Fault information transmission method, device and equipment for communication module

Abstract

The embodiment of the invention discloses a fault information transmission method, device and equipment for a communication module, applied to a first communication module, and the method comprises the following steps: the first communication module receives log information from a second communication module through a wireless local area network, the log information is encrypted through a private key corresponding to a second digital certificate of the second communication module, and the log information comprises log information that the second communication module cannot be connected to a cellular network; and the first communication module sends the log information to the security service platform through the cellular network. By adopting the embodiment of the invention, the log information of the abnormal communication module can be remotely acquired, so that a worker can be assisted to solve the problem that the communication module cannot be connected to a cellular network, and the safety of acquiring the log information can be improved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a method, device and equipment for transmitting fault information of a communication module. Background Art

[0002] The communication module is the core component of the IoT terminal, responsible for network access and data transmission. It covers multiple IoT scenarios downstream and is the most critical basic communication unit in the IoT era. The communication module that supports the cellular network is a key component for achieving stable and efficient communication between devices. For example, in a 5G industrial automation factory, many devices collaborate in production. When the cellular network of a communication module fails, the service will be interrupted. For example, in smart cities, such as smart street lights, surveillance cameras, and unmanned monitoring points, when a communication module fails, it is urgent to quickly determine the cause of the failure.

[0003] However, when the abnormal communication module cannot connect to the cellular network, the staff needs to connect the debugging line to the equipment site, capture the log information of the abnormal communication module on site, and then analyze the reason why the abnormal communication module cannot connect to the cellular network. Therefore, when the communication module fails, how to obtain the fault information of the abnormal communication module to assist the staff in solving the problem that the abnormal communication module cannot connect to the cellular network needs to be solved urgently. Summary of the invention

[0004] The embodiments of the present application provide a method, device and equipment for transmitting fault information of a communication module, which can remotely report log information of an abnormal communication module to assist staff in solving the problem that the communication module cannot connect to a cellular network, and can improve the security of obtaining log information.

[0005] The present application is introduced below from different aspects. It should be understood that the implementation methods and beneficial effects of the following different aspects can be referenced to each other.

[0006] In a first aspect, an embodiment of the present application provides a method for transmitting fault information of a communication module, which can be applied to a first communication module. The method includes:

[0007] The first communication module receives log information from the second communication module through the wireless local area network. The log information is encrypted by the private key corresponding to the second digital certificate of the second communication module, and the log information includes log information that the second communication module cannot connect to the cellular network; the first communication module sends the log information to the security service platform through the cellular network.

[0008] In an embodiment of the present application, the first communication module receives log information from the second communication module through a wireless local area network, and the first communication module then sends the log information to the security service platform through the nest network. Because the log information includes the log information that the second communication module cannot connect to the cellular network, when the second communication module fails, the log information that the second communication module cannot connect to the cellular network can be sent to the first communication module through the wireless local area network. The first communication module can act as a gateway for the second communication module at this time, and forward the log information to the security service platform using the cellular network it supports. Thereby, the log information of the abnormal communication module can be obtained remotely to assist the staff in solving the problem that the communication module cannot connect to the cellular network. And the log information is encrypted by the private key corresponding to the second digital certificate of the second communication module, so as to ensure the security of obtaining the log information.

[0009] In combination with the first aspect, in a feasible implementation method, the first communication module receives an attention (AT) instruction from the security service platform, and the AT instruction is encrypted by a private key corresponding to a third digital certificate of the security service platform. The AT instruction is used to trigger the second communication module to send the log information to the first communication module; the first communication module sends the AT instruction to the second communication module.

[0010] In combination with the first aspect, in a feasible implementation, the first communication module receives a Bluetooth broadcast message from the second communication module via Bluetooth; the Bluetooth broadcast message includes indication information, and the indication information is used to indicate that the second communication module cannot connect to the cellular network; the first communication module sends a first message to the security service platform, and the first message includes the indication information; the first communication module receives a second message from the security service platform, and the second message is used to instruct the first communication module to establish the wireless local area network connection with the second communication module; the wireless local area network connection includes Wireless Fidelity Wi-Fi and / or Bluetooth connection.

[0011] In combination with the first aspect, in a feasible implementation manner, the first message also includes an identifier of the first communication module and a received signal strength of the Bluetooth broadcast message.

[0012] In combination with the first aspect, in a feasible implementation method, the Bluetooth broadcast message is encrypted by the private key corresponding to the second digital certificate; after the first communication module receives the Bluetooth broadcast message from the second communication module via Bluetooth, the method also includes: the first communication module uses the public key corresponding to the second digital certificate to decrypt the Bluetooth broadcast message to obtain the indication information.

[0013] In combination with the first aspect, in a feasible implementation, before the first communication module sends the first message to the security service platform, the method also includes: the first communication module uses the private key corresponding to the first digital certificate of the first communication module to encrypt the first message.

[0014] In combination with the first aspect, in a feasible implementation method, the above-mentioned second message is encrypted by the private key corresponding to the third digital certificate of the security service platform. After the first communication module receives the second message from the security service platform, the method also includes: the first communication module uses the public key corresponding to the third digital certificate to decrypt the second message and determine to establish the wireless local area network connection with the second communication module.

[0015] In combination with the first aspect, in a feasible implementation, before the first communication module receives log information from the second communication module through the wireless local area network, the method also includes: the first communication module receives a third message from the second communication module, the third message is used to request to establish an Internet Protocol security (IPSec) connection with the first communication module; the third message is encrypted by the private key corresponding to the second digital certificate; the first communication module sends a fourth message to the security service platform, the fourth message is used to request to establish an IPSec connection with the security service platform; the first communication module receives a fifth message from the security service platform, the fifth message is used to agree to establish an IPSec connection between the security service platform and the first communication module; the first communication module sends a sixth message to the second communication module, the sixth message is used to agree to establish an IPSec connection between the first communication module and the second communication module.

[0016] Exemplarily, the first communication module receives log information from the second communication module via the wireless local area network, including: the first communication module receives log information from the second communication module via the wireless local area network on an established IPSec connection. The first communication module sends the log information to the security service platform via a cellular network supported by itself, including: the first communication module sends the log information to the security service platform via a cellular network supported by itself on an established IPSec connection. Optionally, reporting log information via an established IPSec connection can improve the security of the reported log information. In other words, the use of the established IPSec connection to report log information can be performed without using the above-mentioned digital certificate for encryption and decryption.

[0017] In combination with the first aspect, in a feasible implementation, after the first communication module receives the third message from the second communication module, the method further includes: the first communication module uses the public key corresponding to the second digital certificate to decrypt the third message.

[0018] In combination with the first aspect, in a feasible implementation, before the first communication module sends the fourth message to the security service platform, the method further includes: the first communication module encrypts the fourth message using a private key corresponding to the first digital certificate of the first communication module;

[0019] In combination with the first aspect, in a feasible implementation, the fifth message is encrypted by a private key corresponding to a third digital certificate of the security service platform. After the first communication module receives the fifth message from the security service platform, the method further includes: the first communication module uses a public key corresponding to the third digital certificate to decrypt the fifth message.

[0020] In combination with the first aspect, in a feasible implementation, before the first communication module sends the sixth message to the second communication module, the method further includes: the first communication module uses the private key corresponding to the first digital certificate to encrypt the sixth message.

[0021] In a second aspect, an embodiment of the present application provides a method for transmitting fault information of a communication module, which can be applied to a security service platform. The method includes:

[0022] The security service platform receives log information of the second communication module sent by the first communication module through the cellular network. The log information is encrypted by the private key corresponding to the second digital certificate of the second communication module. The log information includes log information that the second communication module cannot connect to the cellular network.

[0023] In an embodiment of the present application, the security service platform receives the log information of the second communication module sent by the first communication module through the cellular network. Among them, the log information is encrypted by the private key corresponding to the second digital certificate of the second communication module, and the log information includes the log information that the second communication module cannot be connected to the cellular network. At this time, the first communication module acts as the gateway of the second communication module, and uses the cellular network supported by itself to send the log information that the second communication module cannot be connected to the cellular network to the security service platform. Thereby, the log information of the abnormal communication module can be obtained remotely to assist the staff in solving the problem that the communication module cannot be connected to the cellular network. And the log information is encrypted by the private key corresponding to the second digital certificate of the second communication module, so as to ensure the security of obtaining the log information.

