A dds-based secure vehicle-mounted communication method

Abstract

The application relates to the field of automobile electronics and communication technology and provides a safety vehicle-mounted communication method based on DDS, which comprises the following steps: dividing vehicle data into non-safety data, periodic safety data and non-periodic safety data; establishing a communication channel for each type of data; for a non-periodic transmission channel, a special protection scheme is adopted to detect a communication failure mode; a sender configures a life cycle for data, monitors the life cycle after sending the data, updates a life cycle overrun state when the data is discarded due to exceeding the life cycle, and replies based on an ACK / NACK mechanism; when the data is not confirmed in a timeout, the sender updates the life cycle overrun state; a listener is arranged at a receiver, a data loss communication failure event is detected when the listener detects the life cycle overrun state, and a communication management middleware notifies a safety application when the communication failure is detected. The application aims to solve the problems that existing schemes cannot distinguish data protection and cannot effectively detect non-periodic data.

Description

Technical Field

[0001] This invention relates to the field of automotive electronics and communication technology, and in particular to a secure in-vehicle communication method based on DDS. Background Technology

[0002] In the centralized E / E (Electrical / Electronic Architecture) architecture of modern automobiles, there is typically a central computing unit (HPC) and regional vehicle interface controllers (VIUs) or function control units (ECUs). These units need to exchange a large amount of data. Especially as regional hardware (such as VIUs) becomes standardized and the communication interface with the central computing unit tends to become standardized and decoupled, the reliability and security of data communication become crucial.

[0003] In existing technologies, end-to-end (E2E) technology is typically used to address the reliability and security issues of data communication, but it has the following limitations: First, the existing solution does not differentiate between data of different security levels, resulting in overprotection of insecure data or insufficient protection of security-critical data.

[0004] Second, there is a type of non-periodic data among secure data, characterized by random and discontinuous transmission time. E2E technology, however, relies on continuous counter verification logic. For example, the sender appends a continuously incrementing counter to each data frame, and the receiver checks the continuity of the counter to determine if data has been lost. Clearly, this verification logic is unsuitable for verifying non-periodic data. Summary of the Invention

[0005] The technical problem to be solved by the present invention is to provide a DDS-based secure vehicle communication method to address the above-mentioned deficiencies of the prior art. This method aims to solve the problems of existing communication schemes that do not differentiate between data protection, have unreasonable resource allocation, and cannot effectively detect non-periodic data.

[0006] To address the aforementioned technical problems, this invention proposes a secure vehicle communication method based on DDS, comprising the following steps: Vehicle data is classified according to safety relevance and transmission characteristics, into at least non-functional safety data, periodic functional safety data, and aperiodic functional safety data; a dedicated communication channel is established for each type of data, the communication channel including at least a non-functional safety transmission channel, a periodic functional safety transmission channel, and an aperiodic functional safety transmission channel; For non-functional safety transmission channels, configure a quality of service (QoS) policy that aims for low latency and high performance; For periodic functional safety transmission channels, an E2E protection mechanism is applied to detect failure modes during the communication process; For non-periodic functional safety transmission channels, a special non-periodic data protection scheme is employed to detect failure modes involved in non-periodic functional safety data during communication; the non-periodic data protection scheme includes: The sender configures a lifecycle for non-periodic functional safety data. After the data is sent, the sender synchronously monitors the lifecycle of the data. When the data is discarded due to exceeding its lifecycle, the sender updates the lifecycle expiration status. The receiver replies to the sender with acknowledgment / denial based on the ACK / NACK mechanism; when non-periodic functional safety data times out without acknowledgment, the sender updates the lifetime expired status; A listener is deployed at the receiving end. When the listener detects that the lifespan has expired, the receiving end perceives that the data has been discarded and detects a communication failure event of data loss. A communication middleware is set up between the application and the underlying communication protocol stack. When a communication failure is detected, the communication management middleware obtains and manages all communication channel failure events and sends notifications to security-related applications.

