Security configuration synchronization method for gateway equipment and client

Abstract

The invention discloses a security configuration synchronization method for gateway equipment and a client, the client remotely extracts general configuration data of a target source gateway database through a database synchronization upgrade tool, and encrypts and transmits the general configuration data to the client; meanwhile, the client encrypts and transmits the general configuration data to the to-be-upgraded gateway machine, and remotely writes the general configuration data into a to-be-upgraded gateway database through a database synchronization upgrading tool; and the database synchronous upgrading tool is used for realizing connection and management of a gateway database, exporting and importing of database information, and simultaneously realizing encryption of exported data and decryption of imported data. According to the invention, on the premise of ensuring configuration transmission security, efficient and batch synchronization of application configuration among multiple gateway devices can be realized, meanwhile, specific identity information of the target device is intelligently reserved, and operation and maintenance accidents such as device inactivation caused by configuration synchronization are avoided.

Description

Technical Field

[0001] This invention relates to a secure configuration synchronization method and client for gateway devices, used to perform secure, efficient and reliable synchronization configuration between multiple gateway devices, and to retain the specific identity information of the devices during the synchronization process. It belongs to computer communication technology and equipment operation and maintenance management. Background Technology

[0002] As enterprise networks expand, the number of gateway devices deployed within them (such as API gateways, security gateways, and IoT gateways) is increasing. To ensure network policy consistency and security, these gateway devices typically require identical or similar application configurations, such as routing rules, security policies, and access control lists.

[0003] In existing technologies, the main methods for synchronizing the configurations of multiple gateway devices include the following: 1. Manual Configuration: Maintenance personnel configure a single device via a command-line interface or web management interface, then log in to each other gateway device and repeat the same configuration process. This method is extremely inefficient and inevitably introduces errors due to manual operation. It is difficult to guarantee configuration consistency across a large number of devices, and maintenance costs increase linearly with the number of devices.

[0004] 2. Automated Scripting: This method involves writing scripts in languages ​​such as Shell or Python to automatically execute a series of configuration commands. While this method is more efficient than manual methods, it essentially still simulates human input. Writing, debugging, and maintaining these scripts is complex, and when the configuration logic changes, all scripts need to be updated and redistributed, resulting in poor flexibility. Furthermore, the scripts may contain sensitive configuration information in plaintext, posing a security risk.

[0005] 3. Direct Database File Replacement: Since many gateway devices use file-based databases (such as SQLite) to store configurations, a seemingly simple method is to directly copy the entire database file of a configured gateway device and overwrite the corresponding file on other devices. However, this method has several fatal flaws: ① It destroys device uniqueness: Gateway device database files typically store not only general application configurations but also specific identity information and partial configurations, such as device registration information, software licenses, unique serial numbers, and network interface MAC addresses. Directly overwriting the database file will cause these critical information on the target device to be replaced by the source device's information, thus causing the target device to lose its legitimate identity and requiring re-registration or activation with the management platform. This may even lead to the device malfunctioning, causing serious operational accidents. ② It lacks flexibility: It cannot achieve "incremental updates" or "partial synchronization" of configurations. Each synchronization is a crude replacement of the entire database, making it unsuitable for scenarios where only partial configuration synchronization is required.

[0006] Therefore, existing technologies lack a solution that can efficiently and accurately synchronize general application configurations across multiple gateway devices while ensuring security, and at the same time ensure that the individual-specific information of each device remains intact. Summary of the Invention

[0007] Purpose of the invention: In order to overcome the shortcomings of the existing technology, the present invention provides a secure configuration synchronization method and client for gateway devices, which can achieve efficient and batch synchronization of application configurations among multiple gateway devices while ensuring the security of configuration transmission. At the same time, it intelligently retains the specific identity information of the target device to avoid maintenance accidents such as device inactivation caused by configuration synchronization.

