Program file transfer methods, gateway devices and CNC systems

Abstract

This application relates to the field of CNC (Computer Numerical Control), and particularly to a method for transmitting program files, a gateway device, and a CNC system. The method includes: the gateway device sending a link establishment request to a cloud device; the cloud device establishing a first link between the gateway device and the cloud device based on the link establishment request; the cloud device sending a program file, used to control the operation of a CNC machine tool, to the gateway device through the first link; the gateway device receiving the program file and encrypting it using a password; when the gateway device receives a file retrieval request from the CNC machine tool, the gateway device decrypting the encrypted program file using the password and sending the decrypted program file to the CNC machine tool; and the CNC machine tool performing operations according to the program file. This method can conveniently input program files into a CNC machine tool while ensuring the security of the program files.

Description

Technical Field

[0001] This application relates to the field of numerical control, and in particular to a method for transmitting program files, a gateway device, and a numerical control system. Background Technology

[0002] CNC machine tools, also known as computer numerical control machine tools, are automated machine tools equipped with a program control system. CNC machine tools can perform operations according to program instructions to produce products with specific shapes and dimensions. The program instructions have a significant impact on the efficiency of CNC machine tools in producing finished products. Therefore, program instructions are of great value and are considered confidential information by manufacturers.

[0003] Currently, there are two methods for inputting program instructions into CNC machine tools: paper tape input and local copy input. Paper tape input generally involves printing the program instructions onto paper and reading them using a paper tape photoelectric reader, or printing the process parameters represented by the program instructions onto paper, which are then manually operated by on-site personnel. Paper tape input requires either specialized photoelectric reading equipment or manual operation, making it cumbersome. Furthermore, the paper containing the program instructions or process parameters is at risk of being stolen or transferred. Local copy input involves connecting a computer and the CNC machine tool via a network cable on-site to transfer the program file containing the program instructions from the computer to the CNC machine tool. This method is also relatively cumbersome and difficult to prevent malicious copying by workshop personnel, posing a high risk of data leakage. Summary of the Invention

[0004] This application provides a program file transmission method, a gateway device, and a CNC system, which can conveniently input program files into CNC machine tools while ensuring the security of the program files.

[0005] In a first aspect, a method for transmitting program files is provided, applied to a CNC system. The CNC system includes at least one CNC machine tool, a gateway device, and a cloud device, wherein the at least one CNC machine tool and the gateway device are located within the same local area network. The method includes: the gateway device sending a link establishment request to the cloud device; the cloud device establishing a first link between the gateway device and the cloud device based on the link establishment request; the cloud device sending a program file to the gateway device through the first link, the program file being used to control the operation of the CNC machine tool; the gateway device receiving the program file and encrypting it using a password; when the gateway device receives a file retrieval request from the CNC machine tool, the gateway device decrypting the encrypted program file using the password and sending the decrypted program file to the CNC machine tool; and the CNC machine tool performing operations according to the program file.

[0006] In the program file transmission method provided in this application embodiment, the gateway device on the CNC machine tool side actively sends a link establishment request to the cloud device. Based on this request, the cloud device establishes a link between itself and the gateway device, and transmits the program file through this link. This allows the gateway device to obtain the program file from the cloud device without exposing its network address to the external network, reducing the risk of external network attacks on the gateway device. Furthermore, after receiving the program file, the gateway device encrypts it with a password. The gateway device only decrypts the program file when the CNC machine tool requires it, ensuring the secure storage of the program file on the gateway device.

[0007] In one possible implementation, the link establishment request is a Secure Shell SSH reverse tunnel establishment request, and the first link is an SSH reverse tunnel.

[0008] In this implementation, the cloud device and the gateway device can establish an SSH reverse tunnel, through which program files are transmitted, ensuring the security of program files during the transmission process from the cloud device to the gateway device.

[0009] In one possible implementation, the gateway device is equipped with a hardware encryption module, and the password is stored in the hardware encryption module. Data in the hardware encryption module cannot be copied or read by devices outside the gateway device. Storing the password in the hardware encryption module ensures the security of the password, and thus ensures the security of the program files encrypted with the password.

[0010] In one possible implementation, the password is a random number generated by the gateway device or certificate authority. Using a random number generated by the gateway device or certificate authority as the password, rather than a manually set password, reduces the risk of password leakage.

[0011] In one possible implementation, the link establishment request includes a first digital certificate, and the cloud device has a second digital certificate, wherein the first digital certificate is issued by the second digital certificate; the cloud device establishes a first link between the gateway device and the cloud device based on the link establishment request, including: after the cloud device confirms that the gateway device is a legitimate device according to the first digital certificate and the second digital certificate, the cloud device establishes the first link.

[0012] In this implementation, the cloud device can verify the gateway device's legitimacy based on the gateway device's digital certificate and the digital certificate that issued the gateway device's digital certificate. Only after confirming the gateway device is legitimate is a link established between the cloud device and the gateway device. This ensures that program files are transmitted to legitimate devices, not illegitimate ones, further guaranteeing the security of the program files.

