Method and device for realizing cross-domain data interaction certainty
By constructing physically isolated storage domains and a restricted instruction write mechanism, the deterministic problem of cross-domain data interaction in avionics systems was solved, the system's resistance to denial-of-service attacks and timing consistency were achieved, and the system's reliability and portability were improved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- JITAI AVIATION TECH (SUZHOU) CO LTD
- Filing Date
- 2025-12-31
- Publication Date
- 2026-05-12
AI Technical Summary
Existing cross-domain data interaction schemes are difficult to reconcile the contradictions between production and consumption in avionics systems, resulting in uncontrollable reading time, vulnerability to attacks, and the occurrence of cache false sharing and bus jitter, making it impossible to guarantee deterministic timing boundaries.
By constructing physically isolated storage domains and implementing instruction-restricted interrupt domain writes and budget-constrained periodic task reads, including single-writer binding, cache line alignment, bounded retry reads, and degradation circuit breaker strategies, determinism in data interaction and resistance to denial-of-service attacks are ensured.
It achieves mathematical provability of worst-case execution time, improves the system's resistance to denial-of-service attacks and timing consistency, and ensures the timing consistency and portability of a highly secure real-time system.
Smart Images
Figure CN122019426A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to a method and apparatus for achieving deterministic cross-domain data interaction, belonging to the field of highly reliable time-sensitive networking technology. Background Technology
[0002] In modern avionics systems, core nodes such as flight control computers need to receive high-precision synchronization messages via redundant Ethernet. This process exhibits a significant "production-consumption asymmetry": the production end involves data acquisition triggered by random network interruptions (non-deterministic domain), while the consumption end involves periodic control tasks requiring strict periodic execution and analyzable worst-case execution time (WCET) (deterministic domain). However, existing cross-domain data interaction schemes struggle to reconcile this contradiction, primarily manifested in the following ways: readers in lock-free snapshot mechanisms are prone to unbounded spinning, leading to uncontrollable read latency; interrupt service routines containing complex parsing logic are susceptible to malformed message attacks, potentially causing "interrupt livelock" and hindering high-priority tasks; and multi-core parallel writes can easily lead to cache pseudo-sharing and bus jitter, introducing random latency. Summary of the Invention
[0003] The purpose of this invention is to provide a method and apparatus for achieving deterministic cross-domain data interaction. By constructing physically isolated storage domains, implementing instruction-constrained interrupt domain writing and budget-constrained periodic task reading mechanisms, the mathematical provability of worst-case execution time is achieved, significantly improving the system's resistance to denial-of-service attacks and ensuring timing consistency across hardware platforms. This provides a data interaction solution with deterministic timing boundaries for high-security real-time systems such as avionics.
[0004] To achieve the above objectives, the present invention is implemented using the following technical solution.
[0005] On one hand, the present invention provides a method for achieving determinism in cross-domain data interaction, comprising:
[0006] By pre-aligning with cache lines through single-writer binding, an independent storage area is allocated for each data source, resulting in multiple physically isolated and non-interfering data storage slots;
[0007] In the interrupt domain, input data triggered by external events is acquired, and the data is written to the corresponding storage slot based on preset instruction constraint rules. The data writing time has a definite upper bound.
[0008] In the periodic task domain, data is read from the storage slot based on the preset maximum retry budget and the upper limit of the single read time. When the read fails and the maximum retry budget is not reached, a retry is performed. When the maximum retry budget is reached, a degradation circuit breaker is triggered, thereby limiting the total time of data reading to a deterministic boundary that can be calculated in advance.
[0009] Optionally, the single writer binding includes:
[0010] The interrupt service routine corresponding to the specified data source is bound to a unique processor core by setting processor interrupt affinity;
[0011] During the execution of the interrupt service routine, interrupts from the same source are automatically masked by the interrupt controller or by software instructions to ensure that write access to the storage slot is non-reentrant.
[0012] Optionally, the cache line alignment includes:
[0013] The size of each storage slot and its starting memory address are forced to be aligned to an integer multiple of the processor cache line length.