[0024] In combination with the second aspect, in a feasible implementation method, before the security service platform receives the log information of the second communication module sent by the first communication module, the method also includes: the security service platform uses the private key corresponding to the third digital certificate of the security service platform to encrypt the AT instruction, and the AT instruction is used to trigger the second communication module to send the log information to the first communication module; the security service platform sends the AT instruction to the first communication module.

[0025] In combination with the second aspect, in a feasible implementation, before the security service platform receives the log information of the second communication module sent by the first communication module, the method also includes: the security service platform receives a first message from the first communication module, the first message includes indication information, and the indication information is used to indicate that the second communication module cannot connect to the cellular network; the security service platform sends a second message to the first communication module based on the first message, and the second message is used to instruct the first communication module to establish a wireless local area network connection with the second communication module; the wireless local area network connection includes a Wi-Fi and / or Bluetooth connection.

[0026] In conjunction with the second aspect, in a feasible implementation, the security service platform receiving the first message from the first communication module includes: the security service platform receiving one or more first messages, the first message including the indication information, the identifier of the third communication module, and the reception signal strength of the Bluetooth broadcast message received by the third communication module;

[0027] Based on the first message, the security service platform sends a second message to the first communication module, including: the security service platform selects a third communication module with the strongest receiving signal strength of the Bluetooth broadcast message from one or more third communication modules, and determines it as the first communication module; the security service platform sends the second message to the determined first communication module.

[0028] In combination with the second aspect, in a feasible implementation method, the above-mentioned first message is encrypted by the private key corresponding to the first digital certificate of the first communication module. After the security service platform receives the first message from the first communication module, the method also includes: the security service platform uses the public key corresponding to the first digital certificate to decrypt the first message to obtain the indication information.

[0029] In combination with the second aspect, in a feasible implementation, before the security service platform sends the second message to the first communication module, the method also includes: the security service platform uses the private key corresponding to the third digital certificate of the security service platform to encrypt the second message.

[0030] In combination with the second aspect, in a feasible implementation, before the security service platform receives the log information of the second communication module sent by the first communication module, the method also includes: the security service platform receives a fourth message from the first communication module, and the fourth message is used to request to establish an IPSec connection with the security service platform; the security service platform sends a fifth message to the first communication module, and the fifth message is used to agree to establish an IPSec connection between the security service platform and the first communication module.

[0031] In conjunction with the second aspect, in a feasible implementation, the fourth message is encrypted by a private key corresponding to the first digital certificate of the first communication module. After the security service platform receives the fourth message from the first communication module, the method further includes: the security service platform uses the public key corresponding to the first digital certificate to decrypt the fourth message.

[0032] In combination with the second aspect, in a feasible implementation, before the security service platform sends the fifth message to the first communication module, the method also includes: the security service platform uses the private key corresponding to the third digital certificate of the security service platform to encrypt the fifth message.

[0033] In a third aspect, an embodiment of the present application provides a communication device for executing the method in the first aspect or any possible implementation of the first aspect. The communication device includes:

[0034] A receiving module, configured to receive log information from a second communication module via a wireless local area network, wherein the log information is encrypted by a private key corresponding to a second digital certificate of the second communication module, and the log information includes log information that the second communication module cannot connect to a cellular network;

[0035] The sending module is used to send the log information to the security service platform via the cellular network.

[0036] In combination with the third aspect, in a feasible implementation method, the receiving module is also used to receive an attention AT instruction from the security service platform, the AT instruction is encrypted by the private key corresponding to the third digital certificate of the security service platform, and the AT instruction is used to trigger the second communication module to send the log information to the first communication module; the sending module is also used to send the AT instruction to the second communication module.

[0037] In combination with the third aspect, in a feasible implementation, the receiving module is also used to receive a Bluetooth broadcast message from the second communication module via Bluetooth; the Bluetooth broadcast message includes indication information, and the indication information is used to indicate that the second communication module cannot connect to the cellular network; the sending module is also used to send a first message to the security service platform, and the first message includes the indication information; the receiving module is also used to receive a second message from the security service platform, and the second message is used to indicate that the first communication module establishes a wireless local area network connection with the second communication module; the wireless local area network connection includes Wireless Fidelity Wi-Fi and / or Bluetooth connection.

[0038] In combination with the third aspect, in a feasible implementation, the decryption module is used to use the public key corresponding to the second digital certificate to decrypt the Bluetooth broadcast message to obtain the indication information.

[0039] In combination with the third aspect, in a feasible implementation method, the encryption module is used to encrypt the first message using the private key corresponding to the first digital certificate of the first communication module.

[0040] In combination with the third aspect, in a feasible implementation, the decryption module is also used to use the public key corresponding to the third digital certificate to decrypt the second message and determine to establish the wireless local area network connection with the second communication module.

[0041] In combination with the third aspect, in a feasible implementation method, the receiving module is also used to receive a third message from the second communication module, and the third message is used to request to establish an Internet Protocol security IPSec connection with the first communication module; the third message is encrypted by the private key corresponding to the second digital certificate; the sending module is also used to send a fourth message to the security service platform, and the fourth message is used to request to establish an IPSec connection with the security service platform; the receiving module is also used to receive a fifth message from the security service platform, and the fifth message is used to agree to establish an IPSec connection between the security service platform and the first communication module; the sending module is also used to send a sixth message to the second communication module, and the sixth message is used to agree to establish an IPSec connection between the first communication module and the second communication module.

[0042] In combination with the third aspect, in a feasible implementation method, the decryption module is also used to decrypt the third message using the public key corresponding to the second digital certificate; and is also used to decrypt the fifth message using the public key corresponding to the third digital certificate; the encryption module is also used to encrypt the fourth message using the private key corresponding to the first digital certificate of the first communication module; and is also used to encrypt the sixth message using the private key corresponding to the first digital certificate.

[0043] In a fourth aspect, an embodiment of the present application provides a communication device, configured to execute the method in the second aspect or any possible implementation of the second aspect. The communication device includes:

[0044] The receiving module is used to receive log information of the second communication module sent by the first communication module through a cellular network, wherein the log information is encrypted by a private key corresponding to the second digital certificate of the second communication module, and the log information includes log information that the second communication module cannot connect to the cellular network.

[0045] In combination with the fourth aspect, in a feasible implementation method, the encryption module is used to encrypt the AT instruction using the private key corresponding to the third digital certificate of the security service platform, and the AT instruction is used to trigger the second communication module to send the log information to the first communication module; the sending module is used to send the AT instruction to the first communication module.

[0046] In combination with the fourth aspect, in a feasible implementation, the receiving module is also used to receive a first message from the first communication module, the first message including indication information, the indication information being used to indicate that the second communication module cannot connect to the cellular network; the sending module is also used to send a second message to the first communication module based on the first message, the second message being used to indicate that the first communication module establishes a wireless local area network connection with the second communication module; the wireless local area network connection includes a Wi-Fi and / or Bluetooth connection.

[0047] In combination with the fourth aspect, in a feasible implementation method, the receiving module is also used to receive one or more first messages, which first message includes the indication information, the identifier of the third communication module, and the reception signal strength of the Bluetooth broadcast message received by the third communication module; the sending module is specifically used to select the third communication module with the strongest reception signal strength of the Bluetooth broadcast message from one or more third communication modules, and determine it as the first communication module; and send the second message to the determined first communication module.

[0048] In combination with the fourth aspect, in a feasible implementation, the decryption module is used to use the public key corresponding to the first digital certificate to decrypt the first message to obtain the indication information.

[0049] In combination with the fourth aspect, in a feasible implementation method, the encryption module is also used to encrypt the second message using the private key corresponding to the third digital certificate of the security service platform.

[0050] In combination with the fourth aspect, in a feasible implementation method, the receiving module is also used to receive a fourth message from the first communication module, and the fourth message is used to request to establish an IPSec connection with the security service platform; the sending module is also used to send a fifth message to the first communication module, and the fifth message is used to agree to establish an IPSec connection between the security service platform and the first communication module.

[0051] In combination with the fourth aspect, in a feasible implementation method, the decryption module is also used to use the public key corresponding to the first digital certificate to decrypt the fourth message; the encryption module is also used to use the private key corresponding to the third digital certificate of the security service platform to encrypt the fifth message.

