System and method for data frame transmission in aviation network

Abstract

The invention relates to a system and method for data frame transmission in an aviation network. According to the method, a key configuration table is constructed, the key configuration table can comprise a frame number and a default key corresponding to the frame number, a data frame in the aviation network is obtained, the frame number of the data frame and the length of actual data in a payload field in the data frame are determined, and the payload field of the data frame is determined. And generating a transmission key with a corresponding length according to the key configuration table based on the frame number, and encrypting and decrypting the payload field at the sending end and the receiving end by using the transmission key.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of aviation network transmission, in particular to a system and method for data frame transmission in aviation network. BACKGROUND

[0002] In the current aviation network, data transmission is carried out in the form of data frames through virtual links (VL), and the data frame structure contains sensitive data frame fields, such as the payload field in the data frame. In order to improve information security, the payload of the user application message must be encrypted and protected. However, traditional encryption methods often focus on the level of the entire frame and do not protect other protocol fields in a fine-grained manner, which poses a risk of information leakage. In addition, different data frame lengths and sequence numbers also cause difficulties in aligning data at the decryption end, affecting the decryption effect. In addition, the traditional encryption process has side effects on frame length, affecting the bandwidth allocation gap (BAG) scheduling in the aviation network.

[0003] Therefore, there is an urgent need for a method and system for further improving the existing data frame transmission encryption scheme in the aviation network. SUMMARY

[0004] The summary is provided to introduce some concepts that will be further described in the following detailed description section. The summary is not intended to identify key or essential features of the claimed subject matter, nor is it intended to be used to determine the scope of the claimed subject matter.

[0005] In order to solve the problems in the prior art, the present application discloses an improved method and system. In the method disclosed in the present application, a key configuration table is constructed, which can include frame sequence numbers and a default key corresponding to each frame sequence number, a data frame in the aviation network is obtained and the frame sequence number of the data frame and the length of the actual data in the payload field of the data frame are determined, a transmission key of the corresponding length is generated based on the frame sequence number according to the key configuration table, and the transmission key is used for encryption and decryption of the payload field at the sending end and the receiving end. The system disclosed in the present application can include a key configuration table module, a frame length and frame sequence number detection module, a key generation module, and a data frame field encryption and decryption module.

[0006] Specifically, in the first aspect of the present application, a method for data frame transmission in aviation network is disclosed, which can include:

[0007] constructing a key configuration table, the key configuration table including frame sequence numbers and a default key with a preset length corresponding to each frame sequence number;

[0008] obtaining a data frame in an aeronautical network and determining a frame sequence number of the data frame and a field length of a payload field therein;

[0009] generating a transmission key of a corresponding length according to the key configuration table based on the determined frame sequence number and field length;

[0010] encrypting the payload field using the transmission key at a sending end in the aeronautical network; and

[0011] decrypting the encrypted payload field using the transmission key at a receiving end in the aeronautical network.

[0012] In an optional implementation, the default key in the key configuration table can be a pseudo-random sequence, and the key configuration table includes all frame sequence numbers used in the aeronautical network. Thus, by constructing the key configuration table, the key used by the Payload data frame field under a specific frame sequence number is predefinedly bound.

[0013] In an optional implementation, obtaining the data frame can further include reading the data frame from a sub-virtual link (sub-VL) buffer in the aeronautical network based on a polling mechanism, and determining the field length further includes monitoring and extracting payload data in the payload field in a data link layer in a communication protocol stack of the aeronautical network and determining a length of actual data excluding padding bytes in the payload data. Thus, accurate identification and control of the data frame field length boundary are achieved, effectively avoiding the problem of misdecoding due to field length mismatch, and ensuring the integrity and protocol compatibility of data transmission.