[0013] In one possible implementation, the gateway device has a first directory, and the method further includes: a cloud device creating a virtual directory mapped to the first directory; the cloud device sending program files to the gateway device via a first link, including: the cloud device receiving program files pointing to the virtual directory; and the cloud device sending program files pointing to the virtual directory to the gateway device via the first link. The first directory is the directory where the gateway device stores program files.

[0014] In this implementation, the cloud device can create a directory mapped to the gateway device for storing program files. Users only need to upload the program files to the virtual directory, and the cloud device can automatically send the program files to the gateway device. This simplifies the convenience for users to send program files from the cloud device to the gateway device and improves the user experience.

[0015] Secondly, a method for transmitting program files is provided, applied to a gateway device in a CNC system. The CNC system also includes at least one CNC machine tool and a cloud device, wherein the at least one CNC machine tool and the gateway device are located within the same local area network. The method includes: the gateway device sending a link establishment request to the cloud device, the link establishment being used by the cloud device to establish a first link between the gateway device and the cloud device; the gateway device receiving a program file sent by the cloud device through the first link, the program file being used to control the operation of the CNC machine tool; the gateway device encrypting the program file using a password; when the gateway device receives a file retrieval request sent by the CNC machine tool, the gateway device decrypting the encrypted program file using the password and sending the decrypted program file to the CNC machine tool, enabling the CNC machine tool to perform operations according to the program file.

[0016] In one possible implementation, the link establishment request is a Secure Shell SSH reverse tunnel establishment request, and the first link is an SSH reverse tunnel.

[0017] In one possible implementation, the gateway device is equipped with a hardware encryption module, and the password is located in the hardware encryption module.

[0018] In one possible implementation, the password is a random number generated by the gateway device or certificate authority.

[0019] Thirdly, a program file transmission device is provided, characterized by a gateway device configured in a CNC system, the CNC system further including at least one CNC machine tool and a cloud device, wherein the at least one CNC machine tool and the gateway device are located in the same local area network; the device includes: a sending unit, used to send a link establishment request to the cloud device, the link establishment being used by the cloud device to establish a first link between the gateway device and the cloud device; a receiving unit, used to receive a program file sent by the cloud device through the first link, the program file being used to control the operation of the CNC machine tool; an encryption unit, used to encrypt the program file using a password; and a decryption unit, used to decrypt the encrypted program file using a password when the gateway device receives a file acquisition request sent by the CNC machine tool, and send the decrypted program file to the CNC machine tool, so that the CNC machine tool performs operations according to the program file.

[0020] Fourthly, a CNC system is provided, comprising at least one CNC machine tool, a gateway device, and a cloud device, wherein at least one CNC machine tool and the gateway device are located within the same local area network; the gateway device is used to send a link establishment request to the cloud device; the cloud device is used to establish a first link between the gateway device and the cloud device based on the link establishment request; the cloud device is used to send a program file to the gateway device through the first link, the program file being used to control the operation of the CNC machine tool; the gateway device is used to receive the program file and encrypt the program file using a password; when the gateway device receives a file retrieval request sent by the CNC machine tool, the gateway device is used to decrypt the encrypted program file using a password and send the decrypted program file to the CNC machine tool; the CNC machine tool is used to perform operations according to the program file.

[0021] In one possible implementation, the link establishment request is a Secure Shell SSH reverse tunnel establishment request, and the first link is an SSH reverse tunnel.

[0022] In one possible implementation, the gateway device is equipped with a hardware encryption module, and the password is located in the hardware encryption module.

[0023] In one possible implementation, the password is a random number generated by the gateway device or certificate authority.

[0024] In one possible implementation, the link establishment request includes a first digital certificate and a second digital certificate, wherein the first digital certificate is issued by the second digital certificate; after the cloud device confirms that the gateway device is a legitimate device based on the first digital certificate and the second digital certificate, the cloud device establishes the first link.

[0025] In one possible implementation, the gateway device has a first directory, and the cloud device is used to: create a virtual directory mapped to the first directory; and send program files to the gateway device via a first link, including: receiving program files pointing to the virtual directory; and sending program files pointing to the virtual directory to the gateway device via the first link.

[0026] Fifthly, a gateway device is provided, comprising: a processor and a memory, the processor being configured to execute instructions stored in the memory to perform the method provided in the second aspect.

[0027] In a sixth aspect, a computer-readable storage medium is provided, including computer program instructions that, when executed by a computing device, perform the method provided in the second aspect.

[0028] In a seventh aspect, a computer program product containing instructions is provided, which, when executed by a computing device, cause the computing device to perform the method provided in the second aspect.

[0029] This application provides a program file transfer method, a gateway device, and a CNC system. It enables the gateway device to obtain program files from a cloud device without exposing its network address to the external network, thus reducing the risk of network attacks on the gateway device. Furthermore, after receiving the program file, the gateway device encrypts it with a password. The gateway device only decrypts the program file when the CNC machine tool requires it, ensuring the secure storage of the program file within the gateway device. Attached Figure Description

[0030] Figure 1 This is a schematic diagram of a program file transfer scheme;

[0031] Figure 2 A schematic diagram of a numerical control system provided in an embodiment of this application;

[0032] Figure 3 A schematic diagram of a software architecture provided for an embodiment of this application;

[0033] Figure 4 A flowchart illustrating a program file transfer method provided in this application embodiment;

[0034] Figure 5 A schematic diagram of a program file transfer device provided in an embodiment of this application;

[0035] Figure 6 This is a schematic diagram of the structure of a gateway device provided in an embodiment of this application. Detailed Implementation

[0036] The technical solutions in the embodiments of the present invention will now be described with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments in this specification, and not all of them.

