Rail transit safety access control device and system

Abstract

The embodiment of the application provides a rail transit safety access control device and system, the device comprises a service interface processing unit, a maintenance interface processing unit, a first processor, a second processor and a failure management unit, safety management is carried out for the service interface and the maintenance interface respectively, the service interface bypass function of fault-oriented safety is supported, the double-processor cooperative safety guarantee structure is provided, the safety of the rail transit safety access control device itself is effectively ensured, the correct execution of safety protection is ensured, the safety protection problem of the train electronic control system can be effectively solved, the safety protection level of the train is greatly improved, the maintenance difficulty of high-end equipment of rail transit is reduced, the driving safety is ensured, and the market prospect is wide.

Description

Technical Field

[0001] This application relates to the field of data security technology, specifically to a rail transit safety access control device and system. Background Technology

[0002] During operation and maintenance, trains require regular maintenance of the rolling stock and related ground systems, such as local software upgrades and downloading operational data. Maintenance personnel typically use USB drives or personal computers connected directly to the vehicle control equipment. If these USB drives or personal computers are infected with viruses, the train's electronic control system can easily become infected, affecting the stable operation of the train equipment and compromising driving safety.

[0003] If a train's electronic control system is infected with a virus, it can launch cyberattacks against other devices through the train control network. Furthermore, considering the possibility of malicious attacks during train operation that could impact safe train operation, it is necessary to effectively manage the service interfaces and maintenance interfaces of network and control equipment, effectively block attack links, and effectively protect critical electronic control equipment to prevent malicious damage that could lead to train malfunctions and endanger operational safety.

[0004] Therefore, with the continuous improvement of rail transit safety management, it is necessary to strictly control the access of train electronic control equipment at the access links such as business interfaces and maintenance interfaces to prevent the entry of viruses from USB flash drives and personal computers, prevent malicious attacks on key equipment through the train network, and effectively improve the safety management level of high-end rail transit equipment. Summary of the Invention

[0005] This application provides a rail transit safety access control device and system.

[0006] A first aspect of this application provides a rail transit safety access control device, the device comprising a service interface processing unit, a maintenance interface processing unit, a first processor, a second processor, and a failure management unit, wherein... Both the service interface processing unit and the maintenance interface processing unit include an interface management module and signal relays. Each interface management module has an enable signal. When the enable signal receives a high-level signal, the interface management module manages the interface connected to it; when the enable signal receives a low-level signal, the interface management module does not operate and outputs a high-impedance state to the interface connected to it. The first processor is connected to each interface management module through communication control lines and to each signal relay through relay control signal lines. Each signal relay controls the connection and disconnection between the corresponding interface management module on both sides and the service bus or maintenance bus. The first processor is connected to the second processor. The first processor sends periodic heartbeat signals to the second processor, and the second processor sends periodic heartbeat signals to the first processor. The second processor is connected to the failure management unit via a power supply control signal line. The failure management unit controls the power supply to the coils of each signal relay. The power supply to the relay coils is simultaneously connected to the enable signals of the interface management modules on both sides. When the power supply to the relay coils is output, the corresponding interface management modules on both sides operate. When the power supply to the relay coils is not output, the corresponding interface management modules on both sides output a high-impedance state. When the first and second processors are in normal condition, the second processor controls the failure management unit to output a power supply signal, and the signal relays are powered. When the first and second processors are in abnormal condition, the second processor controls the failure management unit to stop outputting the power supply signal, and the signal relays stop working.

[0007] In an optional embodiment of this application, the service interface processing unit comprises a first Ethernet interface management module, a second Ethernet interface management module, a first USB interface management module, a second USB interface management module, a first serial port interface management module, a second serial port interface management module, a first MVB interface management module, a second MVB interface management module, and a signal relay. The first and second Ethernet interface management modules are connected to the signal relay on both sides; the first and second USB interface management modules are connected to the signal relay on both sides; the first and second serial port interface management modules are connected to the signal relay on both sides; and the first and second MVB interface management modules are connected to the signal relay on both sides.

[0008] In an optional embodiment of this application, the maintenance interface processing unit comprises a third Ethernet interface management module, a fourth Ethernet interface management module, a third USB interface management module, a fourth USB interface management module, a third serial port interface management module, a fourth serial port interface management module, and a signal relay. The third Ethernet interface management module and the fourth Ethernet interface management module are connected to the signal relay on both sides of the signal relay. The third USB interface management module and the fourth USB interface management module are connected to the signal relay on both sides of the signal relay. The third serial port interface management module and the fourth serial port interface management module are connected to the signal relay on both sides of the signal relay.