[0014] In an optional implementation, generating the transmission key can further include:

[0015] performing a table lookup operation on the key configuration table according to the determined frame sequence number to determine whether a length of the default key corresponding to the frame sequence number matches the length of the actual data;

[0016] in the case of matching, extracting the default key as the transmission key; and

[0017] in the case of not matching, generating a transmission key consistent with the length of the actual data in a pseudo-random manner. Thus, the key table lookup mechanism based on frame sequence number indexing is significantly improved in encryption and decryption efficiency and accuracy, and the key matching the field length is dynamically generated according to the field length, thereby ensuring that the lengths of the fields after encryption and decryption processing remain consistent.

[0018] In an alternative implementation, generating the transmission key can further include re-generating the transmission key in a pseudo-random manner in a subsequent round of the frame sequence number, regardless of whether the length of the actual data matches the length of the transmission key in the previous round.

[0019] In an alternative implementation, encrypting the payload field can further include:

[0020] performing an exclusive OR operation on the actual data using the transmission key to generate the ciphertext; and

[0021] replacing the actual data with the generated ciphertext in a sending buffer at a sending end.

[0022] In an alternative implementation, decrypting the encrypted payload field can further include:

[0023] performing an exclusive OR operation on the ciphertext using the transmission key to recover the actual data; and

[0024] replacing the ciphertext with the actual data in a receiving buffer at a receiving end. In this way, the sending end and the receiving end can directly look up a matching key in the configuration table according to the current frame sequence number, complete the encryption and decryption processes, and the encryption and decryption processes do not affect the receiving rhythm of data frames in the end system, do not change the data buffer structure, and do not introduce additional communication protocol stack processing procedures, while ensuring the encryption and decryption security mechanism, fully compatible with the current aviation network computing resources and transmission resource configuration, and guaranteeing the stability and real-time performance of the communication system.

[0025] In a second aspect of the present disclosure, a system for data frame transmission in an aviation network is disclosed, which can include:

[0026] a key configuration table module configured to build a key configuration table including frame sequence numbers and a default key with a preset length corresponding to each frame sequence number;

[0027] a frame length and frame sequence number detection module configured to obtain a data frame in the aviation network and determine a frame sequence number of the data frame and a field length of a payload field therein;

[0028] a key generation module configured to generate a transmission key with a corresponding length according to the key configuration table based on the determined frame sequence number and field length;

[0029] a data frame field encryption and decryption module configured to:

[0030] encrypt the payload field using the transmission key at a sending end in the aviation network; and

[0031] The transmission key is used at a receiving end in the aerial network to decrypt the encrypted payload field.

[0032] In an alternative embodiment, the frame length and frame number detection module can be further configured to obtain the data frame by reading the data frame from a sub virtual link (subVL) buffer in the aerial network based on a polling mechanism, and the frame length and frame number detection module can be further configured to determine the field length by monitoring and extracting payload data in the payload field at a data link layer in a communication protocol stack of the aerial network, and determining a length of actual data in the payload data that does not include padding bytes. Thus, when the data frame is scheduled in a BAG of a virtual link (VL), extracting the data frame at the data link layer instead of in the VL can avoid network scheduling congestion caused by extracting the payload data.

[0033] In an alternative embodiment, the key generation module can be further configured to generate the transmission key by:

[0034] performing a table lookup operation on the key configuration table according to the determined frame number to determine whether a length of a default key corresponding to the frame number matches the length of the actual data;

[0035] extracting the default key as the transmission key in case of a match; and

[0036] generating a transmission key in a pseudo-random manner that is consistent with the length of the actual data in case of a mismatch.

[0037] In an alternative embodiment, the key generation module can be further configured to generate the transmission key by: re-generating the transmission key in a pseudo-random manner that is consistent with the length of the actual data in a subsequent round of the frame number, regardless of whether the length of the actual data matches the length of the transmission key in a previous round.

[0038] In an alternative embodiment, the data frame field encryption and decryption module can be further configured to encrypt the payload field by:

[0039] performing an exclusive OR operation on the actual data using the transmission key to generate ciphertext; and

[0040] replacing the actual data with the generated ciphertext in a sending buffer at a sending end.