[0008] Technical solution: To achieve the above objectives, the technical solution adopted by this invention is as follows: A secure configuration synchronization method for gateway devices is disclosed. The client uses a database synchronization upgrade tool to remotely extract general configuration data from the target source gateway database (filtering and skipping specific configuration data such as gateway device registration information, licenses, and serial numbers), and transmits it to the client in encryption. Simultaneously, the client transmits the general configuration data in encryption to the gateway device to be upgraded. Using the database synchronization upgrade tool, the client remotely writes the general configuration data into the database of the gateway device to be upgraded (without overwriting specific configuration data such as registration information, licenses, and serial numbers). The database synchronization upgrade tool is used to connect to and manage the gateway database, export and import database information, and encrypt exported data and decrypt imported data.

[0009] In this case, after the client establishes communication with the target source gateway, the database synchronization tool automatically connects to its database and executes a structured query. It can export general configuration data, excluding device registration information, based on configuration requirements. The exported data is processed using an encryption algorithm to form an encrypted file, which is then transmitted to the client through a secure channel. When the client forwards the encrypted data to the gateway to be upgraded, the database synchronization tool performs a decryption operation and parses the data content, writing the configuration data to the target database through a database transaction mechanism. During the writing process, a field comparison mechanism can be used to skip device characteristic fields, updating only the general configuration-related data tables.

[0010] Compared to existing technologies, traditional database file replacement methods overwrite device uniqueness fields. This solution, however, utilizes field filtering and selective write mechanisms to fully preserve the target device's registration information and license data while achieving configuration synchronization. Compared to the risks of transmitting sensitive configurations in plaintext using scripts, this solution employs a layered encryption system to build an end-to-end secure channel, effectively preventing data interception and cracking during transmission. Therefore, this solution can securely and efficiently synchronize application configurations between gateway devices, avoiding system failures caused by accidental overwriting of device identity information. Simultaneously, the encrypted transmission mechanism eliminates the risk of configuration data leakage, the field filtering function ensures that synchronization operations do not damage individual device characteristics, and the database transaction mechanism guarantees the atomicity and rollbackability of the configuration write process.

[0011] Specifically, the database synchronization and upgrade tool is natively compiled for gateway devices with different CPU architectures; the binary file of the database synchronization and upgrade tool compiled for a specific CPU architecture, the dependent shared libraries, environment configuration and execution script are packaged into an independent .tar.gz compressed archive file, and the compressed archive file is named according to the CPU architecture.

[0012] Native compilation refers to the executable binary file generated directly for the CPU architecture of the gateway device. Specifically, it can be done using a cross-compilation toolchain or in a development environment with the same CPU architecture as the gateway device, such as using the GCC compiler to generate the corresponding binary file for the ARM64 architecture. Native compilation ensures that the database synchronization upgrade tool is fully compatible with the instruction set of the gateway device, avoiding runtime errors caused by architecture differences.

[0013] The .tar.gz compressed archive file refers to a compressed package containing compiled binary files, shared libraries, environment configurations, and executable scripts. Specifically, the tar command combined with the gzip algorithm can be used to generate the compressed package. This compression method preserves file permission structure, facilitating rapid decompression and deployment on the target device to form a complete toolchain runtime environment. Naming the compressed archive file according to CPU architecture means using the architecture identifier as part of the filename; for example, naming the ARM64 architecture compressed package sync_tool_arm64.tar.gz. This naming convention establishes a mapping relationship between architecture and resource packages, allowing clients to quickly match the corresponding toolchain based on the target device's architecture.

[0014] Compared to existing technologies, traditional automated scripting methods do not consider compatibility issues across different CPU architectures. The same script may fail to execute on x86 and ARM architecture devices due to instruction set incompatibility. Direct database file replacement cannot distinguish between general configurations and device-specific data, posing a risk of compromising device uniqueness. This solution ensures native execution capabilities of the tool across various architectures through native compilation and provides complete toolchain encapsulation through independent compressed packages, avoiding deployment failures due to missing runtime dependencies on target devices. It achieves seamless toolchain compatibility across CPU architecture gateway devices, ensuring that the database synchronization upgrade tool can correctly perform configuration synchronization operations on different hardware platforms. Furthermore, through compressed package encapsulation and naming rules, it simplifies the management and invocation process of multi-architecture resources, allowing clients to support configuration synchronization needs of heterogeneous device clusters without pre-installing multiple versions of the tool.