[0037] In the description of this specification, terms such as "one embodiment" or "some embodiments" mean that one or more embodiments of this specification include a particular feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized.

[0038] In this specification, unless otherwise stated, " / " signifies "or," for example, A / B can mean A or B. "And / or" in this document merely describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. Furthermore, in the description of embodiments in this specification, "multiple" refers to two or more.

[0039] Generally, workshops housing CNC machine tools have a large number of personnel, including those responsible for the daily maintenance of the machine tools, those handling the machining, those inspecting the finished products (i.e., products processed by CNC machine tools), and those transporting the finished products. Therefore, bringing carriers of program instructions (such as paper recording program instructions or computers storing program instructions) into the workshop poses a high risk of leakage. Furthermore, bringing these carriers into the workshop and inputting the program instructions into the CNC machine tools is a complex operation that requires a high level of expertise from the on-site operators.

[0040] With the development of cloud network technology, the security and convenience of cloud networks have improved, leading more and more users to migrate their data centers to the cloud. Developers or users of CNC machine tool program instructions upload files containing these instructions to the cloud network. The cloud network then distributes these files to the gateway device on the CNC machine tool side, where the gateway device stores the file. The CNC machine tool can then retrieve this file from the gateway device and execute the program instructions within it to perform its operations (i.e., process or produce products). This file containing the program instructions can be referred to as a program file.

[0041] By using cloud networks to transmit program files to CNC machine tools, the file transfer mode eliminates the need to bring the carriers of program instructions (such as paper for recording program instructions or computers for storing program instructions) into the workshop, reducing the risk of program instruction leakage. Furthermore, this file transfer mode can efficiently transmit program files to CNC machine tools, reducing the need for manpower and thus reducing the number of people who come into contact with the program files, further lowering the risk of program instruction leakage.

[0042] However, during the process of cloud networks sending program files to CNC machine tools and during the process of gateway devices storing program files, there may be network attacks, leading to the risk of program file leakage. For example... Figure 1 The illustrated scheme involves the user uploading the program file to the cloud network. Upon receiving the program file, the cloud network initiates a connection to the gateway device, establishing a link between the cloud network and the gateway device. The cloud network then sends the program file to the gateway device via this link. The gateway device stores the program file. When the CNC machine tool needs to execute the program instructions in the program file, the CNC machine tool retrieves the program file from the gateway device. Figure 1 In the illustrated scheme, the cloud network needs to initiate a connection to the gateway device. Therefore, the connection request sent by the cloud network to the gateway device carries the gateway device's network address. This connection request uses the gateway device's network address for addressing and forwarding, ultimately reaching the gateway device. This inevitably exposes the gateway device's network address to the external network, making it vulnerable to network attacks and the theft of program files. Furthermore, the program files stored on the gateway device are also at risk of being copied and stolen by personnel on the gateway device side. Therefore, Figure 1 The proposed solution, while efficiently transferring program files to CNC machine tools, also carries the possibility or risk of program file leakage.

[0043] This application provides a program file transfer scheme that can be applied to... Figure 2 The CNC system shown. (As shown) Figure 2 As shown, the CNC system may include at least one CNC machine tool 21, a gateway device 22, and a cloud device 23. The at least one CNC machine tool 21 and the gateway device 22 are located in the same local area network (LAN). The cloud device 23 is located in an external network of the LAN.

[0044] In the program file transfer scheme provided in this application embodiment, the gateway device 22 can actively send a link establishment request to the cloud device 23. The cloud device 23 can respond to the link establishment request and establish a link between the cloud device 23 and the gateway device 22. Since the link is established based on the link establishment request actively initiated by the gateway device 22, the link can be established without addressing and forwarding using the network address of the gateway device 22. This avoids exposing the network address of the gateway device 22 to the external network, preventing the possibility of network attacks on the gateway device 22 from external networks. Furthermore, the gateway device 22 can encrypt the received program file. When the CNC machine tool 21 requests the program file, it decrypts the program file. This ensures the storage security of the program file in the gateway device 22. In short, the program file transfer scheme provided in this application embodiment can eliminate or greatly reduce the possibility or risk of program file leakage.

[0045] Next, combined Figure 2 This paper introduces the file transfer scheme and CNC system provided in the embodiments of this application.

[0046] The CNC machine tool 21 is an automated machine tool that can perform operations such as cutting and shaving on raw materials under the control of program instructions. In some embodiments, the CNC machine tool 21 can be a machine tool in a distributed numerical control (DNC) architecture. The CNC machine tool 21 may include a CNC device, a servo and measurement feedback device, and a job execution device, etc.