[0007] The beneficial effects of this invention are: 1. By classifying data into three categories—non-secure, periodic secure, and aperiodic secure—and configuring differentiated communication channels and quality of service policies, the optimal use of network bandwidth and computing resources is achieved while meeting security requirements, resulting in a good balance between performance, security, and cost. 2. In response to the challenge that traditional E2E protection mechanisms are mainly applicable to periodic data streams and cannot directly and effectively cover non-periodic (event-based) data, this invention proposes a specialized enhanced protection scheme, which significantly improves the functional safety integrity of cross-domain communication. 3. The secure vehicle communication method designed in this invention is particularly suitable for centralized architectures with standardized regional hardware (such as VIU) and decoupled interface from the central computing unit, meeting the management needs of different lifecycles of software and hardware. Attached Figure Description

[0008] The invention will now be further described with reference to the accompanying drawings.

[0009] Figure 1 This is a schematic diagram of the overall framework of DDS-based secure vehicle communication according to an embodiment of the present invention. Detailed Implementation

[0010] like Figure 1 As shown, this embodiment of the invention provides a secure in-vehicle communication method based on DDS (Data Distribution Service), including the following steps: S1. Classify the vehicle data according to safety relevance and transmission characteristics, into at least non-functional safety data, periodic functional safety data, and aperiodic functional safety data; establish a dedicated communication channel for each type of data, wherein the communication channel includes at least a non-functional safety transmission channel, a periodic functional safety transmission channel, and an aperiodic functional safety transmission channel. Specifically, data types can be identified and distinguished through explicit data identifiers or different service call interfaces.

[0011] S2, for non-functional safety transmission channels, configure a communication service quality policy aimed at low latency and high performance; Specifically, complex security verification mechanisms are not enforced for this channel to reduce overhead. This embodiment assigns a lower transmission priority to non-functional safety data, allowing the network layer to cache data for batch transmission during idle periods.

[0012] S3, for periodic functional safety transmission channels, an E2E protection mechanism is applied to detect failure modes during the communication process; Specifically, to ensure a balance between the performance and reliability of vehicle data, the system selects different levels of protocols to generate E2E checksums as needed to detect failure modes during communication. This includes: integrating and verifying in the lower-level communication protocol middleware (in this embodiment, the E2E verification strategy is integrated within the DDS protocol); integrating and verifying in the communication management middleware to adapt to the AUTOSAR SOMEIP protocol; and using a third-party library to generate and verify E2E checksums based on signal-level protection granularity.

[0013] The E2E (end-to-end) protection mechanism used in this embodiment conforms to the AUTOSAR E2E specification, including priority support for Profile 5 (CRC-16-CCITT, 0x1021 polynomial), and the ability to configure other profiles as needed. The E2E protection fields include: Counter, Data ID, and Cyclic Redundancy Check (CRC). The generation and verification of E2E fields can be implemented at different levels. Furthermore, the E2E check result status and the E2E state machine status provide detailed feedback to the application.

[0014] After performing E2E verification on the received data samples, the functional safety cross-domain communication management system can simultaneously return the content of the data (regardless of whether the verification result is correct) and the E2E verification result, including the following detailed E2E result check status and E2E state machine check status.

[0015] Detailed E2E result check status is used to indicate the verification result of a single data point, including: E2E_P05STATUS_OK indicates that the data is complete and the serial number is correct.

[0016] E2E_P05STATUS_OKSOMELOST indicates that some data sequence numbers are missing, but the loss is within the tolerance range.

[0017] E2E_P05STATUS_REPEATED indicates that the data sequence number is duplicated.

[0018] E2E_P05STATUS_ERROR indicates that there is an error in the data, such as a failed CRC check.

[0019] E2E_P05STATUS_WRONGSEQUENCE indicates that the serial number does not meet the incrementing requirement.

[0020] E2E_P05STATUS_NONEWDATA indicates that no new data is available. The primary purpose of E2E state machine checks is to accurately provide the operational status of COMM components to confirm the effectiveness of the corresponding E2E mechanism. Its states include: E2E_SM_DEINIT: Uninitialized state.

[0021] E2E_SM_NODATA: No data.

[0022] E2E_SM_INIT: Initialization state.

[0023] E2E_SM_VALID: Data valid status.

