Traffic management method and system based on edge intelligent router

Abstract

The invention provides a traffic management method and system based on an edge intelligent router, and relates to the field of traffic management. Legal user records and traffic rule configuration are synchronized to the local from a cloud server through the edge intelligent router; the method comprises the following steps: scanning access user information through a lower passing control device of an edge intelligent router, and sending the access user information to the edge intelligent router; and the edge intelligent router matches a user in a locally stored legal user record according to the access user information, if the matching succeeds, a passing access control strategy corresponding to the user is acquired in a locally stored passing rule, and whether the user is allowed to pass is judged according to a matching result.

Description

Technical Field

[0001] The present invention relates to the technical field of traffic management, and in particular to a traffic management method and system based on an edge intelligent router. Background Art

[0002] In order to achieve the security management of entrances and exits of important places, effective personnel identity verification and access management at the entrances and exits have become a common demand. With the use of access control management systems, access control resources, personnel, permissions, events, alarms, etc. are managed in an integrated manner, thereby meeting the user's security needs for entrances and exits while establishing a safe, efficient, comfortable and convenient environment for people's work, life and study.

[0003] For example, Chinese patent document CN201210025349.1 discloses a method for controlling an access control system with a mobile terminal and an access control system, the access control system comprising: an access control controller and an access control server, the access control server monitors the status of each access control point of the access control system through a camera device and saves the status information of the access control point; the access control controller obtains the status information of the access control point from the access control server and sends the status information of the access control point to the mobile terminal. CN201210025349.1 organically combines access control technology with mobile terminal technologies such as mobile phones, improves the current situation in the market where the access control system can only be linked with limited PC clients, reduces the burden of security personnel to monitor the computer display screen in real time, and effectively tracks important events.

[0004] For another example, Chinese patent document CN201480036837.X provides a control method for a mobile terminal and an access control system, wherein a card slot is provided on the side of the mobile terminal, an access control card is arranged in the card slot, the access control card and the card slot are connected via an access control card interface circuit, the access control card in the mobile terminal can store access control identification information of at least one access control device, the processor in the mobile terminal can read the access control identification information stored in the access control card via the access control card interface circuit, the access control card can be detachably arranged in the card slot of the mobile terminal, so that the access control card can be replaced and tested easily, the mobile terminal can correspond to at least one access control card, thereby reducing the difficulty of maintaining the access control card (such as testing, replacement and repair, etc.), and reducing the maintenance cost.

[0005] For example, Chinese patent document CN201610194559.1 involves a Bluetooth access control device, a Bluetooth access control management system and a method. The Bluetooth access control management method includes: the Bluetooth access control device sends a Bluetooth broadcast message; after receiving a trigger request from the user, the Bluetooth smart terminal scans the Bluetooth broadcast message and broadcasts an unlocking control message; the Bluetooth access control device scans the unlocking control message and verifies the legitimacy of the user based on the scanned unlocking control message; the Bluetooth access control device controls the door to be opened when the verification is passed.

[0006] In the above-mentioned Chinese patent documents, the networking methods of the aforementioned access control management systems are usually limited to use in a local area network. Not only does it require the deployment of a dedicated access control server, but it also requires the connection to a general router to achieve the purpose of networking. This model not only increases costs, but also increases the difficulty and workload of maintenance, reducing overall work efficiency. Summary of the invention

[0007] The purpose of the present invention is to provide a traffic management method based on edge intelligent router to solve the problems raised in the above background technology.

[0008] The present invention is achieved through the following technical solutions:

[0009] In a first aspect, the present invention provides a traffic management method based on an edge intelligent router, the method comprising the following steps:

[0010] Synchronize legitimate user records and access rule configurations from the cloud server to the local server through the edge intelligent router;

[0011] Scanning access user information through a lower-level access control device of an edge intelligent router, and sending the access user information to the edge intelligent router;

[0012] The edge intelligent router matches the user in the locally stored legal user records according to the access user information. If the match is successful, the access control policy corresponding to the user is obtained from the locally stored access rules, and determines whether to release the user according to the matching result.

[0013] In an implementable solution, before executing traffic management, the edge intelligent router further includes:

[0014] The tenant administrator logs in to the cloud server and binds multiple edge smart routers to his user account;

[0015] The tenant administrator sets the legal user records and access rules of each lower access control device for each edge intelligent router bound to his account;

[0016] The edge intelligent router uses the tenant administrator account to connect to the cloud server to obtain the legal user records and access rules of this node. Access management uses local data, and even if the network is disconnected, it will not affect the operation of the system.

[0017] In an implementable solution, the edge intelligent router locally stores historical traffic records and periodically synchronizes incremental records to a cloud server.

[0018] In an implementable solution, the edge intelligent router periodically sends heartbeat information to the cloud server, and the cloud server determines whether the edge intelligent router is normal based on the historical time difference of the heartbeat information timestamp.

[0019] In an implementable scheme, the heartbeat information includes the static data of the device ID and device UID of the edge intelligent router and the resource occupancy rate of CPU, bandwidth, and storage, real-time status data of the operating system and application error codes, and the connection status between the edge intelligent router and all its lower-level traffic control devices.