[0009] In one optional embodiment of this application, each Ethernet interface management module connects to multiple Ethernet interfaces, each USB interface management module connects to multiple USB interfaces, each serial port interface management module connects to multiple serial ports, and each MVB interface management module connects to multiple MVB interfaces.

[0010] In an optional embodiment of this application, in the service interface processing unit, each signal line of a plurality of first Ethernet interfaces is connected to each signal line of a plurality of second Ethernet interfaces via normally closed nodes of signal relays; each signal line of a plurality of first USB interfaces is connected to each signal line of a plurality of second USB interfaces via normally closed nodes of signal relays; each signal line of a plurality of first serial ports is connected to each signal line of a plurality of second serial ports via normally closed nodes of signal relays; each signal line of a plurality of first MVB interfaces is connected to each signal line of a plurality of second MVB interfaces via normally closed nodes of signal relays. The first Ethernet interfaces and second Ethernet interfaces are respectively connected to a first Ethernet interface management module and a second Ethernet interface management module; the first USB interfaces and second USB interfaces are respectively connected to a first USB interface management module and a second USB interface management module; the first serial ports and second serial ports are respectively connected to a first serial port interface management module and a second serial port interface management module; and the first MVB interfaces and second MVB interfaces are respectively connected to a first MVB interface management module and a second MVB interface management module.

[0011] In an optional embodiment of this application, each signal line of a plurality of third Ethernet interfaces is connected to each signal line of a plurality of fourth Ethernet interfaces via normally open nodes of signal relays; each signal line of a plurality of third USB interfaces is connected to each signal line of a plurality of fourth USB interfaces via normally open nodes of signal relays; each signal line of a plurality of third serial ports is connected to each signal line of a fourth serial port via normally open nodes of signal relays. The third Ethernet interfaces and fourth Ethernet interfaces are respectively connected to the third Ethernet interface management module and the fourth Ethernet interface management module, respectively; the third USB interfaces and fourth USB interfaces are respectively connected to the third USB interface management module and the fourth USB interface management module, respectively; and the third serial ports and fourth serial ports are respectively connected to the third serial port interface management module and the fourth serial port interface management module, respectively.

[0012] In an optional embodiment of this application, the first processor is connected to each signal relay via a relay status feedback signal line to collect the status data of each signal relay in real time.

[0013] In an optional embodiment of this application, the device further includes a maintenance interface, wherein the maintenance interface is connected to a second processor.

[0014] In an optional embodiment of this application, the device further includes a display alarm unit, wherein the display alarm unit is connected to a first processor, the first processor sends display data and sound data to the display alarm unit via a display control sound signal line, and the display alarm unit sends touch screen and button status signals to the first processor via touch screen signal and button signal lines.

[0015] A second aspect of this application provides a rail transit safety access control system, including a train control network, train electronic control equipment, and the aforementioned rail transit safety access control device. The train control network's Ethernet bus, serial bus, MVB bus, and USB bus are connected to the rail transit safety access control device. The rail transit safety access control device performs authorization verification. If authorization is successful, the train control network is allowed to connect to the train electronic control equipment; if authorization fails, the train control network is prohibited from connecting to the train electronic equipment.

[0016] Compared with the prior art, the technical solutions provided in this application have at least some or all of the following advantages: The rail transit safety access control device described in this application includes a service interface processing unit, a maintenance interface processing unit, a first processor, a second processor, and a failure management unit. It performs safety management for both the service interface and the maintenance interface, supports fault-oriented safety service interface bypass functionality, and possesses a dual-processor collaborative safety protection structure. This effectively ensures the safety of the rail transit safety access control device itself, ensures the correct execution of safety protection measures, effectively solves the safety protection problems of train electronic control systems, significantly improves the safety protection level of trains, reduces the maintenance difficulty of high-end rail transit equipment, ensures train operation safety, and has broad market prospects. Attached Figure Description

