Method and device for upgrading software version of power distribution network robot and electronic equipment

Abstract

The invention discloses a method and device for upgrading a software version of a power distribution network robot, and electronic equipment, and the method comprises the steps: carrying out block encryption on a target software package through an operation and maintenance platform, adding a digital signature, and generating an instruction set containing an upgrading sequence; inserting the security communication component into a corresponding interface of the target robot, triggering a security handshake protocol, establishing a temporary VPN tunnel by the security communication component and the operation and maintenance platform through the security handshake protocol, receiving an instruction set by the security communication component through the temporary VPN tunnel, downloading a target software package to a security sandbox according to the instruction set, and storing the target software package in the security sandbox. According to an upgrading sequence in the upgrading instruction set, controlling each part of the target robot to obtain the target software package from the security sandbox to perform multi-thread upgrading; and after upgrading is completed, VPN temporary tunnel configuration is automatically cleared, and the robot is triggered to recover to a non-extranet connection state. The method does not need to be connected with an external network to obtain the upgrade package, realizes safe and controllable offline version update, and improves the upgrade safety, success rate and efficiency.

Description

Technical Field

[0001] The present invention belongs to the technical field of live-working robots for distribution networks, and in particular relates to a method and device, and electronic equipment for upgrading software versions of distribution network robots. Background Art

[0002] At present, with the development of distribution network live working robot technology, the update and iteration speed of robot software versions is getting faster and faster. Therefore, it is necessary to upgrade the software version of the distribution network live working robot.

[0003] Prior art document 1 (CN113504922A) discloses a robot software upgrade method, device, bridge server, and upgrade server. The bridge server in this solution still requires external network access to obtain upgrade packages. While this reduces the risk of robots directly connecting to the external network, the bridge server itself could become an attack vector. A compromised bridge server could potentially lead to batches of robot upgrade packages being tampered with. Furthermore, the solution relies on pre-set policies to control the upgrade process, lacking hardware-level encryption and two-way identity authentication. This makes it unable to protect against man-in-the-middle attacks or malware injection in high-risk scenarios like live work. The solution is incompatible with complex environments, lacks a sufficient level of security protection, and offers low security. Furthermore, it fails to account for environmental factors such as strong electromagnetic interference and high humidity and dust in distribution stations, resulting in low upgrade efficiency. Summary of the Invention

[0004] In order to address the deficiencies in the prior art, the present invention provides a method, device, and electronic device for software version upgrades of distribution network robots. Through an operation and maintenance platform, centralized version management, encrypted transmission, and multi-component status monitoring are achieved. There is no need to connect to an external network to obtain upgrade packages, thereby achieving safe and controllable offline version updates. This overcomes the defects of existing localized update methods, such as high manual operation risks, chaotic version management, and weak security protection, improves security, upgrade efficiency, and success rate, reduces upgrade costs, and reduces the risk of system downtime caused by upgrade errors.

[0005] The present invention adopts the following technical solutions.

[0006] A first aspect of the present invention provides a method for upgrading software version of a distribution network robot, comprising: The operation and maintenance platform encrypts the target software package in blocks, adds a digital signature, and generates an instruction set containing the upgrade sequence; Insert the secure communication component into the corresponding interface of the target robot, trigger the secure handshake protocol, establish a temporary VPN tunnel between the secure communication component and the operation and maintenance platform through the secure handshake protocol, and check whether all components of the target robot are in an upgradeable state; When all components of the target robot are in an upgradeable state, the secure communication component receives the instruction set through a temporary VPN tunnel. After the signature and configuration file parameter range of the target software package are double-checked and passed, the target software package is downloaded to the secure sandbox in the target robot according to the instruction set. Then, according to the upgrade sequence in the upgrade instruction set, the components of the target robot are controlled to obtain the target software package from the secure sandbox for multi-threaded upgrade. After the upgrade is complete, the VPN temporary tunnel configuration will be automatically cleared to release the security sandbox memory space. After unplugging the security communication component, the robot will be triggered to restore to a state without external network connection and wait for the next upgrade task. Optionally, the additional digital signature includes: A three-level digital signature chain consisting of a development certificate signature, a test certificate signature, and a production certificate signature is attached in sequence; and when any level of the digital signature chain fails verification, a fuse rollback mechanism is triggered; otherwise, the verified software package block is downloaded to the security sandbox, where the fuse rollback mechanism is stored in the instruction set.

[0007] Optionally, the method further includes: The operation and maintenance platform encrypts the target software package in blocks and adds a digital signature. It then updates the device compatibility matrix in the version repository. The device compatibility matrix indicates the applicable robot hardware model, the minimum firmware version requirements for each robot component, and the configuration file parameter range threshold of the software package. Perform hardware model matching verification and firmware version verification on the target robot based on the device compatibility matrix table; perform configuration file parameter range verification based on the device compatibility matrix table.

[0008] Optionally, the version dependencies are managed through a hash tree structure, the hash value of the hash tree root node of each version is stored in the device compatibility matrix table, and the root node hash value of the version is obtained from the device compatibility matrix table to verify whether the target software meets the dependency.

[0009] Optionally, the method further includes: Perform two-way authentication between the secure communication component hardware certificate and the operation and maintenance platform certificate; specifically: The operation and maintenance platform verifies the hardware certificate of the secure communication component and sends a temporary access token containing the operation and maintenance platform certificate to the secure communication self-test after the verification is passed; After the secure communication component verifies the temporary access token sent by the operation and maintenance platform, a temporary VPN tunnel is established between the operation and maintenance platform and the secure communication component, and a session key is generated according to the device serial number of the secure communication component.

[0010] Optionally, check whether all robot components are in an upgradeable state, including: Read the robot's memory usage and calculate the available space based on the content usage; Obtain the average load of the robot CPU within a preset time period, the remaining capacity of the storage partition, and the status data of each component; If the available space, average load, remaining capacity of the storage partition, and status data of each component all meet the preset logic, the component is in an upgradeable state.

[0011] Optionally, the method further includes: Monitor the multi-threaded upgrade process, specifically: When the global task timeout is detected, all upgrade threads are paused, each component records the current upgrade progress, and resources are released; When a component-level operation timeout is detected, the current timed-out component is isolated and rolled back to the last valid version. When monitoring detects a global task timeout during the software submission process, a global rollback is performed.

