System and method for safely upgrading AI equipment on cloud side
Through cloud-side security upgrade of the AI device system, using AI program mirroring, mirror warehouse, management and control components, Kafka message queue and Kubernetes container orchestration, the problem that AI devices cannot meet the fixed public network entry conditions is solved, and batch upgrade of AI devices and rolling upgrade of AI programs is realized to ensure the normal operation of AI services.
Patent Information
- Application Number
- CN202411575050.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-06
- Publication Date
- 2025-02-25
AI Technical Summary
In the prior art, when cloud-side conduit AI devices, AI devices require that they have a fixed public network entrance, resulting in most AI devices not being able to meet this condition and consume a large amount of public network IP addresses and ports, making it impossible to achieve cloud-side security upgrade of AI devices.
A cloud-side security upgrade AI device system is proposed. Through AI program mirroring, mirror warehouse, management and control components, Kafka message queue and Kubernetes container orchestration, batch upgrade of AI devices without a fixed public network entrance is achieved, ensuring that AI services can be used normally during the rolling upgrade of AI programs.
It realizes batch upgrade of AI devices without the need for fixed public network entrances, ensures that AI services can be used normally during the rolling upgrade of AI programs, isolates the AI program running environment and operating system environment, avoids the upgrade being affected by the operating system environment, and orchestrates and deploys programs to upgrade and rollback through Kubernetes.
Smart Images
Figure CN119512595A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the field of computer technology, and in particular, relates to a cloud-side secure upgrade AI device system and method. Background Art
[0002] In related technologies, when the cloud manages AI devices, the AI devices are required to have a fixed public network entrance (fixed public IP address + fixed port) so that deployment and update messages can be sent from the cloud to the AI devices. However, most AI device operating environments do not meet this condition. Even if this condition is met, the operation of a large number of AI devices will consume a large number of public IP addresses and ports, making it impossible to better implement cloud-side security upgrades of AI devices. Summary of the invention
[0003] In view of the above shortcomings of the prior art, the purpose of the invention is to provide a cloud-side secure upgrade system and method for AI devices. The system has a program that does not require a fixed public network entrance and can batch upgrade AI devices, and the AI program can be upgraded in a rolling manner, and AI services can be used normally during the upgrade.
[0004] In a first aspect of the present invention, a cloud-side secure upgrade system for AI devices is proposed, comprising: an AI program image, used to package the model files used by the AI program and the installation package of the operating environment; an image repository, used to receive and save the AI program image packaged and uploaded by the AI application provider; a management and control component, used to manage AI devices and components for managing the AI programs in the AI devices, in the case of managing the AI devices, sending upgrade information to the message queue Kafka, in the case of managing the components of the AI programs in the AI devices, reporting the status of the AI program to the message queue Kafka; Kubernetes, used to manage the life cycle of the AI program.
[0005] Furthermore, the management and control component includes a cloud management component and an AI program management component, wherein the cloud management component is used to manage the AI device, the cloud management component includes a component that triggers a program upgrade of the AI device and first attribute information of the AI device, and the AI program management component is used to manage a component of the AI program in the AI device.
[0006] Furthermore, the cloud management component is used to receive second attribute information of the AI device provided by the system operator, the second attribute information including a unique identification code UUID, an intranet IP address, an owner, a geographic location, and a certificate and certificate issuance for the AI device to the owner of the AI device.
[0007] Furthermore, when the program upgrade component of the AI device is triggered, the cloud management component sends the upgrade information to the message queue Kafka, wherein the upgrade information includes the updated image version, operating environment settings, target AI device list, update strategy and triggerer identity information.
[0008] Furthermore, when the message queue Kafka receives the upgrade information, it sends the upgrade information to the AI program management component. When the AI program management component receives the upgrade information, it verifies the trigger identity information. If the verification is successful, it calls the Kubernetes interface to upgrade the AI program.
[0009] Furthermore, calling a Kubernetes interface to upgrade the AI program includes: the Kubernetes downloading the AI program image from the image repository; starting a first AI program container based on the first image, and stopping a second AI program container.