[0020] In one feasible solution, the method further includes:

[0021] Establishing a mesh topology structure according to the heartbeat information uploaded by the edge intelligent router;

[0022] Build a GIS platform on the cloud server to read the data information of the mesh topology structure;

[0023] Each segment of the mesh topology is rendered in the GIS platform to obtain a distribution map of the fault status of the edge intelligent router.

[0024] In one feasible solution, the method further includes:

[0025] When the pass verification is passed, the pass information can be sent to the designated responsible person as needed according to the configuration.

[0026] In a second aspect, the present invention provides a traffic management system based on an edge intelligent router, the system comprising a cloud server, an edge intelligent router, a traffic control device, and an intelligent device client;

[0027] The cloud server is used to provide tenant and device management, maintain the connection with the edge intelligent router, and forward the communication data between the intelligent device client and the edge intelligent router;

[0028] The edge intelligent router is used to match access users according to the acquired legal user records and access rules, and send instructions to the lower access control device to switch the access control device according to the matching results;

[0029] The passage control device is switched on and off after receiving the instruction;

[0030] The smart device client is used by the tenant administrator to remotely control the switch access control device.

[0031] In an implementable solution, the application structure of the cloud server includes:

[0032] Device management unit, used to manage, configure and control the edge intelligent router and its lower-level access control devices;

[0033] The data unit is used to manage system user data, collect and store historical traffic records and heartbeat information data of each edge intelligent router;

[0034] The update unit is used to manage the upgrade of the firmware and application software of the edge intelligent router through remote upgrade technology.

[0035] In an implementable solution, the application structure of the edge intelligent router includes:

[0036] A first communication module, used for communicating with a lower traffic control device;

[0037] A second communication module, used for communicating with a cloud server;

[0038] The matching module is used to determine whether the current passing user meets the release conditions;

[0039] A control module, used for controlling a lower traffic control device;

[0040] Storage module, used to obtain and store the legal user records and access rule configuration of this node, historical access records, and remote upgrade information data;

[0041] Heartbeat module, used to send heartbeat information to the cloud server at regular intervals;

[0042] A synchronization module, used to synchronize the legal user records and access rules of the edge intelligent router;

[0043] Update module, used to upgrade firmware and application software through remote upgrade technology;

[0044] The notification module is used to send the traffic information to the designated responsible person.

[0045] Compared with the prior art, the present invention has the following beneficial effects:

[0046] 1. By integrating the access control execution module, access control module and routing module in the edge intelligent router, the independent setting of access control server and external router is avoided, which effectively reduces the cost, simplifies the maintenance work and reduces the workload;

[0047] 2. The tenant administrator manages and configures the edge smart router bound to his account through the cloud server, and sends the configuration to the designated edge smart router. Daily access management is carried out by the edge smart router and its lower-level access control device through local data interaction; historical access records are first stored locally and synchronized to the cloud server when the network is connected, ensuring that even if the edge smart router cannot connect to the cloud server, the main functions of the system still operate normally; by integrating traditional access control servers and network routers in the edge smart router, costs are reduced, flexibility and openness are improved, and it can be widely used in various access control scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only preferred embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0049] Figure 1 A flow chart of a traffic management method based on an edge intelligent router provided by an embodiment of the present invention;

[0050] Figure 2 A schematic diagram of the cloud-edge configuration synchronization process provided by an embodiment of the present invention;

[0051] Figure 3 A schematic diagram of the cloud-edge historical traffic record synchronization process provided by an embodiment of the present invention;

[0052] Figure 4 A schematic diagram of the cloud-edge heartbeat mechanism flow provided by an embodiment of the present invention;

[0053] Figure 5 A schematic diagram of a remote control process for an edge intelligent router according to an embodiment of the present invention;

[0054] Figure 6 A schematic diagram of the structure of a traffic management system based on an edge intelligent router provided by an embodiment of the present invention;

[0055] Figure 7 A schematic diagram of the application structure of a cloud server provided in an embodiment of the present invention;

[0056] Figure 8 A schematic diagram of the OTA remote upgrade process provided by an embodiment of the present invention;

[0057] Fig. 9 A schematic diagram of a dual system structure for remote FOTA firmware upgrade provided by an embodiment of the present invention;

[0058] Fig.10A schematic diagram of the application structure of an edge intelligent router provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0059] In order to make the purpose, technical scheme and advantages of the present invention more obvious, the exemplary embodiments according to the present invention will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments of the present invention, and it should be understood that the present invention is not limited to the exemplary embodiments described herein. Based on the embodiments of the present invention described in the present invention, all other embodiments obtained by those skilled in the art without creative work should fall within the protection scope of the present invention.

[0060] In the following description, a large number of specific details are provided to provide a more thorough understanding of the present invention. However, it is apparent to those skilled in the art that the present invention can be implemented without one or more of these details. In other examples, in order to avoid confusion with the present invention, some technical features well known in the art are not described.

[0061] It should be understood that the present invention can be implemented in different forms and should not be interpreted as limited to the embodiments set forth herein. On the contrary, these embodiments are provided to make the disclosure thorough and complete and to fully convey the scope of the present invention to those skilled in the art.

