SFTP-based trackside security platform data downloading method, system and equipment

Abstract

The invention relates to an SFTP-based trackside security platform data downloading method, system and device, and the method comprises the steps: carrying out software self-inspection on an SFTP server based on a configuration file, and building a network connection with a trackside security platform after the self-inspection is passed; the SFTP server sends a message to the trackside security platform every fixed period, wherein the message comprises a version number and a working state of the SFTP server; starting the SFTP server, and setting relevant parameters of the server; starting an SFTP event monitoring thread to manage a connection request of a client, and if the connection request passes authentication, transmitting a file through an SSH session to realize downloading of trackside security platform data from a server to the client; wherein the configuration file comprises version information of the server, IP address and port number information of a redundant red and blue network of a communication board card of the trackside security platform, and IP address and port number information of a local redundant red and blue network. Compared with the prior art, the method has the advantages that transmission safety and integrity are improved, and transmission is more efficient.

Description

Technical Field

[0001] The present invention relates to the technical field of data transmission, and in particular to a method, system and device for downloading data from a trackside safety platform based on SFTP. Background Art

[0002] The trackside safety platform of the rail transit signal system runs trackside equipment such as ZC, LC, CCS, and RBC. These equipment have abandoned the method of manually updating system image files and configuration data on site, and update image files and configuration data through the TFTP protocol, but the following problems still exist:

[0003] (1) When transferring files, if the configuration data is large, it takes a long time, affecting the on-site operation time;

[0004] (2) The TFTP protocol is implemented based on the UDP protocol, and data packets may be out of order or lost, and cannot be recovered.

[0005] (3) There is no encryption function when transmitting data, so there is a risk of data being stolen or tampered with.

[0006] With the development of rail transit, the time-consuming, unstable and unsafe data downloading of trackside safety platforms can no longer meet the requirements, so a new data downloading method is urgently needed.

[0007] After searching, Chinese invention patent publication number CN114401190B discloses a data update method and system for a trackside safety platform based on a data compression algorithm, wherein the trackside safety platform includes MPU1-A, MPU2-A, MPU1-B, MPU2-B and at least two MNCUs; the method includes: a TFTP server receives a data update request sent by the MNCU, wherein the data update request is used to obtain update data for updating the upper layer application of the MPU from the TFTP server; after receiving the data update request, the TFTP server compresses the update data corresponding to the data update request; the TFTP server sends the compressed update data to the MNCU. This existing patent has the problems of data security caused by TFTP transmission and the inability to recover after transmission errors.

[0008] How to achieve fast and highly secure data download from the trackside safety platform has become a technical problem that needs to be solved. Summary of the invention

[0009] The purpose of the present invention is to overcome the defects of the above-mentioned prior art and provide a method, system and device for downloading data from a trackside security platform based on SFTP.

[0010] The purpose of the present invention can be achieved by the following technical solutions:

[0011] According to one aspect of the present invention, a method for downloading data from a trackside safety platform based on SFTP is provided, the method comprising: a configuration file is provided on the SFTP server, a software self-check is performed based on the configuration file, and a network connection with the trackside safety platform is established after the self-check passes;

[0012] After the SFTP server establishes a network connection with the trackside security platform, it sends messages to the trackside security platform at regular intervals, where the messages include the version number and working status of the SFTP server itself;

[0013] Start the SFTP server and set server-related parameters; start the SFTP event monitoring thread to manage the client's connection request. If the connection request authentication is successful, start transferring files through the SSH session to download the trackside safety platform data from the server to the client;

[0014] The configuration file includes the server's own version information, the IP address and port number information of the redundant red and blue network of the trackside safety platform communication board, and the IP address and port number information of the local redundant red and blue network.

[0015] Preferably, the SFTP server enters a self-check phase after startup, specifically: the software reads the local configuration file, first checks whether the version number in the program is consistent with the version number in the configuration file, if they are consistent, then establishes a network connection with the communication board of the trackside safety platform according to the IP address and port number signals in the configuration file; otherwise, exits the program.

[0016] Preferably, the working state includes an initialization state, a downloading state and an idle state.