[0010] Furthermore, reporting the status of the AI program to the message queue Kafka includes: the AI program management component periodically obtains the status of the AI program from the Kubernetes and signs it with a certificate private key; and reporting the signed status of the AI program to the message queue Kafka.
[0011] Furthermore, the message queue Kafka sends the received signed status of the AI program to the cloud management component, and the cloud management component verifies the signature based on the certificate of the AI device.
[0012] The second aspect of the present invention proposes a cloud-side secure upgrade method for AI devices, including: obtaining an AI program image; when a component for program upgrade of the AI device is triggered, the cloud management component sends the upgrade information to the message queue Kafka; when the AI program management component obtains the upgrade information in the message queue Kafka, it verifies the identity information of the triggerer; when the identity information of the triggerer is successfully verified, the AI program is upgraded based on the AI program image.
[0013] According to the third aspect of the present invention, an electronic device is proposed, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the method described in the second aspect of the present invention.
[0014] According to a fourth aspect of the present invention, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to execute the method described in the second aspect of the present invention.
[0015] The beneficial effects of the present invention are as follows:
[0016] The cloud-side secure upgrade AI device system and method described in the present invention includes an AI program image, which is used to package the model files used by the AI program and the installation package of the operating environment; an image warehouse, which is used to receive and save the AI program image packaged and uploaded by the AI application provider; a management and control component, which is used to manage AI devices and components of the AI program in the AI device. When managing AI devices, the upgrade information is sent to the message queue Kafka, and when managing components of the AI program in the AI device, the status of the AI program is reported to the message queue Kafka; Kubernetes is used to manage the life cycle of the AI program. The system deploys AI programs through containerization, receives upgrade instructions and reports AI program status through the message queue Kafka, and uses kubernetes to orchestrate the deployment of program upgrades and rollbacks of AI programs, realizing the need for a fixed public network entrance, and the ability to batch upgrade AI device programs, rolling upgrades of AI programs, and normal use of AI services during upgrades. BRIEF DESCRIPTION OF THE DRAWINGS
[0017] The accompanying drawings are only used to illustrate specific embodiments and are not considered to limit the present invention. In the entire drawings, the same reference symbols represent the same components. Obviously, the drawings described below are only some embodiments recorded in the embodiments of the present invention. For those of ordinary skill in the art, other drawings can also be obtained based on these drawings.
[0018] Figure 1 is a schematic diagram of a cloud-side secure upgrade AI device system according to an embodiment of the present invention;
[0019] Figure 2 is a flowchart of a method for securely upgrading an AI device on the cloud side according to an embodiment of the present invention;
[0020] Figure 3 It is a structural block diagram of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION
[0021] In order to enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all of the embodiments. It should be understood that these descriptions are only exemplary and are not intended to limit the scope of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in the field without making creative work should fall within the scope of protection of the present invention.
[0022] Furthermore, in the following description, descriptions of well-known structures and technologies are omitted to avoid unnecessarily obscuring the concepts disclosed in the present invention.
[0023] In the description of the present invention, it should be noted that, unless otherwise clearly specified and limited, the orientation or position relationship indicated by the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inside", "outside", etc. is based on the orientation or position relationship shown in the drawings, which is only for the convenience of describing the present invention and simplifying the description, and does not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation of the present invention. In addition, the terms "first", "second", and "third" are only used for descriptive purposes and cannot be understood as indicating or implying relative importance. The terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be a connection between the two elements. For those of ordinary skill in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.
[0024] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Instead, they are merely examples of methods and systems consistent with some aspects of the present invention as detailed in the appended claims.