[0062] The purpose of the terms used herein is only to describe specific embodiments and is not intended to be limiting of the present invention. When used herein, the singular forms "one", "an" and "said / the" are also intended to include plural forms, unless the context clearly indicates otherwise. It should also be understood that the terms "consisting of" and / or "comprising", when used in this specification, determine the presence of the features, integers, steps, operations, elements and / or parts, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, parts and / or groups. When used herein, the term "and / or" includes any and all combinations of the relevant listed items.

[0063] In order to fully understand the present invention, a detailed structure will be proposed in the following description to illustrate the technical solution proposed by the present invention. The optional embodiments of the present invention are described in detail as follows, but in addition to these detailed descriptions, the present invention may also have other implementations.

[0064] The purpose of the present invention is to provide a traffic management method, system and router based on an edge intelligent router, which fully integrates the advantages of Internet of Things technology and cloud computing SaaS model by deploying an intelligent router that integrates a traditional access control server and a network router at the edge, while avoiding their shortcomings to the greatest extent.

[0065] Embodiment 1:

[0066] See also Figure 1 In a first aspect, the present invention provides a traffic management method based on an edge intelligent router.

[0067] The method comprises the following steps:

[0068] S201, synchronizing the legal user records and access rule configuration from the cloud server 101 to the local through the edge intelligent router 102;

[0069] Illustratively, in an embodiment of the present invention, the tenant administrator manages and configures the edge intelligent router 102 bound to his account through the cloud server 101, and sends the configuration to the designated edge intelligent router 102. Daily traffic management is carried out by the edge intelligent router 102 and its subordinate traffic control device 104 through local data interaction, and the system operation will not be affected even if the network is disconnected.

[0070] S202, scanning access user information through the lower-level traffic control device 104 of the edge intelligent router 102, and sending the access user information to the edge intelligent router 102;

[0071] Exemplarily, in the embodiment of the present invention, the edge intelligent router 102 supports access to multiple types of lower-level access control devices 104, and can support access control devices 104 including but not limited to smart cards, password verification, and face recognition. These access control devices obtain and parse the current access user information according to the corresponding protocol, and send the parsed access user information to the connected edge intelligent router 102.

[0072] S203, the edge intelligent router 102 matches the user in the locally stored legal user records according to the access user information. If the match is successful, the access control policy corresponding to the user is obtained from the locally stored access rules, and whether to release the user is determined according to the matching result.

[0073] Exemplarily, the embodiments of the present invention support multiple predefined access management rules, such as time-based access rules. Exemplarily, the access time on weekdays can be set to 12:00-14:00, and access is available 24 hours a day on holidays. It also supports custom rules based on multiple specified parameters to meet complex access rule definitions.

[0074] The method provided by the embodiment of the present invention has new features different from the prior art, such as wide support for various types of access control devices, flexible and customizable access rule definitions, etc., showing open and flexible software and hardware scalability. It meets the business needs of access management in different scenarios to the greatest extent and reduces the dependence and binding on special access equipment, software and manufacturers.

[0075] In an practicable solution, the edge intelligent router 102 performs traffic management before: Figure 3 As shown, it also includes:

[0076] S301, the tenant administrator logs in to the cloud server 101 and binds multiple edge intelligent routers 102 under his user account;

[0077] S302, the tenant administrator sets a legal user record and access rules for each lower-level access control device 104 for each edge intelligent router 102 bound to his account;

[0078] S303, the edge intelligent router 102 uses the tenant administrator account to connect to the cloud server 101 to obtain the legal user records and access rules of this node. The access management uses local data, and the system operation is not affected even if the network is disconnected.

[0079] For example, Figure 3 As shown:

[0080] S303-01, the edge intelligent router 102 uses the tenant administrator account to connect to the cloud server 101;

[0081] S303-02, the cloud server 101 notifies the edge intelligent router 102 that the configuration can be updated;

[0082] S303-03, the edge intelligent router 102 calls the configuration update interface of the cloud server 101 to update the configuration;

[0083] S303-04, the edge intelligent router 102 verifies the configuration update result and feeds back the verification result to the cloud server 101. If successful, the cloud server 101 marks the configuration status of the edge intelligent router 102 as updated, and the cloud server 101 and the edge intelligent router 102 record the update log.

[0084] In the embodiment of the present invention, the system adopts the SaaS model of cloud computing, supports a multi-tenant sharing platform, and can meet the needs of users of various types and sizes, especially small and micro enterprise users. Figure 3 In the process shown, the tenant administrator sets the legal user records and access rules of the lower-level access control device 104 for the edge intelligent router 102 to which it is bound on the cloud server 101, and synchronizes the configuration to the corresponding edge intelligent router 102. The access judgment is matched through local data, and the system operation is not affected even if the network is disconnected.

[0085] In an implementable solution, the edge intelligent router 102 locally stores historical traffic records and periodically synchronizes incremental records to the cloud server 101.