[0041] In an alternative embodiment, the data frame field encryption and decryption module can be further configured to decrypt the encrypted payload field by:

[0042] performing an exclusive OR operation on the cipher text using the transmission key to recover the actual data; and

[0043] replacing the cipher text with the actual data in a receive buffer at a receiving end.

[0044] In a third aspect of the present application, a computer readable storage medium having stored thereon instructions includes:

[0045] instructions for constructing a key configuration table including frame sequence numbers and a default key having a preset length corresponding to each frame sequence number;

[0046] instructions for obtaining a data frame in an aerial network and determining a frame sequence number of the data frame and a field length of a payload field therein;

[0047] instructions for generating a transmission key of a corresponding length according to the key configuration table based on the determined frame sequence number and field length;

[0048] instructions for using the transmission key to encrypt the payload field at a transmitting end in the aerial network; and

[0049] instructions for using the transmission key to decrypt the encrypted payload field at a receiving end in the aerial network.

[0050] Other aspects, features, and embodiments of the present application will become apparent to those of ordinary skill in the art, upon reviewing the description of specific, exemplary embodiments of the present application in conjunction with the accompanying figures. While features of the present application can be discussed relative to certain embodiments and figures below, all embodiments of the present application can include one or more of the advantageous features discussed herein. In other words, while one or more embodiments can be discussed as having certain advantageous features, one or more of such features can also be used in accordance with the various embodiments of the application discussed herein. In similar fashion, while exemplary embodiments can be discussed herein as devices, apparatus, or methods, it should be understood that such exemplary embodiments can be implemented in various devices, apparatus, and methods. BRIEF DESCRIPTION OF DRAWINGS

[0051] So that the manner in which the above-recited features of the present disclosure can be understood in detail, a more particular description, briefly summarized above, can be had by reference to various aspects. It is to be

[0052] Figure 1is a schematic block diagram of a system for data frame transmission in an aeronautical network according to one embodiment of the present disclosure.

[0053] Figure 2 is a data flow diagram of the modules in a system for data frame transmission in an aeronautical network according to one embodiment of the present disclosure.

[0054] Figure 3 is a schematic diagram showing how the modules in a system for data frame transmission in an aeronautical network according to one embodiment of the present disclosure are integrated with the communication protocol stack architecture of the aeronautical network.

[0055] Figure 4 is a flow diagram of a method for data frame transmission in an aeronautical network according to one embodiment of the present disclosure. DETAILED DESCRIPTION

[0056] Various embodiments will be described in detail below with reference to the attached drawings. Various embodiments can be implemented in many different forms and should not be construed as limited to the embodiments set forth herein; rather, these embodiments are provided so that this disclosure will be thorough and complete, and fully convey the scope of the embodiments to those skilled in the art. Embodiments can be implemented as a method, apparatus, or article of manufacture using hardware, software, or both. Accordingly, the embodiments can take the form of a hardware implementation, a software implementation, or a combination of both. The detailed description set forth below is therefore not limiting of the embodiments.

[0057] The steps in the flowcharts can be performed by hardware (e.g., a processor, engine, memory, circuitry), software (e.g., an operating system, application, driver, machine / processor executable instructions), or a combination thereof. As will be appreciated by one of ordinary skill in the art, the methods involved in the embodiments can include more or fewer steps than shown.

[0058] The prior art generally uses AES, CTR or GCM mode to perform end-to-end encryption on payload data, but the following problems exist: the payload data frame field is not uniformly encrypted, and there is a security loophole; the frame structure after encryption is inconsistent with the original frame, increasing the complexity of frame demodulation; the frame length and sequence number are not matched for verification, affecting the accuracy of decryption discrimination; and there is a lack of a system mechanism that can dynamically configure the key length. In view of the above technical problems, the present application provides a scheme suitable for use in an aviation network (such as ARINC664, etc.) and having high flexibility and high security for encrypting, decrypting and replacing data frame fields for secure data frame transmission, solving the problems of encryption of payload data frame fields, decryption accuracy difficulty, and inconsistent frame structure in the prior art. By constructing a unified "encryption-decryption-replacement" framework during data frame transmission, the data security guarantee capability of the aviation network under complex tasks is improved.