[0025] For existing AI devices such as AI edge boxes and AI all-in-one machines, AI programs run directly on the operating system of AI devices. When upgrading remotely, upgrade messages are sent through the network. After receiving the upgrade message, the AI device downloads the new model file. After the model file is downloaded, the old AI program is stopped and the AI program is started with the new model file. Finally, the program status is reported. This method requires that the old and new models use the same operating environment. However, many AI models require different operating environments, such as driver versions and AI model framework versions, which are incompatible or even conflicting with each other, resulting in upgrade failure. In addition to downloading new model files, some solutions also modify the environment configuration, but modifying the environment configuration may affect the AI device operating system or other irreversible risks, and the upgrade cannot be rolled back. This method requires upgrading AI devices one by one and cannot be upgraded in batches. Rolling upgrades are not possible, and AI services cannot be used during the upgrade. Even for the same AI program, due to different running device environments, a special upgrade package needs to be developed for the device. When the cloud side manages AI devices, the AI devices are required to have a fixed public network entrance (fixed public network IP address + fixed port) so that deployment and update messages can be sent from the cloud side to the AI devices. However, most AI device operating environments do not meet this condition. Even if they do, the operation of a large number of AI devices will consume a large number of public IP addresses and ports. When AI devices report data to the cloud, they have higher permissions. If the application running on the AI device carries a Trojan, it may use the authorization of the AI device to invade the cloud system.
[0026] To this end, the present invention proposes a cloud-side secure upgrade AI device system and method. Specifically, the cloud-side secure upgrade AI device system and method of an embodiment of the present invention are described below with reference to the accompanying drawings.
[0027] Figure 1 is a schematic diagram of a cloud-side secure upgrade AI device system according to an embodiment of the present invention. Figure 1 As shown in the figure, the cloud-side security upgrade AI device system includes:
[0028] AI program image 110, used to package the model files used by the AI program and the installation package of the operating environment;
[0029] Image repository 120, used to receive and store AI program images packaged and uploaded by AI application providers;
[0030] A management and control component 130, which is used to manage the AI device and the AI program in the AI device. In the case of managing the AI device, the upgrade information is sent to the message queue Kafka 140. In the case of managing the AI program in the AI device, the status of the AI program is reported to the message queue Kafka 140.
[0031] Kubernetes150, used to manage the life cycle of AI programs.
[0032] That is to say, based on the AI program image 110, which contains the model files and operating environment used by the AI program, the AI program can be easily taken anywhere to run; based on the image warehouse 120, it is specifically used to store these packaged AI program images. AI application providers can upload images here for easy access at any time; based on the management and control component 130, both AI devices and AI programs on AI devices can be managed. When the AI device needs to be upgraded, it will send the upgrade information to the message queue Kafka140; and when the AI program changes state during operation, it will also report these state information to the message queue Kafka140. Based on Kubernetes150 to manage the life cycle of the AI program, that is, from the deployment, operation to upgrade and maintenance of the AI program, Kubernetes150 will participate in the whole process to ensure that the AI program can run stably and efficiently in the cloud.
[0033] In one embodiment of the present invention, the management and control component 130 includes a cloud management component 131 and an AI program management component 132, wherein the cloud management component 131 is used to manage AI devices, the cloud management component 131 includes a component for triggering a program upgrade of the AI device and first attribute information of the AI device, and the AI program management component 132 is used to manage components of the AI program in the AI device.
[0034] In one embodiment of the present invention, the cloud management component 131 is used to receive second attribute information of the AI device provided by the system operator, the second attribute information including a unique identification code UUID, an intranet IP address, an owner, a geographic location, and a certificate and certificate issuance for the AI device to the owner of the AI device.
[0035] In one embodiment of the present invention, when a component for program upgrade of an AI device is triggered, the cloud management component 131 sends upgrade information to the message queue Kafka 140, wherein the upgrade information includes an updated image version, operating environment settings, a list of target AI devices, an update strategy, and triggerer identity information.
[0036] In one embodiment of the present invention, upon receiving the upgrade information, the message queue Kafka 140 sends the upgrade information to the AI program management component 132. Upon receiving the upgrade information, the AI program management component 132 verifies the identity information of the triggerer. If the verification is successful, the Kubernetes 150 interface is called to upgrade the AI program.
[0037] In one embodiment of the present invention, when the Kubernetes 150 interface is called to upgrade the AI program, the AI program image can be downloaded from the image repository 120 through Kubernetes 150; the first AI program container is started based on the first image, and the second AI program container is stopped. That is, the new AI program container is started using the downloaded new image, and the old AI program container is stopped.