[0012] Optionally, the method further includes: When the secure communication component is unplugged, the target robot integrity check is triggered. If the integrity check fails, a hierarchical recovery strategy is executed according to the severity level of the integrity check result. Optionally, before the target robot is upgraded, the firmware of each component in the target software package is preloaded into the double buffer of the security sandbox. The double buffer includes a preparation buffer and an active buffer. The preparation buffer is used to preload the encrypted target software package fragment, and the active buffer is used to execute the current fragment burning. The double buffer performs atomic switching when the fragment burning is completed.

[0013] A second aspect of the present invention provides a device for upgrading the software version of a distribution network robot, comprising: The software version release and encryption module is used to encrypt the target software package in blocks, attach a digital signature, and generate an instruction set containing the upgrade sequence; The secure networking module is used to insert the secure communication component into the corresponding interface of the target robot, trigger the secure handshake protocol, establish a temporary VPN tunnel between the secure communication component and the operation and maintenance platform through the secure handshake protocol, and check whether the various components of the target robot are in an upgradeable state; The upgrade module is used to determine whether the components of the target robot are in an upgradeable state. The secure communication component receives the instruction set through a temporary VPN tunnel, performs a double verification of the signature and configuration file parameter range of the target software package, and then downloads the target software package to the security sandbox in the target robot according to the instruction set. According to the upgrade sequence in the upgrade instruction set, the components of the target robot obtain the target software package from the security sandbox for multi-threaded upgrade; The recovery module is used to automatically clear the VPN temporary tunnel configuration after the upgrade is completed, release the security sandbox memory space, and trigger the robot to recover to the state without external network connection after unplugging the security communication component, waiting for the next upgrade task.

[0014] The third aspect of the present invention provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program, when loaded into the processor, implements the above-mentioned method for upgrading the software version of a distribution network robot.

[0015] A fourth aspect of the present invention provides a computer-readable storage medium storing a computer program, which implements the above-mentioned method for upgrading the software version of a distribution network robot when executed by a processor.

[0016] Compared with the prior art, the beneficial effects of the present invention include at least: 1) This invention uses secure communication components and an operation and maintenance platform to build a temporary VPN tunnel for upgrades. This not only solves the problems of strong dependence on dedicated engineering computers and poor environmental adaptability, but also reduces hardware procurement and maintenance costs while achieving the same security level due to the low cost of secure communication components.

[0017] 2) This invention establishes an end-to-end encrypted transmission channel, eliminating the risk of external network exposure and preventing software package tampering or leakage during the upgrade process. This improves upgrade security and further increases the success rate. Furthermore, a dynamic key negotiation strategy is used to generate session keys, further enhancing upgrade security.

[0018] 3) The present invention uses a multi-threaded upgrade engine to achieve parallel upgrades of multiple components, improving upgrade efficiency; and monitors the upgrade status in real time for feedback, solving the problems of missing status feedback and monitoring blind spots in traditional solutions.

[0019] 4) The present invention receives the encrypted software package issued by the operation and maintenance platform through a secure communication component, and performs software compatibility matching based on the hardware version before issuing it, eliminating the risk of version mismatch caused by manually carrying storage media, reducing the risk of equipment damage caused by misoperation, and improving upgrade efficiency and success rate.

[0020] 5) The present invention performs three-level verification during the software upgrade process. If any level of verification fails, the fuse rollback mechanism is triggered, eliminating unauthorized version deployment from the source.

[0021] 6) This invention fully covers the entire life cycle from version management to status feedback. While ensuring compliance with power safety regulations, it achieves three breakthroughs in the safety, automation, and auditability of distribution network live working robot software upgrades, and is therefore practical. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. Those skilled in the art can also derive other drawings based on these drawings without inventive effort. Among them: Figure 1 This is a flowchart of a method for upgrading the software version of a distribution network robot provided by an embodiment of the invention; Figure 2 This is a system diagram of an application scenario of a method for upgrading the software version of a distribution network robot provided by an embodiment of the present invention; Figure 3 This is a system diagram of another application scenario of a method for upgrading software versions of distribution network robots provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0023] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. The embodiments described in this application are only part of the embodiments of the present invention, not all of them. Based on the spirit of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0024] Combine Figure 1 As shown, embodiment 1 of the present invention provides a method for upgrading the software version of a distribution network robot, the method comprising the following contents: Step 1: The operation and maintenance platform encrypts the target software package and adds a digital signature. It also updates the device compatibility matrix in the version repository, marks the applicable robot models and the minimum firmware version requirements of each robot component in the device compatibility matrix, and generates an instruction set containing the upgrade sequence.

[0025] Preferably, but not limitatively, in step 1, the operation and maintenance platform encrypts the target software package and adds a digital signature, which includes: the operation and maintenance platform encrypts the software package in blocks and digitally signs the encrypted software package blocks.

[0026] Further preferably but not restrictively, a three-level digital signature chain consisting of a development certificate signature, a test certificate signature, and a production certificate signature is attached in sequence; and when any level of the digital signature chain fails to be verified, a fuse rollback mechanism is triggered, otherwise the verified software package block is downloaded to the security sandbox, wherein the fuse rollback mechanism is stored in the instruction set.

[0027] Specifically, developers upload the compiled software package to the operation and maintenance platform, triggering the automated encryption pipeline. The version repository module encrypts the software package in blocks and attaches a three-level digital signature chain to the encrypted software package.

[0028] As one of the outstanding substantive features of the present invention, a three-level digital signature chain is added to perform three-level verification during the software upgrade process. If any level of verification fails, the fuse rollback mechanism will be triggered, eliminating unauthorized version deployment from the source and further improving the success rate of software upgrades.

[0029] Preferably, but not restrictively, the operation and maintenance platform uses SM4-CBC mode to encrypt the target software package.

[0030] In some embodiments, the operation and maintenance platform can also adopt other encryption algorithms that meet industry standards and security requirements, such as AES-256, etc. This application does not impose any restrictions here, and the appropriate encryption algorithm is selected according to the industry standards and security requirements of the actual application.

[0031] It should be noted that pre-verification before the encrypted network card is connected can defend against physical hijacking attacks and prevent attackers from forging network card access platforms to steal upgrade packages, meeting Article 5.2.3 of the "Electric Power Monitoring System Security Protection Regulations" that "unauthenticated equipment is prohibited from accessing the production control area"; pre-verification eliminates the risk window of "network card access moment" and complies with the iron rule of "authentication before connection" in the power industry.

[0032] In this embodiment, software packages are encrypted to prevent man-in-the-middle attacks and data leakage during physical access. This is particularly true in offline environments where, while disconnected from the external network, the physical media could be exploited maliciously. Digital signatures are also used to ensure the integrity and source authentication of the software packages. The dual security of encryption algorithms and digital signatures further enhances upgrade security.