[0047] The CNC device, which can be referred to as the "brain" of the CNC machine tool 21, includes one or more processors. The CNC device executes program instructions in a program file to obtain the motion trajectory of the work execution device. The CNC device may include an input module, a processing module, and an output module. The input module is used to acquire the program file. In this embodiment, the CNC device of the CNC machine tool 21 can acquire the program file from the gateway device 22 through its input module. The processing module executes the program instructions in the program file to obtain control instructions for controlling the work execution device. The output module outputs the control instructions. In some embodiments, the CNC device can be a computer numerical control (CNC) device.

[0048] The servo and measurement feedback device can receive control commands from the CNC device, and perform power amplification, shaping, and other processing on the control commands to convert them into the motion trajectory of the work execution device. Then, the motion execution device can be controlled to move according to this motion trajectory, thereby realizing operations such as cutting and shaving.

[0049] The work execution device may include cutting tools for the work. The work execution device can perform cutting, shaving, and other operations under the control of a servo and measurement feedback device.

[0050] Gateway device 22 isolates devices within the local area network (LAN), such as CNC machine tool 21, from the external network to avoid or reduce network attacks on the CNC machine tool from the external network. Gateway device 22 can obtain data from the external network, such as program files from cloud device 23. Gateway device 22 can also be used to store program files. Multiple CNC machine tools 21 may exist within the LAN, and different CNC machine tools 21 may be operating at different times. By storing program files in gateway device 22, the program files can be retrieved from gateway device 22 whenever a CNC machine tool 21 starts operating.

[0051] Cloud device 23 is a device located in a cloud network. In some embodiments, user 24 rents one or more devices in the cloud network, which can be used as cloud device 23. In some embodiments, user 24 can build a cloud network and use one or more devices therein as cloud device 23.

[0052] In some embodiments, the cloud device 23 can be a physical machine, such as a standalone computing device or a cluster of one or more computing devices. In some embodiments, the cloud device 23 can be a virtual device, such as a virtual machine (VM) or a container. This application does not specifically limit the specific implementation of the cloud device 23.

[0053] The foregoing example illustrates the CNC system provided in the embodiments of this application. Next, using the CNC system described above, the implementation process of the program file transfer scheme provided in the embodiments of this application will be introduced.

[0054] Continue reading Figure 2 Gateway device 22 can execute step 201, sending a link establishment request to cloud device 23.

[0055] In some embodiments, it can be configured that there is no link between gateway device 22 and cloud device 23 when step 201 is performed. Then, in step 201, gateway device 22 can pre-configure the network address (e.g., Internet Protocol address, IP address) of cloud device 23 in gateway device 22. Thus, gateway device 22 can include the network address of cloud device 23 in the link establishment request, thereby sending the link establishment request to cloud device 23.

[0056] After receiving the link establishment request, cloud device 23 can respond to the link establishment request and establish link L1 between gateway device 22 and cloud device 23. In some embodiments, after receiving the link establishment request, cloud device 23 can send a link establishment response in reverse through the transmission path of the link establishment request. This allows the link establishment response to be sent to gateway device 22 without carrying the network address of gateway device 22. Cloud device 23 and gateway device 22 can establish link L1 through the link establishment request and link establishment response.

[0057] In an illustrative example, gateway device 22 may send a link establishment request based on the WebSocket protocol. The established link L1 can be a WebSocket link. In some embodiments, gateway device 22 may send a link establishment request based on Message Queuing Telemetry Transport (MQTT). The established link L1 can be an MQTT link.

[0058] In some embodiments, the gateway device 22 may be configured to have an existing link with the cloud device 23 when step 201 is executed. For example, a long-lived connection established between the gateway device 22 and the cloud device 23 before step 201a. For instance, this long-lived connection could be a WebSocket link or an MQTT link. The gateway device 22 and the cloud device 23 can establish a more secure link L1 based on this long-lived connection, such as a secure shell (SSH) reverse tunnel. Specifically, in step 201, the gateway device 22 can send a link establishment request to the cloud device 23 via its existing link; this link establishment request is an SSH reverse tunnel establishment request. After receiving the SSH reverse tunnel establishment request, the cloud device 23 can send an SSH reverse tunnel response to the network device 22 via the existing link between the gateway device 22 and the cloud device 23. Thus, through the SSH reverse tunnel establishment request and the SSH reverse tunnel response, an SSH reverse tunnel can be established between the cloud device 23 and the gateway device 22. The SSH reverse tunnel is link L1.

[0059] In some embodiments, cloud device 23 may verify the legitimacy of gateway device 22 before establishing link L1 between cloud device 23 and gateway device 22.

[0060] In one illustrative example of this embodiment, gateway device 22 may have a digital certificate issued by a certificate authority (CA). This digital certificate serves as the device certificate of gateway device 22, representing the identity of gateway device 22. Specifically, gateway device 22 may send a certificate request message to the certificate authority. This certificate request message may include the identity information of gateway device 22, such as device information of gateway device 22 and / or information of the user to whom gateway device 22 belongs. The certificate authority can use its own digital certificate to sign the certificate request message to obtain the device certificate of gateway device 22.