[0086] For example, specifically, Figure 4 As shown, the method comprises the following steps:

[0087] S401, the edge intelligent router 102 starts a data synchronization task at a scheduled time.

[0088] S402, detect whether the edge intelligent router 102 is in a connected state with the cloud server 101. If it is in a disconnected state, the current synchronization task ends and waits for the next scheduled task; if it is in a connected state, start executing data synchronization.

[0089] In the embodiment of the present invention, it is mainly considered that the network environment in which the edge intelligent router 102 is located is complex, and it cannot be guaranteed that a reliable connection can be maintained between the edge intelligent router 102 and the cloud server 101. Therefore, a timed method is adopted to complete the end-to-cloud data synchronization to ensure the final consistency of the data.

[0090] S403, the edge intelligent router 102 reads the local traffic record library, extracts the differential data, creates an incremental data packet, and encrypts and signs the data packet.

[0091] In the embodiment of the present invention, considering that the edge intelligent router 102 may be limited by system and network resources, edge-to-cloud data synchronization adopts an incremental synchronization method, which can reduce system load and network bandwidth consumption and improve update efficiency, so that synchronization can be performed more frequently to maintain the real-time nature of the data.

[0092] In terms of security, the embodiment of the present invention adopts the asymmetric national secret SM2 algorithm to encrypt, sign, verify and decrypt the incremental data packet to ensure the integrity and reliability of the data.

[0093] S404, the edge intelligent router 102 uploads the incremental data packet, and the cloud server 101 verifies, decrypts and stores the received incremental data packet.

[0094] Specifically, the cloud server 101 uses the asymmetric national encryption SM2 algorithm to verify and decrypt the received incremental data packet, loads the decrypted data into the pass record library of the cloud server 101, and feeds back the synchronization result to the edge intelligent router 102.

[0095] S405, judging whether the synchronization result fed back by the cloud server 101 is successful. If not, the current synchronization fails, the task ends, and the next scheduled task is waited for; if yes, the differential data status is updated to updated, and the current synchronization task ends successfully.

[0096] In an implementable solution, the edge intelligent router 102 sends heartbeat information to the cloud server 101 at regular intervals, and the cloud server 101 determines whether the edge intelligent router 102 is normal based on the historical time difference of the heartbeat information timestamp.

[0097] Exemplarily, in the embodiment of the present invention, the process of the edge intelligent router 102 obtaining and sending heartbeat information is as follows: Figure 5 As shown, it mainly includes the following steps:

[0098] S501, the edge intelligent router 102 starts a heartbeat task at a fixed time.

[0099] S502, the edge intelligent router 102 reads real-time status data of its own system.

[0100] Specifically, the system status data of the edge intelligent router 102 includes but is not limited to the real-time occupancy of system resources such as CPU, bandwidth, storage, operating system error code, application system error code, etc. In this embodiment, all feedback values ​​are defined as two types of numerical variables: one is binary variable type "0" and "1", by mapping the relevant indicator items to the normal value "0" or "1" indicating an abnormality; the other is continuous variable type feedback value, and the real-time occupancy of system resources such as CPU, bandwidth, storage, etc. belongs to this type of feedback value.

[0101] S503: The edge intelligent router 102 sends a status query instruction to all the lower-level traffic control devices 104 connected thereto, and the lower-level traffic control devices 104 return their own status information.

[0102] Specifically, in this embodiment, if the edge intelligent router 102 wants to know the real-time status of the lower-level traffic control device 104 it controls, the edge intelligent router 102 needs to actively request each lower-level traffic control device 104. The present invention supports multiple different types of traffic control devices 104. Since different devices have different interface formats for obtaining status information, this embodiment calls the interface of a specific format according to different traffic control devices 104 to obtain real-time status information. For devices that do not provide such interfaces, the active Ping device IP method is used to implement it. The system enables multi-threading to actively initiate a request to each lower-level traffic control device 104 device under its control by Pinging the device IP. If the device does not respond within the predefined time threshold, the request is re-issued to prevent misjudgment caused by network fluctuations. If the device still does not respond after the request is made again, it is determined that the device has failed.

[0103] S504, the edge intelligent router 102 packages, encrypts and signs the heartbeat information.

[0104] Specifically, in this embodiment, the heartbeat information includes two types of information: static and dynamic. The dynamic information is the real-time status information of the edge intelligent router 102 and the lower-level traffic control device 104 controlled by it obtained in S502 and S503 above; the static information includes but is not limited to information such as device ID and device UID.

[0105] In this embodiment, the edge intelligent router 102 uses the asymmetric national encryption SM2 algorithm to encrypt and sign the heartbeat information packet, and the cloud server 101 also uses the asymmetric national encryption SM2 algorithm to verify and decrypt the received heartbeat information packet.

[0106] S505, the edge intelligent router 102 uploads the heartbeat information to the cloud server 101.

[0107] In the embodiment of the present invention, the cloud server 101 obtains the timestamp of the heartbeat information uploaded by the edge intelligent router 102. The timestamp difference between the heartbeat information uploaded by the edge intelligent router 102 at the previous moment and the heartbeat information uploaded by the edge intelligent router 102 at the next moment is the heartbeat interval time difference. The heartbeat interval time difference is compared with a predefined heartbeat time difference threshold. When the time difference is greater than the time difference threshold, it is determined that the edge intelligent router 102 is faulty or offline.

