Online upgrading system and method based on four-partition safety breakpoint resume

Abstract

The invention provides an online upgrading system and method based on four-partition safe breakpoint resuming, and relates to the technical field of online upgrading, and the system comprises a four-partition architecture comprising a boot loading area, a main partition, a backup partition and a state storage area for equipment to be upgraded; after the upgrade server and the equipment finish bidirectional authentication, dividing the upgrade package into a plurality of upgrade package blocks, sequentially sending the upgrade package blocks according to block serial numbers, and sequentially sending the upgrade package blocks which are not transmitted when a recovery signal reported after transmission of the equipment to be upgraded is interrupted and recovered is received; the to-be-upgraded device stores each upgrade package block into a backup partition and updates the upgrade progress state in a state storage area in real time; and combining and copying the received upgrade package blocks to the main partition, and verifying whether the starting of the main partition is valid or not by the boot loading area so as to complete upgrade or execute rollback. The method has the beneficial effects that the safe, reliable and efficient online upgrading of the embedded software is jointly realized through a four-partition framework, bidirectional authentication and verification and block breakpoint resume.

Description

Technical Field

[0001] This invention relates to the field of online upgrade technology, and in particular to an online upgrade system and method based on four-partition secure breakpoint resume. Background Technology

[0002] Currently, the intelligence level of embedded devices (such as smart meters, industrial sensors, vehicle terminals, and smart home devices) is constantly improving, and software functions increasingly rely on online upgrades for rapid iteration and vulnerability patching. At present, embedded software upgrades mainly adopt a single-partition storage scheme, where the new software to be upgraded is directly overwritten and written to the single program partition where the currently running software resides. With technological advancements, existing embedded software online upgrade (OTA) technologies mainly include the following two categories: Local flashing: The upgrade package is directly flashed to the device storage via physical interfaces such as serial port or JTAG. This method relies on manual on-site operation, resulting in low upgrade efficiency and the inability to perform remote upgrades.

[0003] Simple OTA upgrade: The upgrade package is transmitted to the device via the network, directly overwriting the running partition to complete the upgrade. Some improved solutions introduce dual system partitions (primary partition + backup partition). During the upgrade process, the software is first written to the backup partition, and the system is switched to boot only after successful verification. Other solutions ensure the integrity of the upgrade data through hash verification (such as SHA-256).

[0004] However, existing upgrade technologies still face the following key issues in application: Insufficient reliability: During the upgrade process, abnormal situations such as power outages or network interruptions can easily lead to upgrade failure, damage to the currently running software, and potentially render the system unusable. For equipment deployed in remote areas or critical industrial nodes, on-site maintenance costs are extremely high.

[0005] Weak security: In scenarios with high security requirements, such as finance, public utilities, and vehicle systems, relying solely on methods such as hash verification is insufficient to prevent upgrade packages from being tampered with or maliciously attacked, which may lead to unauthorized control of devices, data leaks, or malfunctions.

[0006] Lack of resume capability: Traditional solutions require the complete upgrade package to be downloaded again after a transmission interruption, which is not only inefficient but also wastes network resources. Summary of the Invention

[0007] To address the problems existing in the prior art, this invention provides an online upgrade system based on four-partition secure breakpoint resume, comprising: The device to be upgraded includes the main partition, boot loader area, backup partition, and state storage area that store the currently running firmware; An upgrade server is used to confirm the upgrade package after two-way authentication communication with the device to be upgraded, divide the upgrade package into multiple upgrade package blocks, and send them to the device to be upgraded in sequence according to the block number of each upgrade package block; The device to be upgraded is used to store each successfully received upgrade packet block into the backup partition, and synchronously record the block sequence number of each successfully received upgrade packet block and the upgrade progress status of the transmission status in the status storage area. When the transmission status is interrupted during data reception, a recovery signal containing the received block sequence number is generated and reported after the transmission status is restored. The upgrade server is also configured to continue sending each of the upgrade packet blocks with the untransmitted block sequence number according to the recovery signal; The device to be upgraded is also used to merge all the upgrade package blocks into a complete upgrade package after they have been received and copy it to the main partition. Then, when the boot loader detects that the main partition is booting successfully, the online upgrade is completed.