[0017] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings: Figure 1 This is a structural diagram of a rail transit safety access control device provided in one embodiment of this application; Figure 2 A flowchart illustrating the bypass function of a rail transit safety access control device according to an embodiment of this application; Figure 3 A flowchart illustrating the maintenance interface protection of a rail transit safety access control device provided in one embodiment of this application; Figure 4 A flowchart illustrating the self-maintenance and safety protection process of a rail transit safety access control device provided in one embodiment of this application; Figure 5 This is a structural diagram of a rail transit safety access control system provided in one embodiment of this application; Figure 6 A flowchart illustrating the protection process of the service interface of a rail transit safety access control device provided in one embodiment of this application. Detailed Implementation

[0018] To make the technical solutions and advantages of the embodiments of this application clearer, the exemplary embodiments of this application will be described in further detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not an exhaustive list of all embodiments. It should be noted that, unless otherwise specified, the embodiments and features in the embodiments of this application can be combined with each other.

[0019] See Figure 1 This application provides a rail transit safety access control device, which includes a service interface processing unit, a maintenance interface processing unit, a first processor (processor A), a second processor (processor B), and a failure management unit. Both the service interface processing unit and the maintenance interface processing unit include an interface management module and signal relays. Each interface management module has an enable signal. When the enable signal receives a high-level signal, the interface management module manages the interface connected to it; when the enable signal receives a low-level signal, the interface management module does not operate and outputs a high-impedance state to the interface connected to it. The first processor is connected to each interface management module through communication control lines and to each signal relay through relay control signal lines. Each signal relay controls the connection and disconnection between the corresponding interface management module on both sides and the service bus or maintenance bus. The first processor is connected to the second processor. The first processor sends periodic heartbeat signals to the second processor, and the second processor sends periodic heartbeat signals to the first processor. The second processor is connected to the failure management unit via a power supply control signal line. The failure management unit controls the power supply to the coils of each signal relay. The power supply to the relay coils is simultaneously connected to the enable signals of the interface management modules on both sides. When the power supply to the relay coils is output, the corresponding interface management modules on both sides operate. When the power supply to the relay coils is not output, the corresponding interface management modules on both sides output a high-impedance state. When the first and second processors are in normal condition, the second processor controls the failure management unit to output a power supply signal, and the signal relays are powered. When the first and second processors are in abnormal condition, the second processor controls the failure management unit to stop outputting the power supply signal, and the signal relays stop working.

[0020] In an optional embodiment of this application, the service interface processing unit comprises a first Ethernet interface management module (Ethernet interface management module A), a second Ethernet interface management module (Ethernet interface management module B), a first USB interface management module (USB interface management module A), a second USB interface management module (USB interface management module B), a first serial port interface management module (serial port interface management module A), a second serial port interface management module (serial port interface management module B), a first MVB interface management module (MVB interface management module A), a second MVB interface management module (MVB interface management module B), and a signal relay. The first and second Ethernet interface management modules are connected to the signal relay on both sides; the first and second USB interface management modules are connected to the signal relay on both sides; the first and second serial port interface management modules are connected to the signal relay on both sides; and the first and second MVB (Multifunction Vehicle Bus Interface) interface management modules are connected to the signal relay on both sides.

[0021] In an optional embodiment of this application, the maintenance interface processing unit comprises a third Ethernet interface management module, a fourth Ethernet interface management module, a third USB interface management module, a fourth USB interface management module, a third serial port interface management module, a fourth serial port interface management module, and a signal relay. The third Ethernet interface management module and the fourth Ethernet interface management module are connected to the signal relay on both sides of the signal relay. The third USB interface management module and the fourth USB interface management module are connected to the signal relay on both sides of the signal relay. The third serial port interface management module and the fourth serial port interface management module are connected to the signal relay on both sides of the signal relay.

[0022] In one optional embodiment of this application, each Ethernet interface management module connects to multiple Ethernet interfaces, each USB interface management module connects to multiple USB interfaces, each serial port interface management module connects to multiple serial ports, and each MVB interface management module connects to multiple MVB interfaces.

[0023] In this application, the business interface processing unit can simultaneously provide parallel protection for multiple Ethernet, multiple USB, multiple serial ports, and multiple MVB, and the maintenance interface processing unit can simultaneously provide parallel protection for multiple Ethernet, multiple USB, and multiple serial ports. It has good adaptability to various types of buses in the rail transit field and improves the interface security management level of train electronic control systems in different application scenarios such as subways and EMUs.