[0015] Specifically, compressed archive files are integrated as resource files into the client's project.

[0016] The resource file refers to a pre-compiled compressed archive file embedded as a resource file within the client program installation package. Specifically, this is achieved by writing the resource file into the executable file during the compilation phase using build tools. Its purpose is to eliminate dependence on external storage media and achieve unified version management. When the client runs, it identifies the CPU architecture of the target gateway device and directly matches the corresponding compressed archive file from the local resource library. For example, when an ARM64 architecture is detected, a compressed package named `sync_tool_arm64.tar.gz` is automatically selected. This compressed package is loaded into a temporary working directory using memory decompression technology, completely restoring the binary executable files, dynamic link libraries, configuration files, and script files required for the toolchain to run. This method avoids the network latency or file corruption risks that may occur when downloading toolkits from external servers in traditional solutions, while a resource signature verification mechanism ensures a strict match between the toolchain version and the client program.

[0017] Specifically, SCP establishes a connection between the client and the gateway device, and the SCP connection can use authentication measures such as SSH keys to avoid transmitting sensitive information in plaintext.

[0018] In this case, when the client establishes a connection with the gateway device, it first completes authentication via the SSH key exchange mechanism, without transmitting sensitive information such as passwords or tokens. After successful authentication, an encrypted transmission channel is established based on the SCP protocol, and all transmitted configuration files and tool files are transmitted encrypted through this channel. For example, when the client transmits an encrypted configuration file to the gateway device, the file content is encapsulated in an SSH encrypted data packet, making it impossible to decrypt the original content even if the data packet is intercepted. Simultaneously, the key authentication mechanism prevents man-in-the-middle attacks, ensuring that only clients possessing the legitimate private key can establish a connection with the gateway device.

[0019] Specifically, the method includes the following steps: S1. Develop a database synchronization and upgrade tool that supports cross-platform and multi-architecture compatibility. Its core functions include database connection and management, data migration and security configuration, and it is natively compiled for gateway devices with different CPU architectures. Specifically, it can be implemented using a cross-platform program based on the libpq and SQLite3 libraries. S2, Client-side tool development includes the following steps: S2-1, Multi-architecture resource packaging: Package the binary files of the database synchronization and upgrade tools compiled for different CPU architectures, the dependent shared libraries, environment configurations and execution scripts into independent .tar.gz compressed archive files, and name the compressed archive files according to the CPU architecture; S2-2, Project Resource Integration: Integrate compressed archive files as embedded resource files into the client's project; S2-3, Runtime Resource Management: When the client runs, it connects to the current gateway device via SCP and identifies its CPU architecture by executing the uname -a command. Then, it extracts the matching compressed archive file from the client's embedded resource file, transmits it to the current gateway device via SCP, and executes decompression and deployment via remote command. S3. Configure the export and encryption process, including the following steps: S3-1 Initialization and Resource Distribution: Start the client and set its SCP connection parameters with the target source gateway. Identify the CPU architecture of the target source gateway through the SCP connection. Based on this, the client extracts the corresponding .tar.gz compressed archive file from the embedded resource files, and transfers the .tar.gz compressed archive file to the temporary directory of the target source gateway through the SCP connection and decompresses it, thus completing the deployment of the toolchain. S3-2, Remote Execution and Data Extraction: The target source gateway executes the decompressed startup script, runs the database synchronization tool through the startup script, connects to the target source gateway database through the database synchronization tool, exports the general configuration data of the target source gateway database and performs encryption operations to generate an encrypted configuration file; S3-3, Backup and Cleanup: Transfer the encrypted configuration file to the PC on the client for backup via SCP connection, while clearing the .tar.gz compressed archive file and decompressed file in the target source gateway, and disconnect the SCP connection between the client and the target source gateway; S4. The configuration synchronization upgrade process includes the following steps: S4-1 Initialization and Resource Distribution: Start the client and set its SCP connection parameters with the gateway to be upgraded. Identify the CPU architecture of the gateway to be upgraded through the SCP connection. Based on this, the client extracts the corresponding .tar.gz compressed archive file from the embedded resources, and transfers the .tar.gz compressed archive file to the temporary directory of the gateway to be upgraded through the SCP connection and decompresses it, thus completing the deployment of the toolchain. S4-2, Encrypted Configuration Transmission: Transmit the encrypted configuration file backed up in the PC to the temporary directory of the gateway to be upgraded via SCP connection; S4-3 Remote Configuration Upgrade: The gateway to be upgraded executes the decompressed startup script, runs the database synchronization tool through the startup script, connects to the database of the gateway to be upgraded through the database synchronization tool, decrypts the encrypted configuration file and writes the decrypted general configuration data into the database of the gateway to be upgraded, and returns the execution result. S4-4. Result Display and Cleanup: Display the execution results on the client, remove the .tar.gz compressed archive file and decompressed file from the gateway to be upgraded, and disconnect the SCP connection between the client and the gateway to be upgraded.

