, the optimized encryption scheduling strategy is determined to be a first-class strategy; otherwise, it is determined to be a second-class strategy. The core of the first-class strategy is to use the FPGA hardware acceleration module to perform parallel encryption processing on standardized data frames, significantly improving encryption efficiency. The second-class strategy uses a pre-built software encryption queue to encrypt standardized data frames in batches to address the situation where hardware resources are insufficient.

[0054] After determining the optimized encryption scheduling strategy, the system uses that strategy to encrypt the standardized data frames. Specifically, the standardized data frames are first re-queued based on priority. For example, the system prioritizes control instruction data with higher priority before placing it in the encryption queue, while lower-priority general service data is placed after it. Next, the corresponding encryption execution path is selected based on the optimized encryption scheduling strategy. If the first strategy is adopted, the FPGA hardware acceleration module is used to encrypt the standardized data frames in parallel; if the second strategy is adopted, the software encryption queue is used to encrypt them in batches. The resulting encrypted data frames are then stored in a pre-built encryption buffer for subsequent processing.

[0055] To further reduce overall latency, the system utilizes a pre-built FPGA hardware acceleration module to perform parallel decapsulation of encrypted data frames. Specifically, the parallel decapsulation unit in the FPGA hardware acceleration module first parses the protocol header of the encrypted data frame to extract the payload information. Then, a pre-built multiplexer is used to re-encapsulate the payload information into the target protocol format. For example, if the target device supports the EtherCAT protocol, the payload information is encapsulated in the EtherCAT format; if it supports the Profinet protocol, it is encapsulated in the Profinet format. Finally, the encapsulated data frame is sent to the target device via the TSN switching matrix.

[0056] like Figure 2As shown, the present invention also provides a real-time encryption collaborative scheduling system for TSN, including a data acquisition module, a protocol encapsulation module, an encryption scheduling module, an encryption processing module and a hardware acceleration module. The data acquisition module is responsible for adjusting the encryption time slot ratio using the TSN time slot dynamic allocation module, and obtaining the data frame to be encrypted, its priority information and encryption resource status information. The protocol encapsulation module is responsible for identifying the protocol type and encapsulating the data frame in a unified format. The encryption scheduling module configures an optimized encryption scheduling strategy based on the standardized data frame and encryption resource status information. The encryption processing module uses the optimized encryption scheduling strategy to encrypt the data frame. The hardware acceleration module is responsible for performing parallel decapsulation operations on the encrypted data frame.

[0057] In addition, if Figure 3 The present invention also provides an electronic device comprising a memory and a processor. The memory is configured to store at least one instruction, and the processor is configured to execute the instruction stored in the memory to implement the above-described method. Furthermore, the present invention also provides a computer-readable storage medium storing at least one instruction, which is executed by the processor in the electronic device to implement the above-described method.

[0058] In summary, the present invention achieves efficient collaboration between dynamic encryption scheduling and multi-protocol compatibility processing by introducing a TSN time slot dynamic allocation module, a protocol-independent middleware layer, and an FPGA hardware acceleration module. In practical applications, this method can not only flexibly adjust the proportion of encryption time slots according to the network load rate, thereby reducing resource waste while ensuring real-time performance, but also solve multi-protocol compatibility issues through unified format encapsulation, avoiding in-depth analysis of specific protocol fields. In addition, the FPGA hardware acceleration module significantly improves the efficiency of encryption and decapsulation through a parallel processing mechanism, further reducing overall latency. Therefore, the present invention can effectively solve the contradiction between real-time performance and security in TSN networks, and meet the needs of industrial scenarios for efficient, flexible, and low-cost solutions.

Claims

1. A real-time encryption collaborative scheduling method for TSN, characterized in that: The method comprises: Using a pre-built TSN timeslot dynamic allocation module, the proportion of encrypted timeslots is adjusted according to the real-time network load rate, and the adjustment result is sent to a pre-built TSN switching matrix, wherein the TSN switching matrix includes a data queue management unit and an encryption processing unit; Obtaining data frames to be encrypted and their priority information from the data queue management unit, and obtaining encryption resource status information from the encryption processing unit, wherein the data frames to be encrypted include control instruction data and ordinary service data, and the encryption resource status information includes hardware acceleration module availability and key cache status; Using a pre-built protocol-independent middleware layer, performing a protocol type identification operation on the data frame to be encrypted to obtain a protocol identifier, and encapsulating the data frame to be encrypted in a unified format according to the protocol identifier to obtain a standardized data frame; Configuring an optimized encryption scheduling strategy based on the standardized data frame and encryption resource status information; Utilizing the optimized encryption scheduling strategy, encrypting the standardized data frame to obtain an encrypted data frame; The encrypted data frames are decapsulated in parallel using a pre-built FPGA hardware acceleration module, and the decapsulated data frames are sent to the target device through the TSN switching matrix.