[0017] More preferably, when the working state is the downloading state, the transmission percentage of the data is also sent to the trackside safety platform.

[0018] Preferably, when the SFTP server detects an abnormal situation, it sends an alarm data packet to the trackside security platform.

[0019] More preferably, the SFTP server maps the abnormal information into a hexadecimal form, forms an error code and stores it in a list type memory, and forms the alarm data packet when the number of elements in the list is greater than 0 and the time interval is a set fixed period.

[0020] Preferably, the setting of server-related parameters includes setting a listening port number and a server timeout period, solidifying a server directory of data to be downloaded, and setting a client authentication method.

[0021] More preferably, the client authentication method is to verify the user name and password of the client connection through a password verifier.

[0022] Preferably, the method of opening an SFTP event listening thread to manage the client's connection request is as follows: when the client user connects to the SFTP server, it is determined whether it is an authenticated connection. If so, an SSH session is created for each successfully authenticated client, and the life cycle processing request of the session is managed; otherwise, the connection will be terminated.

[0023] Preferably, after the client passes authentication, if it is a request to upload a file, the server discards the message; if it is a request to download a file, the server replies with the specified file requested to be downloaded.

[0024] Preferably, the SFTP server divides the file specified for download by the client into blocks, and combines flow control for the file transfer process, supporting breakpoint resume.

[0025] Preferably, the method further comprises the SFTP server setting file system level access restrictions on the client's request.

[0026] According to another aspect of the present invention, a trackside safety platform data download system based on SFTP is provided, the system includes a trackside safety platform and a client, the system includes an SFTP server connected to the trackside safety platform and the client respectively, and the SFTP server implements file transfer with each client based on the SFTP protocol.

[0027] Preferably, the SFTP server enters a self-check phase after startup, and the software reads the local configuration file. If the self-check passes, a network connection is established with the communication board of the trackside safety platform according to the IP address and port number signals in the configuration file, and status type messages and alarm type messages in abnormal situations are sent to the trackside safety platform at a fixed period.

[0028] Preferably, the SFTP server implements breakpoint resume transmission through block segmentation and flow control, and sends the data transmission percentage to the trackside safety platform.

[0029] According to a third aspect of the present invention, there is provided an electronic device, comprising a memory and a processor, wherein a computer program is stored in the memory, and the method described above is implemented when the processor executes the program.

[0030] Compared with the prior art, the present invention has the following beneficial effects:

[0031] 1) The SFTP server of the present invention performs software self-check based on the configuration file, and can establish a network connection with the trackside safety platform only after the self-check passes, thereby further ensuring the security of the trackside safety platform and preventing malicious attacks.

[0032] 2) The SFTP server of the present invention sends messages to the trackside security platform, including working status and alarm type messages, so that the trackside security platform can instantly understand the file transfer status according to the received messages and provide guidance and feedback in time when abnormalities occur, thereby enhancing the management and control and security of the file transfer process.

[0033] 3) The transmission method of the present invention is based on the SFTP protocol. The connection authentication of the client is managed through an event monitoring thread. Only the client that passes the identity authentication can connect to the server. The file is encrypted by the SSH key before the file is transmitted to ensure the security of the data during the transmission process, improve the confidentiality and integrity of the downloaded data, and protect the system data from malicious attacks.

[0034] 4) Compared with the existing system based on the TFTP protocol, the SFTP server of the present invention combines block and flow control technology when transmitting large data files, which has a faster data transmission speed. In addition, due to the characteristics of SFTP in protocol design, transmission mode, error handling and recovery, SFTP is more efficient, reliable and secure when processing large files. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 It is a flow chart of the method for downloading trackside safety data of the present invention;

[0036] Figure 2 It is a schematic diagram of the device structure of the present invention. DETAILED DESCRIPTION

[0037] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0038] This embodiment relates to a method for downloading data from a trackside security platform based on SFTP, which improves the speed and security of data downloading. Figure 1 , including the following steps:

[0039] Step S1, the SFTP server software is initialized, the server software enters the self-checking phase, and a network connection with the trackside safety platform is established.