[0059] Aspects of the application will be described in detail below.

[0060] Figure 1 is a schematic block diagram of a system 100 for data frame transmission in an aviation network according to one embodiment of the present disclosure.

[0061] In one embodiment of the present application, the system 100 for data frame transmission in an aviation network can include a key configuration table module 102, a frame length and frame sequence number detection module 104, a key generation module 106, and a data frame field encryption and decryption module 108.

[0062] In this embodiment, the key configuration table module 102 can be configured to construct a key configuration table. The key configuration table can include the frame sequence numbers of the data frames and a default key with a preset length corresponding to each frame sequence number, i.e., the frame sequence number and the key have a one-to-one mapping relationship in the key configuration table. The default key can have any key value, and the preset length of the default key can be any suitable length, as an example but not limitation, the preset length can be determined according to the sub virtual link (subVL) in the aviation network, because the payload size in one subVL is usually the same.

[0063] In an alternative embodiment, the default key in the key configuration table can be a pseudo-random sequence (i.e., a random sequence key) or any other suitable key, and the key configuration table can include all frame sequence numbers used in the aviation network, such as 0-255 or any other suitable frame sequence number range.

[0064] Thus, by constructing the key configuration table, the key used by the payload data frame field under a specific frame sequence number is predefined and bound for the sender and the receiver to directly look up the matching key in the key configuration table according to the current frame sequence number, so as to complete the encryption and decryption process. Although the traditional key lookup table mechanism based on time index can meet the basic encryption and decryption requirements, there is a long key negotiation delay. Compared with the traditional key lookup table mechanism based on time index, the key lookup table mechanism based on frame sequence number index in the present application can ensure that the receiver and the sender look up the table and accurately read the required key according to the frame sequence number, thereby significantly improving the encryption and decryption efficiency and accuracy.

[0065] In this embodiment, the frame length and frame sequence number detection module 104 can be configured to obtain a data frame in the aerial network and determine the frame sequence number of the data frame and the field length of the payload field therein. In an optional implementation, the frame length and frame sequence number detection module 104 can read the data frame from the subVL buffer in the aerial network based on a polling mechanism, and monitor and extract the payload data in the payload field in the data frame in the data link layer in the communication protocol stack of the aerial network, and determine the length of the actual data (i.e., real data) in the payload data excluding padding bytes, for alignment processing of the payload padding. In this implementation, by way of example but not limitation, the payload frame length ranges from 17 to 1471 Bytes (bytes), and the frame length and frame sequence number detection module 104 can monitor that the payload data minus padding (padding: 0x00 / 0xFF, etc.) is equal to the original Bytes size (i.e., the actual byte size). The above-mentioned calculation method of the actual data length can be referred to as the minus padding (padding 0x00 or 0xFF) mechanism, which is used to unify the length standard (the length standard is unified to the actual data length in the payload data, rather than the length of the entire payload data), so as to ensure that the key and the data are completely aligned. This calculation method also reduces the number of key bits (because the length of the key is equal to the actual data length in the payload data), reduces the waste of computing resources, reduces the bandwidth during the encryption field, and reduces the bandwidth operation of the network.

[0066] In this embodiment, the key generation module 106 can be configured to generate a transmission key with a corresponding length according to the key configuration table based on the determined frame sequence number and field length.

[0067] In an alternative embodiment, the key generation module 106 can perform a table lookup operation on the key configuration table according to the determined frame number to determine whether the length of the default key corresponding to the frame number matches the length of the actual data. In the case of a match, the key generation module 106 can directly extract the default key as the transmission key; in the case of a mismatch, the key generation module 106 can generate a transmission key in a pseudo-random manner that is consistent with the length of the actual data.