[0061] For ease of description, the device certificate or digital certificate of gateway device 22 can be referred to as digital certificate C1. The digital certificate used by the certificate authority to issue digital certificate C1 can be referred to as digital certificate C2.

[0062] Digital certificate C2 can be pre-configured in cloud device 23. Gateway device 22 can send digital certificate C1 to cloud device 23. After receiving digital certificate C1, cloud device 23 can determine whether digital certificate C1 and digital certificate C2 match. If they match, it means that digital certificate C1 from gateway device 22 was issued by digital certificate C1, and gateway device 22 is a legitimate device. For example, gateway device 22 can include digital certificate C1 in the link establishment request, thereby sending digital certificate C1 to cloud device 23.

[0063] After confirming that the gateway device 22 is a legitimate device, the cloud device 23 can respond to the link establishment request from the gateway device 22 and establish link L1 between the cloud device 23 and the gateway device 22.

[0064] Using the method described above, a link L1 can be established between gateway device 22 and cloud device 23, even when gateway device 22 is exposed to the external network. In this way, cloud device 23 can send program files to gateway device 22 through this link L1. A detailed explanation follows.

[0065] In some embodiments, the cloud device 23 may be configured to have a program file. After the link L1 between the gateway device 22 and the cloud device 23 is established, the program file can be sent from the cloud device 23 to the gateway device 22 via the link L1.

[0066] In some embodiments, after link L1 is established between gateway device 22 and cloud device 23, user 24 can perform step 202 to upload program file A1 to cloud device 23. In one illustrative example, cloud device 23 can display a cloud interface, which may include a program file upload entry, allowing user 24 to upload program files through this entry. In one illustrative example, user 24 can access cloud device 23 through a browser. Cloud device 23 can provide a webpage with a program file upload entry, allowing user 24 to upload program files through this entry.

[0067] Program file A1 is used to control the operation of the CNC machine tool. Specifically, program file A1 may include or carry program instructions, which, when executed on the CNC machine tool, can control the operation of the CNC machine tool. For example, program instructions may include operation procedure instructions, process parameters, and other data or instructions that instruct the CNC machine tool on how to operate.

[0068] After receiving the program file A1, the cloud device 23 can execute step 203 to send the program file A1 to the gateway device 22 via link L1.

[0069] In some embodiments, such as Figure 2 As shown, gateway device 22 may have a directory B1, which is used to store program files sent from cloud device 23. Cloud device 23 may create a virtual directory B2, which is mapped to directory B1. A virtual directory, also known as a mirror directory, is a mirror image of a directory on another device. Specifically, virtual directory B2 is a mirror image of target B1 on cloud device 23. For example, after link L1 is established, gateway device 22 can send the storage path of directory B1 within gateway device 22 to cloud device 23 via link L1. Cloud device 23 can create virtual directory B2 based on the storage path of directory B1 within gateway device 22, thus mapping virtual directory B2 to directory B1.

[0070] After creating virtual directory B2, cloud device 23 can display virtual directory B2 to user 24, allowing user 24 to upload data to virtual directory B2. Specifically, program files uploaded by the user to cloud device 23 point to virtual directory B2. Since virtual directory B2 is mapped to directory B1, program files pointing to virtual directory B2 are automatically sent by cloud device 23 to directory B1 of gateway device 22.

[0071] The above method can be used to transfer program files from cloud device 23 to gateway device 22.

[0072] Gateway device 22 encrypts the received program file. Taking program file A1 as an example, after receiving program file A1, gateway device 22 can proceed to step 204 to encrypt program file A1 using password D1. For example, password D1 and program file A1 can be operated on, such as multiplying or adding password D1 to program file A1 to obtain the encryption result.

[0073] In some embodiments, password D1 is not a manually configured password, but a random number generated by the device. This prevents humans from cracking the encryption of the program file using the password and stealing the program file. In an illustrative example, password D1 can be a random number generated by gateway device 22. For example, gateway device 22 can call the rand() function to generate password D1. In an illustrative example, password D1 can be a random number generated by a certificate authority for gateway device 22. In one example, password D1 can be a private key generated by a certificate authority for gateway device 22. The private key is the private key in an asymmetric encryption algorithm, typically generated by a certificate authority. After generating the private key, a public key can be generated based on it. The device's private key can be stored within the device itself, while the device's public key can be sent to other devices. Data encrypted with the private key can be decrypted using the public key. Data encrypted with the public key can be decrypted using the private key. This enables encrypted data transmission between two devices and achieves higher security than symmetric encryption. In this example, gateway device B2 can reuse its device private key to encrypt the program file, thus eliminating the need to generate password D1 itself.

[0074] In some embodiments, such as Figure 2 As shown, gateway device 22 is equipped with a hardware encryption module. The hardware encryption module provides a trusted environment for gateway device 22. Data stored in the hardware encryption module cannot be read or copied. Password D1 is stored in the hardware encryption module, ensuring that password D1 cannot be stolen. Specifically, when encrypting program file A1, the hardware encryption module can call the relevant program, use password D1 to encrypt program file A1, and store the encryption result in directory B1. The encrypted result obtained by encrypting program file A1 can be referred to as the encrypted program file A1. In one example, the hardware encryption module can specifically be an encryption chip. In a specific example, the hardware encryption module can be a trusted platform module (TPM).