[0014] Optionally, writing data to the corresponding storage slot based on preset instruction constraint rules includes:
[0015] Configure the interrupt service routine to execute only a predefined fixed sequence of instructions; wherein, the data processing operations in the fixed sequence of instructions perform a memory copy of a constant length at compile time, and floating-point operations, unbounded loops, and complex branch jumps based on data content are prohibited.
[0016] Optionally, the compile-time constant-length memory copy specifically refers to:
[0017] Based on a predefined load structure of fixed size, a memory copy operation is performed from the network buffer to the corresponding storage slot.
[0018] Optionally, when performing data writing in the interrupt domain, the version fingerprint status of the storage slot is updated before and after the data payload is written.
[0019] When performing data reading in the periodic task domain, a version fingerprint is sampled before and after reading the data payload by inserting a memory barrier instruction. If the version fingerprints sampled before and after are inconsistent, or if the sampled version fingerprint value indicates that the current state is in the writing state, the read is determined to have failed.
[0020] Optionally, the version fingerprint is a monotonically increasing integer, where odd values indicate that the storage slot is in a writing state, and even values indicate that the writing is complete.
[0021] Optionally, the degraded circuit breaker includes at least:
[0022] Mark the data source that failed to read in the current cycle as invalid for this cycle, and remove it from the voting set or reuse the output data that was determined to be valid in the previous cycle.
[0023] Optionally, the deterministic boundary is constrained by the following relationship:
[0024] ;
[0025] ;
[0026] in To maximize retry budget, This is the upper bound of the single read attempt time obtained from the worst-case execution time analysis of the target platform. This represents the worst-case execution time for a single read attempt. To be assigned to the Time budget for each channel The voting algorithm takes a long time. This refers to the system control cycle.
[0027] In a second aspect, the present invention provides a computer device, comprising:
[0028] Memory, used to store computer programs / instructions;
[0029] A processor for executing the computer program / instructions to implement the steps of the method for achieving deterministic cross-domain data interaction as described in any one of the first aspects.
[0030] Compared with the prior art, the beneficial effects achieved by the present invention are as follows:
[0031] This invention achieves the mathematical provability of worst-case execution time (WCET) by constructing physically isolated storage domains, implementing instruction-restricted writes to the interrupt domain, and establishing a budget-constrained read mechanism for the periodic task domain. This provides stringent timing guarantees for airworthiness certification and safety assessment of high-security real-time systems. Based on physical storage isolation and a single-writer binding mechanism, the system effectively eliminates cache pseudo-sharing and bus access jitter in multi-core environments, significantly improving timing consistency and system portability across different hardware platforms. Furthermore, the introduced restricted write and degradation circuit breaker mechanisms greatly enhance the ability to resist denial-of-service (DoS) attacks, ensuring that core control tasks can still be scheduled on time and achieve safe and controllable state switching even under extreme external interference. In summary, this invention provides a closed-loop, predictable, architecture-level solution for cross-domain data interaction in high-reliability scenarios such as avionics and industrial control. Attached Figure Description
[0032] Figure 1 This is a schematic diagram of the data flow for cross-domain data interaction provided in an embodiment of the present invention;
[0033] Figure 2 This is a schematic diagram of the bounded read logic for periodic task execution provided in an embodiment of the present invention. Detailed Implementation
[0034] The technical solution of the present invention will be described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the embodiments of the present invention and the specific features in the embodiments are detailed descriptions of the technical solution of the present invention, rather than limitations thereof. In the absence of conflict, the embodiments of the present invention and the technical features in the embodiments can be combined with each other.
[0035] Example 1
[0036] This embodiment provides a method for achieving deterministic cross-domain data interaction, specifically applied to the flight control computer in an integrated modular avionics system. It addresses the resource contention and timing uncertainty issues faced by the flight control computer when receiving time synchronization data from redundant networks, particularly between nondeterministic interruptions and deterministic control tasks. The application scenario involves the flight control computer receiving time synchronization messages from an external time source via two independent Ethernet channels.
[0037] This embodiment employs a restricted write sequence, cache line alignment with storage slots for single-writer binding, bounded retry reads, and a degradation circuit breaker strategy, such as... Figure 1 As shown, a time-provable data path is constructed from a nondeterministic interrupt domain to a deterministic task domain.