[0068] In this embodiment, after the key configuration table is created, when a frame number in the key configuration table is first indexed, the key generation module 106 can first determine whether the length of the default key corresponding to the frame number is equal to the frame length and the actual data length in the payload data determined by the frame number detection module 104. If so, the key generation module 106 can extract the default key as the transmission key; if not, the key generation module 106 can generate a key in a pseudo-random manner that is consistent with the length of the actual data in the payload field as the transmission key, rather than directly extracting the default key.

[0069] In the above embodiments, the frame number can be 0-255 or any other suitable frame number range, the data frames are sequentially sent with frame numbers 0, 1, 2,..., 244, 255, the first round is completed, and the frame number of the next sent data frame is 0, and so on for the frame number rotation of the next round. As can be understood by those skilled in the art, the above frame number range and rotation method are merely exemplary and not limiting, and in other alternative embodiments, any other suitable frame number range and rotation method can also be used.

[0070] In an alternative embodiment, the frame length and frame number detection module 104 can be further configured to regenerate in a pseudo-random manner a transmission key consistent with the length of the actual data (i.e., the length of the actual data in the payload data in the subsequent rounds) in the subsequent rounds of the frame number (i.e., all subsequent rounds except the first round), regardless of whether the length of the actual data matches the length of the transmission key in the previous round. In other words, after the frame number is traversed in the first round, in the subsequent rounds starting from the second round, the keys corresponding to all frame numbers, including the default key and the newly generated transmission key, are no longer used or extracted, regardless of whether the length of the actual data determined in these subsequent rounds matches the length of the key in the key configuration table. Thus, after each round of sequence numbers (such as 0-255) is completed, the same length of key is regenerated (updated) even if the length is consistent when the next round (such as 0-255 sequence numbers) and subsequent rounds are performed, avoiding the use of old keys, and thus enabling dynamic adjustment of key content according to the above key rolling strategy to achieve long-term security control.

[0071] In this embodiment, the data frame field encryption / decryption module 108 can be configured to encrypt the payload field using the transmission key at the transmitting end in the aviation network, and decrypt the encrypted payload field using the transmission key at the receiving end in the aviation network.

[0072] In an alternative implementation, the data frame field encryption / decryption module 108 can encrypt the payload field by performing an XOR operation on the actual data using the transmission key to generate ciphertext (encryption: ciphertext = payload actual data ^ transmission key), and replacing the actual data with the generated ciphertext in the transmitting buffer (Tx Buffer) at the transmitting end. In this implementation, the data frame field encryption / decryption module 108 can replace the original frame content in the transmitting buffer in situ by the above operation (i.e., replace the actual bytes in the payload data with ciphertext of the same length), without affecting the scheduling structure, i.e., the replaced data frame maintains the original frame structure.

[0073] In an alternative implementation, the data frame field encryption / decryption module 108 can decrypt the encrypted payload field by performing an XOR operation on the ciphertext using the transmission key to restore the actual data (decryption: payload actual data = ciphertext ^ transmission key), and replacing the ciphertext with the actual data in the receiving buffer (Rx Buffer) at the receiving end. In this implementation, the data frame field encryption / decryption module 108 can replace the ciphertext content in the transmitting buffer in situ by the above operation (i.e., replace the ciphertext in the payload data with actual data of the same length), without affecting the scheduling structure, i.e., the replaced data frame maintains the original frame structure. The data frame field encryption / decryption module 108 can implement a "decode-replace" operation on the encrypted field in the Rx Buffer and update the replaced data in situ in the Rx Buffer for use by the subsequent application processing flow. In addition, the data frame field encryption / decryption module 108 can directly perform the inverse XOR operation to complete decryption. Thus, frame field-level encryption of frame field A using key B can be implemented to generate ciphertext C, and this encryption method has symmetric reversibility, and the original value A of the frame field can be directly recovered from C at the receiving end (i.e., A ^ B = C, C ^ B = A). Since the encryption / decryption operations are synchronized using the frame sequence number as the unique index, they do not need to rely on any context state or specific identification, greatly simplifying the encryption / decryption flow and improving system robustness.