[0033] Preferably but not limitedly, step 1 further comprises: The version repository module updates the compiled software package information to the device compatibility matrix table, and marks the robot models applicable to the compiled software package and the minimum firmware version requirements of each robot component in the device compatibility matrix table.

[0034] In some embodiments, the robot hardware model, the minimum supported firmware version, whether SM4-CBC encryption is supported, and whether digital signatures are supported are recorded in a device compatibility matrix table. The minimum supported firmware version indicates the minimum firmware version required for the device to run. A version lower than this may result in functional incompatibility or inability to decrypt.

[0035] Preferably, but not limitatively, the version dependency is managed through a hash tree structure, and the hash value of the hash tree root node of each version is stored in the device compatibility matrix table.

[0036] Specifically, the version dependency data is divided into multiple data blocks. Each data block can be a file, a module, or a dependency. A hash value is calculated for each data block and stored in the leaf nodes of the hash tree. For each adjacent leaf node, the hash value of their hash values is calculated and stored in the parent node. This is repeated until the root node is constructed. The hash value of the root node of the hash tree for each version is stored in the device compatibility matrix.

[0037] One of the key features of this invention is that, through a hash tree structure, the dependencies of the current version can be verified by simply obtaining the root node hash value of the version from the device compatibility matrix. This allows for rapid verification of the integrity of a single data block or an entire version. Furthermore, the hash tree structure ensures data consistency and integrity; changes to any data block result in changes to the root node hash value. This makes it easier to manage multiple versions and supports version switching and updates.

[0038] Preferably, but not restrictively, before downloading the target software package for upgrading in step 3, the device management module performs hardware model matching verification and firmware version verification on the target robot based on the device compatibility matrix table. If the hardware model or firmware version of the target robot does not meet the corresponding requirements in the device compatibility matrix table, the current upgrade process is terminated, the connection between the encryption network card and the operation and maintenance platform is disconnected, and the robot is restarted to switch to safe mode.

[0039] It should be noted that the safe mode only loads core drivers and services, disables all non-essential third-party drivers, applications and extended functions, such as network modules, advanced motion control algorithms, etc.; only retains hardware drivers and system services that maintain basic operations; basic hardware drivers include motor control and sensor communication, and system services include security monitoring processes.

[0040] In this embodiment, the present invention receives the encrypted software package issued by the operation and maintenance platform through a secure communication component, and performs software compatibility matching according to the hardware version before issuing it, eliminating the risk of version mismatch caused by manually carrying storage media, reducing the risk of equipment damage caused by misoperation, and improving upgrade efficiency and success rate.

[0041] In some embodiments, detailed error context may be recorded in the log, and the highest level alarm may be triggered to notify the operation and maintenance team via SMS or email.

[0042] In this embodiment, dual compatibility verification of hardware model matching verification and firmware version verification is performed by the device management module. When the verification fails, the encryption network card is disconnected to prevent the wrong version from being written, thereby improving the security of the upgrade.

[0043] Step 2: Insert the secure communication component into the corresponding interface of the target robot, triggering the secure handshake protocol. The secure communication component and the operation and maintenance platform establish a temporary VPN (Virtual Private Network) tunnel through the secure handshake protocol. The edge proxy service starts the self-test program to check whether the various components of the target robot are in an upgradeable state.

[0044] Step 2 includes: performing two-way authentication between the secure communication component hardware certificate and the operation and maintenance platform certificate, specifically: The operation and maintenance platform verifies the hardware certificate of the secure communication component and sends a temporary access token containing the operation and maintenance platform certificate to the secure communication component after verification. After the secure communication component verifies the temporary access token sent by the operation and maintenance platform, a temporary VPN tunnel is established between the operation and maintenance platform and the secure communication component, and a session key is generated according to the device serial number of the secure communication component.

[0045] Specifically, hardware certificate verification utilizes a two-way authentication mechanism based on a national encryption algorithm, verifying the authentication between the security chip embedded in the encryption network card and the certificate system pre-configured by the operation and maintenance platform. Specifically, the operation and maintenance platform sends a random number N1 and its own three-level digital signature chain to the encryption network card to initiate an authentication request. The network card verifies the platform's certificate, generates a random number N2, and returns its own certificate and signature. The platform verifies the network card's certificate, and the platform sends the encrypted session key.

[0046] Specifically, the robot identity is compared with the preset platform whitelist of the operation and maintenance platform for verification.

[0047] It can be understood that hardware certificate verification is to verify the legitimacy of the physical network card device, and the verification is initiated by the operation and maintenance platform. Platform certificate verification is to verify the authenticity of the operation and maintenance server identity, and the verification is initiated by the encryption network card.

[0048] As one of the outstanding essential features of the present invention, by establishing a temporary VPN tunnel through two-way authentication between the secure communication component and the operation and maintenance platform, the security of the upgrade is improved. In addition, by utilizing public network resources, there is no need to lay dedicated lines, and the cost of the secure communication component is low, which further reduces the upgrade cost.

[0049] In some embodiments, the secure handshake protocol can be IPSec (Internet Protocol Security), and identity authentication is performed between the operation and maintenance platform and the secure communication component through digital authentication or a preset shared key. Keys for encryption and authentication are generated through IKE (Internet Key Exchange), and the operation and maintenance platform and the secure communication component establish a security association for subsequent IPsec communication.

[0050] Optionally, in step 2, a temporary VPN tunnel is established with the operation and maintenance platform through the secure communication component, including: A pre-shared key is pre-written in the operation and maintenance platform and the secure communication component, and the operation and maintenance platform establishes a temporary VPN tunnel with the secure communication component through the pre-shared key.

[0051] In this embodiment, the same pre-shared key is written in advance in the secure communication component and the operation and maintenance platform, which is simple to implement. However, the risk of key leakage is high, and it cannot resist replay attacks. The security is not as high as the method of data interaction through a secure handshake protocol.

[0052] In some embodiments, engineers can plug an industrial-grade encrypted network card into the Type-C debugging port of the robot control cabinet. The industrial-grade encrypted network card can have an IP (International Protection) rating of 67.

[0053] In some embodiments, existing commercial network cards can be modified in both hardware and software. To meet the requirements of live distribution network operations, commercial network cards need to be modified in both hardware and software, and customized development based on commercial network cards is carried out, specifically including the following: 1) Physical Layer Characteristics: It uses a non-standard 8-pin M12-X encoding interface and separates the power and data pins. Pins 1-4 can be set to 24V for power supply, and pins 5-8 can be set to differential signals for data transmission.