[0052] In a fifth aspect, an embodiment of the present application provides a communication device, where the communication device can be a first communication module, and the communication device can include a processor, a memory, and a network interface, and the processor is connected to the memory and the network interface. The network interface is used to provide a data communication function, the memory is used to store a computer program, and the processor is used to call the computer program, so that the communication device executes the method for reporting fault information of a cellular network provided by the first aspect or any feasible implementation of the first aspect, and can also achieve the beneficial effects of the method for reporting fault information of a cellular network provided by the first aspect.

[0053] In a sixth aspect, an embodiment of the present application provides a communication device, where the communication device can be a security service platform, and the communication device can include a processor, a memory, and a network interface, and the processor is connected to the memory and the network interface. The network interface is used to provide a data communication function, the memory is used to store a computer program, and the processor is used to call the computer program, so that the communication device executes the cellular network fault information reporting method provided by the second aspect or any feasible implementation of the second aspect, and can also achieve the beneficial effects of the cellular network fault information reporting method provided by the second aspect.

[0054] In the seventh aspect, an embodiment of the present application provides a computer-readable storage medium, which is used to store a computer program. When the computer program is executed on a communication device, the communication device executes the method for reporting fault information of a cellular network provided by the first aspect, or the second aspect, or any possible implementation of any of the aspects, and can also achieve the beneficial effects of the method for reporting fault information of a cellular network provided by the first aspect or the second aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0056] Figure 1 It is a schematic diagram of a system architecture provided by an embodiment of the present application;

[0057] Figure 2 This is a flow chart of a method for transmitting fault information of a communication module provided in an embodiment of the present application;

[0058] Figure 3 This is a schematic diagram of a structure for distributing digital certificates provided by an embodiment of the present application;

[0059] Figure 4 It is a schematic diagram of the structure of a Bluetooth broadcast message data packet provided in an embodiment of the present application;

[0060] Figure 5 This is a schematic diagram of a process for establishing a wireless direct connection provided by an embodiment of the present application;

[0061] Figure 6 is a structural diagram of a communication device provided in an embodiment of the present application;

[0062] Figure 7 It is a structural diagram of a security service platform provided in an embodiment of the present application;

[0063] Figure 8 It is a structural diagram of a communication device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0064] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0065] In the description of this application, unless otherwise specified, " / " means "or", for example, A / B can mean A or B. "And / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, "at least one" means one or more, and "plurality" means two or more. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can mean: a, b, c; a and b; a and c; b and c; or a, b, and c. Among them, a, b, and c can be single or multiple.

[0066] In this application, the words "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described in this application as "exemplary", "for example" or "for example" should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of the words "exemplary", "for example" or "for example" is intended to present the related concepts in a concrete way.

[0067] It should be understood that in the present application, "when", "if" and "if" all mean that the device will take corresponding actions under certain objective circumstances, and do not limit the time, nor do they require that the device must have a judgment action when it is implemented, nor do they mean that there are other limitations.

[0068] Elements used in the singular herein are intended to mean "one or more" rather than "one and only one" unless specifically stated otherwise.

[0069] It can be understood that in each embodiment of the present application, "A corresponds to B" means that there is a corresponding relationship between A and B, and B can be determined according to A. However, it should also be understood that determining B according to A does not mean determining B only according to A, and B can also be determined according to A and / or other information.

[0070] The embodiments of the present application are described below in conjunction with the drawings in the embodiments of the present application.

[0071] This application can be applied to Figure 1 In the system architecture shown in Figure 1As shown, the system architecture may include but is not limited to: one or more communication modules, a security service platform, a firewall, and a client. Communication module A is connected to communication module B (or communication module C, communication module D), and information can be transmitted to each other through the network. The security service platform is connected to communication module B (or communication module C, communication module D), and information can be transmitted to each other through the network. The client is connected to the firewall, and the firewall is connected to the security service platform. After the client passes the verification of the firewall, it can connect to the security service platform, and the security service platform can be accessed on the client.

[0072] 1. Communication module

[0073] The communication module is a hardware component embedded in the terminal device. It can provide wireless or wired communication functions, enabling the device to connect to the Internet or other networks. The communication module can integrate processors, memory, communication chips and various interfaces, and is a bridge for data exchange between devices. The communication module can support cellular networks, such as the fourth generation of mobile communication technology (Fourth Generation, 4G), the fifth generation of mobile communication technology (Fifth Generation, 5G), wireless local area networks (WLAN), such as Wi-Fi and Bluetooth, Ethernet, etc.

[0074] 2. Security Service Platform

[0075] The security service platform can be an integrated network security management and monitoring system that can be specifically used to manage and monitor the operation and status of multiple embedded communication modules. The security and integrity of the network and data can be ensured by using encryption technology and strict access control. The security service platform can also support cellular networks such as 4G, 5G, WLAN, Ethernet, etc.

[0076] It should be noted that the above Figure 1 The system architecture or scenario in the embodiment of the present application is only an exemplary implementation method. The system architecture or scenario in the embodiment of the present application includes but is not limited to the above system architecture or scenario.

[0077] The following further describes a method, device and apparatus for transmitting fault information of a communication module provided in an embodiment of the present application:

[0078] See also Figure 2 , Figure 2 It is a flowchart diagram of a method for transmitting fault information of a communication module provided in an embodiment of the present application, and the method includes steps S201 and S202. Figure 2 The method shown can be applied to the first communication module and the security service platform.

[0079] S201, the second communication module sends log information to the first communication module via the wireless local area network. Correspondingly, the first communication module receives log information from the second communication module via the wireless local area network.

[0080] In a possible implementation, the second communication module may support cellular network and / or wireless local area network connection. When the second communication module fails, the second communication module may send (report) log information to the first communication module via the wireless local area network. The log information may include log information that the second communication module cannot connect to the cellular network.

[0081] Among them, the first communication module can support cellular network and / or wireless LAN connection, and the cellular network can be used normally, that is, the first communication module can use the cellular network for communication. It should be noted that the first communication module can have a multi-network connection function and can work in different types of network environments to meet different communication needs. When the cellular network of the first communication module is normal, the first communication module can use the cellular network to forward received data or information. When the first communication module establishes a wireless LAN connection with other modules, devices or platforms, the first communication module can use the wireless LAN connection for high-speed data transmission or local resource sharing. Exemplarily, the wireless LAN can be Wi-Fi, wireless direct connection (Wi-Fi Direct), Bluetooth, Zigbee (Zigbee), Z-Wave (Z-Wave), etc.

[0082] Exemplarily, the log information of the second communication module may include logs generated by an application processor (AP) and a communication processor (CP). Specifically, it may include one or more of the following: a status log of the second communication module, a network connection log of the second communication module, a communication log of the second communication module, a system log of the second communication module, a security log of the second communication module, an application layer log of the second communication module, a performance log of the second communication module, or a log of interaction between the second communication module and other IoT devices. These logs can record various events and operations during the operation of the communication module, which can help R&D and staff to debug, troubleshoot and analyze performance.

[0083] Exemplarily, the log information of the second communication module being unable to connect to the cellular network may include a connection failure log, a signal failure log, a network performance failure log, a switching and roaming failure log, an authentication and registration failure log, a device and configuration failure log, an environmental impact failure log, etc. For example, the connection failure log may indicate recording the cellular network connection failure, disconnection, or connection timeout of the second communication module. Among them, the connection failure may record the time, failure reason, error code, etc. when connecting to the cellular network. The disconnection may record the time, reason, or error code, etc. when disconnecting the network connection. The connection timeout may record the time, number of attempts, or timeout reason, etc. of the connection timeout. For another example, the signal failure log may indicate recording the signal loss, weak signal, or signal interference of the cellular network of the second communication module. Among them, the signal loss may record the time, duration, or recovery time of the complete loss of the signal of the cellular network. The weak signal may record the time, duration, or recovery situation of the signal strength of the cellular network below the threshold. The signal interference may record the time, interference source, or impact range of the signal interference of the cellular network. It should be noted that in the log information of the second communication module being unable to connect to the cellular network, the specific contents contained in the above-mentioned network performance fault log, switching and roaming fault log, authentication and registration fault log, device and configuration fault log, and environmental impact fault log can be referred to the enumeration of connection fault logs and signal fault logs, and are not listed one by one here.