[0108] The heartbeat mechanism described in the embodiment of the present invention can, on the one hand, realize rapid monitoring of faulty or offline edge intelligent routers 102, and can also determine the location of faulty or offline edge intelligent routers 102 based on the recorded information of the edge intelligent router 102, effectively avoiding the impact of equipment failure on user experience due to long-term lack of maintenance; on the other hand, the real-time status of the edge intelligent router 102 can be viewed based on the dynamic status information of the heartbeat information, which is helpful to predict equipment failures in advance and can effectively reduce the overall failure rate of the system.

[0109] In an implementable scheme, the heartbeat information includes the static data of the device ID and device UID of the edge intelligent router 102 and the resource occupancy rate of CPU, bandwidth, and storage, real-time status data of the operating system and application error codes, and the connection status between the edge intelligent router 102 and all its lower-level traffic control devices 104.

[0110] In one feasible solution, the method further includes:

[0111] Establishing a mesh topology structure according to the heartbeat information uploaded by the edge intelligent router 102;

[0112] A GIS platform is built on the cloud server 101 to read data information of the mesh topology structure;

[0113] Each segment of the mesh topology structure is rendered in the GIS platform to obtain a distribution map of the fault status of the edge intelligent router 102 .

[0114] For example, in this embodiment, for daily operation and maintenance work, the cloud server 101 platform provides a centralized monitoring interface based on GIS maps and visuals, which is displayed in a variety of data dashboards and simulates the real environment in a real-scene mode. When a fault is detected, the status of the edge intelligent router 102 is intuitively displayed in the real scene, which is convenient for operation and maintenance personnel to quickly locate, improve maintenance efficiency, and realize intelligent operation and maintenance management.

[0115] In one feasible solution, the method further includes:

[0116] When the pass verification is passed, the pass information can be sent to the designated responsible person as needed according to the configuration.

[0117] Exemplarily, in an embodiment of the present invention, for business scenarios where it is necessary to notify relevant designated responsible persons of access information in a timely manner, such as the need to notify administrators of visitor access information, and for example, in campus access management business scenarios, it is necessary to notify parents of students who ask for leave during normal class time, etc., the tenant administrator can set relevant notification configuration items to meet the business needs of sending access information to designated responsible persons in various forms and channels. Exemplarily, it can be configured to send access information through channels such as SMS or WeChat. The access information can not only be in text form, but also in the case where the access control device 104 is a face recognition type or has a camera device connected to the edge intelligent router 102 and supports camera scenarios, the access information sent can also be an image or short video of the current access operation.

[0118] In addition, the tenant administrator can view and remotely control the access device 104 through the smart device client 105. Specifically, Figure 6 As shown, the method comprises the following steps:

[0119] S601, the tenant administrator uses the intelligent device client to log in to the cloud server 101.

[0120] S602: The tenant administrator checks whether the target access control device 104 is online.

[0121] In the embodiment of the present invention, whether the target traffic control device 104 is online is determined by the heartbeat information uploaded by the upper edge intelligent router 102, and only the online edge intelligent router 102 can perform the remote control operation.

[0122] S603, the smart device client 105 sends a control instruction to the target access control device 104 bound to the corresponding account of the tenant administrator through the cloud server 101, and the control instruction includes the device ID of the upper edge smart router 102 and the device address of the target access control device 104 connected to it; the upper edge smart router 102 receives the control instruction to the target access control device 104 forwarded by the cloud server 101; the upper edge smart router 102 conveys the control instruction to the target access control device 104 according to the device address of the target access control device 104 in the instruction.

[0123] S604: The target traffic control device 104 executes the control instruction.

[0124] S605, the target traffic control device 104 feeds back the control instruction execution result to the upper edge intelligent router 102 to which it is connected; the upper edge intelligent router 102 forwards the control instruction execution result to the cloud server 101; the cloud server 101 conveys the execution result of the control instruction by the target traffic control device 104 to the smart device client 105.

[0125] Embodiment 2:

[0126] In a second aspect, the present invention provides a traffic management system based on an edge intelligent router, the system comprising a cloud server 101, an edge intelligent router 102, a traffic control device 104, and an intelligent device client 105;

[0127] The cloud server 101 is used to provide tenant and device management, maintain the connection with the edge intelligent router 102, and forward the communication data between the smart device client 105 and the edge intelligent router 102;

[0128] The edge intelligent router 102 is used to match access users according to the acquired legal user records and access rules, and send instructions to the lower access control device 104 to turn on or off the access device according to the matching results;

[0129] The passage control device 104 switches the passage device on and off after receiving the instruction;

[0130] The smart device client 105 is used by the tenant administrator to remotely control the switch access control device 104 .