[0054] In this embodiment, the encryption network card supports IP67 protection level and -40℃~85℃ operating temperature, which reduces the failure rate by 89% compared with the traditional M12 interface, and meets the requirements of harsh environments such as high humidity and strong electromagnetic interference in substations.

[0055] As one of the outstanding substantive features of the present invention, a non-standard 8-pin M12-X coding interface is adopted, and the power supply and data pins are separated. The failure rate in the high-humidity environment of the substation is lower than that of the traditional M12 interface, and the anti-electromagnetic interference transmission success rate is higher, which further improves the efficiency and success rate of version upgrades.

[0056] 2) Protocol layer and physical layer characteristics: A private handshake protocol is designed. When the network card is connected, it sends a specific wake-up sequence to the operation and maintenance platform. If the network card does not receive a correct response from the operation and maintenance platform, the communication is rejected.

[0057] The operation and maintenance platform needs to confirm the legitimacy of the network card to prevent counterfeit devices. The network card needs to confirm platform authorization to prevent illegal server access. Both parties dynamically generate session keys through the IKEv2 four-way handshake for key negotiation to avoid the risk of static key leakage.

[0058] As one of the outstanding substantive features of the present invention, by optimizing the handshake protocol, the six interactions of the standard IKEv2 are compressed to four, unnecessary SA (Security Association) payloads are deleted, and common parameter combinations are preset, such as setting DH (Diffie-Hellman) to group 14 and a key length of 256 bits, which can reduce negotiation time by 30%.

[0059] (3) Identify unauthorized connector insertion through changes in capacitance between pins, and erase the key storage area when forcibly disassembled.

[0060] It's important to note that the capacitance detection point is located at the network card interface, not inside the robot. The detection target is the network card itself, not the robot. Legitimate hardware is identified by measuring the capacitance matrix between the card pins. This design prevents attackers from using ordinary network cards for impersonation, as counterfeit cards cannot accurately replicate the capacitance characteristics.

[0061] The protection against violent disassembly is bidirectional. The network card's self-destruct chip erases its own key and simultaneously triggers the robot to clear the temporary session key via a GPIO signal. This design ensures that even if the network card is forcibly disassembled, attackers cannot obtain the valid key.

[0062] The key storage strategy utilizes a hierarchical design: the network card's eSE (embedded Secure Element) chip stores long-term identity keys, while the robot's secure enclave stores only session keys. This architecture addresses temporary connection requirements while ensuring that core keys never leave the hardware's secure environment. A dynamic calibration mechanism using a capacitance matrix is used to identify unauthorized connectors. During each authentication, the network card sends a specific stimulus signal, and the robot measures the response waveform and compares it to pre-stored signatures. Due to physical variations in PCB material and trace spacing, the capacitance response error rate of counterfeit network cards can be as high as 12%, while the error rate of authorized products is as low as 0.3%.

[0063] Preferably, but not limited to, the edge agent service starts a self-check program to check whether each component of the robot is in an upgradeable state, including: The edge proxy service reads the robot's memory usage and calculates the available space; The edge proxy service obtains the average load of the robot CPU within a preset time period; The edge proxy service checks the remaining capacity of the robot storage partition; The edge proxy service obtains status data of various robot components, including arm joint temperature, encoder feedback deviation, leakage current, power supply charging status, power supply bus ripple, ambient temperature, and ambient humidity; If the available space, average load, remaining capacity of the storage partition, and status data of each component all meet the preset logic, the component is in an upgradeable state.

[0064] Specifically, the robot components include: core control unit, robotic arm subsystem, insulation detection module, BMS (Battery Management System), and auxiliary subsystem.

[0065] In some embodiments, the specific self-test process is as follows: First, check the hardware resources. This includes: reading / proc / meminfo to obtain memory usage and calculate available space; using the mpstat command to collect the average CPU load over 5 seconds; and checking the remaining capacity of the storage partition. The upgrade can only be performed if the remaining capacity of the storage partition is greater than or equal to twice the software package size.

[0066] Next, a key subsystem status scan is performed. This includes: sending a CANopen SDO Read command to obtain joint temperature. For example, the joint temperature of the corresponding robot arm can be read through object dictionary index 0x3001; performing a zero reset to detect encoder feedback deviation; performing an insulation test, triggering self-test mode, and measuring leakage current. This can be converted from the AD sampling value, applying a 1kV test voltage, and monitoring the fluctuation amplitude over 10 seconds; reading the BMS's 0x6A message to obtain the SOC (State of Charge) and collecting the power bus ripple. Upgrade is possible when the peak value is ≤100mV; and performing an environmental adaptability test, including temperature sensor reading and humidity testing. Programming can only be initiated when the temperature is within the -40°C to 85°C range and the relative humidity is less than 85%. Finally, a self-test report is generated.

[0067] In some embodiments, the preset logic is set based on security isolation requirements, real-time requirements, and compliance constraints. The security isolation requirement is that the robot is offline and cannot rely on the cloud for status verification. The real-time requirement is that the hardware status, including but not limited to battery power and memory usage, must be confirmed before the upgrade. Delayed detection may cause the upgrade to be interrupted. The compliance constraint is that the "Electric Power Monitoring System Safety Protection Regulations" require local execution of key status checks.

[0068] It is understandable that those skilled in the art can set the specific range of the preset logic according to actual applications, and this embodiment does not limit this.

[0069] In this embodiment, a self-check program is started through the edge proxy service to automatically check whether the various components of the robot are in an upgradeable state to ensure that the upgrade conditions are met before the upgrade is performed, without the need for manual inspection, thereby improving the success rate and efficiency of the upgrade.

[0070] Step 3: When the components of the target robot are in an upgradeable state, the secure communication component receives the instruction set through a temporary VPN tunnel. After the signature and configuration file parameter range of the target software package are double-checked and passed, the target software package is downloaded to the security sandbox in the target robot according to the instruction set. The components of the target robot are controlled to obtain the target software package upgrade from the security sandbox according to the upgrade sequence in the upgrade instruction set.

[0071] Step 3.1: When the target robot components are in an upgradeable state, the secure communication component collects the instruction set issued by the operation and maintenance platform through a temporary VPN tunnel. The edge proxy service decrypts the instructions in the instruction set and converts them into robot control bus upgrade instructions.