[0074] Figure 2This is a data flow diagram of the modules in a system for data frame transmission in an aviation network according to an embodiment of the present disclosure. These modules include a key configuration table module, a frame length and frame sequence number detection module, a key generation module, and a data frame field encryption / decryption module.

[0075] like Figure 2 As shown, the key configuration table module can create a key configuration table, including configuring the length of the key required for the payload data. Each frame number corresponds to a default key (preset length is N bits), and the frame number can include, for example, 0-255.

[0076] Application data accesses the subVL buffer of the aviation network through the communication service COM. The frame length and frame sequence number detection module can read frame data from the subVL buffer based on a polling mechanism and (at the data link layer of the communication protocol stack of the aviation network) monitor and extract the payload data therein, determine the frame length of the payload data (i.e., the length of the actual payload data excluding padding bytes) and the frame sequence number (which can be in the header of the payload field or other positions), and pass the determined frame length and frame sequence number to the key generation module.

[0077] The key generation module generates a transmission key based on the frame length and frame sequence number from the frame length and sequence number detection module. This generated transmission key is then passed to the data frame field encryption / decryption module. The module synchronizes this transmission key to both the receiving and receiving ends based on the frame sequence number. This means that both the sending and receiving ends use the same corresponding transmission key for encryption and decryption based on the same frame sequence number in the key configuration table. However, the transmission key itself is not transmitted to the receiving or sending ends via the key generation module. Instead, synchronization is achieved by updating the key configuration table in the runtime RAM at both the sending and receiving ends. This synchronization can be performed by the end-system operating software (OPS) at both the sending and receiving ends. In addition to synchronizing the transmission key, the frame sequence number rounds can also be synchronized to ensure that the key configuration table update occurs within the same frame sequence number round.

[0078] The data frame field encryption / decryption module can use this key to encrypt and replace payload data (at the sending end) and decrypt and replace payload data (at the receiving end).

[0079] Figure 3 This is a schematic diagram illustrating how the modules in a system for data frame transmission in an aviation network according to an embodiment of the present disclosure are integrated with the communication protocol stack architecture of the aviation network. These modules include a frame length and frame sequence number detection module, a key generation module, and a data frame field encryption / decryption module.

[0080] In one exemplary embodiment of the present invention, such as Figure 3 As shown, user application data is first generated at the application layer of the communication protocol stack, and then the data is encapsulated at the network layer with IP / UDP and port binding.

[0081] Subsequently, a data frame structure (MAC frame structure) is constructed at the data link layer (MAC) and a frame sequence number is added. At this point, the frame length and frame sequence number detection module can detect and acquire the data frame at the data link layer and determine its frame sequence number and the length of the payload field, i.e., the length of the actual data in the payload excluding padding bytes. The key generation module can then generate a transmission key based on this length and frame sequence number.

[0082] The data frame field encryption / decryption module can use the transmission key at the transport layer to encrypt and decrypt the data frame (specifically, the actual data in the payload field of the data frame excluding padding bytes) and perform in-situ replacement in TxBuffer and Rx Buffer. The replacement delay is less than 1 microsecond, which is stable and efficient.

[0083] Finally, at the hardware layer, the data frame (MAC frame) is written to the Tx Buffer and submitted to the MAC controller for transmission.

[0084] In this exemplary embodiment, the frame length and frame sequence number detection module, the key generation module, and the data frame field encryption / decryption module can be deployed in the runtime RAM of the end system and scheduled by the end system OPS to complete their respective operations.