[0131] For example, see Figure 7The system includes a cloud server 101, at least one edge intelligent router 102, at least one traffic control device 104 and at least one intelligent device client 105. The edge intelligent router 102 and the cloud server 101 are connected and communicated through a wired network or a wireless network; each edge intelligent router 102 can control multiple lower-level traffic control devices 104, and the communication between the two supports multiple connection methods, including any of the following: wired network connection, serial port connection, WIFI connection, Bluetooth connection, infrared connection; the intelligent device client 105 and the cloud server 101 are connected and communicated wirelessly.

[0132] In one feasible solution, the cloud server 101 is deployed on the Internet, and at least one edge intelligent router 102 is connected to the Internet via a wired network or a wireless network. The edge intelligent router 102 and the cloud server 101 are both assigned fixed Internet IP addresses, and the two can directly access each other.

[0133] In another feasible solution, the cloud server 101 is deployed in the Internet, and at least one edge intelligent router 102 is connected to a local area network through a wired network or a wireless network. In this case, direct communication is impossible because one or both parties do not have a fixed Internet IP address. The present invention provides a point-to-point intranet penetration function to achieve a point-to-point network connection between the edge intelligent router 102 and the cloud server 101, meeting various complex networking requirements of the cloud edge.

[0134] In one possible implementation, see Figure 8 , the application structure 900 of the cloud server 101 includes:

[0135] The device unit 910 is used to manage, configure and control the edge intelligent router 102 and its lower-level access control device 104. In an implementable solution, the device unit 910 includes a management module 911, a configuration module 912 and a control module 913. The management module 911 is used to manage the edge intelligent router 102 in the system. The tenant administrator manages the edge intelligent router 102 and the lower-level access control device 104 bound to his account through the management module 911, defines the relationship between the two devices, and static properties such as device ID, device name and device address; the configuration module 912 is used to configure the edge intelligent router 102 in the system. The tenant administrator configures the legal user records and access rules of each lower-level access control device 104 under the control of the edge intelligent router 102 bound to his account through the configuration module 912. The configuration module 912 background sends the configuration to the corresponding edge intelligent router 102 synchronously, and the access judgment is completed locally at the edge without remotely reading cloud data, which effectively improves the system reliability; the control module 913 is used for users to remotely control the switch access control device 104. The tenant administrator uses the smart device client 105 to send a control instruction for the target access control device 104 to the control module 913. The control module 913 sends the control instruction to the edge intelligent router 102, and the edge intelligent router 102 then conveys it to the target access control device 104. The target access control device 104 executes the control instruction and sends the execution result to the control module 913 through the edge intelligent router 102. Finally, the control module 913 conveys the execution result to the smart device client 105 of the tenant administrator.

[0136] The data unit 920 is used to manage system user data, collect and store historical traffic records and heartbeat information data of each edge intelligent router 102. In an implementable solution, the data unit 920 includes a user module 921, a traffic module 922, and a heartbeat module 923. The user module 921 is used to manage tenant-related data in the system; the traffic module 922 is used to collect and synchronize historical traffic records of each edge intelligent router 102; the heartbeat module 923 is used to receive the heartbeat information of each edge intelligent router 102, and judge whether the edge intelligent router 102 is normal in real time according to the historical time difference of the heartbeat information timestamp.

[0137] The update unit 930 is used to upgrade and manage the firmware and application software of the edge intelligent router 102 through the remote upgrade technology OTA (Over-the-Air Technology). In an implementable solution, the update unit 930 includes an OTA management module 931, an upgrade service module 932, a file service management module 933 and a task management module 934. The OTA management module 931 is used for OTA software management, OTA version tree management, OTA upgrade plan management, upgrade condition management, edge intelligent router 102 software version management, edge intelligent router 102 upgrade condition management, OTA differential package production, OTA package encryption and distribution; the file service management module 932 is used for OTA upgrade package storage and download services, providing download permission check, breakpoint resume, and flow control services; the upgrade service module 933 is used for OTA version update check, upgrade package signature calculation, OTA upgrade notification and OTA upgrade result reporting; the task management module 934 is used for upgrade task release, task scheduling, task batch processing, task time-sharing processing, and task error retry.

[0138] The cloud server 101 implements the upgrade function of the edge intelligent router 102 firmware and application software through the remote upgrade technology OTA (Over-the-Air Technology). Fig. 9 As shown, the method comprises the following steps:

[0139] S701, the system administrator uploads the updated OTA software package to the cloud server 101, and the cloud server 101 packages, encrypts and signs the OTA software package.

[0140] In this embodiment, the edge intelligent router 102 uses the asymmetric national encryption SM2 algorithm to encrypt and sign the OTA upgrade package.

[0141] S702, the cloud server 101 obtains a list of upgradeable edge intelligent routers 102, sets the edge intelligent routers 102 in the list to an updateable state, and notifies the edge intelligent routers 102 in the list that they can be upgraded.

[0142] Specifically, the cloud server 101 obtains a list of upgradeable edge intelligent routers 102 according to the version tree of the OTA software package and the upgrade conditions of the edge intelligent routers 102.

[0143] S703, the edge intelligent router 102 that receives the upgrade notification performs an OTA upgrade check and executes a device consistency check. If the verification passes, the upgrade task can be started, otherwise the edge intelligent router 102 ends the upgrade.

