Factory management system data access method and system based on double-entrance hybrid deployment

Abstract

According to the factory management system data access method and system based on double-entrance hybrid deployment provided by the invention, through a double-entrance hybrid deployment architecture and a dynamic perception control mechanism, deep decoupling of client-side independent deployment sense and actual cloud storage is effectively realized; users of small and medium-sized enterprises can perceive a traditional local deployment system in a use process, so that psychological obstacles on data cloud are eliminated; meanwhile, all core production data are centrally stored in the cloud, the professional safety protection capability and the low-cost storage advantage of a cloud service provider are fully utilized, a company headquarters can directly access production operation data of customer factories in real time through an independent public network entrance, and efficient remote management and control and unification and coordination of multiple factories are achieved. According to the scheme, on the premise that local hardware burdens of clients are not increased and data consistency is not sacrificed, contradictions in three aspects of safety, cost and management efficiency are balanced, and the digital transformation requirements of vast small and medium-sized manufacturing enterprises in China at present are particularly met.

Description

Technical Field

[0001] This invention belongs to the field of cloud computing technology, and in particular relates to a data access method and system for a factory management system based on dual-entry hybrid deployment. Background Technology

[0002] With the deepening of Industry 4.0 and intelligent manufacturing, factory management systems (including MES, ERP, WMS, etc.) are gradually evolving from traditional on-premises independent deployments to cloud-based and SaaS-based solutions. Cloud-based deployment, with its elastic scalability, low maintenance costs, high availability, and convenient remote access capabilities, has become the mainstream development trend in the industry. Large manufacturing enterprises typically accept and actively adopt pure cloud or hybrid cloud solutions to achieve real-time control and centralized data analysis of multiple factories from headquarters.

[0003] However, the situation is significantly different for the vast majority of small and medium-sized enterprises (SMEs), especially private SMEs. Due to concerns about data security, frequent cases of industry information leaks, and a strong psychological need for "data sovereignty," most SME owners are highly resistant to the model of completely hosting core production data (such as process formulas, order details, quality records, and real-time inventory status) in the cloud. They would rather choose a purely on-premises deployment solution that is expensive and has poor scalability than accept the potential risks brought by cloud storage.

[0004] Currently, although some hybrid deployment solutions have emerged (such as local front-end + cloud back-end, edge computing gateways, etc.), these solutions often still require customers to be clearly aware of and accept the fact that data is being migrated to the cloud, or local servers still need to store some core business data. This makes it difficult to completely eliminate customers' psychological barriers and to realize the cost and security advantages brought by centralized cloud storage. Existing hybrid deployment methods lack effective decoupling mechanisms and dynamic control measures between "customer-perceived independent deployment" and "actual centralized cloud storage," making it difficult to simultaneously meet the triple needs of SMEs for security, cost control, and remote management by headquarters. Summary of the Invention

[0005] The purpose of this invention is to provide a data access method and system for a factory management system based on a dual-entry hybrid deployment, in order to solve the problem of how to achieve the actual centralized storage of core business data in the cloud without changing the customer's subjective perception that "data is stored locally", while simultaneously supporting the company headquarters to remotely access and manage the customer's factory data in real time.

[0006] To achieve one of the above-mentioned objectives, one embodiment of the present invention provides a data access method for a factory management system based on a dual-entry hybrid deployment, the method comprising:

[0007] The local entry server receives access requests, calculates the access source trust level based on the request source, and calculates the perceived independent deployment tendency based on the trust level, local cache hit rate and cloud latency compensation factor.

[0008] Based on the perceived independent deployment tendency, system security risk index and access source trust classification, dynamic routing decision factors are calculated to determine the proxy mode;

[0009] Based on the determined proxy mode and dynamic routing decision factors, the local data visibility masking strength is calculated on the local entry server to control the user interface display strategy of sensitive fields. At the same time, according to the proxy mode, the core business write operations are sent to the cloud data server through an encrypted channel for actual storage.

[0010] As a further improvement to one embodiment of the present invention, the method further includes, in which the step of calculating the access source trust classification based on the request source includes,

[0011] After receiving an access request, the local entry server obtains the authorization indicator value, time decay factor, and intranet indicator value corresponding to the request source in the currently maintained status table through an encrypted channel with the cloud data server.

[0012] Based on the acquired authorization indication value, time decay factor, and internal network indication value, the trust level of the access source is calculated in real time. The formula is:

[0013]

[0014] in, The normalization coefficient is... The weight of the internal network indicator value. This is an indicator value indicating whether the request at time t originated from the customer's internal network. The weight of the authorization instruction value, For the current time t, is the request to determine whether it matches the instruction value authorized by the company headquarters? The weights of the time decay factor, It is the normalized decay factor of the time difference between the current time t and the last successful authentication.

[0015] As a further improvement to one embodiment of the present invention, the method further includes, in that the calculation of the perceived independent deployment tendency based on the trust level, local cache hit rate, and cloud latency compensation factor includes,

[0016] Obtain the cache hit ratio in real time from the local cache management module on the local entry server. And the delay compensation factor calculated based on the actual measured cloud round-trip time. ;

[0017] Based on the current cache hit rate, cloud latency compensation factor, and the access source trust classification. Calculate the perceived independent deployment tendency The formula is:

[0018]

[0019] in, The coefficients for the reverse weighting of trust grading. The coefficient for the reverse weight of cache hits. This is the coefficient for the delay compensation weight.