[0085] Figure 4 This is a flowchart of a method 400 for data frame transmission in an aviation network according to an embodiment of the present disclosure.

[0086] like Figure 4 As shown, method 400 begins at step 402, constructing a key configuration table that includes frame sequence numbers and a default key of a preset length corresponding to each frame sequence number. In an optional implementation, the default key in the key configuration table may be a pseudo-random sequence, and the key configuration table includes all frame sequence numbers used in the aviation network.

[0087] Next, method 400 continues to step 404, acquiring a data frame from the aviation network and determining the frame sequence number and the length of the payload field within the data frame. In an optional implementation, this step may further include: reading the data frame from the subVL buffer in the aviation network based on a polling mechanism; and monitoring and extracting the payload data in the payload field at the data link layer of the communication protocol stack of the aviation network, and determining the length of the actual data in the payload data excluding padding bytes.

[0088] Subsequently, method 400 continues to step 406, generating a transmission key of the corresponding length according to the key configuration table based on the determined frame sequence number and field length. In an optional embodiment, this step may further include: performing a lookup operation on the key configuration table according to the determined frame sequence number to determine whether the length of the default key corresponding to the frame sequence number matches the length of the actual data; if they match, extracting the default key as the transmission key; and if they do not match, generating a transmission key with the same length as the actual data in a pseudo-random manner. In another optional embodiment, this step may further include: in subsequent rounds of the frame sequence number, regenerating a transmission key with the same length as the actual data in a pseudo-random manner, regardless of whether the length of the actual data matches the length of the transmission key in previous rounds.

[0089] Then, method 400 continues to step 408, whereby the transmission key is used at the sending end in the aviation network to encrypt the payload field. In an alternative implementation, this step may further include: performing an XOR operation on the actual data using the transmission key to generate ciphertext; and replacing the actual data with the generated ciphertext in the sending buffer at the sending end.

[0090] Finally, method 400 continues to step 410, whereby the transmission key is used at the receiving end in the aviation network to decrypt the encrypted payload field. In an alternative implementation, this step may further include: performing an XOR operation on the ciphertext using the transmission key to restore the actual data; and replacing the ciphertext with the actual data in the receiving buffer at the receiving end.

[0091] After step 410, method 400 ends.

[0092] In summary, this invention relates to a technical solution for encrypting, decrypting, and replacing data frame fields in aviation networks for secure data frame transmission, aiming to improve the overall security of data during air-to-ground communication. Unlike traditional methods that only encrypt and decrypt at the frame level, this invention proposes a mechanism for encrypting, decrypting, and replacing payload data in the payload frame field. Through the coordinated design of various modules, it ensures real-time performance, encryption / decryption accuracy, and structural compatibility during transmission.

[0093] The embodiments of the present invention have been described above with reference to block diagrams and / or operational descriptions of methods and apparatus according to embodiments of the present invention. The functions / actions indicated in the blocks may appear in a different order than shown in any flowchart. For example, depending on the functions / actions involved, two blocks shown consecutively may actually be executed substantially simultaneously, or these blocks may sometimes be executed in reverse order.

[0094] The above description is merely a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for data frame transmission in an aerial network, the method comprising: constructing a key configuration table comprising frame sequence numbers and one default key of a preset length corresponding to each frame sequence number; obtaining a data frame in the aerial network and determining a frame sequence number of the data frame and a field length of a payload field therein; generating a transmission key of a corresponding length according to the key configuration table based on the determined frame sequence number and field length; encrypting the payload field using the transmission key at a transmitting end in the aerial network; and decrypting the encrypted payload field using the transmission key at a receiving end in the aerial network. The default key in the key configuration table is a pseudo-random sequence, and the key configuration table comprises all frame sequence numbers used in the aerial network.