[0038] In one embodiment of the present invention, when the status of the AI program is reported to the message queue Kafka140, the AI program management component 132 periodically obtains the status of the AI program from Kubernetes150 and signs it using the certificate private key; and reports the signed status of the AI program to the message queue Kafka140.
[0039] In one embodiment of the present invention, the message queue Kafka 140 sends the received signed AI program status to the cloud management component 131 , and the cloud management component 131 verifies the signature based on the certificate of the AI device.
[0040] In a specific embodiment of the present invention, the AI device owner applies to the system operator for access to the remote management system; the system operator provides AI device information (device UUID, intranet IP address, owner, geographic location) to the cloud management component 131, and applies for an AI device certificate. The certificate is provided to the AI device owner; the AI application provider packages the AI program image 110 and uploads it to the image repository 120. This step can package the program running environment together with the program, and there is no need to modify the system environment during the upgrade; the AI device owner triggers the program upgrade component of the AI device from the cloud management component 131, and sends the upgrade information to the message queue Kafka140, where the upgrade information includes: updated image version, running environment settings, target AI device list, update strategy and triggerer identity information; the AI program management component 132 monitors the upgrade information of the message queue Kafka140, and when the AI program management component 132 receives the upgrade information sent by the message queue Kafka140, it verifies the triggerer identity information; if the verification is successful, the kubernetes150 interface is called to start the upgrade Level AI program, in which the AI program management component 132 on all AI devices listens to the upgrade information of the message queue Kafka140, thereby realizing batch upgrade; kubernetes150 downloads the AI program image, uses the new image to start the new AI program container, and then stops the old AI program container, that is, uses kubernetes150 to manage the AI program, automatically upgrades and monitors the program status; the AI program management component 132 obtains the AI program status from kubernetes150 at a regular interval, signs it with the certificate private key, and then sends it to the message queue Kafka140; the cloud management component 131 listens to the message queue Kafka140, and after obtaining the AI program status, uses the certificate of the corresponding AI device to verify the signature, authenticates the message of the AI device, and then updates the version information and status information of the AI program in the database.
[0041] According to the cloud-side secure upgrade AI device system of the embodiment of the present invention, through the coordinated use of the AI program image 110 and the image warehouse 120, the AI program and its operating environment can be easily packaged, stored and distributed, which greatly simplifies the process of AI device system upgrade. The management and control component 130 realizes the rapid transmission of upgrade information through the message queue Kafka140, making the system upgrade of AI devices more efficient and accurate; the cloud management component 131 is not only responsible for managing the basic information of AI devices (such as UUID, intranet IP address, owner, geographic location, etc.), but also provides certificate and certificate issuance services, which enhances the security and flexibility of device management. By receiving the AI device attribute information provided by the system operator, the cloud management component can more comprehensively grasp the device status and provide strong support for subsequent maintenance and management; the AI program management component 132 ensures the reliability and security of AI program upgrades by verifying the identity information of the triggerer and calling the Kubernetes150 interface. At the same time, by regularly obtaining the status of the AI program from Kubernetes150 and reporting it with a signature, real-time monitoring and feedback of the running status of the AI program is achieved, providing a strong guarantee for the stable operation of the AI program; Kubernetes150, as a core component of container orchestration and management, plays an important role in the life cycle management of the AI program. From the deployment, operation to the upgrade and maintenance of the AI program, Kubernetes150 provides comprehensive support to ensure that the AI program can run stably and efficiently in the cloud. At the same time, through the use of Kubernetes150 and the image warehouse 120, the rapid download and deployment of the AI program image is achieved, further improving the efficiency of the system upgrade. As a result, the system deploys the AI program through containerization, receives the upgrade instructions through kafka, reports the status of the AI program, and uses kubernetes to orchestrate the deployment program to upgrade and roll back the AI program, without the need for a fixed public network entrance; the system isolates the operating environment and operating system environment of the AI program, so that the AI program upgrade is not affected by the operating system environment and the old AI program operating environment. And because the AI program and the AI program operating environment are packaged together, there is no need to develop a special upgrade package for the device. One image package can run on various devices; it can batch upgrade AI device programs, and AI programs can be upgraded in a rolling manner. AI services can be used normally during the upgrade period; it can authenticate and filter messages reported by AI devices, and only allow the modification of the application status on the corresponding AI device of the cloud system. It prevents the intrusion of devices into the cloud system and then controls all devices.