[0040] After the SFTP server is started, it enters the software initialization state. The software reads the local configuration file ConfigFile.ini, which includes the server's own version information, the IP address and port number information of the redundant red and blue network of the communication board, and the IP address and port number information of the local redundant red and blue network. The server enters the self-check stage, first checking whether the version number in the program is consistent with the version number in the configuration file. If not, the program is exited; if consistent, a network connection is established with the communication board of the trackside safety platform according to the IP address and port number signals in the configuration file.

[0041] Step S2, start the communication thread with the trackside safety platform, including status type messages and alarm type messages.

[0042] The SFTP server sends a message to the trackside safety platform at a fixed period of 2 seconds. The message includes:

[0043] a) The server's own version number, which is convenient for checking and verifying the current server program version number on the trackside security platform,

[0044] b) The working status of the server, which is divided into initialization status, downloading status, idle status, etc., as well as the transmission percentage in the downloading status.

[0045] c) Alarm type message with the trackside safety platform. When the server detects an abnormal situation, it maps the abnormal information into hexadecimal form to form an error code and puts it into the list type memory. When the number of elements in the list is greater than 0 and the time interval is 2 seconds, an alarm data packet is formed and sent to the trackside safety platform.

[0046] Step S3, start the SFTP server and set server related parameters;

[0047] Use Maven to build and manage engineering projects, add the Apache MINA SSHD library to the pom file, create a server instance, handle client connection requests, and dispatch requests to the corresponding handler. Set the listening port number and server timeout, solidify the server data directory to be downloaded, and set the client authentication method. Here, the password verifier is used to verify the username and password of the connection.

[0048] Step S4, enable the file system access restriction function: the server manages and controls the file system access for the request from the client, and further enhances the security at the file system level on the basis of the transmission protocol encryption. This embodiment creates an implementation class based on the FileSystemAccessor interface class, limits the download directory to the / home / tftps directory, and when the client connects to the server, it can only access the files in this directory, but not other files.

[0049] Step S5, start the SFTP event monitoring thread. When the client user connects to the SFTP server, determine whether it is an authenticated connection. If so, process the request and reply with the specified file; if not, discard it.

[0050] Use a thread pool to manage multiple client connections. Set a custom thread pool through the setExecutorService method of SshServer. Limit the maximum number of client connections by the size of the thread pool. In this embodiment, the thread pool is set to a maximum of 40. When the thread pool is full, new client connections will not be processed immediately until other connections are processed.

[0051] Based on the SftpEventListener interface event listening class, when a connection request is received from a client user, it is determined whether it is an authenticated connection based on the password authentication method. If so, an SSH session is created for each successfully authenticated client, the session life cycle is managed to handle requests, and the corresponding service access rights are authorized; if not, the connection will be terminated.

[0052] If it is a client's request to upload a file, the server will discard the message.

[0053] Step S6, file transfer processing, supports the breakpoint resume function in a large data file environment.

[0054] Start to transfer files. Since the configuration data of some sites on site is very large, about 5G, we consider using chunking combined with flow control to increase the transmission rate. Implement the FileSystemView interface and create the ChunkedFile class. This class implements the division of large files in memory into small chunks for transmission. Set the chunk size in the program to 1024*1024, that is, the chunk size is about 1MB. Each chunk is transmitted independently, and control can be performed between each chunk transmission. Use the InputStream and OutputStream methods to control the reading of data and achieve the purpose of flow control for processing large files.

[0055] The ChunkedFile class implements the function of resumeable file transfer. The program divides the file specified by the client for download into chunks. The first 4 bytes of each chunk are the chunk number, denoted as index. Let the total number of chunks be T, and the number of the chunk being transferred at that time be N (0 < N's index < T + 1). When receiving the request instruction for transfer interruption sent by the client, the index (N) of the current chunk is recorded in memory. At the same time, after sending the data of the current chunk, the data sending is aborted. At this time, the percentage of the completed transfer, which is N / T, will be sent to the trackside safety platform in the status message. When receiving the instruction for resuming transfer sent by the same client again, the program starts transferring from the (N + 1)-th chunk of data until the transfer of the T-th chunk of data is completed. At the same time, the server will send 100% of the transfer percentage to the trackside safety platform in the status message.