[0020] This solution achieves architectural transparency through a native compilation toolchain, mitigates data leakage using encrypted transmission and local decryption mechanisms, and employs a field filtering strategy to prevent the overwriting of device identification information. Existing technologies cannot maintain the integrity of specific device fields during synchronization; however, this solution achieves selective synchronization of configuration data by pre-setting a filter list during data export and skipping retained fields during data import. This solution solves the problems of poor tool compatibility, high risk of sensitive data exposure, and easy overwriting of device identification information when synchronizing configurations across multiple architecture devices. The cross-platform toolchain enables one-time development for multi-architecture adaptation, reducing operational complexity; encrypted transmission and local execution mechanisms form end-to-end data protection, preventing leakage in intermediate stages; the field filtering strategy ensures that device fingerprint information is not tampered with, maintaining the legitimacy of the network topology. Automatic cleanup of temporary files during the operation process avoids wasted storage space and eliminates security risks caused by file remnants.

[0021] Specifically, the CPU architecture of the gateway includes x86, x86-64, ARM32, ARM64, etc. This solution adapts to various mainstream architectures through native compilation, enabling the synchronization tool to run directly in the native environment of the target device without the need for an intermediate conversion layer, thus ensuring execution efficiency and avoiding the complexity of cross-platform adaptation.

[0022] Specifically, when extracting general configuration data from the target source gateway database, only general configuration data related to application configuration is extracted, and specific configuration data including registration information, license, serial number, network interface, and MAC address are not extracted; when importing general configuration data into the gateway database to be upgraded, specific configuration data is not overwritten.

[0023] The general configuration data related to application configuration in the gateway database refers to a set of parameters directly related to the implementation of specific gateway business functions. This mainly includes the list of downstream devices it connects to and their communication parameters, the target platform and protocol information for data reporting, and the data processing rules and control logic on the edge side. These configurations define the gateway's business behavior and are typically universal within the same project or solution. They include the following specific information: (1) Access device configuration: Device list: Unique identifiers (such as device ID, address code) of the connected slave devices or sensing devices. Communication parameters: Protocol type for communication with downstream devices (e.g., Modbus RTU / TCP, 104, 61850), serial port parameters (baud rate, data bits, stop bits, parity bits), network parameters (IP, port); Data point table: Protocol type for communication with downstream devices (e.g., Modbus RTU / TCP, 104, 61850), serial port parameters (baud rate, data bits, stop bits, parity bits), and network parameters (IP, port).

[0024] (2) Data reporting configuration Platform connection information: Address, port, and URL path of the target cloud platform or data center; Uplink protocol and parameters: The protocol used when communicating with the platform (such as MQTT, HTTP / HTTPS, custom TCP protocol) and its related parameters (such as MQTT Topic, QoS, ClientID; HTTP API key / token). Data format and template: The encapsulation format of the reported data (such as JSON, XML), data template or object model definition.

[0025] (3) Business rules and processing logic configuration: Data preprocessing rules: Rules for data cleaning, filtering, alarm judgment, formula calculation, etc., executed on the edge side.

[0026] Control strategy: Automated control logic, such as linkage control, timed tasks, and PID control loop parameters.

[0027] Storage strategy: duration of historical data storage in local data caching, triggering conditions, etc.