[0075] CNC machine tool 21, which is on the same local area network as gateway device 22, can obtain program files from gateway device 22. Details are as follows.

[0076] The CNC machine tool 21 can execute step 205, sending an acquisition request to the gateway device 22 to obtain program file A1. After receiving the acquisition request, the gateway device 22 can execute step 206, using password D1 to decrypt the encrypted program file A1. For example, password D1 is stored in a hardware encryption module, and step 206 can be specifically executed by the hardware encryption module. Specifically, the hardware encryption module can call a relevant program to decrypt the encrypted program file A1 using password D1. Then, the gateway device 22 can send the decrypted program file A1 to the CNC machine tool 21 via step 207.

[0077] In some embodiments, before executing step 206, the CNC machine tool 21 may determine whether the CNC machine tool 21 that sent the acquisition request is a trusted device. The gateway device 22 only executes step 206 and step 207 when the CNC machine tool 21 is a trusted device. In an illustrative example, the device identifier of the CNC machine tool 21 (e.g., the media access control (MAC) address of the CNC machine tool 21) may be pre-configured in the gateway device 22. The acquisition request sent by the CNC machine tool 21 to the gateway device 22 carries the device identifier of the CNC machine tool 21. When the gateway device 22 receives the acquisition request, it may determine whether the device identifier carried in the acquisition request is the device identifier pre-configured in the gateway device 22. If yes, the CNC machine tool 21 is confirmed as a trusted device. If not, the CNC machine tool 21 is confirmed as an untrusted device.

[0078] After obtaining the program file A1, the CNC machine tool 21 can execute the program instructions contained in the program file A1 to perform operations.

[0079] The program file transmission scheme provided in this application ensures the security of each link in the transmission path from the cloud to the CNC machine tool, avoiding or greatly reducing the risk of program files being stolen or leaked.

[0080] The above text combined Figure 2 This example illustrates the flow of the program file transfer scheme provided in the embodiments of this application. Next, in conjunction with... Figure 3 This paper introduces a software architecture that can implement this transmission scheme.

[0081] like Figure 3 As shown, gateway device 22 may include a connection establishment request module. This module can proactively initiate a connection request with cloud device 23, such as sending a link establishment request to cloud device 23. The link establishment request may carry a digital certificate C1.

[0082] Cloud device 23 may include an authentication module and a secure link establishment module. The authentication module can be used to verify whether gateway device 22 is a legitimate device based on digital certificates C1 and C2. When gateway device 22 is confirmed to be a legitimate device, the secure link establishment module can work with the coordination module in gateway device 22 to establish a secure link. For example, the secure link can be an SSH reverse tunnel.

[0083] The cloud device 23 may also include a file transceiver module. The file transceiver module can receive program files uploaded by users and send the program files to the gateway device 22 through a secure link between the cloud device 23 and the gateway device 22.

[0084] Gateway device 22 includes an encryption module. The encryption module can use password D1 to encrypt program files. The encrypted program files can be stored in directory B1.

[0085] The CNC machine tool 21 can access directory B1 to obtain program files. During the process of obtaining the program files, the encryption module can decrypt the program files encrypted with password D1, allowing the CNC machine tool 21 to obtain the decrypted program files.

[0086] The functions of each module in cloud device 23 and gateway device 22 can be referred to the above text. Figure 2 The implementation of the illustrated embodiment will not be described in detail here.

[0087] Based on the above description, this application also provides a file transfer method, which can be applied to a gateway device in a CNC system, for example... Figure 2 The gateway device 22 in the CNC system shown. The CNC system also includes at least one CNC machine tool and a cloud device, for example... Figure 2 The CNC system shown includes a CNC machine tool 21 and a cloud device 23. The at least one CNC machine tool and the gateway device are located on the same local area network. Figure 4 As shown, the method includes the following steps.

[0088] Step 401: The gateway device sends a link establishment request to the cloud device. This link establishment is used by the cloud device to establish a first link between the gateway device and the cloud device. For details, please refer to the above text. Figure 2 The implementation of step 201 will not be described in detail here.

[0089] Step 402: The gateway device receives a program file sent by the cloud device through the first link. This program file is used to control the operation of the CNC machine tool. For details, please refer to the above description. Figure 2 The implementation of step 203 will not be described in detail here.

[0090] Step 403: The gateway device encrypts the program file using a password. For details, please refer to the above text. Figure 2 The implementation of step 204 will not be described in detail here.

[0091] Step 404: When the gateway device receives a file retrieval request from the CNC machine tool, the gateway device uses the password to decrypt the encrypted program file and sends the decrypted program file to the CNC machine tool, enabling the CNC machine tool to perform operations according to the program file. For details, please refer to the above text. Figure 2 The implementation of steps 205, 206, and 207 will not be repeated here.

[0092] In some embodiments, the link establishment request is a Secure Shell SSH reverse tunnel establishment request, and the first link is an SSH reverse tunnel. For details, please refer to the above description. Figure 2 The implementation of link L1 shown will not be described in detail here.