2. The method of claim 1, wherein, 3.The method of claim 1, wherein: obtaining the data frame further comprises reading the data frame from a sub virtual link (sub VL) buffer in the aerial network based on a polling mechanism, and determining the field length further comprises monitoring and extracting payload data in the payload field at a data link layer in a communication protocol stack of the aerial network and determining a length of actual data excluding padding bytes in the payload data. generating the transmission key further comprises:

4. The method of claim 3, wherein, performing a table lookup operation on the key configuration table according to the determined frame sequence number to determine whether a length of the default key corresponding to the frame sequence number matches the length of the actual data; extracting the default key as the transmission key in case of a match; and generating a transmission key consistent with the length of the actual data in a pseudo-random manner in case of a mismatch. generating the transmission key further comprises regenerating a transmission key consistent with the length of the actual data in a pseudo-random manner in a subsequent round of the frame sequence number regardless of whether the length of the actual data matches the length of the transmission key in a previous round. encrypting the payload field further comprises: performing an exclusive OR operation on the actual data using the transmission key to generate ciphertext; and replacing the actual data with the generated ciphertext in a transmitting buffer at the transmitting end.

5. The method of claim 4, wherein, decrypting the encrypted payload field further comprises:

6. The method of claim 3, wherein, performing an exclusive OR operation on the ciphertext using the transmission key to recover the actual data; and replacing the ciphertext with the actual data in a receiving buffer at the receiving end. 8.A system for data frame transmission in an aerial network, the system comprising: a key configuration table module configured to construct a key configuration table comprising frame sequence numbers and one default key of a preset length corresponding to each frame sequence number; 7. The method of claim 6, wherein, a frame length and frame sequence number detection module configured to obtain a data frame in the aerial network and determine a frame sequence number of the data frame and a field length of a payload field therein; and a transmission key generation module configured to generate a transmission key of a corresponding length according to the key configuration table based on the determined frame sequence number and field length. ​ ​ ​ ​ a key generation module configured to generate, based on the determined frame sequence number and field length, a transmission key of the corresponding length from the key configuration table; a data frame field encryption and decryption module configured to: encrypt, at a sending end in the aerial network, the payload field using the transmission key; and decrypt, at a receiving end in the aerial network, the encrypted payload field using the transmission key.

9. The system of claim 8, wherein: the frame length and frame sequence number detection module is further configured to obtain the data frame by reading the data frame from a sub-virtual link (sub-VL) buffer in the aerial network based on a polling mechanism; and the frame length and frame sequence number detection module is further configured to determine the field length by monitoring and extracting payload data in the payload field at a data link layer in a communication protocol stack of the aerial network and determining a length of actual data in the payload data that does not include padding bytes.

10. The system of claim 9, wherein, the key generation module is further configured to generate the transmission key by: performing a table lookup operation on the key configuration table based on the determined frame sequence number to determine whether a length of a default key corresponding to the frame sequence number matches the length of the actual data; extracting the default key as the transmission key in the case of a match; and in the case of a mismatch, generating a transmission key of a length consistent with the length of the actual data in a pseudo-random manner. the key generation module is further configured to generate the transmission key by, in subsequent rounds of the frame sequence number, regenerating a transmission key of a length consistent with the length of actual data in a pseudo-random manner regardless of whether the length of the actual data matches the length of the transmission key of a previous round.

11. The system of claim 10, wherein, the data frame field encryption and decryption module is further configured to encrypt the payload field by:

12. The system of claim 9, wherein, performing an exclusive OR operation on the actual data using the transmission key to generate ciphertext; and replacing the actual data with the generated ciphertext in a sending buffer at the sending end. the data frame field encryption and decryption module is further configured to decrypt the encrypted payload field by:

13. The system of claim 12, wherein, performing an exclusive OR operation on the ciphertext using the transmission key to recover the actual data; and replacing the ciphertext with the actual data in a receiving buffer at the receiving end.

14. A computer-readable storage medium having stored thereon instructions that, when executed, cause a computer to perform the method of any one of claims 1 to 7. ​

Images