[0084] In a possible implementation, when the second communication module fails, the second communication module can use the private key corresponding to the second digital certificate to encrypt the log information, and send (report) the encrypted log information to the first communication module through the wireless local area network. Exemplarily, a digital certificate (DigitalCertificate, DC) can be preset in the second communication module, and the digital certificate is issued (or distributed) by the Certificate Authority (Certificate Authority, CA) center. The digital certificate is stored in the trusted platform module (Trusted Platform Module, TPM) in the communication module, and the TPM can be understood as a dedicated security encryption chip for securely generating, storing and managing encryption keys or other security credentials. It should be noted that the TPM security chip can securely store the private key and public key of the digital certificate to prevent the private key and public key from being stolen or tampered with. When it is necessary to use a private key for encryption, public key decryption or signing operations, the TPM security chip can perform these operations internally, and the private key and public key of the digital certificate will not be exposed, thereby ensuring the security of information during the return process. In an exemplary embodiment, when the second communication module sends the log information or data, it can use the private key corresponding to its second digital certificate to encrypt the sent log information or data. After receiving the log information or data, other modules on the other end (such as the first communication module) can use the public key corresponding to the second digital certificate to decrypt it.

[0085] For example, all communication modules can add a TPM security chip to the hardware when they leave the factory, and pre-install (build-in) the digital certificate. The security service platform can also pre-install the digital certificate issued by the same certificate issuing center. The digital certificates pre-installed in each communication module and security service platform are issued or distributed by the same certificate issuing center. This ensures the security of data transmission between different devices, thereby solving the trust problem between different devices. Figure 3 As shown, digital certificates (DC) are pre-installed in the first communication module, the second communication module and the security service platform, and the first digital certificate, the second digital certificate and the third digital certificate are distributed or issued by CA respectively.

[0086] In a possible implementation, before step S201, the security service platform uses the private key corresponding to its own third digital certificate to encrypt the AT instruction, and sends the encrypted AT instruction to the first communication module. Accordingly, the first communication module receives the AT instruction from the security service platform. Among them, the AT instruction is used to trigger the second communication module to send log information to the first communication module. The first communication module can then forward the AT instruction to the second communication module, and accordingly, the second communication module receives the AT instruction from the first communication module. The above process may include the security service platform sending an AT instruction and encrypting the AT instruction, the first communication module forwarding the AT instruction, and the second communication module sending log information to the first communication module after receiving the AT instruction.

[0087] It can be understood that all AT commands start with "AT", followed by specific commands and parameters. For example, the AT+CSQ command is used to query signal quality. AT commands can be applied to 4G modules, 5G modules, GPS receivers, and Bluetooth devices, etc. Exemplarily, "AT" can mean a test connection, such as the AT command simply sends "AT" and the device returns "OK" to indicate a normal connection. "AT+GMI" means querying manufacturer information. "AT+DEBUG" can mean instructing the module to enter debug mode.

[0088] Exemplarily, the AT command can trigger the second communication module to enter the debug mode (debug mode). Assuming that "opensesame" is a special instruction that triggers the debug mode, the special instruction can be encrypted with the private key corresponding to the third digital certificate of the security service platform and sent to the second communication module. After the second communication module receives the encrypted AT command, it uses the public key corresponding to the third digital certificate to decrypt. If the decryption is successful, it enters the debug mode. After the second communication module enters the debug mode, the debug port and the log port can be opened, and the second communication module can generate and transmit real-time log information. In addition, in the debug mode, the second communication module can receive the AT command of the security service platform, and the AT command may include modifying configuration parameters, querying module status, executing test commands, etc.

[0089] In a possible implementation, the above AT command can be input by the staff at the client corresponding to the security service platform. Before the client accesses the security service platform, the client needs to obtain a connection license (verification code), which is saved by the owner of the security service platform. After the client obtains the connection license, it can initiate a connection request to the firewall corresponding to the security service platform. The client can pass the authentication of the firewall using the connection license. After passing the authentication of the firewall, the client can initiate an access request to the security service platform, and when the client receives the response of accepting access returned by the security service platform, the client can directly access the security service platform. The staff can remotely access the security service platform on the client interface and view the log information sent by the second communication module to the security service platform through the first communication module. Or the staff enters the AT command at the client to view the log data or log information saved in the security service platform. After the security service platform receives the AT command, it can send the AT command to the second communication module through the above-mentioned first communication module. Thereby, the client can remotely view the log information or data of the security service platform without obtaining any data of the security service platform, thereby ensuring data security.

[0090] In another possible implementation, when the second communication module fails, the log information of the second communication module can be actively reported (sent) to the first communication module through an automatic detection mechanism. For example, the second communication module can be set up with a regular self-check mechanism to periodically check the connection status, signal strength, or data transmission status of the cellular network supported by the second communication module. When it is checked that the connection status, signal strength, or data transmission status of the cellular network supported by the second communication module The corresponding parameters do not meet the corresponding preset conditions, the second communication module actively reports (sends) the log information of the second communication module to the first communication module.

[0091] In a possible implementation, when the second communication module cannot connect to the cellular network, the second communication module may periodically send a Bluetooth broadcast message to the first communication module via Bluetooth Low Energy (BLE).

[0092] In a possible implementation, before step S201, the second communication module sends a Bluetooth broadcast message to the first communication module via Bluetooth. Correspondingly, the first communication module receives a Bluetooth broadcast message from the second communication module via Bluetooth. The Bluetooth broadcast message includes indication information, and the indication information is used to indicate that the second communication module cannot be connected to the cellular network. The indication information may include an indication that the second communication module cannot access the cellular network, and an indication that the second communication module can access the cellular network but cannot connect to the Internet. The indication information can be identified using a specific error code, for example, "0x02" can indicate an indication that the second communication module cannot access the cellular network, and "0x03" can indicate an indication that the second communication module can access the cellular network but cannot connect to the Internet. It should be noted that the first communication module here refers to any communication module that can normally connect to the cellular network. After receiving the Bluetooth broadcast message, the first communication module uses the public key corresponding to the second digital certificate to decrypt the Bluetooth broadcast message and obtain the indication information. The first communication module sends a first message to the security service platform, and the first message includes the indication information. For the first message, the first communication module can use the private key corresponding to its first digital certificate to encrypt. After receiving the first message, the security service platform uses the public key corresponding to the first digital certificate of the first communication module to decrypt the first message and obtain the instruction information. Based on the first message, the security service platform sends a second message to the first communication module, and the second message is used to instruct the first communication module to establish a wireless local area network connection with the second communication module. The wireless local area network connection includes a Wi-Fi and / or Bluetooth connection.

[0093] In another possible implementation, before step S201, the second communication module sends a Bluetooth broadcast message to one or more communication modules (the one or more communication modules include the first communication module) via Bluetooth. Correspondingly, the one or more communication modules receive the Bluetooth broadcast message from the second communication module. In other words, multiple other communication modules around the second communication module may have received the Bluetooth broadcast message. Among them, the Bluetooth broadcast message can be encrypted using the private key corresponding to the second digital certificate of the second communication module. Optionally, the Bluetooth broadcast message may include the identifier of the second communication module, the location information of the second communication module, and indication information. Optionally, the Bluetooth broadcast message also includes the media access control (MAC) address information of the second communication module, etc.

[0094] The one or more communication modules mentioned above send a first message to the security service platform respectively. Correspondingly, the security service platform receives a first message from the one or more communication modules. In other words, the security service platform can receive multiple messages sent from multiple normal communication modules. It should be noted that in the embodiment of the present application, a normal communication module refers to a communication module that can be normally connected to a cellular network, and an abnormal communication module refers to a communication module that cannot be connected to a cellular network. One or more communication modules are expressed using a third communication module, and the first message mentioned above may include an identifier of the third communication module, location information of the third communication module, a received signal strength of a Bluetooth broadcast message received by the third communication module, location information of the second communication module, an identifier of the second communication module, and indication information. Optionally, the first message may include only indication information, an identifier of the third communication module, and a received signal strength of a Bluetooth broadcast message received by the third communication module.

[0095] Before the security service platform sends the second message to the first communication module, the security service platform needs to first select the third communication module with the strongest received signal strength of the Bluetooth broadcast message from the one or more third communication modules to determine the first communication module. Specifically, the security service platform arranges the received signal strength of the one or more received Bluetooth broadcast messages in order from large to small or from small to large based on the one or more first messages received above. From the arrangement order, the security service platform determines the third communication module corresponding to the strongest received signal strength of one or more Bluetooth broadcast messages as the first communication module. It can be understood that the first communication module determined by the received signal strength of the Bluetooth broadcast message may be closest to the second communication module, the received signal strength of the Bluetooth broadcast message is the strongest, and the information transmission is faster. At the same time, the faster the first communication module establishes a wireless LAN connection with the second communication module, the lower the bit error rate can be.