[0028] A secure configuration synchronization client for gateway devices is disclosed. This client establishes a connection with the gateway device via SCP, and sets up a database synchronization and upgrade tool running on the gateway device within the client. The client remotely extracts general configuration data from the target source gateway database and remotely writes the general configuration data into the gateway database to be upgraded. The database synchronization and upgrade tool is used to realize the connection and management of the gateway database, the export and import of database information, and to encrypt the exported data and decrypt the imported data.

[0029] Specifically, the database synchronization and upgrade tool is natively compiled for gateway devices with different CPU architectures; the binary file of the database synchronization and upgrade tool compiled for a specific CPU architecture, the dependent shared libraries, environment configurations, and execution scripts are packaged into an independent .tar.gz compressed archive file, and the compressed archive file is named according to the CPU architecture; the compressed archive file is integrated into the client's project as a resource file.

[0030] Beneficial Effects: Compared with existing technologies, the secure configuration synchronization method and client for gateway devices provided by this invention have the following advantages: 1. High efficiency and accuracy: It achieves complete automation of configuration synchronization. A single encrypted configuration file can be quickly deployed to a large number of similar gateway devices, greatly improving operation and maintenance efficiency and eliminating errors that may be introduced by manual operation, ensuring configuration consistency; 2. High security: The configuration file is always encrypted during transmission and storage, effectively preventing sensitive configuration information from being intercepted during transmission or leaked on the management machine; 3. Intelligence and reliability: Through the "selective synchronization" mechanism, it perfectly distinguishes between general, reusable application configurations and device-specific configurations. Identity information; This fundamentally solves the problem of device inactivation caused by directly replacing database files, ensuring the normal and stable operation of the target device after configuration synchronization; 4. Easy to deploy and use: Complex logic such as decryption and database operations is encapsulated in an independent upgrade tool. Operation and maintenance personnel do not need in-depth database knowledge. They only need to execute simple file transfer and tool run commands to complete complex configuration synchronization, reducing the operation threshold; 5. It has the ability to automatically identify CPU architecture, achieving full architecture compatibility with one operation, greatly improving the adaptability and flexibility of the tool; 6. It establishes a secure cleanup mechanism, automatically removing temporary data after all operations are completed, effectively protecting sensitive information and ensuring environmental security. Attached Figure Description

[0031] Figure 1 A flowchart illustrating the process of developing a database synchronization and upgrade tool; Figure 2 A diagram illustrating the configuration of the export and encryption process; Figure 3 This is a diagram illustrating the configuration of the synchronous upgrade process. Detailed Implementation

[0032] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments.

[0033] A secure configuration synchronization method and client for gateway devices is disclosed, which aims to solve technical problems including but not limited to: 1. How to achieve secure and efficient batch synchronization of gateway device configurations, avoiding inefficiency and errors caused by manual operation; 2. How to avoid overwriting or destroying the specific information inherent in the target gateway device (such as device registration information, license information, serial number, etc.) when synchronizing general application configurations; 3. Providing an integrated solution to reduce the complexity and technical threshold of configuration synchronization operations.

[0034] This design utilizes a secure configuration synchronization client for gateway devices. It establishes a connection with the gateway device via SCP and includes a database synchronization and upgrade tool running on the gateway device. This tool remotely extracts general configuration data from the target source gateway database and writes it back to the database of the gateway to be upgraded. The database synchronization and upgrade tool enables connection and management of the gateway database, as well as the export and import of database information. It also encrypts exported data and decrypts imported data. The secure configuration synchronization of gateway devices is performed using this client, and the specific steps are explained below.

[0035] S1. Develop database synchronization and upgrade tools like Figure 1 The diagram shows the development process of the database synchronization and upgrade tool. This tool supports cross-platform and multi-architecture compatibility, and its core functions include database connection and management, data migration (import / export), and security configuration (encryption / decryption). To adapt to the deployment environment, it is natively compiled for gateway devices with different CPU architectures (such as x86, x86-64, ARM32, ARM64, etc.) to ensure optimal performance and compatibility.

[0036] The database synchronization and upgrade tool mainly includes two functions: exporting general configuration data of the target source gateway device and importing general configuration data of the gateway device to be upgraded. The execution process of these two functions is as follows.