[0008] Preferably, the upgrade server includes: The authentication module is used to perform two-way authentication with the device to be upgraded via the TLS protocol after the device to be upgraded is initialized. When the authentication is successful, communication is established to determine whether the latest version of the running firmware in the upgrade server is consistent with the version of the current running firmware in the main partition. If they are inconsistent, the latest version of the running firmware is used as the upgrade package. The upgrade package transmission module, connected to the authentication module, is used to divide the upgrade package into multiple upgrade package blocks and send them sequentially to the device to be upgraded according to the block number of each upgrade package block; The breakpoint resume module is connected to the upgrade package transmission module and is used to continue sending each of the upgrade package blocks with the untransmitted block sequence number according to the recovery signal.

[0009] Preferably, the upgrade package transmission module includes: The block sending unit is used to divide the upgrade package into multiple upgrade package blocks, associate each upgrade package block with a block sequence number, and send them to the device to be upgraded in the order of the block sequence numbers of each upgrade package block. The breakpoint resume module includes: The filtering and sending unit is configured to select each upgrade packet block whose block number matches the received block number in the recovery signal as the transmitted upgrade packet block, and then send the remaining untransmitted upgrade packet blocks to the device to be upgraded.

[0010] Preferably, the device to be upgraded includes: The status recording module is used to store the successfully received upgrade packet blocks into the backup partition, and synchronously record the block sequence number and transmission status of each successfully received upgrade packet block in the status storage area as the upgrade progress status. The merge verification module, connected to the status recording module, is used to merge all the upgrade package blocks into a complete upgrade package and verify it. After the verification is passed, the data of the backup partition is copied to the main partition. Then, when the boot loader detects that the main partition is booting effectively, the online upgrade is completed. The recovery transmission module is used to read the block sequence number that has been successfully received in the upgrade progress status as a recovery signal and report it when the transmission status is interrupted during data reception.

[0011] Preferably, the device to be upgraded also includes: The data clearing module, connected to the merge verification module, is used to record the version number and upgrade time of the upgrade package in the status storage area after the online upgrade of the main partition is completed, and then clear the complete upgrade package stored in the backup partition, or record the reason for failure when the upgrade fails.

[0012] Preferably, each of the upgrade package blocks is also associated with a block hash value, and the status recording module includes: The upgrade packet block verification unit is used to calculate the corresponding real-time hash value in real time when receiving an upgrade packet block, compare the real-time hash value with the corresponding block hash value, and store the upgrade packet in the backup partition when the comparison is consistent. The status update unit, connected to the upgrade package verification unit, is used to update the upgrade progress status by using the corresponding block sequence number as the block sequence number that has been successfully received when storing each upgrade package block into the backup partition.

[0013] Preferably, the backup partition stores backup firmware of the firmware currently running on the primary partition; the merge verification module includes: The rollback unit is used to copy the backup running firmware in the backup partition to the main partition to complete the version rollback when the boot loader detects an abnormality in the main partition indicating an upgrade failure.

[0014] This invention also provides an online upgrade method based on four-partition secure breakpoint resume, applied to the aforementioned online upgrade system, comprising: Step S1: After the upgrade server and the device to be upgraded communicate with each other for bidirectional authentication, the upgrade package is confirmed. The upgrade package is divided into multiple upgrade package blocks and sent to the device to be upgraded in sequence according to the block number of each upgrade package block. At the same time, the upgrade progress status stored in the status storage area is continuously obtained. Step S2: The device to be upgraded stores each successfully received upgrade packet block into the backup partition, and simultaneously records the block sequence number of each successfully received upgrade packet block and the upgrade progress status in the status storage area. The device to be upgraded then determines whether a transmission interruption occurred during data reception. If so, after the transmission state is restored, a recovery signal containing the received block sequence number is generated and reported, and the process proceeds to step S3; If not, proceed to step S4; Step S3: The upgrade server continues to send upgrade packet blocks with untransmitted block sequence numbers according to the recovery signal; Step S4: After all upgrade package blocks have been received, the device to be upgraded is merged into a complete upgrade package and copied to the main partition. Then, when the boot loader detects that the main partition is booting successfully, the online upgrade is completed.