[0024] In an optional embodiment of this application, in the service interface processing unit, each signal line of a plurality of first Ethernet interfaces is connected to each signal line of a plurality of second Ethernet interfaces via normally closed nodes of signal relays; each signal line of a plurality of first USB interfaces is connected to each signal line of a plurality of second USB interfaces via normally closed nodes of signal relays; each signal line of a plurality of first serial ports is connected to each signal line of a plurality of second serial ports via normally closed nodes of signal relays; each signal line of a plurality of first MVB interfaces is connected to each signal line of a plurality of second MVB interfaces via normally closed nodes of signal relays. The first Ethernet interfaces and second Ethernet interfaces are respectively connected to a first Ethernet interface management module and a second Ethernet interface management module; the first USB interfaces and second USB interfaces are respectively connected to a first USB interface management module and a second USB interface management module; the first serial ports and second serial ports are respectively connected to a first serial port interface management module and a second serial port interface management module; and the first MVB interfaces and second MVB interfaces are respectively connected to a first MVB interface management module and a second MVB interface management module.

[0025] In an optional embodiment of this application, each signal line of a plurality of third Ethernet interfaces is connected to each signal line of a plurality of fourth Ethernet interfaces via normally open nodes of signal relays; each signal line of a plurality of third USB interfaces is connected to each signal line of a plurality of fourth USB interfaces via normally open nodes of signal relays; each signal line of a plurality of third serial ports is connected to each signal line of a fourth serial port via normally open nodes of signal relays. The third Ethernet interfaces and fourth Ethernet interfaces are respectively connected to the third Ethernet interface management module and the fourth Ethernet interface management module, respectively; the third USB interfaces and fourth USB interfaces are respectively connected to the third USB interface management module and the fourth USB interface management module, respectively; and the third serial ports and fourth serial ports are respectively connected to the third serial port interface management module and the fourth serial port interface management module, respectively.

[0026] See Figure 1Processor A is connected via communication control lines to Ethernet interface management module A, Ethernet interface management module B, USB interface management module A, USB interface management module B, serial port interface management module A, serial port interface management module B, MVB interface management module A, and MVB interface management module B, respectively. Processor A is also connected via communication control lines to Ethernet interface management module C, Ethernet interface management module D, USB interface management module C, USB interface management module D, serial port interface management module C, serial port interface management module D, and MVB interface management module C and MVB interface management module D, respectively. In the service interface processing unit, each signal line of Ethernet interfaces A1 and A2 is connected to each signal line of Ethernet interfaces B1 and B2 via normally closed terminals of signal relays; each signal line of USB interfaces A1 and A2 is connected to each signal line of USB interfaces B1 and B2 via normally closed terminals of signal relays; each signal line of serial ports A1 and A2 is connected to each signal line of serial ports B1 and B2 via normally closed terminals of signal relays; and each signal line of MVB interfaces A1 and A2 is connected to each signal line of MVB interfaces B1 and B2 via normally closed terminals of signal relays. In the maintenance interface processing unit, each signal line of Ethernet interfaces C1 and C2 is connected to each signal line of Ethernet interfaces D1 and D2 via normally open terminals of signal relays; each signal line of USB interfaces C1 and C2 is connected to each signal line of USB interfaces D1 and D2 via normally open terminals of signal relays; and each signal line of serial ports C1 and C2 is connected to each signal line of serial ports D1 and D2 via normally open terminals of signal relays. Maintenance interface E is connected to processor B. Processor A and processor B are connected via heartbeat 1 signal line, heartbeat 2 signal line, and internal bus. Processor A sends periodic heartbeat signals to processor B via heartbeat 1 signal line, and processor B sends periodic heartbeat signals to processor A via heartbeat 2 signal line. Processor A and processor B transmit data via internal bus.

[0027] The rail transit safety access control device of this application has a bypass function. When processor B detects an abnormality in processor A through a heartbeat signal, processor B controls the failure management unit to shut off the power supply to the relay coil through the power supply control signal line. At this time, the interfaces on both sides of the service processing unit are directly connected through the normally closed nodes of the signal relays to ensure that the interconnection between the service interface of the train electronic control equipment and the train control network is not affected in the event of a fault in the rail transit safety access control device itself. The coil power supply is connected to the enable signal EN of each interface management module of the service interface processing unit. When the relay coil power supply stops, it can ensure that the corresponding interface management module quickly outputs a high-impedance state, ensuring low latency in the implementation of the bypass function and ensuring service stability.