[0072] Specifically, the operation and maintenance personnel select the target robot on the operation and maintenance platform, the task scheduling module generates a JSON format instruction set, the encrypted network card receives the instruction set through the VPN tunnel, and the edge proxy service decrypts and converts it into a format recognized by the robot control bus.

[0073] Step 3.2: The robot-side execution unit verifies the version of the target software package. If the verification passes, the target software package is downloaded to the security sandbox according to the upgrade sequence in the control bus upgrade instruction.

[0074] Specifically, after the encryption network card receives the command, the edge proxy service downloads the software package to the security sandbox according to priority. The version verification module performs a three-level digital signature chain verification, verifies the digital signature and the configuration file parameter range, and stores the verified software package in the security sandbox. The configuration file parameters include the robot arm angle threshold. In some embodiments, a virtual machine, such as VMware Virtual Box, may be used to implement a secure sandbox environment. A container, such as Docker, may also be used to implement a secure sandbox environment.

[0075] It is understandable that the security sandbox is only an isolated execution environment during the upgrade process and does not store complete file copies.

[0076] As one of the outstanding essential features of the present invention, by downloading the target software package to a secure sandbox, the sandbox environment and the host system can be effectively isolated, making it impossible for malicious code to break through the isolation layer to attack, thereby further improving the security of the upgrade.

[0077] Preferably, but not restrictively, the target software package is split into multiple independent upgrade units according to functional modules, such as robotic arm control, visual processing, and insulation detection, and a dependency graph is constructed. A directed acyclic graph is constructed based on the dependency graph, and the traversal order of the directed acyclic graph is used as the upgrade order.

[0078] Preferably, but not limited to, the upgrade sequence is dynamically adjusted according to the importance of components and the real-time status of the target robot.

[0079] The real-time status of the target robot includes battery power and CPU load. The importance of components is pre-set. In some embodiments, the order of importance of components is communication module > robot controller > insulation detection module.

[0080] Step 3.3: The robot-side execution unit starts the multi-threaded upgrade engine, assigns upgrade tasks according to the upgrade sequence in the instruction set, controls the target robot components to obtain the target software package upgrade from the security sandbox, and monitors each upgrade thread.

[0081] The robot-side execution unit starts the multi-threaded upgrade engine, including: initializing the task queue of the multi-threaded upgrade engine; creating multiple independent threads, and the independent threads include the robotic arm, communication module, etc.

[0082] Preferably, but not restrictively, before the target robot is upgraded, the firmware of each component in the target software package is preloaded into the double buffer of the security sandbox. The double buffer includes a preparation buffer and an active buffer. The preparation buffer is used to preload the encrypted software package fragment, and the active buffer is used to execute the current fragment burning. The double buffer performs atomic switching when the fragment burning is completed.

[0083] It is understandable that the double buffer is a dynamic memory management structure within the security sandbox, which can be designed as a pipeline acceleration structure. For example, a 128KB allocated swap area is a non-persistent storage. The double buffer only stores temporarily decrypted shard data, and the complete version package is persistently stored in an independent encrypted partition. The buffer is automatically erased after the upgrade is completed.

[0084] In this way, preloading can reduce the IO waiting time during the upgrade process.

[0085] Preferably, but not limitatively, a watchdog timer is started, a timeout threshold is set, and each upgrade thread is monitored by the watchdog timer.

[0086] Preferably, but not restrictively, when a global task timeout is monitored, all threads are immediately paused, a pause instruction is sent to each component, each component records the current upgrade progress, and releases resources; when a component-level operation timeout is monitored, the current timed-out component is isolated and rolled back to the last valid version.

[0087] Furthermore, if a global task timeout occurs during the commit phase, a global rollback is performed, specifically by switching to the backup partition and restarting the robot to safe mode.

[0088] It should be noted that global tasks in the upgrade system refer to top-level operations that span multiple modules and require coordinated completion. These include pre-upgrade environment preparation, such as encrypted network card authentication; core upgrade processes, such as software package transfer, verification, and flashing; and post-upgrade processing, such as status synchronization and auditing.

[0089] Taking the robotic arm controller as an example, it uses dual firmware partitions, A / B. Partition A contains the running version, and partition B contains the rollback version. A rollback only switches the partition pointer, eliminating the need for a full disk wipe. If a robotic arm rollback causes incompatibility with other components, the vision system is automatically downgraded to a compatible version, logging a dependency conflict and prompting a synchronization requirement for subsequent upgrades.

[0090] It should be noted that resource release includes: unloading uncommitted software packages loaded into memory and releasing distributed task locks.

[0091] Isolate the currently timed-out component, including: marking the component as "isolated state" in the device management table, closing the corresponding communication interface, and partially rolling back to restore the last valid version of the component from the security sandbox.

[0092] Furthermore, if the data transmission times out, such as network packet loss, the last 128KB data block is retransmitted for a maximum of three times. If failure occurs, a global rollback is triggered.

[0093] Preferably, but not limitatively, the current upgrade task obtains a distributed task lock before the upgrade, and uses the distributed task lock to lock the target robot component corresponding to the current upgrade task.

[0094] In some embodiments, a distributed lock Redis Redlock is used to ensure that the same component is not operated by multiple tasks at the same time, reduce the risk of upgrade failure caused by resource conflicts, and improve the success rate and efficiency of the upgrade. Preferably, but not restrictively, the method also includes: when the operation and maintenance platform simultaneously issues upgrade tasks to multiple target robots, an asynchronous non-blocking I / O model is adopted, and the target robots synchronously upgrade different components through a thread pool, each thread has an exclusive communication channel, and an independent memory sandbox is allocated for each upgrade task.

[0095] In some embodiments, the operation and maintenance platform can support greater than or equal to 500 concurrent connections, and the thread pool defaults to 4 threads.

[0096] In this embodiment, by allocating an independent memory sandbox to each upgrade task, the spread of memory leaks can be prevented.

[0097] Preferably, but not limited to, pipeline parallelism is utilized to perform upgrades of multiple different components simultaneously.

[0098] In some embodiments, while Robot A is upgrading its robotic arm, Robot B is also upgrading its power module. This automated task dispatching and parallel upgrade mechanism allows for batch upgrades of multiple robots, shortening the upgrade process and reducing ineffective waiting time, thereby improving upgrade efficiency.

[0099] Step 3.4: If the verification in step 3.2 fails, all download threads are suspended, the security sandbox memory space is frozen, the downloaded target software package is deleted, and the temporary VPN tunnel configuration is automatically cleared to disconnect the temporary VPN tunnel.