[0144] Specifically, the edge intelligent router 102 sends its own device ID to the cloud server 101, and the cloud server 101 verifies the device ID in the list of devices to be upgraded.

[0145] S704, the cloud server 101 generates an upgrade task for the edge intelligent router 102 and adds the task to an upgrade task list.

[0146] S705, the edge intelligent router 102 downloads the OTA upgrade package and verifies the downloaded OTA upgrade package. If the verification is successful, it means that the downloaded OTA upgrade package is valid, otherwise the downloaded OTA upgrade package is invalid, and the upgrade of the edge intelligent router 102 is completed.

[0147] S706, the edge intelligent router 102 performs the decryption and installation operations of the downloaded OTA upgrade package; after the new version software is installed, installation verification is performed to verify whether the new version software is installed successfully. If the installation fails, it rolls back to the old version; the edge intelligent router 102 feeds back the software upgrade result to the cloud server 101, and the cloud server 101 updates the upgrade task status of the edge intelligent router 102 in the OTA upgrade task list; after the OTA upgrade task is completed, the cloud server 101 and the edge intelligent router 102 will record the upgrade record log.

[0148] Specifically, in this embodiment, the edge intelligent router 102 uses the asymmetric national encryption SM2 algorithm to decrypt and verify the signature of the OTA upgrade package.

[0149] In one feasible solution, it also includes:

[0150] The remote upgrade (FOTA, Firmware-Over-the-Air) of the edge intelligent router 102 firmware adopts a dual-system upgrade strategy. When an error occurs in the new version of the firmware, the system automatically rolls back to the previous version.

[0151] Specifically, in this embodiment, OTA is divided into two categories, one is firmware online upgrade FOTA (Firmware-Over-the-Air), and the other is application software online upgrade SOTA (Software-Over-the-Air). In this embodiment of the present invention, the firmware online upgrade adopts a dual system upgrade strategy, such as Figure 8 As shown in the figure, the area storing the firmware is divided into two parts, one for the currently running firmware and the other for the backup firmware. Except for the first installation without backup, the subsequent installations have two versions of the firmware coexisting. The latest version of the firmware is currently running, and the backup area is the previous version of the firmware. When the current firmware sends an error, the system automatically rolls back to the previous version, which will not cause the system to crash, providing double insurance for the system.

[0152] The online upgrade of application software is similar to the online upgrade of firmware, but it does not need to support dual-zone systems. If the upgrade is completed and the verification is successful, it will be overwritten by the new version; if the verification fails, the old version will be rolled back. The online upgrade adapter of application software needs to implement version fault diagnosis capabilities, that is, hash verification of each file hash table, etc., to determine whether the file is damaged.

[0153] For example, in one possible implementation, see Fig.10 , the edge intelligent router 102 application structure 1100 includes:

[0154] The first communication module 1101 is used for communication with the lower traffic control device 104. It receives user access information sent by the traffic control device 104; sends control instructions to the traffic control device 104 and receives the execution results fed back by the traffic control device 104; and regularly monitors the status of the traffic control device 104;

[0155] The second communication module 1102 is used for communication with the cloud server 101. It receives the legal user records and traffic rules of the node issued by the cloud server 101; receives the control instructions of the smart device client 105 to its lower traffic control device 104 issued by the cloud server and transmits the execution results of the control instructions to the smart device client 105 through the cloud server 101; sends heartbeat information to the cloud server 101 at regular intervals; provides OTA (Over-the-Air Technology) cloud-to-terminal secure communication link;

[0156] The matching module 1103 is used to determine whether the current passing user meets the release conditions. According to the access user information obtained by the first communication module 1101, the user corresponding to the access user information is matched in the locally stored legal user records. If the match is successful, the access control policy corresponding to the matched user is obtained from the locally stored management rules, and then it is determined whether to release the user according to the matching result;

[0157] The control module 1104 is used to control the traffic control device 104. If the matching module 1103 matches successfully, or the second communication module 1102 receives the control instruction of the traffic control device 104 sent by the smart device client 105 through the cloud server 101, the first communication module 1101 completes the interaction with the switch instruction of the traffic control device 104, and the storage module 1105 completes the storage and upload of the operation record;

[0158] Storage module 1105, used to obtain and store data such as legal user records and access rule configuration, historical access records, OTA upgrade information, etc. of this node;

[0159] The heartbeat module 1106 is used to periodically send heartbeat information to the cloud server 101. The heartbeat module 1106 collects heartbeat information periodically, including reading the real-time status of the edge intelligent router 102 itself and obtaining the real-time status of all lower-level communication control devices 104 connected thereto through the first communication module 1101, encapsulating it into a heartbeat packet and uploading it to the cloud server 101 through the second communication module 1102;

[0160] The synchronization module 1107 is used to synchronize the legal user records and access rules of the edge intelligent router 102. The edge intelligent router 102 uses the tenant administrator account to connect to the cloud server 101, and obtains and synchronizes the legal user records and access rules of this node through the second access module 1102. Access management uses local data, and even if the network is disconnected, it will not affect the operation of the system;

[0161] The notification module 1108 is used to send the pass information to the designated responsible person. When the pass verification is successful, the notification module 1108 sends the pass information to the designated responsible person in various forms and channels according to the configuration as needed; the update module 1109 is used to upgrade the firmware and application software through the remote upgrade technology OTA (Over-the-Air Technology).