[0028] See Figure 1 and Figure 2 In the event of a malfunction in the rail transit safety access control device itself, the interfaces on both sides of the maintenance interface processing unit are connected to the normally open nodes of the signal relays, and the interfaces on both sides are in a disconnected state to prevent unauthorized external devices from accessing the train electronic control equipment.

[0029] The service interface processing unit of the rail transit safety access control device proposed in this application has a bypass function. When processor A fails, processor B can control the failure management unit to cut off the power supply to the signal relay coil, keeping the service interface connected and the maintenance interface disconnected. This ensures that the normal operation of the train electronic control equipment is not affected in the event of a serious failure of the rail transit safety access control device itself, while preventing malicious intrusion into the train electronic control equipment through the maintenance interface.

[0030] In the rail transit safety access control device of this application, the service interface processing unit and the maintenance interface processing unit have an enable signal EN. The enable signal EN and the corresponding relay coil power supply are interconnected. When the failure management unit cuts off the power supply to the signal relay coil, the left and right bus interface processing units corresponding to the service interface processing unit and the maintenance interface processing unit output a high impedance state to ensure low latency of bypass function implementation and ensure service stability.

[0031] The rail transit safety access control device proposed in this application has a dual-processor collaborative safety protection structure. Processor A is responsible for computation and processing, while processor B is responsible for monitoring the behavior of processor A and controlling relay disconnection after a fault. Processor B is also responsible for maintaining the program of processor A and providing effective security protection for the data accessed by processor A, thereby effectively improving the security of the rail transit safety access control device itself.

[0032] In an optional embodiment of this application, the first processor is connected to each signal relay via a relay status feedback signal line to collect the status data of each signal relay in real time.

[0033] In an optional embodiment of this application, the device further includes a maintenance interface, wherein the maintenance interface is connected to a second processor.

[0034] In an optional embodiment of this application, the maintenance interface processing unit connects the maintenance interface of the maintenance equipment, USB flash drive, and train electronic control equipment to manage maintenance access. First, after the maintenance equipment and USB flash drive are connected to the rail transit safety access control device, the administrator performs manual authorization confirmation via the touchscreen of the rail transit safety access control device. If authorization is successful, the maintenance equipment and USB flash drive are allowed to connect to the maintenance interface of the train electronic control device. If authorization fails, the maintenance equipment and USB flash drive are prohibited from connecting to the maintenance interface of the train electronic control device. After the maintenance equipment and USB flash drive are connected to the train electronic equipment, the processor A of the rail transit safety access control device performs security checks on the input data of the maintenance equipment or the transmission data of the USB flash drive. When the data is detected as secure, it is transmitted to the maintenance interface of the train electronic control system via Ethernet, USB, or serial port interface. When data insecurity is detected, data transmission to the maintenance interface of the train electronic control system is stopped, and an audible and visual alarm is activated. The rail transit safety access control device records the review process and data security status. Taking maintenance interface 1 Ethernet C1 and corresponding Ethernet D1 as an example, the workflow is as follows: Figure 3 As shown. The processing methods for the Ethernet interface, USB interface, and serial port interface of the service interface processing unit are the same as those for... Figure 3 same.

[0035] The software updates and maintenance of processor A in the rail transit safety access control device of this application are handled by processor B. Maintenance interface E first connects to processor B, requiring manual security review and confirmation. After approval, maintenance interface E transmits data to processor B, which performs security checks on the data. Following the processor B's detection, processor B transmits the data back to processor A via its internal bus. Simultaneously, the rail transit safety access control device records the review process and data security status to effectively prevent malicious attacks from affecting the normal operation of processor A. The security protection process for self-maintenance in this application is as follows: Figure 4 As shown.

[0036] In an optional embodiment of this application, the device further includes a display alarm unit, wherein the display alarm unit is connected to a first processor, the first processor sends display data and sound data to the display alarm unit via a display control sound signal line, and the display alarm unit sends touch screen and button status signals to the first processor via touch screen signal and button signal lines.

[0037] The rail transit safety access control device of this application is mainly used for safety protection during train operation and maintenance, to prevent virus infection, malicious attacks and other issues caused by peripheral devices such as USB flash drives and personal computers accessing the vehicle control system from affecting the safe operation of the train control system, and to avoid personal injury and equipment loss.