[0038] 1. Construct physically isolated storage domains;
[0039] During system startup or initialization, a physically isolated storage area is first constructed in memory as the sole data interaction medium connecting the nondeterministic interrupt domain and the deterministic periodic task domain.
[0040] Define the cache line-aligned storage slot:
[0041] Each timing source (e.g., two independent network channels) is allocated a dedicated memory slot. Each slot contains two parts: an atomic version fingerprint for consistency control and a data payload area for storing time synchronization messages. To ensure no false sharing occurs during access in a multi-core environment, the total size of each slot and its starting address are forcibly aligned to an integer multiple of the processor cache line (64 bytes in this example). This is implemented through compiler instructions or a specified memory allocator, ensuring that a cache line contains only the data of one slot, thereby physically isolating access from different channels. Specifically, in the C language implementation, cache line alignment can be ensured through the following structure definition:
[0042] #define CACHE_LINE_SIZE 64
[0043] typedef struct {
[0044] atomic_uint version; / / Atomic version fingerprint
[0045] TimeData payload; / / Time data payload
[0046] SlotInner;
[0047] / / Use unions to ensure alignment and avoid the risks of variable-length arrays
[0048] typedef struct {
[0049] union {
[0050] SlotInner inner;
[0051] uint8_t raw[CACHE_LINE_SIZE * ((sizeof(SlotInner) + CACHE_LINE_SIZE - 1) / CACHE_LINE_SIZE)];
[0052] };
[0053] } _attribute_((aligned(CACHE_LINE_SIZE))) AlignedSlot;
[0054] / / Compile-time static assertion to ensure strict slot size alignment
[0055] _Static_assert(sizeof(AlignedSlot) % CACHE_LINE_SIZE == 0, "Slot sizealignment error");
[0056] With the above definition, the size of the AlignedSlot structure will be expanded to an integer multiple of the cache line size, and the starting address will be aligned to the cache line. In this way, each slot independently occupies one or more cache lines in memory, eliminating the false sharing interference caused by cache line sharing during multi-core concurrent access.
[0057] Implement a single-writer binding strategy:
[0058] To achieve one write per slot, both hardware and software binding are implemented for each data source (network channel):
[0059] Interrupt affinity binding: Through operating system or hardware configuration, the network interrupt service routine (ISR) of channel A is fixedly bound to processor core Core 0 for execution; the ISR of channel B is bound to Core 1. This ensures from the hardware scheduling level that each memory slot can only be written to by a designated core.
[0060] Same-source interrupt masking: At the entry point of each ISR, same-source interrupts are masked by configuring the interrupt controller (such as GIC / APIC) or disabling interrupts at the software entry point, thereby preventing nesting or re-entry of the same interrupt and ensuring that write access to the same slot is logically serial and non-reentrant.
[0061] II. Interrupt domain execution of restricted write sequences;
[0062] As a non-deterministic event, network outages are subject to strict instructional constraints in their handling procedures, transforming them into data producers with definite time upper bounds.
[0063] Network interrupt service routines are designed to execute only predefined sequences of instructions of compile-time determinable length, with specific constraints including:
[0064] Floating-point operations, unbounded loops (such as while loops), and branching based on message content depth (such as protocol parsing) are prohibited.
[0065] The permitted operations include only: reading network controller hardware registers, performing a fixed-length memory copy to move data, and updating atomic version fingerprints.
[0066] This design ensures that the execution path of the interrupt service routine remains fixed regardless of the complexity or abnormality of the external network message format, and there is no execution time deviation due to data content.
[0067] Deterministic write process:
[0068] When an interrupt is triggered, the bound core operates on its corresponding memory slot according to the following atomic sequence:
[0069] Mark write start: Set the version fingerprint of the slot to an odd value (e.g., the original value plus 1) with an atomic storage operation to indicate that the data is being updated.
[0070] Perform a fixed-length memory copy: move data from the network buffer to the slot. The copy length is predefined. The size (compile-time constant) determines the execution. .
[0071] Mark write complete: Update the version fingerprint to an even value (add 1 to the previous odd value) again with an atomic storage operation, indicating that the data is now in a consistent and readable state.
[0072] Based on the above constraints and procedures, the worst-case execution time (WCET) of a single interrupt service routine can be analyzed using static analysis tools based on the target processor architecture, and a definite mathematical upper bound can be obtained.
