Security Design for Data Distribution Service Based on Secure Onboard Communication

Data Distribution Service(DDS) middleware plays a critical role in intelligent connected vehicle (ICV) communication; however, its existing security mechanisms often compromise real-time performance. This study proposes a hierarchical dynamic security protection architecture that achieves the deep integration of Secure Onboard Communication(SecOC) and DDS security through protocol extension, policy mapping, and resource degradation. The core innovations are as follows: (1)Dynamic Security Policy Adaptation across Protocol Layers: By extending the Real-Time Publish-Subscribe protocol of DDS, SecOC security fields (Freshness Value + Message Authentication Code) are embedded into the message structure, and a dynamic mapping mechanism between the topic-level Quality of Service policies and Protocol Data Unit-level security parameters is established. Security levels are defined based on Extensible Markup Language configuration files to achieve automated policy loading from application-layer encryption to transport-layer authentication, thereby solving the problem of consistency in security policies between heterogeneous protocol stacks.(2)Lightweight Security Grading Method: A security grading method: A security grading framework was constructed based on the sensitivity of DDS topics. This method balances security strength and computational overhead through differentiated security processing while considering the ISO 26262 functional safety standard. Experimental verification demonstrates its superiority in terms of jitter, latency, and throughput, effectively meeting the dual requirements of ICV for strong security and high real-time performance.