[0096] The security service platform sends a second message to the first communication module that has been determined. Correspondingly, the first communication module receives the second message from the security service platform. The second message is used to instruct the first communication module to establish a wireless local area network connection with the second communication module, and the wireless local area network connection includes a Wi-Fi and / or Bluetooth connection.

[0097] Exemplarily, as shown in Table 1 below, the security service platform can sort the received signal strengths of the Bluetooth broadcast messages, and establish a received signal strength list of the Bluetooth broadcast messages based on the sorting order (exemplarily, the received signal strengths of the Bluetooth broadcast messages in the following list are sorted from large to small). The list may include the received signal strength of the Bluetooth broadcast message, the identification of one or more communication modules, the location information of one or more communication modules, the location information of the second communication module, and the identification of the second communication module.

[0098] Optionally, the security service platform can display the list on the user interface, and can select the signal strength of the Bluetooth broadcast message as needed, and determine the communication module as the gateway according to the signal strength of the selected Bluetooth broadcast message. For example, if the signal strength of the Bluetooth broadcast message corresponding to sequence number 1 is selected, the security service platform can determine the communication module identifier (e.g., the communication module with the International Mobile Equipment Identity (IMEI) of "bbbbbb" as the first communication module.

[0099] Table 1

[0100]

[0101] It should be noted that a communication module that generally supports Bluetooth function has a total of 40 channels, of which channels 37, 38 and 39 can be used as main broadcast channels, and the remaining 37 channels can be used as data channels or auxiliary broadcast channels. The payload format of the message packet of the ordinary Bluetooth broadcast indication (Advertising Indication, ADV_IND) (also known as ordinary broadcast packet) can be composed of a 6-byte address of the broadcasting device (second communication module) and 0-31 bytes of data.

[0102] like Figure 4 As shown, Figure 4It is a structural schematic diagram of a Bluetooth broadcast message data packet provided by an embodiment of the present application. It can represent the data packet structure of the broadcast data (Advertising Data, AdvData) or the scan response data (ScanResponse Data) in the second communication module. The broadcast data can represent the data packet sent by the communication module with Bluetooth function when broadcasting, which is used to allow other communication modules to discover and identify. The scan response data can represent the data packet sent as a response after the Bluetooth device receives the scan request. The structure of the data packet can be divided into an important part (Significant Part) and a secondary part (Non-Significant Part). The important part represents the essential information in the broadcast data packet, such as the information stored on the AD structure 1, AD structure 2, ..., AD structure N structure. The secondary part represents the optional information in the broadcast data packet, such as the information stored on the 000...000b structure. AdvData can be composed of multiple elements, each of which can be composed of three parts: "length", "type", and "data". Exemplarily, "length" can be represented by 1 byte (1 octet) to represent the size or required space of the data field. "Data" can use length bytes (Length octets) to represent the size or required space of the data field. "AD Type" can use n bytes (n octets) to represent the size or required space of the data field, where n is a variable and can be any positive integer. For example, 2octet represents 2 bytes, and 3octet represents 3 bytes. "AD Data" can use a length of n bytes (Length-n octets) to represent the size or required space of the data field. n is also a variable, indicating the length of the data. For example, Length-2octet represents a 2-byte data field, and Length-3octet represents a 3-byte data field. Among them, the AD Data (AD Data) storage space can carry encrypted data to be sent. The encrypted data refers to the information or data carried by the Bluetooth broadcast message, which may include the identification (IMEI) of the second communication module, the location information of the second communication module, the indication information, and the MAC address information of the second communication module, etc.

[0103] In a possible implementation, before the second communication module sends a Bluetooth broadcast message to the first communication module, the second communication module uses the private key corresponding to the second digital certificate to encrypt the Bluetooth broadcast message. Correspondingly, after the first communication module receives the Bluetooth broadcast message from the second communication module, the first communication module uses the public key corresponding to the second digital certificate to decrypt the Bluetooth broadcast message, and can obtain the location information of the second communication module, the identifier of the second communication module (IMEI), and the indication information.

[0104] In a possible implementation, before the first communication module sends the first message to the security service platform, the first communication module decrypts the above Bluetooth broadcast message and adds relevant information of the first communication module, such as the identification (IMEI) of the first communication module, the location information of the first communication module, the reception signal strength of the Bluetooth broadcast message received by the first communication module from the second communication module, etc. After the first communication module re-encrypts the above-mentioned information using the private key corresponding to the first digital certificate, it sends the first message to the security service platform, and the first message may include the identification (IMEI) of the first communication module, the location information of the first communication module, the reception signal strength of the Bluetooth broadcast message of the second communication module, the location information of the second communication module, the identification (IMEI) of the second communication module, and the indication information. After the security service platform receives the first message from the first communication module, it uses the public key corresponding to the first digital certificate to decrypt the first message, and can obtain the identification (IMEI) of the first communication module, the location information of the first communication module, the reception signal strength of the Bluetooth broadcast message of the second communication module, the location information of the second communication module, the identification (IMEI) of the second communication module, and the indication information. Optionally, the Bluetooth broadcast message may include only the indication information, and the first message may include only the indication information, the identifier of the third communication module, and the reception signal strength of the Bluetooth broadcast message received by the third communication module.

[0105] In a possible implementation, before the security service platform sends the second message to the first communication module, the private key corresponding to the third digital certificate is used to encrypt the second message. After the first communication module receives the second message from the security service platform, the first communication module uses the public key corresponding to the third digital certificate to decrypt the second message and determines to establish a wireless local area network connection with the second communication module.

[0106] In a possible implementation, the specific steps of establishing a wireless local area network connection between the first communication module and the second communication module are as follows: Figure 5As shown. The first communication module sends a Bluetooth connection request to the second communication module, and a Bluetooth connection can be established by calling the "connect()" method. The first communication module can start the established timer, which is used to record the time of the Bluetooth connection. If the Bluetooth connection times out within the predetermined time, the first communication module can determine that it cannot establish a Bluetooth connection with the second communication module. If the Bluetooth connection between the first communication module and the second communication module is successful within the predetermined time, the timer is turned off. Exemplarily, when the Bluetooth connection times out within the predetermined time, the first communication module can call the "cancelConnect()" method to send an instruction to cancel the Bluetooth connection to the second communication module, cancel the current Bluetooth connection request, and ensure that the first communication module will not wait indefinitely for the response of the second communication module to agree to the Bluetooth connection. Optionally, after the first communication module cancels the connection with the second communication module, a message of Bluetooth connection failure can be sent to the security service platform. The security service platform can select the next communication module (such as the fourth communication module) from the above list (Table 1) as the first communication module, initiate a Bluetooth connection request to the fourth communication module, and also call the "connect()" method to establish a Bluetooth connection. Repeat the above steps until the first communication module receives a response from the second communication module agreeing to establish a Bluetooth connection, and the first communication module successfully establishes a Bluetooth connection with the second communication module.