[0100] In some embodiments, if a verification error occurs, the device is immediately terminated and isolated, all download threads are suspended, sandbox memory is frozen, downloaded encrypted package fragments are deleted, a hardware watchdog is triggered to reset the encryption network interface, the temporary VPN tunnel is disconnected, the session key is cleared, a snapshot of the error context is saved to WORM (Write Once Read Many) storage, a visual report is generated, and the abnormal device is marked as "high risk" on the operation and maintenance platform. In this way, WROM ensures data integrity and immutability.

[0101] In some embodiments, a manual intervention process may be used, for example, an alarm may be sent to an engineer's PDA (Personal Digital Assistant) through an emergency channel of an encrypted network card. Step 4: The robot-side execution unit monitors the status of each upgrade thread and each component in real time, periodically reports to the operation and maintenance platform, and records the operation log in the audit log module.

[0102] Specifically, the status collector monitors the status of each upgrade thread in real time, collecting progress every 200ms. Abnormal events trigger context snapshots. The audit log module generates an upgrade summary based on the operation log and transmits it back to the operations and maintenance platform via an encrypted network interface card.

[0103] Specifically, when a hardware failure occurs, such as an overheated robotic arm motor or abnormal battery voltage, all upgrade tasks are immediately suspended, component power is cut off, audible and visual alarms are activated, a repair work order is generated, and pushed to the operation and maintenance platform. When a software error occurs, such as a digital signature verification failure or a configuration file parameter out of bounds, the abnormal module is isolated, rolled back to the previous trusted version, the security sandbox is locked, and the automatic repair process in step 5 is initiated. When a communication problem occurs, such as a CAN bus interruption or heartbeat packet loss, the physical interface is reset, the backup communication channel is switched, the lost data packets are retransmitted, and a communication quality report is generated.

[0104] Taking the robotic arm controller as an example, a rollback is triggered when any of the following conditions are detected: Firmware signature verification failed, joint position error within the control cycle is continuously greater than 2°, or the safety watchdog timed out.

[0105] It should be noted that the backup communication channel is a redundant path at the physical layer, for example, switching to RS485 when a CAN bus fails. Preferably, but not limited to, structured logs and error context association technology are used to make fault information computable, replacing manual log reading. This reduces the mean troubleshooting time from 11 hours to 47 minutes, supporting component-level rollback operations.

[0106] Preferably, but not limitatively, the method further comprises: before each upgrade, independently storing partitions in each component and saving snapshots.

[0107] Taking a robotic arm controller as an example, a snapshot includes the component's corresponding firmware image, configuration file, and calibration data. The firmware image contains the current version of the robotic arm, while the configuration file includes joint parameters and PID control coefficients. Calibration data includes encoder zero position and force sensor reference value.

[0108] Furthermore, Linux dm-verity is used to ensure snapshot integrity.

[0109] Step 5: After the upgrade is complete, the VPN temporary tunnel configuration will be automatically cleared to release the security sandbox memory space. After unplugging the secure communication component, the robot will be triggered to restore to a state without external network connection and wait for the next upgrade task.

[0110] Preferably, but not limitatively, the method further comprises: triggering an integrity check of the target robot after the secure communication component is unplugged, and executing a graded recovery strategy according to the severity level of the integrity check result when the integrity check fails.

[0111] In some embodiments, severity levels include: critical exception, emergency exception, critical exception, warning exception, and caution exception. A critical exception includes system file tampering; an emergency exception includes invalid firmware signature; a warning exception includes configuration parameter out of bounds; and a caution exception includes resource usage exceeding limits.

[0112] When a severe exception occurs, the circuit breaker is activated, the system restarts in read-only recovery mode, mounts the backup partition, automatically repairs the system, pulls damaged files from the trusted image server, performs incremental repairs, isolates the system securely, marks the faulty storage partition as "untrusted", and disables all non-essential services.

[0113] Taking the robotic arm controller as an example, the incremental repair is to roll back only the components related to the robotic arm controller. Specifically, the old version of the firmware is loaded from the snapshot partition, the firmware activation command is sent through the CAN bus, and the calibration parameters are reloaded.

[0114] It should be noted that the read-only recovery mode is a special state specifically used for system repair. It mounts the read-only root file system and prohibits any write operations to prevent further damage.

[0115] It should be noted that an independent storage area is opened in the robot as a backup partition to save the last stable version that has been fully verified.

[0116] It should be noted that the trusted mirror server is a secure storage node of the operation and maintenance platform, storing original files. File corruption usually occurs when the storage medium on the robot side is abnormal, rather than during the transmission process, because the transmission process has been encrypted and verified by SM4.

[0117] When an emergency-level exception occurs, the hardware-level circuit is blown, the encryption network card key and temporary files in the security sandbox are securely erased, and the double verification of the signature and configuration parameter range in step 3.2 is performed.

[0118] When a warning-level exception occurs, the most recent valid value is retrieved from the historical compliance configuration library, and a parameter modification confirmation request is generated and pushed to the operation and maintenance platform for prompting.

[0119] As you can understand, integrity checks include configuration parameter verification, comparing them against safety thresholds in the device compatibility matrix. Integrity checks also include parameter relevance verification. For example, when the robot arm's angle parameters change, the calibration parameters of the vision system are checked to ensure they match.

[0120] When an attention-level exception occurs, non-core resources are released, resource recycling plans are triggered, zombie processes are terminated, and temporary files are cleaned up.

[0121] In this embodiment, the robot can be restored to a safe operating state more quickly through a hierarchical recovery strategy.

[0122] What is significantly different from the prior art is that the update is manually updated through mobile storage media or directly updated using a dedicated engineering computer. The present invention uses a secure communication component, which no longer requires operation and maintenance personnel to use USB flash drives, mobile hard disks and other devices to download a specific version of the software package on the operation and maintenance platform and manually copy it to the storage medium, carry it to the work site and insert it into the robot control interface. There is no need for operation and maintenance personnel to operate the robot's local control panel, enter the system maintenance menu step by step, select the upgrade package in the external storage device and start the installation program. There is also no need to configure a reinforced laptop computer loaded with a dedicated upgrade program, which is directly connected to the debug port of the robot control cabinet via a physical network cable. Engineering personnel do not need to perform network initialization operations such as IP address configuration and firewall policy adjustment on site before transferring the software package through the FTP protocol.