[0024] E2E_SM_INVALID: Data invalid status.

[0025] The communication management component configures timeout deadlines for both the sender and receiver for the corresponding data's fault tolerance period, including: The publisher fails to send data on time → triggers an event (on the publisher's side).

[0026] Subscribers do not receive data on time → Event triggered (subscriber side).

[0027] The detection of this timeout period is implemented by the low-level communication protocol middleware, for example: Deadline QoS configuration for the DDS protocol: When the underlying communication protocol uses DDS, or... The SOMEIP protocol's Entry Expiration mechanism indirectly achieves a similar function. Service providers (such as ECUs) periodically send service discovery messages (OfferService Entry). If subscribers do not receive updates within a certain period of time, they consider the service unavailable.

[0028] The communication management component can acquire and manage data delay events, send application alerts to security-related applications, and assist the system in entering a secure state.

[0029] Furthermore, the functional safety cross-domain communication management system is designed with robustness in mind to prevent functional unavailability due to communication interference. Interference in communication can cause transient failures, such as: (1) Some sequence numbers in the message sequence are skipped, but the skipped sequence is within the acceptable range.

[0030] (2) The message sequence has some repetitions, but the number of repetitions is within the allowable range.

[0031] (3) No new data has been received in the message, but it is within the allowable range.

[0032] To ensure that transient failure modes do not affect the safety objectives of the function, set the maximum tolerable counter difference (MaxDeltaCounterInit) and the maximum tolerable duplicate and no new data (MaxNoNewOrRepeatedData).

[0033] The above method adopts standardized AUTOSAR E2E protection, combined with timeout monitoring and configurable robust parameters, to effectively deal with problems such as data corruption, loss, out-of-order delivery, and delay, and can tolerate a certain amount of transient network interference, thereby improving the availability of the system.

[0034] S4. For non-periodic functional safety transmission channels, a special non-periodic data protection scheme is adopted to detect the failure modes involved in non-periodic functional safety data during communication. Specifically, periodic data involves eight failure modes: information duplication, information loss, information delay, information spoofing or incorrect address, information corruption, information communication channel blockage, asymmetric information, and some receivers failing to receive information. Especially regarding information loss and information duplication, the E2E mechanism based on continuous counters has limitations.

[0035] The non-periodic data protection scheme includes: The sender configures a lifecycle for non-periodic functional safety data. After the data is sent, the sender synchronously monitors the lifecycle of the data. When the data is discarded due to exceeding its lifecycle, the sender updates the lifecycle expiration status. The receiver replies to the sender with acknowledgment / denial based on the ACK / NACK mechanism; when non-periodic functional safety data times out without acknowledgment, the sender updates the lifetime expired status; A listener is deployed at the receiving end. When the listener detects that the lifespan has expired, the receiving end perceives that the data has been discarded and detects a communication failure event of data loss. Specifically, the sending Data Writer configures a lifespanDuration for non-periodic functional safety data. In this embodiment, the configured lifespanDuration = Fault Tolerance Time Interval (FTTI) for safety data - the user-set offset. In this way, the effective lifespan of the event data is ensured to be slightly shorter than its diagnostic interval, which satisfies the FTTI's requirement for data timeliness and also reserves processing redundancy through the offset to prevent data from becoming invalid due to transmission delays and not being processed in time during the diagnostic period.

[0036] After the data is sent, the sender synchronously monitors the lifecycle of the data; when the data is discarded due to exceeding its lifecycle, the sender updates the Lifespan Exceeded Status. The receiver replies to the sender with acknowledgment / denial (ACK / NACK) based on the ACK / NACK mechanism; when non-periodic functional safety data times out without acknowledgment, the sender updates the lifetime expired status; A Data Reader Listener is deployed on the receiving Data Reader; when the listener detects that the data has been discarded, the receiving end senses that the data has been lost. When a communication failure is detected, the communication management middleware notifies security-related applications; the communication management middleware acquires and manages all communication failure events detected by all communication channels.