[0015] Preferably, step S1 includes: Step S11: After the device to be upgraded is initialized, the upgrade server performs mutual authentication with the device to be upgraded via the TLS protocol. Once authentication is successful, communication is established. Step S12: The upgrade server determines whether the latest version of the running firmware in the upgrade server is consistent with the running firmware version of the main partition. If they are inconsistent, the latest version of the running firmware is used as the upgrade package. In step S13, the upgrade server divides the upgrade package into multiple upgrade package blocks and sends them sequentially to the device to be upgraded according to the block number of each upgrade package block.

[0016] The above technical solution has the following advantages or beneficial effects: 1. A four-partition storage architecture is adopted to achieve physical isolation between operation and upgrade. The primary partition ensures the stable operation of the current system; the backup partition serves as an upgrade cache and rollback backup; the state storage area persistently records the upgrade progress; and the boot loader area is responsible for the final verification of boot validity. This design achieves physical separation between operation and upgrade, ensuring that any interruption during any upgrade stage will not affect the operation of the primary partition, fundamentally eliminating the risk of the system becoming unusable.

[0017] 2. Before the upgrade, mandatory two-way authentication between the device and the server is performed to ensure the legitimacy and trustworthiness of the communication link. Secondly, after the upgrade package is transmitted, its integrity is verified to effectively prevent data tampering during transmission and ensure the authenticity and integrity of the software image.

[0018] 3. The system achieves precise breakpoint resumption by combining chunked transmission with persistent status recording. When transmission is interrupted, the system can accurately locate the breakpoint based on the status record, requiring only the re-downloading of the missing data blocks. This avoids the repeated transmission of the entire upgrade package, significantly improving upgrade efficiency and saving network resources. Attached Figure Description

[0019] Figure 1 A schematic diagram of the structure of an online upgrade system based on four-partition secure breakpoint resume is provided in a preferred embodiment of the present invention. Figure 2 This is a schematic diagram of the two-way authentication process between the upgrade server and the device to be upgraded, in a preferred embodiment of the present invention. Figure 3 This is a schematic diagram of the upgrade server's workflow in a preferred embodiment of the present invention. Figure 4 A flowchart illustrating an online upgrade method based on four-partition secure breakpoint resume is provided in a preferred embodiment of the present invention. Figure 5 This is a schematic diagram of the sub-process of step S1 in a preferred embodiment of the present invention. Detailed Implementation

[0020] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments. The present invention is not limited to this embodiment; other embodiments that conform to the spirit of the present invention may also fall within the scope of the present invention.

[0021] In a preferred embodiment of the present invention, based on the above-mentioned problems existing in the prior art, an online upgrade system based on four-partition secure breakpoint resume is provided, comprising: Device 2 to be upgraded includes a main partition, a boot loader area, a backup partition, and a state storage area that store the currently running firmware; Upgrade server 1 is used to confirm the upgrade package after two-way authentication communication with the device to be upgraded, divide the upgrade package into multiple upgrade package blocks and send them to the device to be upgraded in sequence according to the block number of each upgrade package block; The device to be upgraded 2 is used to store each successfully received upgrade packet block into the backup partition, and simultaneously record the block sequence number of each successfully received upgrade packet block and the upgrade progress status of the transmission status in the status storage area. When the transmission status is interrupted during data reception, a recovery signal containing the received block sequence number is generated and reported after the transmission status is restored. Upgrade server 1 is also used to continue sending upgrade packet blocks with untransmitted block sequence numbers according to the recovery signal; The device to be upgraded, 1, is also used to merge all upgrade package blocks into a complete upgrade package after they have been received and copy it to the main partition. Then, when the boot loader detects that the main partition is bootable, the online upgrade is completed.

[0022] Specifically, this embodiment fundamentally solves the reliability problem of system "bricking" due to unexpected interruptions during the upgrade process by introducing a four-partition storage architecture comprising a bootloader, a primary partition, a backup partition, and a state storage area. The core of the four-partition storage architecture lies in achieving physical separation between operation and upgrade. During an upgrade, the new upgrade package is written to the backup partition, ensuring that the currently running primary partition software remains intact and is not damaged midway. Even if the upgrade process fails due to power outages or network interruptions, the device can still boot normally from the intact primary partition, greatly improving system robustness.

[0023] Specifically, the bootloader is used to complete the online upgrade when the main partition is found to be bootable (can boot normally) after the upgrade package is merged, verified, and copied to the main partition. It can also be used to automatically switch control back to the old version of the program in the backup partition (or copy the old version to the main partition for version rollback) when the main partition program is detected to be corrupted or the upgrade fails to boot (such as boot timeout or abnormal critical functions). This ensures that the device has at least one usable version, thereby fundamentally preventing it from becoming bricked.