[0107] In one possible implementation, Figure 5As shown, after the first communication module establishes a Bluetooth connection with the second communication module, the first communication module can call the "WiFiP2pManager.createGroup()" method to establish a WiFi P2P (WiFi point-to-point) group, so that the first communication module becomes the group owner (Group Owner) of the WiFi Direct group. At this time, the first communication module can be called the group owner or group owner, and assumes a role similar to that of a wireless router. The first communication module can create a "WiFiP2pConfig" object containing connection information, which contains the configuration parameters of the first communication module required for the WiFi point-to-point connection. Here, the first communication module can use the private key corresponding to the first digital certificate to encrypt the sent "WiFiP2pConfig" object. Through the successfully established Bluetooth connection, the first communication module can send the encrypted "WiFiP2pConfig" object to the second communication module via Bluetooth. The second communication module receives the encrypted information from the first communication module through the Bluetooth input stream. The second communication module uses the public key corresponding to the first digital certificate to decrypt the encrypted information and obtain the decrypted "WiFiP2pConfig" object. The second communication module uses the configuration information in the decrypted "WiFiP2pConfig" object to connect to the WiFi direct connection group of the first communication module. Among them, the second communication module calls the "connect()" method to initiate a wireless LAN direct connection (WLAN Direct) connection request to the first communication module. After receiving the wireless LAN direct connection request, the first communication module calls the "accept()" method to send a response message to the second communication module agreeing to the wireless LAN direct connection. After the second communication module receives the response message from the first communication module, it creates a socket connection object, which can specify the IP address and port number of the first communication module to be connected. The second communication module sends the Socket connection object to the first communication module. After the first communication module receives the Socket connection object, the second communication module can create a ServerSocket object to listen for connection requests on a specific port. The first communication module can accept the connection request from the second communication module through the "accept()" method of the ServerSocket object. When the first communication module receives the Socket connection request, it can send a response to the second communication module agreeing to establish a Socket connection. Finally, the first communication module and the second communication module can establish a connection through their respective Socket objects and can perform two-way data communication. The second communication module completes a handshake with the first communication module through a Bluetooth connection and successfully establishes a wireless local area network connection.At this time, the first communication module can be used as the gateway of the second communication module, that is, the normal module (first communication module) can be used as the gateway of the abnormal module (second communication module). In other words, some high-priority services of the abnormal communication module can be forwarded by the 4G cellular network of the normal communication module. Optionally, if the cellular network of the normal communication module is a 5G network, because the bandwidth of the 5G network is sufficient, all services of the abnormal communication module can also be forwarded. It should be noted that large files or high-data services can be transmitted between communication modules based on wireless LAN direct connection technology, which mainly utilizes the point-to-point connection advantages of wireless LAN direct connection. Among them, WiFi6 can theoretically reach a transmission rate of 1.4Gbps or higher, with high bandwidth and low latency characteristics. For example, high-definition video files, complex 3D models or large amounts of sensor data can be transmitted in a shorter time.

[0108] In a possible implementation, before step S201, the second communication module sends a third message to the first communication module through the wireless local area network. Accordingly, the first communication module receives the third message from the second communication module through the wireless local area network. The third message is used to request to establish an Internet Protocol security IPSec connection with the first communication module, and the second communication module can encrypt the third message using the private key corresponding to the second digital certificate. The first communication module sends a fourth message to the security service platform through the cellular network, and accordingly, the security service platform receives the fourth message from the first communication module through the cellular network. The fourth message is used to request to establish an IPSec connection with the security service platform. The security service platform sends a fifth message to the first communication module, and accordingly, the first communication module receives the fifth message from the security service platform. The fifth message is used to agree to establish an IPSec connection between the security service platform and the first communication module. The first communication module sends a sixth message to the second communication module, and accordingly, the second communication module receives the sixth message from the first communication module. The sixth message is used to agree to establish an IPSec connection between the first communication module and the second communication module. Optionally, if a wireless local area network connection can also be established between the first communication module and the security service platform, a message is sent through the wireless local area network to complete the above IPSec connection establishment process.

[0109] After the first communication module establishes an IPSec connection with the second communication module, the second communication module and the security service platform can communicate through the established end-to-end encrypted IPSec connection. Exemplarily, the second communication module uses a wireless local area network (such as WLAN Direct technology) to send the above-mentioned log information (optionally unencrypted) to the first communication module through the established IPSec connection. After the first communication module receives the log information, it can use the cellular network to send the log information (optionally unencrypted) to the security service platform through the IPSec connection established between it and the security service platform. The security service platform receives the log information of the second communication module sent by the first communication module. Optionally, if the security service platform needs to send the generated AT command to the second communication module, the security service platform can send the AT command (optionally unencrypted) to the first communication module through the established IPSec connection between it and the first communication module. After the first communication module receives the AT command from the security service platform, it can send the AT command (optionally unencrypted) to the second communication module through the established IPSec connection between it and the second communication module. The second communication module receives the AT command from the first communication module.

[0110] In a possible implementation, the third message, the fourth message, the fifth message, and the sixth message sent in the process of establishing the IPSec connection can be encrypted and decrypted using a digital certificate. However, after the IPSec connection has been successfully established, the established IPSec connection can ensure that the information in the transmission process will not be intercepted or tampered by an unauthorized third party, which can meet the security requirements of data transmission. Therefore, when transmitting information or data through the established IPSec connection, it is not necessary to encrypt the information or data sent by using a digital certificate.

[0111] It should be noted that when the second communication module cannot connect to the cellular network, the second communication module can request the security service platform to establish an IPSec connection through the first communication module. The use of IPSec connection can ensure the confidentiality and integrity of data during transmission and prevent data from being eavesdropped or tampered with in an unsafe network environment.

[0112] It can be understood that the above IPSec connection includes two stages. The first stage of the IPSec connection is: the second communication module establishes an Internet Key Exchange Security Association (IKE SA) (or an Internet Security Association and a Key Management Protocol Security Association ISAKMP SA) with the security service platform through the first communication module. Exemplarily, the second communication module sends an IKE SA negotiation request to the security service platform through the first communication module. The security service platform sends a response result of completing the IKE SA negotiation to the second communication module through the first communication module. Exemplarily, there are two main modes for establishing IKE SA: Main Mode and Aggressive Mode. Among them, the main mode is a process of gradually establishing a security association, which is mainly used to protect identity information and negotiate security parameters. The exchange process of the main mode is divided into three stages, with a total of six messages. Stage 1 is the negotiation stage. Message 1 can refer to the initiator sending a proposal containing security parameters such as encryption algorithm and hash algorithm to the responder. Message 2 can refer to the responder replying to the encryption algorithm, hash algorithm and other parameters selected by it. Phase 2 is the key exchange phase. Message 3 may refer to the initiator sending a public key and a random number for generating a shared key. Message 4 may refer to the responder sending its public key and a random number. Phase 3 is the authentication phase. Message 5 may refer to the initiator sending identity authentication information (such as a certificate, a hash value of a pre-shared key). Message 6 may refer to the responder sending identity authentication information. Among them, the aggressive mode is a faster exchange method that completes the establishment of a security association in three messages. Because of its faster speed, the protection of identity information is weaker. Message one may refer to the initiator sending a proposal containing its encryption algorithm, hash algorithm, public key, random number and identity authentication information. Message two may refer to the responder sending its selected encryption algorithm, hash algorithm, key, random number and identity authentication information. Message three may refer to the initiator sending the final identity authentication information (such as a signature, certificate).

[0113] The second stage of the IPSec connection is: the second communication module establishes an IPSec connection with the security service platform through the first communication module. The connection process may include three processes: message a, message b and message c. Message a may refer to the negotiation initiator sending IPSec security proposals, identity and verification data to the negotiation responder. The negotiation responder searches for matching security proposals and generates a key. Message b may refer to the negotiation responder sending a confirmed security proposal, identity and verification data to the negotiation initiator. The negotiation initiator receives the security proposal and generates a key. Message c may refer to the negotiation initiator sending a confirmation message to the negotiation responder, and the negotiation responder receives the confirmation message. Thereafter, the first communication module can establish an end-to-end encrypted IPSec security connection with the security service platform.

[0114] S202, the first communication module sends the above log information to the security service platform via the cellular network. Correspondingly, the security service platform receives the log information of the second communication module sent by the first communication module. The second communication module encrypts the log information using the private key corresponding to the second digital certificate, and the log information includes the log information that the second communication module cannot connect to the cellular network.

[0115] In a possible implementation, the security service platform determines that the second communication module cannot be connected to the cellular network based on the log information. When the above-mentioned WLAN Direct connection is successfully established, the first communication module can be used as the gateway of the second communication module, and the first communication module sends log information to the security service platform through the cellular network. At this time, when the second communication module cannot be connected to the cellular network, some high-priority services of the second communication module can be forwarded to the security service platform by the cellular network of the first communication module. The cellular network of the first communication module can be a 4G or 5G network. Thereby avoiding business interruption and reducing losses. Exemplarily, since the above-mentioned log information includes the log information that the second communication module cannot be connected to the cellular network, the security service platform can determine that the second communication module cannot be connected to the cellular network according to the log information, and can analyze the specific reasons why the second communication module cannot be connected to the cellular network. The specific reasons may include poor wireless signal, arrears of the subscriber identity module (Subscriber Identity Module, SIM) card or embedded SIM card, abnormality of the SIM or embedded SIM card, version problem of the second communication module, radio frequency problem, network configuration error, or other software or hardware failures. Except for hardware failures that require on-site repair or replacement of hardware equipment, the other specific failure causes mentioned above can be repaired remotely after analysis through the security service platform, so as to remotely locate and analyze the reasons why the abnormal communication module cannot connect to the cellular network, quickly restore the business of the abnormal communication module, and save human resources and repair time.