[0037] S1-1, Exporting general configuration data of the target source gateway device (1) Run the database synchronization and upgrade tool. The first parameter is the database file path; the second parameter is the export path for the general configuration data. (2) Connect to the database file according to the database file path: If the connection is successful, proceed to step (3); otherwise, return a connection failure message. (3) Read the application configuration data from the database, filter out the general configuration data, and convert the general configuration data into JSON or XML format file content according to the table of general configuration data; (4) Perform encryption calculations on the file content from step (3) to generate an encrypted configuration file; (5) Write the encrypted configuration file to the specified export path of the general configuration data.

[0038] S1-2. Importing general configuration data of the gateway device to be upgraded (1) Run the database synchronization and upgrade tool. The first parameter is the database file path; the second parameter is the path to the encrypted configuration file. (2) Connect to the database file according to the database file path: If the connection is successful, proceed to step (3); otherwise, return a connection failure message. (3) Read the encrypted configuration file according to the path and decrypt it into JSON or XML format file content; (4) Load the contents of a JSON or XML file; (5) Write the contents of a JSON or XML file into the specified database file.

[0039] S2, Client-Side Tool Development S2-1, Multi-architecture resource packaging: The binary files, dependent shared libraries, environment configurations and execution scripts of the database synchronization and upgrade tools compiled for different CPU architectures (such as x86, x86-64, ARM32, ARM64, etc.) are packaged into a single independent .tar.gz compressed archive file, and the compressed archive file is named according to the CPU architecture.

[0040] Due to the size limitations of resource files and to ensure efficient extraction, resource files for different CPU architectures are packaged separately. During client compilation, resource files for different CPU architectures are compiled and entered into the client tool. When the client tool runs, it releases the corresponding resource files based on the CPU architecture of the gateway device to be upgraded and deletes them promptly after use. For users, these compressed archive files are imperceptible.

[0041] S2-2, Project Resource Integration: Integrate compressed archive files as embedded resource files into the client's project.

[0042] S2-3. Runtime Resource Management: When the client runs, it connects to the current gateway device via SCP, identifies the CPU architecture of the current gateway device, and then extracts the matching compressed archive file from the client's embedded resource file. The archive file is then transmitted to the current gateway device via SCP, and decompression and deployment are performed via remote command execution to ensure the compatibility and executability of the toolchain.

[0043] S3, Configure export and encryption process (e.g.) Figure 2 (As shown) S3-1 Initialization and Resource Distribution: Start the client and set its SCP connection parameters with the target. Identify the CPU architecture of the target source gateway through the SCP connection. Based on this, the client extracts the corresponding .tar.gz compressed archive file from the embedded resource files, and transfers the .tar.gz compressed archive file to the temporary directory of the target source gateway through the SCP connection and decompresses it, thus completing the deployment of the toolchain. (1) Determine the CPU architecture of the gateway device: After the client starts, log in via SSH and enter commands such as uname -a to obtain the gateway device's echo information and determine the gateway's CPU architecture. If the echo information contains "x86_64", it means that it is a 64-bit x86 CPU architecture gateway device; if the echo information contains "aarch64", it means that it is a 64-bit ARM CPU architecture gateway device; if the echo information contains "armv71", "armv61", "armv5tel", etc., it means that it is a 32-bit ARM CPU architecture gateway device. (2) Based on the CPU architecture, extract the corresponding .tar.gz compressed archive file from the resource file path in memory to the file path specified by the client; (3) Transfer the .tar.gz compressed archive file to the temporary directory of the target source gateway via SCP connection. If the CPU architecture of the gateway machine is ARM64, the decompression command is tar -xvf sync_tool_arm64.tar.gz. Execute this command to decompress the file.

[0044] S3-2, Remote Execution and Data Extraction: The target source gateway executes the decompressed startup script, runs the database synchronization tool through the startup script, connects to the target source gateway database through the database synchronization tool, exports the general configuration data of the target source gateway database and performs encryption operations to generate an encrypted configuration file.

[0045] When extracting general application configuration data from the target source gateway database, the table contents of general configuration can be filtered to ignore and skip configuration information such as gateway device registration information, license, serial number, and network interface MAC address, thus forming a general configuration file.