[0024] The primary partition is where the device's currently stable firmware runs. During normal operation, the device executes software from this partition. During the upgrade process, the data in this partition remains unchanged until all steps are deemed safe and error-free. Only after the upgrade package in the backup partition has been fully verified will it be copied to the primary partition, completing the final update.

[0025] All new software upgrade packages downloaded from the server are first written to the backup partition to prevent direct contamination or damage to the running primary partition. The backup partition typically stores the previous stable version before overwriting the primary partition. Even if the new version upgrade fails, the boot loader can roll back to the old version from here, providing double protection.

[0026] The state storage area is used for progress management throughout the upgrade process, persistently recording key information. It records which upgrade packets have been successfully received, which is crucial for enabling resumeable transmission. It also marks the device's current status, such as whether it's upgrading, successful, or failed. Furthermore, it can record the upgrade version number, reason for failure, etc. If the device restarts after a power outage, network failure, or other abnormal situation during the upgrade process, the system can read the information in this partition to pinpoint the exact point of interruption, allowing it to resume from the breakpoint instead of starting from scratch.

[0027] Furthermore, in this embodiment, while ensuring system reliability, a strict security authentication mechanism is used to address the risks of upgrade package tampering and malicious attacks. Specifically, two-way authentication must be performed between upgrade server 1 and the device to be upgraded 2, effectively verifying the legitimacy of both parties' identities and preventing unauthorized server access or man-in-the-middle attacks from the source, thus ensuring the reliability of the upgrade source.

[0028] In addition, in this embodiment, the device to be upgraded 2 verifies the merged complete upgrade package after all upgrade package blocks have been received. This constitutes a second line of defense, ensuring the integrity of the upgrade package during transmission and preventing data from being maliciously tampered with.

[0029] To address the inefficiency caused by the lack of resume capability, this embodiment combines chunked transmission and persistent state recording. The complete upgrade package is divided into multiple smaller chunks for transmission, and a state storage area is used to record the status of each successfully received upgrade package chunk and the overall transmission progress in real time and persistently. When the connection is restored after an interruption, the system does not need to start from the beginning but can accurately locate the transmission breakpoint and only request the download of the remaining upgrade package chunks that have not yet been successfully transmitted. This mechanism avoids a huge waste of network resources and time, ensuring that the upgrade process remains efficient even in unstable network environments.

[0030] In summary, the online upgrade system in this embodiment organically integrates three major technical pillars: a four-partition architecture, two-way authentication and verification, and segmented breakpoint resumption, forming a complete and interconnected system. This system logically progresses layer by layer, ultimately achieving secure, reliable, and efficient online upgrades of embedded software, comprehensively surpassing the performance bottlenecks of traditional upgrade solutions.

[0031] In a preferred embodiment of the present invention, the upgrade server 1 includes: The authentication module 11 is used to perform two-way authentication with the device to be upgraded via the TLS protocol after the device to be upgraded is initialized. When the authentication is successful, communication is established to determine whether the latest version of the running firmware in the upgrade server is consistent with the version of the current running firmware in the main partition. If they are inconsistent, the latest version of the running firmware is used as the upgrade package. The upgrade package transmission module 12 and the connection authentication module 11 are used to divide the upgrade package into multiple upgrade package blocks and send them to the device to be upgraded in sequence according to the block number of each upgrade package block; The breakpoint resume module 13 is connected to the upgrade package transmission module 12 and is used to continue sending each upgrade package block with the untransmitted block sequence number according to the recovery signal.

[0032] Specifically, in this embodiment, three modules constitute the core logical closed loop of the upgrade server, respectively responsible for security establishment, normal task processing, and anomaly recovery, including: Before data transmission begins, authentication module 11 establishes a secure communication channel between upgrade server 1 and the device to be upgraded 2. It performs mutual authentication with the device to be upgraded 2 via the TLS protocol. The authentication process is as follows: Figure 2 As shown, this not only verifies the legitimacy of the device to be upgraded, ensuring that the upgrade service is not provided to unauthorized devices, but also verifies the identity of the server by using a pre-set server public key to verify the digital signature, preventing forgery, and enabling the device to confirm that it is connecting to a legitimate and trusted upgrade source. This module ensures the trustworthiness of the communication link from the source, effectively preventing man-in-the-middle attacks, server impersonation, and device spoofing, laying a secure foundation for all subsequent operations.