[0042] In one embodiment of the present invention, the present invention also provides a cloud-side secure upgrade method for AI devices, such as Figure 2 As shown, the cloud-side secure upgrade method for AI devices includes:
[0043] S210, obtaining an AI program image.
[0044] In an embodiment of the present invention, the AI program image packaged and uploaded by the AI application provider can be received and saved based on the image repository, thereby obtaining the AI program image.
[0045] S220, when the program upgrade component of the AI device is triggered, the cloud management component sends the upgrade information to the message queue Kafka.
[0046] Among them, the upgrade information includes the updated image version, operating environment settings, target AI device list, update strategy and trigger identity information.
[0047] S230, when the AI program management component obtains the upgrade information in the message queue Kafka, it verifies the identity information of the triggerer.
[0048] In an embodiment of the present invention, when the message queue Kafka receives the upgrade information, it can send the upgrade information to the AI program management component, and then the AI program management component verifies the triggerer identity information when obtaining the upgrade information in the message queue Kafka.
[0049] S240: When the identity information of the triggerer is successfully verified, the AI program is upgraded based on the AI program image.
[0050] In an embodiment of the present invention, when the verification is successful, the Kubernetes interface is called to upgrade the AI program, wherein the AI program image is downloaded from the image repository through Kubernetes; the first AI program container is started based on the first image, and the second AI program container is stopped.
[0051] According to the cloud-side secure upgrade method of the embodiment of the present invention, the AI program is deployed through containerization, the upgrade instruction is received through kafka, the AI program status is reported, and the Kubernetes orchestration deployment program is used to upgrade and roll back the AI program, without the need for a fixed public network entrance; the method isolates the running environment and operating system environment of the AI program, so that the AI program upgrade is not affected by the operating system environment and the old AI program running environment. Moreover, since the AI program and the AI program running environment are packaged together, there is no need to develop a special upgrade package for the device. One image package can run on various devices; it can batch upgrade the programs of AI devices, and the AI program can be rolled up and upgraded, and the AI service can be used normally during the upgrade; the message authentication and filtering reported by the AI device only allows the modification of the application status on the corresponding AI device of the cloud-side system. Prevent the intrusion of the cloud system through the device and then control all devices.
[0052] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods of each embodiment of the present application.
[0053] According to one aspect of an embodiment of the present invention, an electronic device is provided.
[0054] Figure 3 Schematic diagram of the structure of an electronic device according to an embodiment of the present invention. Figure 3 As shown, the electronic device may include one or more ( Figure 3 Only one is shown in the figure) processor 102 (processor 102 may include but is not limited to a microprocessor (Microprocessor Unit, referred to as MPU) or a programmable logic device (Programmable logic device, referred to as PLD)) and a memory 104 for storing data. In an exemplary embodiment, the electronic device may also include a transmission device 106 and an input / output device 108 for communication functions. It can be understood by those skilled in the art that Figure 3 The structure shown is for illustration only and does not limit the structure of the above terminal device. Figure 3 More or fewer components as shown, or with Figure 3 Equivalent functions or comparisons shown Figure 3 A different configuration with more features is shown.
[0055] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the cloud-side security upgrade AI device method in the embodiment of the present invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, to implement the above method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the terminal device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.
[0056] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the switching device. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.
[0057] The present invention proposes a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to enable the computer to execute a cloud-side secure upgrade method for AI devices.