[0093] In some embodiments, the gateway device is configured with a hardware encryption module, and the password is located in the hardware encryption module. For details, please refer to the above description. Figure 2 The implementation details of the hardware encryption module shown are omitted here.

[0094] In some embodiments, the password is a random number generated by the gateway device or certificate authority. See the above for details. Figure 2 The implementation of the cipher D1 shown will not be repeated here.

[0095] In the program file transmission method provided in this application embodiment, the gateway device on the CNC machine tool side actively sends a link establishment request to the cloud device. Based on this request, the cloud device establishes a link between itself and the gateway device, and transmits the program file through this link. This allows the gateway device to obtain the program file from the cloud device without exposing its network address to the external network, reducing the risk of network attacks on the gateway device. Furthermore, after receiving the program file, the gateway device encrypts it with a password. The gateway device only decrypts the program file when the CNC machine tool requires it, ensuring the secure storage of the program file on the gateway device.

[0096] See Figure 5 This application also provides a program file transfer device 500. The device 500 can be configured in a gateway device of a CNC system, which further includes at least one CNC machine tool and a cloud device, wherein the at least one CNC machine tool and the gateway device are located within the same local area network. Figure 5 As shown, the device includes:

[0097] Sending unit 510 is used to send a link establishment request to the cloud device, wherein the link establishment is used by the cloud device to establish a first link between the gateway device and the cloud device;

[0098] The receiving unit 520 is used to receive a program file sent by the cloud device through the first link, the program file being used to control the operation of the CNC machine tool;

[0099] Encryption unit 530 is used to encrypt the program file using a password;

[0100] The decryption unit 540 is used to decrypt the encrypted program file using the password when the gateway device receives a file acquisition request sent by the CNC machine tool, and send the decrypted program file to the CNC machine tool so that the CNC machine tool can perform operations according to the program file.

[0101] The functions of each functional unit in device 500 can be referred to the above text. Figure 4 The method embodiments shown or Figure 2 The implementation of the gateway device 22 shown will not be described in detail here.

[0102] See Figure 6 This application provides a gateway device 600, including a processor 610 and a memory 620. The memory 620 stores computer instructions. The processor 610 executes the computer instructions stored in the memory 620, enabling the gateway device 600 to perform operations. Figure 4 The various method embodiments shown, or the execution thereof Figure 2 The operations performed by the gateway device 22 shown.

[0103] In some embodiments, the processor 610 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. The general-purpose processor may be a microprocessor or any conventional processor.

[0104] This application provides a numerical control system, which may include at least one CNC machine tool, a gateway device, and a cloud device. The gateway device can be... Figure 6 The gateway device 600 shown, or Figure 2 The gateway device 22 shown. This CNC machine tool can be Figure 2 The CNC machine tool 23 shown is illustrated. Cloud devices can provide... Figure 2 The cloud device 21 is shown. The functions of the CNC machine tool, gateway device, and cloud device can be found in the description above, and will not be repeated here.

[0105] Furthermore, the method steps in the embodiments of this application can be implemented in hardware or by a processor executing software instructions. The software instructions can consist of corresponding software modules, which can be stored in random access memory (RAM), flash memory, read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), registers, hard disks, portable hard disks, CD-ROMs, or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor, enabling the processor to read information from and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can reside in an ASIC.

[0106] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted through the computer-readable storage medium. The computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state disk (SSD)).

[0107] It is understood that the various numerical designations used in the embodiments of this application are merely for descriptive convenience and are not intended to limit the scope of the embodiments of this application.

Claims

1. A program file transfer method characterized by, The method is applied to a CNC system, the CNC system including at least one CNC machine tool, a gateway device, and a cloud device, wherein the at least one CNC machine tool and the gateway device are located within the same local area network; the method includes: The gateway device sends a link establishment request to the cloud device; The cloud device establishes a first link between the gateway device and the cloud device based on the link establishment request; wherein, after receiving the link establishment request, the cloud device sends a link establishment response in reverse through the transmission path of the link establishment request, and the link establishment response does not carry the network address of the gateway device; The cloud device sends a program file to the gateway device through the first link. The program file is used to control the operation of the CNC machine tool. The gateway device receives the program file and encrypts the program file using a password; When the gateway device receives a file retrieval request from the CNC machine tool, the gateway device uses the password to decrypt the encrypted program file and sends the decrypted program file to the CNC machine tool. The CNC machine tool performs operations according to the program file.

2. The method of claim 1, wherein, The link establishment request is a Secure Shell SSH reverse tunnel establishment request, and the first link is an SSH reverse tunnel.

3. The method according to claim 1 or 2, characterized in that, The gateway device is equipped with a hardware encryption module, and the password is located in the hardware encryption module.

4. The method according to claim 1 or 2, characterized in that, The password is a random number generated by the gateway device or certificate authority.

5. The method according to claim 1 or 2, characterized in that, The link establishment request includes a first digital certificate, and the cloud device has a second digital certificate, wherein the first digital certificate is issued by the second digital certificate; The cloud device establishes a first link between the gateway device and the cloud device based on the link establishment request, including: after the cloud device confirms that the gateway device is a legitimate device based on the first digital certificate and the second digital certificate, the cloud device establishes the first link.