2. The TSN-oriented real-time encryption collaborative scheduling method according to claim 1, characterized in that: The obtaining of the data frames to be encrypted and their priority information in the data queue management unit, and the obtaining of the encryption resource status information in the encryption processing unit, includes: Using a pre-built AXI4 bus, the data frames to be encrypted and their priority information in the data queue management unit are sent to the protocol-independent middleware layer; The encryption resource status information in the encryption processing unit is sent to the TSN time slot dynamic allocation module using a pre-built PCIe interface.

3. The TSN-oriented real-time encryption collaborative scheduling method according to claim 1, characterized in that: The performing a protocol type identification operation on the data frame to be encrypted to obtain a protocol identifier includes: Analyzing the header field of the data frame to be encrypted to obtain a protocol signature code; Using a pre-built pattern matching engine, a rapid comparison operation is performed on the protocol feature code to obtain a protocol matching result; According to the protocol matching result, a corresponding protocol identifier is determined, wherein the protocol identifier supports EtherCAT and Profinet industrial communication protocols.

4. The TSN-oriented real-time encryption collaborative scheduling method according to claim 1, characterized in that: The configuring an optimized encryption scheduling strategy according to the standardized data frame and the encryption resource status information includes: Determining the availability of the current hardware acceleration module according to the encryption resource status information; When the hardware acceleration module is available, determining that the optimized encryption scheduling strategy is a first-category strategy; When the hardware acceleration module is unavailable, determining that the optimized encryption scheduling strategy is a second type of strategy; The first type of strategy includes using the FPGA hardware acceleration module to perform parallel encryption processing on the standardized data frame; The second type of strategy includes using a pre-built software encryption queue to perform batch encryption processing on the standardized data frames.

5. The TSN-oriented real-time encryption collaborative scheduling method according to claim 1, characterized in that: The step of encrypting the standardized data frame using the optimized encryption scheduling strategy to obtain an encrypted data frame includes: Performing a priority-based queue reordering operation on the standardized data frame; Selecting a corresponding encryption execution path according to the optimized encryption scheduling strategy; The encryption execution path is used to perform an encryption operation on the standardized data frame to generate the encrypted data frame, and the encrypted data frame is stored in a pre-built encryption buffer area.

6. The TSN-oriented real-time encryption collaborative scheduling method according to claim 1, characterized in that: The method of utilizing a pre-built FPGA hardware acceleration module to perform a parallel decapsulation operation on the encrypted data frame includes: Utilizing the parallel decapsulation unit in the FPGA hardware acceleration module to perform a protocol header parsing operation on the encrypted data frame; Extracting payload information from the encrypted data frame according to the parsing result; The payload information is repackaged into a target protocol format using a pre-built multiplexer and sent to a target device through the TSN switching matrix.

7. A real-time encryption collaborative scheduling system for TSN, characterized by: The system comprises: A data acquisition module is configured to use a pre-built TSN time slot dynamic allocation module to adjust the proportion of encryption time slots according to the real-time network load rate, and send the adjustment result to a pre-built TSN switching matrix, wherein the TSN switching matrix includes a data queue management unit and an encryption processing unit, and obtain the data frames to be encrypted and their priority information from the data queue management unit, and obtain the encryption resource status information from the encryption processing unit; A protocol encapsulation module is used to use a pre-built protocol-independent middleware layer to perform a protocol type identification operation on the data frame to be encrypted to obtain a protocol identifier, and encapsulate the data frame to be encrypted in a unified format according to the protocol identifier to obtain a standardized data frame; An encryption scheduling module, configured to obtain an optimized encryption scheduling strategy based on the standardized data frame and encryption resource status information; An encryption processing module, configured to perform encryption processing on the standardized data frame using the optimized encryption scheduling strategy to obtain an encrypted data frame; The hardware acceleration module is used to use a pre-built FPGA hardware acceleration module to perform a parallel decapsulation operation on the encrypted data frame, and send the decapsulated data frame to the target device through the TSN switching matrix.

8. The TSN-oriented real-time encryption collaborative scheduling system according to claim 7, characterized in that: The protocol encapsulation module further includes: A protocol identification unit is used to analyze the header field of the data frame to be encrypted to obtain a protocol feature code, and use a pre-built pattern matching engine to quickly compare the protocol feature code to obtain a protocol matching result; The encapsulation unit is used to determine the corresponding protocol identifier according to the protocol matching result, and encapsulate the data frame to be encrypted in a unified format according to the protocol identifier to obtain a standardized data frame.

9. An electronic device, characterized in that: The electronic device comprises: a memory storing at least one instruction; A processor executes instructions stored in the memory to implement the TSN-oriented real-time encryption collaborative scheduling method according to any one of claims 1 to 6.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores at least one instruction, and the at least one instruction is executed by a processor in an electronic device to implement the TSN-oriented real-time encryption collaborative scheduling method according to any one of claims 1 to 6.

Images