[0058] The applicant of the present invention has made a detailed explanation and description of the implementation examples of the present invention in conjunction with the drawings in the specification. However, those skilled in the art should understand that the above implementation examples are only preferred implementation schemes of the present invention, and the detailed description is only to help readers better understand the spirit of the present invention, but not to limit the scope of protection of the present invention. On the contrary, any improvements or modifications based on the inventive spirit of the present invention should fall within the scope of protection of the present invention.
[0059] In addition, each functional unit in each embodiment of the present invention may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.
[0060] The storage medium mentioned above may be a read-only memory, a magnetic disk or an optical disk, etc. Although the embodiments of the present invention have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limiting the present invention. A person of ordinary skill in the art may change, modify, replace and modify the above embodiments within the scope of the present invention.
[0061] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the embodiments of the present invention, rather than to limit them. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions recorded in the above embodiments, or replace some of the technical features therein by equivalents; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention. Any changes or replacements that can be easily thought of by those skilled in the art within the technical scope disclosed in the present invention should be covered within the protection scope of the present invention.
Claims
1. A cloud-side secure upgrade AI device system, characterized in that: include: AI program image, which is used to package the model files and operating environment installation packages used by AI programs; An image repository, used to receive and store the AI program images packaged and uploaded by AI application providers; A management and control component, for managing AI devices and components for managing AI programs in the AI devices, in the case of managing AI devices, sending upgrade information to the message queue Kafka, and in the case of managing the components for AI programs in the AI devices, reporting the status of the AI programs to the message queue Kafka; Kubernetes, which is used to manage the lifecycle of the AI program.
2. The cloud-side secure upgrade AI device system according to claim 1, characterized in that: The management and control component includes a cloud management component and an AI program management component, wherein the cloud management component is used to manage the AI device, the cloud management component includes a component that triggers a program upgrade of the AI device and first attribute information of the AI device, and the AI program management component is used to manage a component of the AI program in the AI device.
3. The cloud-side secure upgrade AI device system according to claim 2, characterized in that: The cloud management component is used to receive second attribute information of the AI device provided by the system operator, the second attribute information including a unique identification code UUID, an intranet IP address, an owner, a geographic location, and a certificate and certificate issuance for the AI device to the owner of the AI device.
4. The cloud-side secure upgrade AI device system according to claim 2, characterized in that: When the program upgrade component of the AI device is triggered, the cloud management component sends the upgrade information to the message queue Kafka, wherein the upgrade information includes the updated image version, operating environment settings, target AI device list, update strategy and triggerer identity information.
5. The cloud-side secure upgrade AI device system according to claim 4, characterized in that: When the message queue Kafka receives the upgrade information, it sends the upgrade information to the AI program management component. When the AI program management component receives the upgrade information, it verifies the trigger identity information. When the verification is successful, it calls the Kubernetes interface to upgrade the AI program.
6. The cloud-side secure upgrade AI device system according to claim 4, characterized in that: Call the Kubernetes interface to upgrade the AI program, including: The Kubernetes downloads the AI program image from the image repository; The first AI program container is started based on the first image, and the second AI program container is stopped.
7. The cloud-side secure upgrade AI device system according to claim 2, characterized in that: Reporting the status of the AI program to the message queue Kafka includes: The AI program management component periodically obtains the status of the AI program from the Kubernetes and signs it using the certificate private key; The signed status of the AI program is reported to the message queue Kafka.
8. The cloud-side secure upgrade AI device system according to claim 7, characterized in that: The message queue Kafka sends the received signed status of the AI program to the cloud management component, and the cloud management component verifies the signature based on the certificate of the AI device.
9. A cloud-side secure upgrade method for AI devices, characterized in that: include: Get the AI program image; When the program upgrade component of the AI device is triggered, the cloud management component sends the upgrade information to the message queue Kafka; The AI program management component verifies the identity information of the triggerer when obtaining the upgrade information in the message queue Kafka; When the triggerer identity information is successfully verified, the AI program is upgraded based on the AI program image.
10. A non-transitory computer-readable storage medium storing computer instructions, characterized in that: The computer instructions are used to cause the computer to execute the method according to claim 9.