[0033] The upgrade package transmission module 12 is responsible for handling the distribution process of a brand new or complete upgrade task. Upon receiving a report from the device that the upgrade progress status is non-interrupted (indicating the start of a new task, not a continuation of transmission after an interruption), this module first executes version comparison logic to confirm the difference between the latest firmware version on the server and the currently running version on the device's main partition. If the versions are inconsistent, the upgrade process is triggered. Upgrade server 1 and the device to be upgraded 2 negotiate the upgrade task. The server returns matching upgrade package information (total size, number of blocks, hash value, digital signature) based on the device model, version, and hardware configuration. Subsequently, server 1 divides the complete upgrade package data into blocks, adds a corresponding block number to each block, and sends all upgrade package blocks sequentially to the device to be upgraded 2. This module realizes intelligent triggering of upgrade tasks (avoiding unnecessary duplicate upgrades) and block-based data transmission, providing a foundation for efficient and controllable large file transmission.

[0034] The breakpoint resume module 13 is responsible for transmitting only the remaining data when the upgrade transmission process resumes after an interruption caused by network outages, power failures, or other anomalies. This module is activated when it detects a recovery signal reported by the device to be upgraded 2 (i.e., a signal generated after the upgrade device and upgrade server resume communication after an interruption in upgrade packet block transmission due to network outages, power failures, program malfunctions, crashes, or other anomalies during the upgrade process). The upgrade server reads the sequence number of the successfully received blocks from the recovery signal and logically divides the complete upgrade packet into transmitted and untransmitted parts. Subsequently, it only sends the untransmitted upgrade packet blocks to the device sequentially. This module, through state awareness and differential transmission, avoids re-downloading the entire upgrade packet after a transmission interruption, significantly saving network bandwidth and improving upgrade efficiency, especially suitable for upgrade scenarios in unstable network environments.

[0035] In summary, these three modules form a collaborative system: the authentication module ensures channel security, the upgrade package transmission module manages the full distribution of new tasks, and the breakpoint resume module handles incremental recovery after abnormal interruptions. Together, they guarantee the security and efficiency of the upgrade process. Specifically, its complete workflow is as follows: Figure 3 As shown.

[0036] In a preferred embodiment of the present invention, the upgrade progress status includes the received block sequence number, and the upgrade packet transmission module 12 includes: The block sending unit 121 is used to divide the upgrade package into multiple upgrade package blocks, associate each upgrade package block with a block sequence number, and send them to the device to be upgraded in the order of the block sequence numbers of each upgrade package block. The breakpoint resume module 13 includes: The filtering and sending unit 131 is used to select each upgrade packet block whose block number matches the received block number in the recovery signal as the transmitted upgrade packet block according to the recovery signal, and then send the remaining untransmitted upgrade packet blocks to the device to be upgraded.

[0037] Specifically, in this embodiment, the core technical function of the block sending unit 121 is to perform structured processing on the complete upgrade package data. It is responsible for dividing the upgrade package into multiple upgrade package blocks of controllable size and assigning a unique block number to each upgrade package block. This operation transforms the originally large single upgrade package into an ordered, independently identifiable, and manageable linear data sequence.

[0038] When the device restarts due to a fault and reports a recovery signal, the filtering and sending unit 131 logically divides the complete upgrade packet block sequence based on the set of received block sequence numbers contained in the recovery signal. Specifically, it classifies all upgrade packet blocks whose sequence numbers already exist in the device's reported list as transmitted upgrade packet blocks, and classifies the remaining upgrade packet blocks in the sequence as untransmitted upgrade packet blocks. This filtering mechanism is key to achieving efficient resource utilization.

[0039] Through the collaborative work of the two units mentioned above, the system establishes a mechanism for resuming interrupted transmissions. The segmentation unit establishes a baseline for data addressability, while the filtering unit, based on this baseline and the persistent status records on the device, accurately identifies the difference in data to be transmitted. This allows the server to completely avoid retransmitting successfully transmitted data during the resumption process, only transmitting upgrade packets that the device has not yet received. This maximizes network bandwidth conservation and improves upgrade efficiency after a transmission interruption.