[0046] S3-3, Backup and Cleanup: Transfer the encrypted configuration file to the client's PC for backup via SCP connection. At the same time, use the rm command to remove the .tar.gz compressed archive file and decompressed file in the target source gateway, and disconnect the SCP connection between the client and the target source gateway.

[0047] S4, Configuration synchronization upgrade process (e.g.) Figure 3 (As shown) S4-1 Initialization and Resource Distribution: Start the client and set its SCP connection parameters with the gateway to be upgraded. Identify the CPU architecture of the gateway to be upgraded through the SCP connection. Based on this, the client extracts the corresponding .tar.gz compressed archive file from the embedded resource files, and transfers the .tar.gz compressed archive file to the temporary directory of the gateway to be upgraded through the SCP connection and decompresses it, thus completing the deployment of the toolchain. S4-2, Encrypted Configuration Transmission: Transmit the encrypted configuration file backed up on the PC to the temporary directory of the gateway to be upgraded via SCP connection.

[0048] S4-3. Remote Configuration Upgrade: The gateway to be upgraded executes the decompressed startup script, runs the database synchronization tool through the startup script, connects to the database of the gateway to be upgraded through the database synchronization tool, decrypts the encrypted configuration file, writes the decrypted general configuration data into the database of the gateway to be upgraded, and returns the execution result.

[0049] When writing general configuration data to the gateway device to be upgraded, since the data content is general configuration information and does not contain configuration information such as the gateway device's registration information, license, serial number, or network interface MAC address, it will not affect the specific identity information of the gateway device to be upgraded.

[0050] S4-4. Result Display and Cleanup: Display the execution results on the client, remove the .tar.gz compressed archive file and decompressed file from the gateway to be upgraded, and disconnect the SCP connection between the client and the gateway to be upgraded.

[0051] S5, Repeated Configuration Repeat step S4 to perform application configuration data upgrade operations on multiple gateways to be upgraded.

[0052] S6. Configuration file selection Optionally, following step S3, an optional workflow is provided: the client can decrypt and deserialize the acquired encrypted configuration file, providing a visual interface for interactive review. Users can select the configuration items to be synchronized, and the system then generates a new encrypted file containing only the selected configurations, which is synchronized to the gateway device to be upgraded.

[0053] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the above embodiments do not limit the present invention in any way, and all technical solutions obtained by equivalent substitution or equivalent transformation fall within the protection scope of the present invention.

Claims

1. A method for synchronizing secure configurations for gateway devices, characterized in that: The client uses a database synchronization upgrade tool to remotely extract general configuration data from the target source gateway database and transmits it to the client in encryption. Simultaneously, the client transmits the general configuration data in encryption to the gateway machine to be upgraded, and uses the database synchronization upgrade tool to remotely write the general configuration data into the database of the gateway to be upgraded. The database synchronization upgrade tool is used to realize the connection and management of the gateway database, the export and import of database information, and the encryption of exported data and the decryption of imported data.

2. The method for synchronizing secure configuration of a gateway device according to claim 1, characterized in that: The database synchronization and upgrade tool is natively compiled for gateway devices with different CPU architectures. The binary file of the database synchronization and upgrade tool compiled for a specific CPU architecture, the dependent shared libraries, environment configuration and execution script are packaged into an independent .tar.gz compressed archive file, and the compressed archive file is named according to the CPU architecture.

3. The method for synchronizing secure configuration of a gateway device according to claim 2, characterized in that: Integrate compressed archive files as resource files into the client's project.

4. The method for synchronizing secure configuration for a gateway device according to claim 1, characterized in that: Establish a connection between the client and the gateway device using SCP.