[0116] In another possible implementation, the specific cause of the cellular network failure needs to be analyzed by staff. The security service platform can analyze simple or common failures based on the above log information, but if the security service platform cannot confirm the specific reason why the abnormal communication module cannot connect to the cellular network, the staff can view the above log information on the security service platform through the client and then analyze the specific reason why the abnormal communication module cannot connect to the cellular network. The staff can remotely access the log information of the abnormal communication module stored in the security service platform through the client.

[0117] It should be noted that the staff can only view the log data or information on the security service platform by remotely inputting the above AT commands on the client, or download the log information of the abnormal communication module stored on the security service platform on the client. The owner of the communication module or security service platform will strictly restrict the rights of the staff. Therefore, if the access to the security service platform is not enabled, personnel other than the owner of the communication module or security service platform cannot download or transmit any data to the security service platform through the client, thereby ensuring data security.

[0118] Exemplarily, the staff (or R&D personnel) access the security service platform through the client, and can operate the second communication module on the user interface of the security service platform. The operation for the second communication module may include forwarding the input AT command through the first communication module, forwarding the firmware upgrade (Firmware Over-The-Air, FOTA) of the specified version through the first communication module, forwarding the configuration file (profile) of the embedded SIM card through the first communication module, and forwarding the real-time collected and printed operation log through the first communication module. Among them, the new version file for FOTA upgrade on the security service platform needs to go through the normal version file release process, and the owner of the version file is uploaded to the security service platform to complete the version upgrade process.

[0119] In an embodiment of the present application, the first communication module receives log information from the second communication module through a wireless local area network, and the log information is encrypted by the private key corresponding to the second digital certificate of the second communication module, and the log information includes log information that the second communication module cannot connect to the cellular network; the first communication module sends the log information to the security service platform through the cellular network it supports. Thus, the log information of the abnormal communication module can be obtained remotely to assist the staff in solving the problem that the communication module cannot connect to the cellular network. And the log information is encrypted by the private key corresponding to the second digital certificate of the second communication module, so as to ensure the security of obtaining the log information.

[0120] The method of the embodiment of the present application is described in detail above, and the device of the embodiment of the present application is provided below.

[0121] See also Figure 6 , Figure 6 : is a schematic diagram of the structure of a communication device provided in an embodiment of the present application, and the communication device may include:

[0122] The receiving module 601 is used to receive log information from the second communication module through the wireless local area network, where the log information is encrypted by the private key corresponding to the second digital certificate of the second communication module, and the log information includes log information that the second communication module cannot connect to the cellular network;

[0123] The sending module 602 is used to send the log information to the security service platform through the cellular network.

[0124] In a feasible implementation, the receiving module 601 is also used to receive an attention AT instruction from the security service platform, the AT instruction is encrypted by the private key corresponding to the third digital certificate of the security service platform, and the AT instruction is used to trigger the second communication module to send the log information to the first communication module; the sending module 602 is also used to send the AT instruction to the second communication module.

[0125] In a feasible implementation, the receiving module 601 is also used to receive a Bluetooth broadcast message from the second communication module via Bluetooth; the Bluetooth broadcast message includes indication information, and the indication information is used to indicate that the second communication module cannot connect to the cellular network; the sending module 602 is also used to send a first message to the security service platform, and the first message includes the indication information; the receiving module 601 is also used to receive a second message from the security service platform, and the second message is used to instruct the first communication module to establish the wireless local area network connection with the second communication module; the wireless local area network connection includes Wireless Fidelity Wi-Fi and / or Bluetooth connection.

[0126] In a feasible implementation, the decryption module 604 is configured to use the public key corresponding to the second digital certificate to decrypt the Bluetooth broadcast message to obtain the indication information.

[0127] In a feasible implementation, the encryption module 603 is used to encrypt the first message using the private key corresponding to the first digital certificate of the first communication module.

[0128] In a feasible implementation, the decryption module 604 is further configured to use the public key corresponding to the third digital certificate to decrypt the second message and determine to establish the wireless local area network connection with the second communication module.

[0129] In a feasible implementation, the receiving module 601 is also used to receive a third message from the second communication module, and the third message is used to request to establish an Internet Protocol security IPSec connection with the first communication module; the third message is encrypted by the private key corresponding to the second digital certificate; the sending module 602 is also used to send a fourth message to the security service platform, and the fourth message is used to request to establish an IPSec connection with the security service platform; the receiving module 601 is also used to receive a fifth message from the security service platform, and the fifth message is used to agree to establish an IPSec connection between the security service platform and the first communication module; the sending module 602 is also used to send a sixth message to the second communication module, and the sixth message is used to agree to establish an IPSec connection between the first communication module and the second communication module.

[0130] In a feasible implementation, the decryption module 604 is also used to decrypt the third message using the public key corresponding to the second digital certificate; and is also used to decrypt the fifth message using the public key corresponding to the third digital certificate; the encryption module 603 is also used to encrypt the fourth message using the private key corresponding to the first digital certificate of the first communication module; and is also used to encrypt the sixth message using the private key corresponding to the first digital certificate.

[0131] In a specific implementation, the communication device can execute the above-mentioned Figure 2 The steps or methods performed by the first communication module in the embodiment shown in the figure implement the functions implemented in the above method embodiment. For details, please refer to the above Figure 2 The corresponding descriptions provided in each step of the method embodiment are not repeated here.

[0132] In the embodiment of the present application, the receiving module 601 receives log information from the second communication module through the wireless local area network. The log information is encrypted by the private key corresponding to the second digital certificate of the second communication module, and the log information includes log information that the second communication module cannot connect to the cellular network; the sending module 602 sends the log information to the security service platform through the cellular network. The log information of the abnormal communication module can be obtained remotely to assist the staff in solving the problem that the communication module cannot connect to the cellular network, and the security of obtaining the log information can be improved.

[0133] See also Figure 7 , Figure 7 : is a structural diagram of a security service platform provided in an embodiment of the present application. The communication device may include:

[0134] The receiving module 701 is used to receive log information of the second communication module sent by the first communication module through a cellular network. The log information is encrypted by the private key corresponding to the second digital certificate of the second communication module, and the log information includes log information that the second communication module cannot connect to the cellular network.

[0135] In a feasible implementation, the encryption module 703 is used to encrypt the AT instruction using the private key corresponding to the third digital certificate of the security service platform, and the AT instruction is used to trigger the second communication module to send the log information to the first communication module; the sending module 702 is also used to send the AT instruction to the first communication module.

[0136] In a feasible implementation, the receiving module 701 is also used to receive a first message from the first communication module, and the first message includes indication information, and the indication information is used to indicate that the second communication module cannot connect to the cellular network; the sending module 702 is also used to send a second message to the first communication module based on the first message, and the second message is used to indicate that the first communication module establishes a wireless local area network connection with the second communication module; the wireless local area network connection includes a Wi-Fi and / or Bluetooth connection.

[0137] In a feasible implementation, the receiving module 701 is also used to receive one or more first messages, which include the indication information, the identifier of the third communication module, and the reception signal strength of the Bluetooth broadcast message received by the third communication module; the sending module 702 is specifically used to select the third communication module with the strongest reception signal strength of the Bluetooth broadcast message from one or more third communication modules, and determine it as the first communication module; and send the second message to the determined first communication module.

[0138] In a feasible implementation, the decryption module 704 is further configured to use the public key corresponding to the first digital certificate to decrypt the first message to obtain the indication information.

[0139] In a feasible implementation, the encryption module 703 is further configured to encrypt the second message using a private key corresponding to a third digital certificate of the security service platform.

[0140] In a feasible implementation, the receiving module 701 is also used to receive a fourth message from the first communication module, and the fourth message is used to request to establish an IPSec connection with the security service platform; the sending module 702 is also used to send a fifth message to the first communication module, and the fifth message is used to agree to establish an IPSec connection between the security service platform and the first communication module.

[0141] In a feasible implementation, the decryption module 704 is also used to decrypt the fourth message using the public key corresponding to the first digital certificate; the encryption module 703 is also used to encrypt the fifth message using the private key corresponding to the third digital certificate of the security service platform.