[0037] In one implementation, when detecting failure modes involved in non-periodic functional safety data during communication, if the receiver fails to receive the non-periodic functional safety data correctly, the sender retransmits the data; if the retransmitted data is still not received correctly, the sender updates the lifetime expired status.

[0038] In one implementation, the non-periodic data protection scheme further includes: The sender also sends heartbeat messages to the receiver via a heartbeat mechanism. The receiver responds to the sender with acknowledgment / denial based on the ACK / NACK mechanism. If the receiver replies with denial, a communication failure event due to communication link congestion is detected. The receiver monitors the sender's heartbeat signal; if the sender fails to send a heartbeat message within a preset heartbeat period, a communication failure event due to sender inactivity is detected. This method of configuring a Liveliness QoS Policy can effectively detect sender inactivity or prolonged communication link congestion, which is crucial for ensuring the availability of the event channel.

[0039] In one implementation, the sender embeds the timestamp of the most recent lifetime overdue state into the heartbeat message. Upon receiving the message, the receiver replies to the sender with an acknowledgment / denial carrying the timestamp of the most recent lifetime overdue state. If the sender finds by comparing the timestamps that the timestamp replied by the receiver is not the timestamp of the most recent lifetime overdue state embedded in the heartbeat message by the sender, then a communication failure event of receiver listener failure is detected.

[0040] Specifically, the proper functioning of the aforementioned comparison mechanism should be monitored and managed by health management. This is to account for extreme cases where the listener might fail to trigger correctly due to software errors, resource contention, buffer overflows, or other reasons, resulting in the inability to detect data loss. In such cases, the receiver might be unable to process data loss in a timely manner, thereby affecting security features.

[0041] In one implementation, the heartbeat cycle is accelerated when the number of data / messages that fail to be received correctly exceeds a preset threshold. In this case, changing the normal heartbeat period to a fast heartbeat period enables the receiver to detect the loss of event-related data more quickly.

[0042] In one implementation, the non-periodic data protection scheme further includes: A globally unique Data ID is set for non-periodic functional safety data, and a CRC check is performed on the data. If the Data ID of the received data does not match the preset globally unique identifier, or the CRC check result is inconsistent with the check value carried by the data, a communication failure event of information corruption, spoofing, or address error is detected. When sending non-periodic functional safety data, the sender configures redundant transmission to combat data loss caused by network transient interference; The DDS protocol automatically identifies duplicate information caused by network retransmission or active redundant transmission through its built-in sequence number mechanism. When duplicate information is detected, the receiver retains only the first valid sample. The sender embeds a timestamp when sending aperiodic functional safety data, and the receiver also embeds a timestamp when replying with acknowledgment / denial based on the ACK / NACK mechanism. If the sender detects that the difference between its own timestamp when sending data and the timestamp in the receiver's reply message exceeds a preset delay threshold, a communication failure event due to information delay is detected. Specifically, the calculation method is as follows: Delay = Receive timestamp (local clock) - Send timestamp Delay determination: If the delay is greater than the delay threshold, the message is sent to security-related applications and marked as a delay event.

[0043] Meanwhile, the sender's Lifespan mechanism can also discard data and notify the receiver when the data is delayed for too long (exceeding its lifespan) due to internal reasons of the sender, providing another layer of delay protection.

[0044] In one implementation, the sender and receiver should maintain a consistent time base. This embodiment uses gPTP to achieve sender / receiver clock synchronization and strictly control errors.

[0045] In one implementation, the aperiodic data protection scheme is configured based on the application ID, facilitating dynamic adjustment and function migration. Furthermore, security parameters such as E2EProfile, robustness thresholds, redundancy policies, and time parameters can be added to enhance the applicability of the protection scheme, tailored to different application scenarios and security requirements.

[0046] S5 sets up a communication middleware between the application and the underlying communication protocol stack. When a communication failure is detected, the communication management middleware acquires and manages failure events for all communication channels and sends notifications to security-related applications. The security-related applications then take appropriate measures based on the received failure events.