[0073] III. Bounded reads and downgraded circuit breaking in the periodic task domain;
[0074] In the flight control computer, deterministic tasks running with a 1ms cycle act as consumers, reading data from storage slots using a budget-aware bounded retry protocol to ensure the total time spent on the read phase is controllable. The bounded read state machine logic for the periodic task execution is as follows: Figure 2 As shown.
[0075] The periodic task sets a retry counter cnt for each channel, initially set to 0, and presets a maximum number of retries. =5, for each slot, a single read attempt follows these steps:
[0076] Use atomic load instructions to read the version fingerprint, denoted as... .
[0077] Execute memory barrier instructions to prevent out-of-order execution by the processor. Execute memory barrier instructions (such as FullBarrier or acquire / release semantic barriers) to prevent out-of-order execution by the processor and ensure the consistency of the observation order in a weak memory model architecture.
[0078] copy The data is stored in the task's local variables.
[0079] The memory barrier instruction is executed again.
[0080] The version fingerprint is read again using the atomic load instruction, and recorded as follows: .
[0081] Consistency check: Checks whether the following conditions are met. If the number is even, the read is successful and the data is valid; otherwise, the read attempt is considered a failure.
[0082] Retry and circuit breaker logic: If the read fails and cnt < Then the task executes a lightweight Instructions (such as the x86 pause command) release bus pressure, and then Try again.
[0083] If cnt >= If the operation still fails, the circuit breaker is immediately triggered, terminating the current read cycle for that slot and ensuring that the worst-case read operation time is limited to [a certain value]. Within, among them WCET for a single attempt.
[0084] When the circuit breaker is triggered, the system performs the following preset security degradation actions:
[0085] Input set correction: Immediately mark the channel as "invalid for this cycle" and remove it from the valid input set of the voting algorithm for this cycle to prevent the use of torn or stale data.
[0086] Inertial hold: If, after elimination, the number of remaining valid channels is lower than the minimum number required by the voting algorithm (e.g., less than 2 in a "two out of three" vote), the control system will no longer use new readings, but will reuse the valid output values verified in the previous cycle and enter hold mode until communication is restored.
[0087] The core of this embodiment lies in providing provable deterministic guarantees for the temporal behavior of the entire system through the following mathematical model, including:
[0088] Single-channel read time constraint: ,in, The worst-case execution time (WCET) for a single read attempt is obtained through static analysis of the platform. The time budget allocated to the reading phase of a single channel.
[0089] System periodic budget closed-loop constraints: ;
[0090] Where K=2 is the number of channels. The voting algorithm takes a long time. To be assigned to the Time budget for each channel This is the system control cycle. This constraint ensures that the total time from data reading to algorithm completion is strictly less than the task cycle, thus fundamentally eliminating the possibility of task timeouts due to data contention.
[0091] Example 2
[0092] This embodiment describes a computer device for achieving deterministic cross-domain data interaction. This device can be a flight control computer module of an integrated modular avionics system, comprising:
[0093] Multi-core processors, such as a multi-core SoC based on the ARM Cortex-A series, include at least two processor cores, Core 0 and Core 1.
[0094] Memory includes non-volatile memory (such as Flash) and volatile memory (such as SRAM or DDR). Non-volatile memory is used to store computer program instructions; volatile memory is divided into designated memory regions to implement the physically isolated storage slots described in this invention.
[0095] Peripheral interfaces and interrupt controllers: Integrated Ethernet controllers (such as TSN endpoints) and matching interrupt controllers (such as GICs).
[0096] The computer program / instructions stored in the non-volatile memory are loaded by the processor after the system starts and executed as described in Example 1, which will not be repeated here.
[0097] In summary, by constraining interrupt writes to a fixed-length instruction sequence and combining it with a bounded retry read strategy, this invention achieves the mathematical provability of worst-case execution time (WCET), providing stringent timing guarantees for airworthiness certification and safety assessment of high-security real-time systems. Through physical storage isolation and single-writer binding mechanisms, it effectively eliminates cache pseudo-sharing and bus access jitter in multi-core environments, improving the system's timing consistency and portability across different hardware platforms. Furthermore, the introduction of restricted writes and degradation circuit breaker mechanisms significantly enhances the system's resistance to denial-of-service (DoS) attacks, ensuring that even under extreme external interference, core control tasks can still be scheduled on time and achieve controllable and safe state switching. This provides a closed-loop, predictable solution for cross-domain data interaction in high-reliability scenarios such as avionics and industrial control.