[0040] In a preferred embodiment of the present invention, the device 2 to be upgraded includes: The status recording module 21 is used to store the successfully received upgrade packet blocks into the backup partition, and synchronously record the block sequence number and transmission status of each successfully received upgrade packet block in the status storage area as the upgrade progress status. The merge verification module 22 and the connection status recording module 21 are used to merge all upgrade package blocks into a complete upgrade package and verify it after all upgrade package blocks have been received. After the verification is passed, the data of the backup partition is copied to the main partition. Then, the online upgrade is completed when the boot loader detects that the main partition is bootable. The recovery transmission module 24 is used to read the block sequence number that has been successfully received in the upgrade progress status as a recovery signal and report it when the transmission status is restored after the transmission status is interrupted during the data reception process.

[0041] In a preferred embodiment of the present invention, the backup partition stores a backup of the firmware currently running on the primary partition; the merge verification module 22 includes: The rollback unit 221 is used to copy the backup running firmware in the backup partition to the main partition to complete the version rollback when the boot loader detects an abnormality in the main partition indicating that the upgrade has failed.

[0042] In a preferred embodiment of the present invention, each upgrade package block is also associated with a block hash value, and the status recording module 21 includes: The upgrade packet block verification unit 211 is used to calculate the corresponding real-time hash value in real time when receiving an upgrade packet block, compare the real-time hash value with the corresponding block hash value, and store the upgrade packet in the backup partition when the comparison is consistent. The status update unit 212 is connected to the upgrade package verification unit 211, and is used to update the upgrade progress status by using the corresponding block sequence number as the received block sequence number when storing each upgrade package block into the backup partition.

[0043] Specifically, in this embodiment, the core technical function of the status recording module 21 and its internal units is to achieve real-time verification of upgrade data and accurate persistence of upgrade status. Specifically, the upgrade packet block verification unit immediately calculates the real-time hash value of each upgrade packet block received by the device and compares it with the corresponding block hash issued by the server. This real-time verification mechanism ensures that the integrity of each upgrade packet block is verified in real time before it is written to the backup partition, effectively preventing damaged or tampered data from being partially received and stored.

[0044] After a single upgrade package block passes verification and is successfully stored in the backup partition, the status update unit 212 is triggered. This unit is responsible for synchronously updating the status storage area with the block sequence number associated with the currently successfully stored upgrade package block as the received block sequence number.

[0045] The status recording module 21, through the collaboration of the two units mentioned above, tightly couples data reception, local verification, and status persistence, forming the data foundation for realizing reliable breakpoint resume function.

[0046] After all upgrade package blocks have been received, the merge verification module first merges all the scattered upgrade package blocks in the backup partition into a complete upgrade package, calculates the total hash of the complete upgrade package in the backup partition, and compares the information to prevent data errors or intentional tampering during transmission. This verification is an integrity confirmation of the complete upgrade package image. After the verification passes, the module copies the entire data from the backup partition to the primary partition, completing the system software version update. Finally, the online upgrade is officially completed by checking the validity of the primary partition through the boot loader (e.g., whether there is a boot timeout or abnormality of critical functions).

[0047] In summary, the merge verification module ensures that the system can safely and completely transition from one stable state to another by performing a series of operations, including merging, final verification, data copying, and update triggering.

[0048] In a preferred embodiment of the present invention, the device 2 to be upgraded further includes: The data clearing module 23 and the connection merging verification module 22 are used to record the version number and upgrade time of the upgrade package in the status storage area after the online upgrade is completed in the main partition, and then clear the complete upgrade package stored in the backup partition, or record the reason for failure when the upgrade fails.

[0049] Specifically, after a successful upgrade, the data clearing module first records the version number of the upgrade package and the exact upgrade time in the status storage area. This operation creates a complete upgrade audit log, providing solid data evidence for subsequent system maintenance, version management, and fault tracing.

[0050] After confirming that the primary partition has completed the online upgrade, the module immediately performs a resource cleanup task, completely erasing the upgrade package data temporarily stored in the backup partition. This is intended to immediately free up occupied non-volatile storage space, ensuring that limited storage resources can be used for future upgrade tasks or daily system functions, while avoiding potential logic chaos in the next upgrade due to residual data.