Claims

1. A DDS-based secure vehicle communication method, comprising the following steps: Vehicle data is classified according to safety relevance and transmission characteristics, into at least non-functional safety data, periodic functional safety data, and aperiodic functional safety data; a dedicated communication channel is established for each type of data, the communication channel including at least a non-functional safety transmission channel, a periodic functional safety transmission channel, and an aperiodic functional safety transmission channel; For non-functional safety transmission channels, configure a quality of service (QoS) policy that aims for low latency and high performance; For periodic functional safety transmission channels, an E2E protection mechanism is applied to detect failure modes during the communication process; For non-periodic functional safety transmission channels, a special non-periodic data protection scheme is adopted to detect the failure modes involved in non-periodic functional safety data during communication. The non-periodic data protection scheme includes: The sender configures a lifecycle for non-periodic functional safety data. After the data is sent, the sender synchronously monitors the lifecycle of the data. When the data is discarded due to exceeding its lifecycle, the sender updates the lifecycle expiration status. The receiver replies to the sender with acknowledgment / denial based on the ACK / NACK mechanism; when non-periodic functional safety data times out without acknowledgment, the sender updates the lifetime expired status; A listener is deployed at the receiving end. When the listener detects that the lifespan has expired, the receiving end senses that the data has been discarded and detects a communication failure event of data loss. A communication management middleware is set up between the application and the underlying communication protocol stack. When a communication failure is detected, the communication management middleware obtains and manages all communication channel failure events and sends notifications to security-related applications.

2. The DDS-based secure vehicle communication method as described in claim 1, characterized in that: When detecting failure modes involved in non-periodic functional safety data during communication, if the receiver fails to receive the non-periodic functional safety data correctly, the sender retransmits the data; if the retransmitted data is still not received correctly, the sender updates the lifetime overdue status.

3. The DDS-based secure vehicle communication method as described in claim 1, characterized in that: The non-periodic data protection scheme also includes: The sender also sends heartbeat messages to the receiver via a heartbeat mechanism. The receiver replies to the sender with acknowledgment / denial based on the ACK / NACK mechanism. If the receiver replies with denial, a communication failure event of communication link blockage is detected. The receiver monitors the sender's heartbeat signal. If the sender fails to send a heartbeat message within the preset heartbeat period, a communication failure event of sender inactivity is detected.

4. The DDS-based secure vehicle communication method as described in claim 3, characterized in that: The sender embeds the timestamp of the most recent lifetime expired state into the heartbeat message. Upon receiving this message, the receiver replies to the sender with an acknowledgment / denial carrying the timestamp of the most recent lifetime expired state. If the sender finds by comparing the timestamps that the timestamp replied by the receiver is not the timestamp of the most recent lifetime expired state embedded in the heartbeat message by the sender, then a communication failure event of receiver listener failure is detected.

5. A DDS-based secure vehicle communication method as described in claim 3, characterized in that: When the number of data or messages that fail to be received correctly exceeds a preset threshold, the heartbeat cycle is accelerated.

6. A DDS-based secure vehicle communication method as described in claim 3, characterized in that: The non-periodic data protection scheme also includes: A globally unique Data ID is set for non-periodic functional safety data, and CRC check is performed on the data. If the Data ID of the received data does not match the preset globally unique identifier, or the CRC check result is inconsistent with the check value of the data itself, a communication failure event of information corruption, spoofing, or address error is detected. When sending non-periodic functional safety data, the sender configures redundant transmission to combat data loss caused by network transient interference; The DDS protocol automatically identifies duplicate information caused by network retransmission or active redundant transmission through its built-in sequence number mechanism. When duplicate information is detected, the receiver retains only the first valid sample. When the sender transmits non-periodic functional safety data, it embeds a timestamp. When the receiver replies with acknowledgment / denial based on the ACK / NACK mechanism, it also embeds a timestamp. If the sender finds that the difference between its own timestamp when transmitting data and the timestamp in the receiver's reply message exceeds a preset delay threshold, it detects a communication failure event due to information delay.

7. A DDS-based secure vehicle communication method as described in claim 6, characterized in that: The sender and receiver should maintain the same time base.

8. A DDS-based secure vehicle communication method as described in claim 6, characterized in that: Configure the non-periodic data protection scheme based on the application ID.

Images