[0123] Therefore, the risk of accidentally touching the emergency stop button and causing system crashes due to touch screen operations when the robot is powered on is avoided, and the risk of abnormal shaking of the robotic arm and damage to the lidar module due to incorrect operations is avoided, thereby reducing the risk of human-computer interaction. In addition, the version is managed through the device compatibility matrix table to avoid the situation where engineers use untested temporary versions and cannot track problems, resulting in difficulty in version tracing. Moreover, when multiple robots in the same station room need to be upgraded, there is no need to perform media insertion and installation operations one by one, which improves the efficiency of collaborative upgrades of multiple devices.

[0124] By using an IP67-rated encrypted network card, the system maintains good contact with the robot interface even in poor field conditions, improving the upgrade success rate. Furthermore, the present invention only requires operators to select the target robot and target software to complete the upgrade with one click, requiring minimal technical expertise from the operator.

[0125] Embodiment 2 of the present invention provides a device for upgrading the software version of a distribution network robot, which runs the method for upgrading the software version of a distribution network robot as described in embodiment 1. The device includes: The software version release and encryption module is used to encrypt the target software package in blocks, attach a digital signature, and generate an instruction set containing the upgrade sequence; The secure networking module is used to insert the secure communication component into the corresponding interface of the target robot, trigger the secure handshake protocol, establish a temporary VPN tunnel between the secure communication component and the operation and maintenance platform through the secure handshake protocol, and check whether the various components of the target robot are in an upgradeable state; The upgrade module is used to determine whether the components of the target robot are in an upgradeable state. The secure communication component receives the instruction set through a temporary VPN tunnel, performs a double verification of the signature and configuration file parameter range of the target software package, and then downloads the target software package to the security sandbox in the target robot according to the instruction set. According to the upgrade sequence in the upgrade instruction set, the components of the target robot obtain the target software package from the security sandbox for multi-threaded upgrade; The recovery module is used to automatically clear the VPN temporary tunnel configuration after the upgrade is completed, release the security sandbox memory space, and trigger the robot to recover to the state without external network connection after unplugging the security communication component, waiting for the next upgrade task.

[0126] Combine Figure 2 As shown, Figure 2 This is a schematic diagram of the system architecture of an application scenario provided by an embodiment of the present invention. Figure 2 As shown in the figure, the system architecture includes an operation and maintenance platform, a secure communication component, a robot-side execution unit, and an audit log module. The operation and maintenance platform sends an encrypted software package to the secure communication component. After receiving the software package, the secure communication component establishes a temporary VPN tunnel with the robot-side execution unit to perform software upgrades on various robot components. The robot-side execution unit records the operation log and transmits it to the audit log module. The audit log module stores the operation date, triggers the robot-side execution unit to perform an integrity check, and uploads the audit report to the operation and maintenance platform through the secure communication component.

[0127] Operation and maintenance personnel can select the software packages and corresponding robot components that need to be upgraded through the operation and maintenance platform. The operation and maintenance platform can perform software and hardware matching checks on the software packages and corresponding robot components selected by the user to determine whether the software packages selected by the user are compatible with the corresponding robot components.

[0128] Figure 3 As shown, the operation and maintenance platform includes a version repository module, a device management module, and a task scheduling module. The version repository module stores software packages and their history of version iterations. The device management module stores the binding relationship between robot serial numbers and hardware configurations. Before issuing upgrade tasks, the device management module automatically matches the target device's hardware capabilities with the software package requirements. The task scheduling module generates an upgrade instruction sequence with a priority policy for the upgrade device selected by the operation and maintenance personnel.

[0129] Specifically, the version repository module stores software packages encrypted using SM4-CBC mode and X.509 standard digital signature files, maintaining a historical map of version iterations. When developers upload compiled software packages, the encryption pipeline is automatically triggered, and version dependencies are managed through a hash tree structure to ensure compatibility between the upgrade package and the robot firmware version. The device management module can establish a binding relationship between the robot serial number and the hardware configuration. Before the upgrade task is issued, it can automatically match the hardware capabilities of the target device with the software package requirements. The task scheduling module can generate an upgrade instruction sequence that includes a priority strategy. After the operation and maintenance personnel select the target device, the upgrade order is automatically arranged, and rollback instructions are automatically inserted during exception handling.

[0130] like Figure 3 As shown in the figure, the secure communication components include an industrial-grade encrypted network card and an edge proxy service. The industrial-grade encrypted network card is plugged into the robot's interface during an upgrade to transmit the software package to the robot. The edge proxy service parses the upgrade instructions issued by the operation and maintenance platform and converts the plaintext into messages that can be recognized by the robot's control bus.

[0131] Specifically, the industrial-grade encryption network card is used to establish an offline communication channel between the operation and maintenance platform and the robot end that complies with the "Electric Power Monitoring System Security Protection Regulations". After being inserted into the robot's Type-C interface, it automatically performs two-way authentication and uses fragmented encryption transmission technology to split the software package into 128KB data blocks and encrypt them separately.

[0132] The edge proxy service can convert Modbus-TCP to MQTT (Message Queuing Telemetry Transport), parse the JSON-formatted instruction set issued by the platform, listen to the specific port 1883, decrypt and convert encrypted instructions into CAN messages recognized by the robot control bus, cache status data in an offline environment, and upload it in batches after communication is restored.

[0133] like Figure 3 As shown, the robot-side execution unit includes a version verification module, a multi-threaded upgrade engine, and a status collector. The version verification module verifies the integrity and compliance of the software package. After decrypting the software package, it verifies the digital signature chain level by level and performs parameter range checks on the configuration file. The multi-threaded upgrade engine enables parallel programming and progress synchronization of multiple components, creating independent thread pools to handle firmware updates for modules such as the robotic arm controller and insulation detection. The status collector monitors the upgrade process in real time and reports status in a structured manner. It collects progress indicators for each component in a 200ms cycle and captures context snapshots when an anomaly is detected.

[0134] The audit log module is used for full lifecycle operation recording and visual analysis. It uses WORM (Write Once Read Many) storage technology to save original logs to prevent subsequent tampering and automatically generates interactive upgrade reports.

[0135] Through the embodiments of the present application, a temporary VPN tunnel is established with the operation and maintenance platform via a secure communication component during an upgrade. This not only solves the problem of strong dependence on dedicated engineering computers and poor environmental adaptability, but also reduces hardware procurement and maintenance costs due to the low cost of the secure communication component. Furthermore, the secure communication component receives the encrypted software package issued by the operation and maintenance platform and performs software compatibility matching based on the hardware version before issuing it. This eliminates the risk of version mismatches caused by manually carrying storage media, reduces the risk of equipment damage caused by misoperation, and improves upgrade efficiency and success rate.