5. The method for synchronizing secure configuration of a gateway device according to claim 1, characterized in that: The method includes the following steps: S1. Develop a database synchronization and upgrade tool that supports cross-platform and multi-architecture compatibility. Its core functions include database connection and management, data migration and security configuration, and it is natively compiled for gateway devices with different CPU architectures. S2, Client-side tool development includes the following steps: S2-1, Multi-architecture resource packaging: Package the binary files of the database synchronization and upgrade tools compiled for different CPU architectures, the dependent shared libraries, environment configurations and execution scripts into independent .tar.gz compressed archive files, and name the compressed archive files according to the CPU architecture; S2-2, Project Resource Integration: Integrate compressed archive files as embedded resource files into the client's project; S2-3. Runtime resource management: When the client runs, it connects to the current gateway device via SCP, identifies the CPU architecture of the current gateway device, and then extracts the matching compressed archive file from the client's embedded resource file. The archive file is then transmitted to the current gateway device via SCP and decompressed and deployed via remote command. S3. Configure the export and encryption process, including the following steps: S3-1 Initialization and Resource Distribution: Start the client and set its SCP connection parameters with the target source gateway. Identify the CPU architecture of the target source gateway through the SCP connection. Based on this, the client extracts the corresponding .tar.gz compressed archive file from the embedded resource files, and transfers the .tar.gz compressed archive file to the temporary directory of the target source gateway through the SCP connection and decompresses it, thus completing the deployment of the toolchain. S3-2, Remote Execution and Data Extraction: The target source gateway executes the decompressed startup script, runs the database synchronization tool through the startup script, connects to the target source gateway database through the database synchronization tool, exports the general configuration data of the target source gateway database and performs encryption operations to generate an encrypted configuration file; S3-3, Backup and Cleanup: Transfer the encrypted configuration file to the PC on the client for backup via SCP connection, while clearing the .tar.gz compressed archive file and decompressed file in the target source gateway, and disconnect the SCP connection between the client and the target source gateway; S4. The configuration synchronization upgrade process includes the following steps: S4-1 Initialization and Resource Distribution: Start the client and set its SCP connection parameters with the gateway to be upgraded. Identify the CPU architecture of the gateway to be upgraded through the SCP connection. Based on this, the client extracts the corresponding .tar.gz compressed archive file from the embedded resource files, and transfers the .tar.gz compressed archive file to the temporary directory of the gateway to be upgraded through the SCP connection and decompresses it, thus completing the deployment of the toolchain. S4-2, Encrypted Configuration Transmission: Transmit the encrypted configuration file backed up in the PC to the temporary directory of the gateway to be upgraded via SCP connection; S4-3 Remote Configuration Upgrade: The gateway to be upgraded executes the decompressed startup script, runs the database synchronization tool through the startup script, connects to the database of the gateway to be upgraded through the database synchronization tool, decrypts the encrypted configuration file and writes the decrypted general configuration data into the database of the gateway to be upgraded, and returns the execution result. S4-4. Result Display and Cleanup: Display the execution results on the client, remove the .tar.gz compressed archive file and decompressed file from the gateway to be upgraded, and disconnect the SCP connection between the client and the gateway to be upgraded.

6. The method for synchronizing secure configuration for a gateway device according to claim 2 or 5, characterized in that: The CPU architecture of the gateway includes x86, x86-64, ARM32, and ARM64.

7. The method for synchronizing secure configuration of a gateway device according to claim 1, characterized in that: When extracting general configuration data from the target source gateway database, only general configuration data related to application configuration is extracted, and specific configuration data including registration information, license, serial number, network interface, and MAC address are not extracted; when importing general configuration data into the gateway database to be upgraded, specific configuration data is not overwritten.

8. A secure configuration synchronization client for gateway devices, characterized in that: The client establishes a connection with the gateway device via SCP, sets up a database synchronization and upgrade tool running on the gateway device within the client, remotely extracts the general configuration data from the target source gateway database, and remotely writes the general configuration data into the gateway database to be upgraded; the database synchronization and upgrade tool is used to realize the connection and management of the gateway database, the export and import of database information, and to encrypt the exported data and decrypt the imported data.

9. The security configuration synchronization client for gateway devices according to claim 8, characterized in that: The database synchronization and upgrade tool is natively compiled for gateway devices with different CPU architectures. The binary file of the database synchronization and upgrade tool compiled for a specific CPU architecture, the dependent shared libraries, environment configuration and execution script are packaged into an independent .tar.gz compressed archive file, and the compressed archive file is named according to the CPU architecture. The compressed archive file is integrated into the client's project as a resource file.

Images