[0038] See Figure 5 This application provides a rail transit safety access control system, including a train control network, train electronic control equipment, and the aforementioned rail transit safety access control device. The train control network's Ethernet bus, serial bus, MVB bus, and USB bus are connected to the rail transit safety access control device. The rail transit safety access control device performs authorization confirmation. If the authorization is successful, the train control network is allowed to connect to the train electronic control equipment. If the authorization fails, the train control network is prohibited from connecting to the train electronic equipment.

[0039] The working principle of the rail transit safety access control system in this application is as follows: The service interface processing unit of the rail transit safety access control device connects the service interfaces of the train control network and the train electronic control equipment. After the Ethernet, serial port, MVB, USB, and other buses of the train control network are connected to the rail transit safety access control device, the administrator performs manual authorization confirmation through the touch screen of the rail transit safety access control device. If the authorization is successful, the train control network is allowed to connect to the train electronic control equipment. If the authorization fails, the connection between the train control network and the train electronic equipment is prohibited. After the train control network connects to the train electronic equipment, the processor A of the rail transit safety access control device performs security detection on the input data of the train control network. When the data is detected as secure, it is transmitted to the service interface of the train electronic control system through the Ethernet, USB, serial port, and MVB network interfaces. When data insecurity is detected, data transmission to the service interface of the train electronic control system is stopped, and an audible and visual alarm is activated. At the same time, the rail transit safety access control device records the review process and data security status. Taking one Ethernet A and one corresponding Ethernet B service interface as an example, the workflow is as follows: Figure 6 As shown. The processing methods for the USB interface, serial port interface, and MVB interface of the business interface processing unit are as follows: Figure 6 same.

[0040] The rail transit safety access control system proposed in this application realizes zoned security protection for business data interfaces and maintenance data interfaces, and adopts different protection strategies. New access to business interfaces or maintenance interfaces requires manual authorization. After authorization, the data accessed by the new interface must pass security detection before it can be transmitted to the train electronic control equipment. At the same time, the rail transit safety access control device will record the review process and data security status, which significantly improves the security protection of the train electronic control equipment.

[0041] In the rail transit safety access control system proposed in this application, a new technical solution for separating the management of service interfaces and maintenance interfaces is implemented. A bypass function is designed for the service interfaces, while a fault-oriented safety and interface disconnection strategy is adopted for the maintenance interfaces. This ensures that normal service communication is not affected even in the event of a fault in the rail transit safety access control device itself, while effectively protecting the maintenance interfaces. It also enhances the safety protection of the train electronic control system in extreme situations, effectively solving the safety protection problem of the train electronic control system. Compared to the current model that relies entirely on on-site personnel for management, the implementation of this application can more effectively and systematically review the access behavior of various train buses, significantly improving the standardization of on-site maintenance management of rail transit equipment.

[0042] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0043] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A rail transit safety access control device, characterized in that, The device includes a service interface processing unit, a maintenance interface processing unit, a first processor, a second processor, and a failure management unit, wherein... Both the service interface processing unit and the maintenance interface processing unit include an interface management module and signal relays. Each interface management module has an enable signal. When the enable signal receives a high-level signal, the interface management module manages the interface connected to it; when the enable signal receives a low-level signal, the interface management module does not operate and outputs a high-impedance state to the interface connected to it. The first processor is connected to each interface management module through communication control lines and to each signal relay through relay control signal lines. Each signal relay controls the connection and disconnection between the corresponding interface management module on both sides and the service bus or maintenance bus. The first processor is connected to the second processor. The first processor sends periodic heartbeat signals to the second processor, and the second processor sends periodic heartbeat signals back to the first processor. The second processor is connected to the failure management unit via a power supply control signal line. The failure management unit controls the power supply to the coils of each signal relay. The relay coil power supply is simultaneously connected to the enable signals of the interface management modules on both sides. When the relay coil power supply is output, the corresponding interface management modules on both sides operate. When the relay coil power supply is not output, the corresponding interface management modules on both sides output a high-impedance state. When the first and second processors are in normal condition, the second processor controls the failure management unit to output a power supply signal, and the signal relays are powered. When the first and second processors are in abnormal condition, the second processor controls the failure management unit to stop outputting the power supply signal, and the signal relays stop operating. The device also includes a maintenance interface, which is connected to the second processor. The maintenance interface processing unit connects to the maintenance interfaces of the operation and maintenance equipment, USB flash drive, and train electronic control equipment to manage maintenance access. The software update and maintenance of the first processor of the rail transit safety access control device is handled by the second processor. The maintenance interface first connects to the second processor and undergoes manual security review and confirmation. After passing the review, the maintenance interface transmits the data to the second processor. The second processor performs security checks on the data. After passing the second processor's check, the second processor transmits the data to the first processor via the internal bus. At the same time, the rail transit safety access control device records the review process and data security status.