[0162] The update module 1109 includes an OTA engine and an OTA adapter. The OTA engine is a bridge connecting the edge intelligent router 102 update module 1109 and the cloud server 101 update unit 930 to achieve secure communication between the cloud and the terminal. It is mainly responsible for coordinating and scheduling the edge intelligent router 102 to upgrade, receive OTA upgrade notifications, actively upgrade checks, download upgrade packages, decrypt upgrade packages, verify signatures, reconstruct differential packages, distribute and schedule upgrade packages, and other related tasks. The OTA upgrade adapter is designed to be compatible with different update logics or processes of different software or devices, and different implementations encapsulated according to unified interface requirements. The upgrade adapter is provided by each software implementation that requires an OTA upgrade.

[0163] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A traffic management method based on edge intelligent router, characterized in that: The method comprises the following steps: Synchronize legitimate user records and access rule configurations from the cloud server to the local server through the edge intelligent router; Scanning access user information through a lower-level access control device of an edge intelligent router, and sending the access user information to the edge intelligent router; The edge intelligent router matches the user in the locally stored legal user records according to the access user information. If the match is successful, the access control policy corresponding to the user is obtained from the locally stored access rules, and determines whether to release the user according to the matching result.

2. A traffic management method based on edge intelligent router according to claim 1, characterized in that: Before executing traffic management, the edge intelligent router further includes: The tenant administrator logs in to the cloud server and binds multiple edge smart routers to his user account; The tenant administrator sets the legal user records and access rules of each lower access control device for each edge intelligent router bound to his account; The edge intelligent router uses the tenant administrator account to connect to the cloud server to obtain the legal user records and access rules of this node. Access management uses local data, and even if the network is disconnected, it will not affect the operation of the system.

3. A traffic management method based on edge intelligent router according to claim 2, characterized in that: The edge intelligent router stores historical traffic records locally and synchronizes incremental records to the cloud server at regular intervals.

4. A traffic management method based on edge intelligent router according to claim 3, characterized in that: The edge intelligent router sends heartbeat information to the cloud server at regular intervals, and the cloud server determines whether the edge intelligent router is normal based on the historical time difference of the heartbeat information timestamp.

5. A traffic management method based on edge intelligent router according to claim 4, characterized in that: The heartbeat information includes the static data of the device ID and device UID of the edge intelligent router and the resource occupancy rate of CPU, bandwidth, and storage, the real-time status data of the operating system and application error codes, and the connection status between the edge intelligent router and all its lower-level traffic control devices.

6. A traffic management method based on edge intelligent router according to claim 5, characterized in that: The method further comprises: Establishing a mesh topology structure according to the heartbeat information uploaded by the edge intelligent router; Build a GIS platform on the cloud server to read the data information of the mesh topology structure; Each segment of the mesh topology is rendered in the GIS platform to obtain a distribution map of the fault status of the edge intelligent router.

7. A traffic management method based on edge intelligent router according to claim 6, characterized in that: The method further comprises: When the pass verification is passed, the pass information can be sent to the designated responsible person as needed according to the configuration.

8. A traffic management system based on an edge intelligent router, applied to the traffic management method based on an edge intelligent router as claimed in any one of claims 1 to 7, characterized in that: The system includes a cloud server, an edge intelligent router, a traffic control device, and an intelligent device client; The cloud server is used to provide tenant and device management, maintain the connection with the edge intelligent router, and forward the communication data between the intelligent device client and the edge intelligent router; The edge intelligent router is used to match access users according to the acquired legal user records and access rules, and send instructions to the lower access control device to switch the access control device according to the matching results; The passage control device switches the passage device on and off after receiving the instruction; The smart device client is used by the tenant administrator to remotely control the switch access control device.

9. The traffic management system based on edge intelligent router according to claim 8 is characterized in that: The application structure of the cloud server includes: Device management unit, used to manage, configure and control the edge intelligent router and its lower-level access control devices; The data unit is used to manage system user data, collect and store historical traffic records and heartbeat information data of each edge intelligent router; The update unit is used to manage the upgrade of the firmware and application software of the edge intelligent router through remote upgrade technology.

10. A traffic management system based on edge intelligent router according to claim 9, characterized in that: The application structure of the edge intelligent router includes: A first communication module, used for communicating with a lower traffic control device; A second communication module, used for communicating with a cloud server; The matching module is used to determine whether the current passing user meets the release conditions; A control module, used for controlling a lower traffic control device; Storage module, used to obtain and store the legal user records and access rule configuration of this node, historical access records, and remote upgrade information data; Heartbeat module, used to send heartbeat information to the cloud server at regular intervals; A synchronization module, used to synchronize the legal user records and access rules of the edge intelligent router; Update module, used to upgrade firmware and application software through remote upgrade technology; The notification module is used to send the traffic information to the designated responsible person.

Images