[0142] In a specific implementation, the communication device can execute the above-mentioned Figure 2 The steps or methods executed by the security service platform in the embodiment shown in the figure implement the functions implemented in the above method embodiment. For details, please refer to the above Figure 2 The corresponding descriptions provided in each step of the method embodiment are not repeated here.

[0143] In the embodiment of the present application, the receiving module 701 receives the log information of the second communication module sent by the first communication module, and the log information is encrypted by the private key corresponding to the second digital certificate of the second communication module, and the log information includes the log information that the second communication module cannot connect to the cellular network. The log information of the abnormal communication module can be obtained remotely to assist the staff to solve the problem that the communication module cannot connect to the cellular network, and the security of obtaining the log information can be improved.

[0144] See also Figure 8 , Figure 8 801 is a schematic diagram of the structure of a communication device provided in an embodiment of the present application. The communication device may be the first communication module or the security service platform in any of the above embodiments, and may be used to implement the steps of the fault information transmission method of the communication module performed by the first communication module or the security service platform described in any of the above embodiments. The communication device may include: a processor 801, a memory 802, a network interface 803, and a bus system 804.

[0145] The memory 802 includes but is not limited to RAM, ROM, EPROM or CD-ROM, and is used to store relevant instructions and data. The memory 802 stores the following elements, executable modules or data structures, or their subsets, or their extended sets:

[0146] Operation instructions: include various operation instructions, used to implement various operations.

[0147] Operating system: includes various system programs used to implement various basic businesses and handle hardware-based tasks.

[0148] Figure 8 Only one memory is shown in the figure, of course, the memory can also be set to multiple as needed.

[0149] Processor 801 can be a controller, CPU, general processor, DSP, ASIC, FPGA or other programmable logic device, transistor logic device, hardware component or any combination thereof. It can implement or execute various exemplary logic boxes, modules and circuits described in conjunction with the disclosure of the embodiments of the present application. For example, the first communication module involved in Example 1 receives log information from the second communication module via a wireless local area network, and sends the log information to the security service platform via a cellular network. Processor 801 can also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and the like.

[0150] The network interface 803 can provide a network communication function, and can optionally include a standard wired interface, a wireless interface (such as a WI-FI interface). In the embodiment of the present application, the network interface 803 is used to execute the process of establishing a wireless local area network connection between the first communication module and the second communication module involved in the first embodiment.

[0151] In a specific application, the various components of the communication device are coupled together through the bus system 804, wherein the bus system 804 may include a power bus, a control bus, and a status signal bus in addition to a data bus. Figure 8 In the figure, various buses are labeled as bus system 804. For convenience of representation, Figure 8 The drawing is only schematic.

[0152] It should be noted that in practical applications, the processor in the embodiment of the present application can be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method embodiment can be completed by an integrated logic circuit of hardware in the processor or an instruction in the form of software. The above processor can be a general-purpose processor, a digital signal processor (Digital Signal Processor, DSP), an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field programmable gate array (Field Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The disclosed methods, steps and logic block diagrams in the embodiments of the present application can be implemented or executed.

[0153] It can be understood that the memory in the embodiments of the present application can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct RAM bus random access memory (DRRAM). It should be noted that the memory described in the embodiments of the present application is intended to include but is not limited to these and any other suitable types of memory.

[0154] An embodiment of the present application further provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a computer, the method or steps executed by the first communication module or the security service platform in any of the above embodiments are implemented.

[0155] An embodiment of the present application also provides a computer program product, which, when executed by a computer, implements the method or steps executed by the first communication module or the security service platform in any of the above embodiments.

[0156] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0157] In short, the above are only preferred embodiments of the technical solution of this application, and are not intended to limit the protection scope of this application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of this application should be included in the protection scope of this application.

Claims

1. A method for transmitting fault information of a communication module, It is characterized in that Applied to the first communication module, the method includes: receiving log information from the second communication module through the wireless local area network, wherein the log information is encrypted by a private key corresponding to the second digital certificate of the second communication module, and the log information includes log information that the second communication module cannot connect to the cellular network; The log information is sent to the security service platform via the cellular network.

2. The method according to claim 1, It is characterized in that Before receiving the log information from the second communication module through the wireless local area network, the method further includes: receiving an attention AT instruction from the security service platform, wherein the AT instruction is encrypted by a private key corresponding to a third digital certificate of the security service platform, and the AT instruction is used to trigger the second communication module to send the log information to the first communication module; Send the AT command to the second communication module.

3. The method according to claim 2, It is characterized in that Before receiving the log information from the second communication module through the wireless local area network, the method further includes: receiving a Bluetooth broadcast message from the second communication module via Bluetooth; the Bluetooth broadcast message includes indication information, and the indication information is used to indicate that the second communication module cannot connect to the cellular network; Sending a first message to the security service platform, where the first message includes the indication information; A second message is received from the security service platform, where the second message is used to instruct the first communication module to establish a wireless local area network connection with the second communication module; the wireless local area network connection includes a wireless fidelity Wi-Fi and / or Bluetooth connection.

4. The method according to claim 3, It is characterized in that The Bluetooth broadcast message is encrypted by the private key corresponding to the second digital certificate; After receiving the Bluetooth broadcast message from the second communication module via Bluetooth, the method further includes: The public key corresponding to the second digital certificate is used to decrypt the Bluetooth broadcast message to obtain the indication information.

5. The method according to claim 3, It is characterized in that Before sending the first message to the security service platform, the method further includes: The first message is encrypted using the private key corresponding to the first digital certificate of the first communication module.

6. The method according to claim 3, It is characterized in that The second message is encrypted by a private key corresponding to a third digital certificate of the security service platform. After receiving the second message from the security service platform, the method further includes: The second message is decrypted using the public key corresponding to the third digital certificate to determine that the wireless local area network connection is established with the second communication module.

7. A method for transmitting fault information of a communication module, It is characterized in that Applied to a security service platform, the method comprises: Log information of a second communication module sent by a first communication module is received through a cellular network, wherein the log information is encrypted by a private key corresponding to a second digital certificate of the second communication module, and the log information includes log information that the second communication module cannot connect to the cellular network.

8. The method according to claim 7, It is characterized in that Before receiving the log information of the second communication module sent by the first communication module, the method further includes: Encrypting an AT command using a private key corresponding to the third digital certificate of the security service platform, wherein the AT command is used to trigger the second communication module to send the log information to the first communication module; Send the AT command to the first communication module.

9. The method according to claim 8, It is characterized in that Before receiving the log information of the second communication module sent by the first communication module, the method further includes: receiving a first message from the first communication module, wherein the first message includes indication information, and the indication information is used to indicate that the second communication module cannot connect to the cellular network; Based on the first message, a second message is sent to the first communication module, where the second message is used to instruct the first communication module to establish a wireless local area network connection with the second communication module; the wireless local area network connection includes a Wi-Fi and / or Bluetooth connection.

10. The method according to claim 9, It is characterized in that The receiving a first message from the first communication module includes: receiving one or more first messages, wherein the first message includes the indication information, an identifier of the third communication module, and a received signal strength of the Bluetooth broadcast message received by the third communication module; Based on the first message, sending a second message to the first communication module includes: Selecting a third communication module having the strongest received signal strength of the Bluetooth broadcast message from one or more third communication modules, and determining the module as the first communication module; Send a second message to the determined first communication module.

11. The method according to claim 9, It is characterized in that The first message is encrypted by a private key corresponding to a first digital certificate of the first communication module. After receiving the first message from the first communication module, the method further includes: The first message is decrypted using the public key corresponding to the first digital certificate to obtain the indication information.

12. The method according to claim 9, It is characterized in that Before sending the second message to the first communication module, the method further includes: The second message is encrypted using the private key corresponding to the third digital certificate of the security service platform.

13. A communication device, It is characterized in that include: A receiving module, configured to receive log information from a second communication module via a wireless local area network, wherein the log information is encrypted by a private key corresponding to a second digital certificate of the second communication module, and the log information includes log information that the second communication module cannot connect to a cellular network; The sending module is used to send the log information to the security service platform via the cellular network.

14. A communication device, It is characterized in that include: Processor, memory, and network interface; The processor is connected to the memory and the network interface, wherein the network interface is used to provide a data communication function, the memory is used to store a computer program, and the processor is used to call the computer program so that the communication device executes the method as described in any one of claims 1-12.

Images