2. The rail transit safety access control device according to claim 1, characterized in that, The service interface processing unit consists of a first Ethernet interface management module, a second Ethernet interface management module, a first USB interface management module, a second USB interface management module, a first serial port interface management module, a second serial port interface management module, a first MVB interface management module, a second MVB interface management module, and a signal relay. The first and second Ethernet interface management modules are connected to the signal relay on both sides; the first and second USB interface management modules are connected to the signal relay on both sides; the first and second serial port interface management modules are connected to the signal relay on both sides; and the first and second MVB interface management modules are connected to the signal relay on both sides.

3. The rail transit safety access control device according to claim 1, characterized in that, The maintenance interface processing unit consists of a third Ethernet interface management module, a fourth Ethernet interface management module, a third USB interface management module, a fourth USB interface management module, a third serial port interface management module, a fourth serial port interface management module, and a signal relay. The third and fourth Ethernet interface management modules are connected to the signal relay on both sides, the third and fourth USB interface management modules are connected to the signal relay on both sides, and the third and fourth serial port interface management modules are connected to the signal relay on both sides.

4. The rail transit safety access control device according to claim 1, characterized in that, Each Ethernet interface management module connects to multiple Ethernet interfaces, each USB interface management module connects to multiple USB interfaces, each serial port interface management module connects to multiple serial ports, and each MVB interface management module connects to multiple MVB interfaces.

5. The rail transit safety access control device according to claim 4, characterized in that, In the service interface processing unit, each signal line of multiple first Ethernet interfaces is connected to each signal line of multiple second Ethernet interfaces via normally closed nodes of signal relays; each signal line of multiple first USB interfaces is connected to each signal line of multiple second USB interfaces via normally closed nodes of signal relays; each signal line of multiple first serial ports is connected to each signal line of multiple second serial ports via normally closed nodes of signal relays; each signal line of multiple first MVB interfaces is connected to each signal line of multiple second MVB interfaces via normally closed nodes of signal relays. The first Ethernet interfaces and second Ethernet interfaces are connected to the first Ethernet interface management module and the second Ethernet interface management module, respectively; the first USB interfaces and second USB interfaces are connected to the first USB interface management module and the second USB interface management module, respectively; the first serial ports and second serial ports are connected to the first serial port interface management module and the second serial port interface management module, respectively; and the first MVB interfaces and second MVB interfaces are connected to the first MVB interface management module and the second MVB interface management module, respectively.

6. The rail transit safety access control device according to claim 4, characterized in that, Each signal line of multiple third Ethernet interfaces is connected to each signal line of multiple fourth Ethernet interfaces via normally open nodes of signal relays; each signal line of multiple third USB interfaces is connected to each signal line of multiple fourth USB interfaces via normally open nodes of signal relays; each signal line of multiple third serial ports is connected to each signal line of multiple fourth serial ports via normally open nodes of signal relays. The third and fourth Ethernet interfaces are connected to the third and fourth Ethernet interface management modules, respectively; the third and fourth USB interfaces are connected to the third and fourth USB interface management modules, respectively; and the third and fourth serial ports are connected to the third and fourth serial port interface management modules, respectively.

7. The rail transit safety access control device according to claim 1, characterized in that, The first processor is connected to each signal relay via a relay status feedback signal line to collect the status data of each signal relay in real time.

8. The rail transit safety access control device according to claim 1, characterized in that, The device further includes a display alarm unit, which is connected to a first processor. The first processor sends display data and sound data to the display alarm unit via a display control sound signal line, and the display alarm unit sends touch screen and button status signals to the first processor via touch screen signal and button signal lines.

9. A rail transit safety access control system, characterized in that, It includes a train control network, train electronic control equipment, and a rail transit safety access control device according to any one of claims 1 to 8, wherein the Ethernet bus, serial bus, MVB bus, and USB bus of the train control network are connected to the rail transit safety access control device, and authorization is confirmed by the rail transit safety access control device. If the authorization is successful, the train control network is allowed to connect to the train electronic control equipment; if the authorization is unsuccessful, the train control network is prohibited from connecting to the train electronic control equipment.

Images