[0051] Furthermore, this module is designed to handle abnormal situations. When the upgrade process fails due to verification failure or other errors, the data erasure module is responsible for recording the detailed reasons for the failure in the state storage area. This technical measure persists critical fault information, enabling the device to report the specific error context (such as "checksum error" or "write timeout") to maintenance personnel or the server when reset or remotely queried, greatly facilitating remote diagnosis of problems and the formulation of subsequent repair strategies.

[0052] This invention also provides an online upgrade method based on four-partition secure breakpoint resumption, applicable to the aforementioned online upgrade system, such as... Figure 4 As shown, it includes: Step S1: After the upgrade server and the device to be upgraded communicate with each other for two-way authentication, the upgrade package is confirmed. The upgrade package is divided into multiple upgrade package blocks and sent to the device to be upgraded in sequence according to the block number of each upgrade package block. At the same time, the upgrade progress status stored in the status storage area is continuously obtained. Step S2: The device to be upgraded stores each successfully received upgrade packet block into the backup partition, and simultaneously records the block sequence number of each successfully received upgrade packet block and the upgrade progress status in the status storage area. The device to be upgraded then determines whether a transmission interruption occurred during data reception. If so, after the transmission status is restored, a recovery signal containing the block sequence number is generated and reported, and the process proceeds to step S3; If not, proceed to step S4; Step S3: The upgrade server continues to send upgrade packet blocks with untransmitted block sequence numbers according to the recovery signal; Step S4: After all upgrade package blocks have been received, the device to be upgraded merges them into a complete upgrade package and copies it to the main partition. Then, when the boot loader detects that the main partition is bootable, the online upgrade is completed.

[0053] In a preferred embodiment of the present invention, such as Figure 5 As shown, step S1 includes: Step S11: After the device to be upgraded is initialized, the upgrade server performs mutual authentication with the device to be upgraded via the TLS protocol. Once authentication is successful, communication is established. Step S12: The upgrade server determines whether the latest version of the running firmware in the upgrade server is consistent with the running firmware version of the main partition. If they are inconsistent, the latest version of the running firmware is used as the upgrade package. In step S13, the upgrade server divides the upgrade package into multiple upgrade package blocks and sends them to the device to be upgraded in sequence according to the block number of each upgrade package block, while continuously acquiring the upgrade progress status stored in the status storage area.

[0054] The above are merely preferred embodiments of the present invention and are not intended to limit the implementation methods and protection scope of the present invention. Those skilled in the art should recognize that any equivalent substitutions and obvious changes made using the content of this specification and illustrations should be included within the protection scope of the present invention.

Claims

1. An online upgrade system based on four-partition secure breakpoint resume, characterized in that, include: The device to be upgraded includes the main partition, boot loader area, backup partition, and state storage area that store the currently running firmware; An upgrade server is used to confirm the upgrade package after two-way authentication communication with the device to be upgraded, divide the upgrade package into multiple upgrade package blocks, and send them to the device to be upgraded in sequence according to the block number of each upgrade package block; The device to be upgraded is used to store each successfully received upgrade packet block into the backup partition, and synchronously record the block sequence number of each successfully received upgrade packet block and the upgrade progress status of the transmission status in the status storage area. When the transmission status is interrupted during data reception, a recovery signal containing the received block sequence number is generated and reported after the transmission status is restored. The upgrade server is also configured to continue sending each of the upgrade packet blocks with the untransmitted block sequence number according to the recovery signal; The device to be upgraded is also used to merge all the upgrade package blocks into a complete upgrade package after they have been received and copy it to the main partition. Then, when the boot loader detects that the main partition is booting successfully, the online upgrade is completed.

2. The online upgrade system according to claim 1, characterized in that, The upgrade server includes: The authentication module is used to perform two-way authentication with the device to be upgraded via the TLS protocol after the device to be upgraded is initialized. When the authentication is successful, communication is established to determine whether the latest version of the running firmware in the upgrade server is consistent with the version of the current running firmware in the main partition. If they are inconsistent, the latest version of the running firmware is used as the upgrade package. The upgrade package transmission module, connected to the authentication module, is used to divide the upgrade package into multiple upgrade package blocks and send them sequentially to the device to be upgraded according to the block number of each upgrade package block; The breakpoint resume module is connected to the upgrade package transmission module and is used to continue sending each of the upgrade package blocks with the untransmitted block sequence number according to the recovery signal.