6. The method of claim 1 or 2, wherein, The gateway device has a first directory, and the method further includes: the cloud device creating a virtual directory mapped to the first directory; The cloud device sends program files to the gateway device via the first link, including: The cloud device receives program files pointing to the virtual directory; The cloud device sends the program file pointing to the virtual directory to the gateway device through the first link.

7. A program file transfer method characterized by comprising: A gateway device is used in a CNC system, wherein the CNC system further includes at least one CNC machine tool and a cloud device, wherein the at least one CNC machine tool and the gateway device are located within the same local area network; the method includes: The gateway device sends a link establishment request to the cloud device. The link establishment is used by the cloud device to establish a first link between the gateway device and the cloud device. After receiving the link establishment request, the cloud device sends a link establishment response in reverse through the transmission path of the link establishment request. The link establishment response does not carry the network address of the gateway device. The gateway device receives a program file sent by the cloud device through the first link, and the program file is used to control the operation of the CNC machine tool; The gateway device uses a password to encrypt the program file; When the gateway device receives a file retrieval request from the CNC machine tool, the gateway device uses the password to decrypt the encrypted program file and sends the decrypted program file to the CNC machine tool, so that the CNC machine tool can perform operations according to the program file.

8. The method of claim 7, wherein, The link establishment request is a Secure Shell SSH reverse tunnel establishment request, and the first link is an SSH reverse tunnel.

9. The method according to claim 7 or 8, characterized in that, The gateway device is equipped with a hardware encryption module, and the password is located in the hardware encryption module.

10. The method according to claim 7 or 8, characterized in that, The password is a random number generated by the gateway device or certificate authority.

11. A program file transfer apparatus characterized by comprising: A gateway device configured in a CNC system, the CNC system further including at least one CNC machine tool and a cloud device, wherein the at least one CNC machine tool and the gateway device are located within the same local area network; the device includes: A sending unit is configured to send a link establishment request to the cloud device, wherein the link establishment is used by the cloud device to establish a first link between the gateway device and the cloud device; wherein, after receiving the link establishment request, the cloud device sends a link establishment response in reverse through the transmission path of the link establishment request, and the link establishment response does not carry the network address of the gateway device; A receiving unit is configured to receive a program file sent by the cloud device through the first link, the program file being used to control the operation of the CNC machine tool; An encryption unit is used to encrypt the program file using a password; The decryption unit is used to decrypt the encrypted program file using the password when the gateway device receives a file retrieval request sent by the CNC machine tool, and then send the decrypted program file to the CNC machine tool so that the CNC machine tool can perform operations according to the program file.

12. A numerical control system characterized by comprising: The CNC system includes at least one CNC machine tool, a gateway device, and a cloud device, wherein the at least one CNC machine tool and the gateway device are located within the same local area network; The gateway device is used to send a link establishment request to the cloud device; The cloud device is used to establish a first link between the gateway device and the cloud device based on the link establishment request; wherein, after receiving the link establishment request, the cloud device sends a link establishment response in reverse through the transmission path of the link establishment request, and the link establishment response does not carry the network address of the gateway device; The cloud device is used to send a program file to the gateway device through the first link, and the program file is used to control the operation of the CNC machine tool; The gateway device is used to receive the program file and encrypt the program file using a password; When the gateway device receives a file retrieval request sent by the CNC machine tool, the gateway device uses the password to decrypt the encrypted program file and sends the decrypted program file to the CNC machine tool. The CNC machine tool is used to perform operations according to the program file.

13. The numerically controlled system of claim 12, wherein, The link establishment request is a Secure Shell SSH reverse tunnel establishment request, and the first link is an SSH reverse tunnel.

14. The numerically controlled system according to claim 12 or 13, characterized in that, The gateway device is equipped with a hardware encryption module, and the password is located in the hardware encryption module.

15. The numerically controlled system according to claim 12 or 13, characterized in that, The password is a random number generated by the gateway device or certificate authority.

16. The CNC system according to claim 12 or 13, characterized in that, The link establishment request includes a first digital certificate, and the cloud device has a second digital certificate, wherein the first digital certificate is issued by the second digital certificate; after the cloud device confirms that the gateway device is a legitimate device based on the first digital certificate and the second digital certificate, the cloud device is used to establish the first link.

17. The CNC system according to claim 12 or 13, characterized in that, The gateway device has a first directory, and the cloud device is used for: Create a virtual directory mapped to the first directory; Sending program files to the gateway device via the first link includes: Receive the program file pointing to the virtual directory; The program file pointing to the virtual directory is sent to the gateway device via the first link.

18. A gateway device, characterized in that, include: It includes a processor and a memory, the processor being configured to execute instructions stored in the memory to perform the method according to any one of claims 7 to 10.

19. A computer-readable storage medium, characterized in that, It includes computer program instructions, which, when executed by a computing device, cause the computing device to perform the method as described in any one of claims 7 to 10.

20. A computer program product containing instructions, characterized in that, When the instructions are executed by the computing device, the computing device performs the method as described in any one of claims 7 to 10.

Images