[0136] Regarding the system in the above embodiment, the specific manner in which each unit performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0137] Embodiment 3 of the present invention provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is loaded into the processor, the method for upgrading the software version of a distribution network robot described in embodiment 1 is implemented.

[0138] Embodiment 4 of the present invention provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements a method for upgrading the software version of a distribution network robot according to embodiment 1.

[0139] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0140] The present disclosure may be a system, method and / or computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present disclosure.

[0141] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered by the scope of protection of the claims of the present invention.

Claims

1. A method for upgrading the software version of a distribution network robot, characterized in that: The following steps are involved: The operation and maintenance platform encrypts the target software package in blocks, adds a digital signature, and generates an instruction set containing the upgrade sequence; Insert the secure communication component into the corresponding interface of the target robot, trigger the secure handshake protocol, establish a temporary VPN tunnel between the secure communication component and the operation and maintenance platform through the secure handshake protocol, and check whether all components of the target robot are in an upgradeable state; When all components of the target robot are in an upgradeable state, the secure communication component receives the instruction set through a temporary VPN tunnel. After the signature and configuration file parameter range of the target software package are double-checked and passed, the target software package is downloaded to the secure sandbox in the target robot according to the instruction set. Then, according to the upgrade sequence in the upgrade instruction set, the components of the target robot are controlled to obtain the target software package from the secure sandbox for multi-threaded upgrade. After the upgrade is complete, the VPN temporary tunnel configuration will be automatically cleared to release the security sandbox memory space. After unplugging the security communication component, the robot will be triggered to restore to a state without external network connection and wait for the next upgrade task.

2. The method for upgrading the software version of a distribution network robot according to claim 1, characterized in that: The additional digital signature includes: A three-level digital signature chain consisting of a development certificate signature, a test certificate signature, and a production certificate signature is attached in sequence; and when any level of the digital signature chain fails verification, a fuse rollback mechanism is triggered; otherwise, the verified software package block is downloaded to the security sandbox, where the fuse rollback mechanism is stored in the instruction set.

3. The method for upgrading the software version of a distribution network robot according to claim 1, characterized in that: The method further comprises: The operation and maintenance platform encrypts the target software package in blocks and adds a digital signature. It then updates the device compatibility matrix in the version repository. The device compatibility matrix indicates the applicable robot hardware model, the minimum firmware version requirements for each robot component, and the configuration file parameter range threshold of the software package. Perform hardware model matching verification and firmware version verification on the target robot based on the device compatibility matrix table; perform configuration file parameter range verification based on the device compatibility matrix table.

4. The method for upgrading the software version of a distribution network robot according to claim 1, characterized in that: The version dependencies are managed through a hash tree structure. The hash value of the hash tree root node of each version is stored in the device compatibility matrix table. The hash value of the root node of the version is obtained from the device compatibility matrix table to verify whether the target software meets the dependency.

5. The method for upgrading the software version of a distribution network robot according to claim 1, characterized in that: The method further comprises: Perform two-way authentication between the secure communication component hardware certificate and the operation and maintenance platform certificate; specifically: The operation and maintenance platform verifies the hardware certificate of the secure communication component and sends a temporary access token containing the operation and maintenance platform certificate to the secure communication self-test after the verification is passed; After the secure communication component verifies the temporary access token sent by the operation and maintenance platform, a temporary VPN tunnel is established between the operation and maintenance platform and the secure communication component, and a session key is generated according to the device serial number of the secure communication component.

6. The method for upgrading the software version of a distribution network robot according to claim 1, characterized in that: Check whether all parts of the robot are in an upgradeable state, including: Read the robot's memory usage and calculate the available space based on the content usage; Obtain the average load of the robot CPU within a preset time period, the remaining capacity of the storage partition, and the status data of each component; If the available space, average load, remaining capacity of the storage partition, and status data of each component all meet the preset logic, the component is in an upgradeable state.

7. The method for upgrading the software version of a distribution network robot according to claim 1, characterized in that: The method further comprises: Monitor the multi-threaded upgrade process, specifically: When the global task timeout is detected, all upgrade threads are paused, each component records the current upgrade progress, and resources are released; When a component-level operation timeout is detected, the current timed-out component is isolated and rolled back to the last valid version. When monitoring detects a global task timeout during the software submission process, a global rollback is performed.

8. The method for upgrading the software version of a distribution network robot according to claim 1, characterized in that: The method further comprises: When the secure communication component is unplugged, the target robot integrity check is triggered. If the integrity check fails, a hierarchical recovery strategy is executed according to the severity level of the integrity check result.

9. The method for upgrading the software version of a distribution network robot according to claim 1, characterized in that: Before the target robot is upgraded, the firmware of each component in the target software package is preloaded into the double buffer of the security sandbox. The double buffer includes a preparation buffer and an active buffer. The preparation buffer is used to preload the encrypted target software package fragments, and the active buffer is used to execute the current fragment burning. The double buffer performs atomic switching when the fragment burning is completed.

10. A device for upgrading the software version of a distribution network robot, characterized in that: include: The software version release and encryption module is used to encrypt the target software package in blocks, attach a digital signature, and generate an instruction set containing the upgrade sequence; The secure networking module is used to insert the secure communication component into the corresponding interface of the target robot, trigger the secure handshake protocol, establish a temporary VPN tunnel between the secure communication component and the operation and maintenance platform through the secure handshake protocol, and check whether the various components of the target robot are in an upgradeable state; The upgrade module is used to determine whether the components of the target robot are in an upgradeable state. The secure communication component receives the instruction set through a temporary VPN tunnel, performs a double verification of the signature and configuration file parameter range of the target software package, and then downloads the target software package to the security sandbox in the target robot according to the instruction set. According to the upgrade sequence in the upgrade instruction set, the components of the target robot obtain the target software package from the security sandbox for multi-threaded upgrade; The recovery module is used to automatically clear the VPN temporary tunnel configuration after the upgrade is completed, release the security sandbox memory space, and trigger the robot to recover to the state without external network connection after unplugging the security communication component, waiting for the next upgrade task.

11. An electronic device comprising a processor and a storage medium; characterized in that: The storage medium is used to store instructions; The processor is configured to operate according to the instructions to execute the steps of the method for upgrading the software version of a distribution network robot according to any one of claims 1 to 9.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the method for upgrading the software version of a distribution network robot described in any one of claims 1 to 9 are implemented.

Images