3. The online upgrade system according to claim 2, characterized in that, The upgrade package transmission module includes: The block sending unit is used to divide the upgrade package into multiple upgrade package blocks, associate each upgrade package block with a block sequence number, and send them to the device to be upgraded in the order of the block sequence numbers of each upgrade package block. The breakpoint resume module includes: The filtering and sending unit is configured to select each upgrade packet block whose block number matches the received block number in the recovery signal as the transmitted upgrade packet block, and then send the remaining untransmitted upgrade packet blocks to the device to be upgraded.

4. The online upgrade system according to claim 1, characterized in that, The devices to be upgraded include: The status recording module is used to store the successfully received upgrade packet blocks into the backup partition, and synchronously record the block sequence number and transmission status of each successfully received upgrade packet block in the status storage area as the upgrade progress status. The merge verification module, connected to the status recording module, is used to merge all the upgrade package blocks into a complete upgrade package and verify it. After the verification is passed, the data of the backup partition is copied to the main partition. Then, when the boot loader detects that the main partition is booting effectively, the online upgrade is completed. The recovery transmission module is used to read the block sequence number that has been successfully received in the upgrade progress status as a recovery signal and report it when the transmission status is interrupted during data reception.

5. The online upgrade system according to claim 4, characterized in that, The equipment to be upgraded also includes: The data clearing module, connected to the merge verification module, is used to record the version number and upgrade time of the upgrade package in the status storage area after the online upgrade of the main partition is completed, and then clear the complete upgrade package stored in the backup partition, or record the reason for failure when the upgrade fails.

6. The online upgrade system according to claim 4, characterized in that, Each of the upgrade package blocks is also associated with a block hash value, and the status recording module includes: The upgrade packet block verification unit is used to calculate the corresponding real-time hash value in real time when receiving an upgrade packet block, compare the real-time hash value with the corresponding block hash value, and store the upgrade packet in the backup partition when the comparison is consistent. The status update unit, connected to the upgrade package verification unit, is used to update the upgrade progress status by using the corresponding block sequence number as the block sequence number that has been successfully received when storing each upgrade package block into the backup partition.

7. The online upgrade system according to claim 4, characterized in that, The backup partition stores backup firmware of the firmware currently running on the main partition; The merged verification module includes: The rollback unit is used to copy the backup running firmware in the backup partition to the main partition to complete the version rollback when the boot loader detects an abnormality in the main partition indicating an upgrade failure.

8. An online upgrade method based on four-partition secure breakpoint resume, characterized in that, Applied to the online upgrade system as described in any one of claims 1-7, comprising: Step S1: After the upgrade server and the device to be upgraded communicate with each other for bidirectional authentication, the upgrade package is confirmed. The upgrade package is divided into multiple upgrade package blocks and sent to the device to be upgraded in sequence according to the block number of each upgrade package block. Step S2: The device to be upgraded stores each successfully received upgrade packet block into the backup partition, and simultaneously records the block sequence number of each successfully received upgrade packet block and the upgrade progress status in the status storage area. The device to be upgraded then determines whether a transmission interruption occurred during data reception. If so, after the transmission state is restored, a recovery signal containing the received block sequence number is generated and reported, and the process proceeds to step S3; If not, proceed to step S4; Step S3: The upgrade server continues to send upgrade packet blocks with untransmitted block sequence numbers according to the recovery signal; Step S4: After all upgrade package blocks have been received, the device to be upgraded is merged into a complete upgrade package and copied to the main partition. Then, when the boot loader detects that the main partition is booting successfully, the online upgrade is completed.

9. The online upgrade method according to claim 8, characterized in that, Step S1 includes: Step S11: After the device to be upgraded is initialized, the upgrade server performs mutual authentication with the device to be upgraded via the TLS protocol. Once authentication is successful, communication is established. Step S12: The upgrade server determines whether the latest version of the running firmware in the upgrade server is consistent with the running firmware version of the main partition. If they are inconsistent, the latest version of the running firmware is used as the upgrade package. In step S13, the upgrade server divides the upgrade package into multiple upgrade package blocks and sends them sequentially to the device to be upgraded according to the block number of each upgrade package block.

Images