[0056] Step S7, the log saving stage. In this stage, the interaction instructions and exception handling will be saved to the local hard disk for easy diagnosis and maintenance. During the operation of the server, various problems or errors may occur, such as the failure of the configuration file request, the interruption of the network connection, insufficient permissions, the number of connections exceeding the upper limit, and the non-existence of the requested downloaded file, etc. The server forms a part of these exception information into error codes and sends them to the trackside safety platform through the alarm type message, and forms another part into a log file and saves it to the local hard disk of the computer where the server runs for easy diagnosis and maintenance.

[0057] This embodiment also relates to a trackside safety platform data download system based on the SFTP protocol, such as Figure 2 , including an SFTP server, a trackside safety platform, and clients of various devices (such as: clients of trackside devices, clients of on-vehicle devices, clients of devices of other manufacturers). The server establishes a network connection with the communication board of the trackside safety platform.

[0058] The SFTP protocol is used for file transfer between the SFTP server and the client to realize the data download of the trackside safety platform to the clients of various devices. The configuration file ConfigFile.ini on the server includes the version information of the server itself, as well as the IP addresses and port numbers of the redundant red and blue networks of the communication board, and the IP addresses and port numbers of the local redundant red and blue networks. The server enters the self-check stage. First, it checks whether the version number in the program is consistent with the version number in the configuration file. If not, the program exits; if consistent, it establishes a network connection with the communication board of the trackside safety platform according to the IP and port numbers in the configuration file.

[0059] The server sends messages to the trackside safety platform at fixed intervals. The messages include the version number of the server itself, the working status of the server operation, which is divided into initialization status, download status, idle status, etc., and the transfer percentage in the download status. When the server detects an abnormal situation, it sends an alarm data packet to the trackside safety platform.

[0060] The server creates a server instance, sets relevant parameters, sets file system access restrictions, and starts an event listening thread to achieve connection and control management with the client.

[0061] When the server receives a connection request from a client user, it determines whether it is an authentication connection based on the password authentication method. If so, it creates an SSH session for each successfully authenticated client, manages the life cycle of the SSH session, processes requests, and authorizes corresponding service access rights; if not, the connection will be terminated. If it is a client's request to upload a file, the server will discard the message.

[0062] During operation, the server records the operation log and saves it on the server. In addition, the download status and abnormal information are sent to the trackside safety platform in the form of status message and alarm type message respectively.

[0063] The electronic device of the present invention includes a central processing unit (CPU), which can perform various appropriate actions and processes according to computer program instructions stored in a read-only memory (ROM) or loaded from a storage unit into a random access memory (RAM). In the RAM, various programs and data required for device operation can also be stored. The CPU, ROM and RAM are connected to each other via a bus. An input / output (I / O) interface is also connected to the bus.

[0064] Multiple components in the device are connected to the I / O interface, including: input units, such as keyboards, mice, etc.; output units, such as various types of displays, speakers, etc.; storage units, such as disks, optical disks, etc.; and communication units, such as network cards, modems, wireless communication transceivers, etc. The communication unit allows the device to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunication networks.

[0065] The processing unit performs the various methods and processes described above, such as methods S1 to S7. For example, in some embodiments, methods S1 to S7 may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit. In some embodiments, part or all of the computer program may be loaded and / or installed on the device via a ROM and / or a communication unit. When the computer program is loaded into the RAM and executed by the CPU, one or more steps of methods S1 to S7 described above may be performed. Alternatively, in other embodiments, the CPU may be configured to execute methods S1 to S7 in any other appropriate manner (e.g., by means of firmware).

[0066] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0067] The program code for implementing the method of the present invention can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code can be executed entirely on the machine, partially on the machine, partially on the machine as a stand-alone software package and partially on a remote machine, or entirely on a remote machine or server.