[0098] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0099] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.
[0100] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.
[0101] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.
[0102] The embodiments of the present invention have been described above with reference to the accompanying drawings. However, the present invention is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of the present invention without departing from the spirit and scope of the claims. All of these forms are within the protection scope of the present invention.
Claims
1. A method for achieving deterministic cross-domain data interaction, characterized in that, include: By pre-aligning with cache lines through single-writer binding, an independent storage area is allocated for each data source, resulting in multiple physically isolated and non-interfering data storage slots; In the interrupt domain, input data triggered by external events is acquired, and the data is written to the corresponding storage slot based on preset instruction constraint rules. The data writing time has a definite upper bound. In the periodic task domain, data is read from the storage slot based on the preset maximum retry budget and the upper limit of a single read time. Retry is performed when a read fails and the maximum retry budget is not reached. When the maximum retry budget is reached, a degradation circuit breaker is triggered, thereby limiting the total time of data reading to a deterministic boundary that can be calculated in advance.
2. The method for achieving deterministic cross-domain data interaction according to claim 1, characterized in that, The single-writer binding includes: The interrupt service routine corresponding to the specified data source is bound to a unique processor core by setting processor interrupt affinity; During the execution of the interrupt service routine, interrupts from the same source are automatically masked by the interrupt controller or by software instructions to ensure that write access to the storage slot is non-reentrant.
3. The method for achieving deterministic cross-domain data interaction according to claim 1, characterized in that, The cache line alignment includes: The size of each storage slot and its starting memory address are forced to be aligned to an integer multiple of the processor cache line length.
4. The method for achieving deterministic cross-domain data interaction according to claim 1, characterized in that, The process of writing data to the corresponding storage slot based on preset instruction constraint rules includes: Configure the interrupt service routine to execute only a predefined fixed sequence of instructions; wherein, the data processing operations in the fixed sequence of instructions perform a memory copy of a constant length at compile time, and floating-point operations, unbounded loops, and complex branch jumps based on data content are prohibited.
5. The method for achieving deterministic cross-domain data interaction according to claim 4, characterized in that, The compile-time constant-length memory copy is specifically as follows: Based on a predefined load structure of fixed size, a memory copy operation is performed from the network buffer to the corresponding storage slot.
6. The method for achieving deterministic cross-domain data interaction according to claim 1, characterized in that, When writing data in the interrupt domain, the version fingerprint status of the storage slot is updated before and after writing the data payload. When performing data reading in the periodic task domain, a version fingerprint is sampled before and after reading the data payload by inserting a memory barrier instruction. If the version fingerprints sampled before and after are inconsistent, or if the sampled version fingerprint value indicates that the current state is in the writing state, the read is determined to have failed.
7. The method for achieving deterministic cross-domain data interaction according to claim 6, characterized in that, The version fingerprint is a monotonically increasing integer, where odd values indicate that the storage slot is in the writing state, and even values indicate that the writing is complete.
8. The method for achieving deterministic cross-domain data interaction according to claim 1, characterized in that, The downgraded circuit breaker includes at least: Mark the data source that failed to read in the current cycle as invalid for this cycle, and remove it from the voting set or reuse the output data that was determined to be valid in the previous cycle.
9. The method for achieving deterministic cross-domain data interaction according to claim 1, characterized in that, The deterministic boundary is constrained by the following relationship: ； ； in To maximize retry budget, This is the upper bound of the single read attempt time obtained from the worst-case execution time analysis of the target platform. This represents the worst-case execution time for a single read attempt. To be assigned to the Time budget for each channel The voting algorithm takes a long time. This refers to the system control cycle.
10. A computer device, characterized in that, include: Memory, used to store computer programs / instructions; A processor for executing the computer program / instructions to implement the steps of the method for achieving deterministic cross-domain data interaction as described in any one of claims 1 to 9.