[0068] In the context of the present invention, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0069] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A method for downloading data from a trackside safety platform based on SFTP, characterized in that: The method comprises: a configuration file is set on an SFTP server, a software self-check is performed based on the configuration file, and a network connection with a trackside safety platform is established after the self-check passes; After the SFTP server establishes a network connection with the trackside security platform, it sends messages to the trackside security platform at regular intervals, where the messages include the version number and working status of the SFTP server itself; Start the SFTP server and set server-related parameters; start the SFTP event monitoring thread to manage the client's connection request. If the connection request authentication is successful, start transferring files through the SSH session to download the trackside safety platform data from the server to the client; The configuration file includes the server's own version information, the IP address and port number information of the redundant red and blue network of the trackside safety platform communication board, and the IP address and port number information of the local redundant red and blue network.

2. A method for downloading data from a trackside safety platform based on SFTP according to claim 1, characterized in that: The SFTP server enters the self-check stage after startup, specifically: the software reads the local configuration file, first checks whether the version number in the program is consistent with the version number in the configuration file, if consistent, establishes a network connection with the communication board of the trackside safety platform according to the IP address and port number signals in the configuration file; otherwise exits the program.

3. A method for downloading data from a trackside safety platform based on SFTP according to claim 1, characterized in that: The working states include initialization state, downloading state and idle state.

4. A method for downloading data from a trackside safety platform based on SFTP according to claim 3, characterized in that: When the working state is the downloading state, the transmission percentage of the data is also sent to the trackside safety platform.

5. The method for downloading data from a trackside safety platform based on SFTP according to claim 1, characterized in that: When the SFTP server detects an abnormal situation, it sends an alarm data packet to the trackside security platform.

6. A method for downloading data from a trackside safety platform based on SFTP according to claim 5, characterized in that: The SFTP server maps the abnormal information into a hexadecimal form, forms an error code and puts it into a list type memory, and forms the alarm data packet when the number of elements in the list is greater than 0 and the time interval is a set fixed period.

7. A method for downloading data from a trackside safety platform based on SFTP according to claim 1, characterized in that: The server-related parameters are set including setting the listening port number and the server timeout period, solidifying the server data directory to be downloaded, and setting the client authentication method.

8. A method for downloading data from a trackside safety platform based on SFTP according to claim 7, characterized in that: The client authentication method is to verify the user name and password of the client connection through a password verifier.

9. A method for downloading data from a trackside safety platform based on SFTP according to claim 1, characterized in that: The specific method of opening an SFTP event listening thread to manage the client's connection request is as follows: when a client user connects to an SFTP server, it is determined whether it is an authenticated connection. If so, an SSH session is created for each successfully authenticated client, and the session life cycle processing request is managed; otherwise, the connection will be terminated.

10. The method for downloading data from a trackside safety platform based on SFTP according to claim 1, characterized in that: After the client passes authentication, if it is a request to upload a file, the server discards the message; if it is a request to download a file, the server replies with the specified file to be downloaded.

11. A method for downloading data from a trackside safety platform based on SFTP according to claim 1, characterized in that: The SFTP server divides the file specified by the client for download into blocks, and combines flow control for the file transfer process, supporting breakpoint resume.

12. A method for downloading data from a trackside safety platform based on SFTP according to claim 1, characterized in that: The method further includes the SFTP server setting file system level access restrictions on the request of the client.

13. A system using the SFTP-based trackside security platform data download method according to any one of claims 1 to 12, the system comprising a trackside security platform and a client, characterized in that: The system comprises an SFTP server connected to the trackside safety platform and the client respectively, and the SFTP server realizes file transmission with each client based on the SFTP protocol.

14. The system according to claim 13, characterized in that The SFTP server enters the self-test phase after startup. The software reads the local configuration file. If the self-test passes, a network connection is established with the communication board of the trackside safety platform according to the IP address and port number signals in the configuration file, and status type messages and alarm type messages in abnormal situations are sent to the trackside safety platform at a fixed period.

15. The system according to claim 13, characterized in that The SFTP server implements breakpoint-resume transmission through block segmentation and flow control, and sends the data transmission percentage to the trackside security platform.

16. An electronic device comprising a memory and a processor, wherein a computer program is stored in the memory, wherein: When the processor executes the program, the method according to any one of claims 1 to 12 is implemented.

Images