[0020] As a further improvement to one embodiment of the present invention, the method further includes, in the step of calculating dynamic routing decision factors and determining the proxy mode based on perceived independent deployment tendency, system security risk index, and access source trust classification, the following steps are included:

[0021] The local entry server receives the current system security risk index from the cloud data server. ;

[0022] Combined with the aforementioned perception of independent deployment tendency and the access source trust classification Calculate the dynamic routing decision factor The formula is:

[0023]

[0024] in, This is a sensitivity adjustment parameter;

[0025] The calculated Each is compared with the preset forced local proxy trigger threshold. and direct cloud pass-through security acceptance threshold The comparison is performed, and the proxy mode for the current access is determined based on the comparison result.

[0026] when At that time, it is determined to be in forced local proxy mode;

[0027] when At that time, it was determined to be a progressive hybrid proxy model;

[0028] when At that time, it was determined to be in direct cloud pass-through mode.

[0029] As a further improvement to one embodiment of the present invention, the method further includes, in part, calculating the local data visibility masking intensity on the local entry server to control the user interface display strategy for sensitive fields based on the determined proxy mode and dynamic routing decision factor.

[0030] When entering forced local proxy mode or progressive hybrid proxy mode, the local entry server counts the number of sensitive fields involved in this request. and request depth ;

[0031] Combining the dynamic routing decision factors Trust rating of access sources Calculate the local data visibility masking intensity. The formula is:

[0032]

[0033] in, This is the adjustment coefficient;

[0034] according to The value determines the strength of the masking applied to sensitive fields. The higher the value, the stronger the hiding, blurring, or visual cues for sensitive fields;

[0035] After determining to enter the progressive hybrid proxy mode, an appropriate masking intensity is determined and applied on the local entry server based on the DRDF(t) value to achieve transitional control of the display of sensitive fields;

[0036] When entering the direct cloud pass-through mode, the user interface display request is directly passed through to the cloud data server for processing.

[0037] As a further improvement to one embodiment of the present invention, the method further includes, according to the proxy mode, sending the core business write operation to the cloud data server for actual storage via an encrypted channel.

[0038] In the forced local proxy mode, when a core business write operation is received, the local entry server generates a temporary transaction identifier and associates the write operation content, the temporary transaction identifier, and the trust level of the current access source. and dynamic routing decision factors The data is sent to the cloud data server via an encrypted channel for actual writing.

[0039] In the progressive hybrid proxy mode, the local entry server temporarily stores some of the core business write operations locally, while sending the remaining operation content to the cloud data server through an encrypted channel. After the cloud data server returns a new version number and verification value, the local temporary storage and cloud data are merged.

[0040] In the direct cloud pass-through mode, the local entry server directly transmits the core business write operation content along with the temporary transaction identifier to the cloud data server through the encrypted channel to perform a complete write.

[0041] After the cloud data server completes the write operation, it returns a new version number and checksum to the local entry server. The local entry server then uses this information to determine the correct version number and checksum. The value and the agent mode are used to update the user interface using partial real-time refresh, gradual synchronous refresh, or delayed polling.

[0042] As a further improvement of one embodiment of the present invention, the method further includes, after each periodic incremental data synchronization is completed, the cloud data server issues the system security risk index for the current period.

[0043] The local entry server collects the recent historical average of the perceived independent deployment tendency. and the average visibility masking intensity of recent historical local data ;

[0044] Calculate perceived security satisfaction based on current security risk assessment values. The formula is:

[0045]

[0046] in, The parameter representing the nonlinear influence of the masking intensity is... Contributes parameters to perceived tendency;

[0047] when When the threshold is below the preset minimum perceived security threshold, increase the forced local agent trigger threshold. This enhances the local proxy tendency for subsequent access requests.

[0048] To achieve one of the above-mentioned objectives, an embodiment of the present invention also provides a data access system for a factory management system based on a dual-entry hybrid deployment, the system comprising a perception tendency calculation module, a dynamic routing decision module, and a write operation control module;

[0049] The perception tendency calculation module is used to receive access requests on the local entry server, calculate the access source trust level according to the request source, and calculate the perception independent deployment tendency based on the trust level, local cache hit rate and cloud latency compensation factor.

[0050] The dynamic routing decision module is used to calculate dynamic routing decision factors and determine the proxy mode based on perceived independent deployment tendency, system security risk index and access source trust level.

[0051] The write operation control module is used to calculate the local data visibility masking strength on the local entry server according to the determined proxy mode and dynamic routing decision factor in order to control the user interface display strategy of sensitive fields. At the same time, according to the proxy mode, the core business write operation is sent to the cloud data server through an encrypted channel for actual storage.

[0052] To achieve one of the above-mentioned objectives, an embodiment of the present invention also provides an electronic device, including a memory and a processor, characterized in that the memory stores a computer program that can run on the processor, and when the program is executed on the processor, it implements the steps in the factory management system data access method based on dual-entry hybrid deployment as described above.

[0053] To achieve one of the above-mentioned objectives, an embodiment of the present invention also provides a storage medium storing a computer program, characterized in that, when the computer program is executed by a processor, it implements the steps in the factory management system data access method based on dual-entry hybrid deployment as described above.

[0054] Compared with existing technologies, this invention provides a data access method and system for a factory management system based on dual-entry hybrid deployment. Through a dual-entry hybrid deployment architecture and dynamic perception control mechanism, it effectively decouples the "sense of independent deployment" on the customer side from actual cloud storage. This allows SMEs to perceive it as a traditional on-premises system, eliminating psychological barriers to data migration to the cloud. Simultaneously, core production data is centrally stored in the cloud, fully leveraging the professional security capabilities and low-cost storage advantages of cloud service providers. Furthermore, the company headquarters can access the customer's factory's production and operation data in real time and directly through an independent public network entry point, achieving efficient remote management and unified coordination across multiple factories. This solution effectively balances the contradictions of security, cost, and management efficiency without increasing the burden on the customer's local hardware or sacrificing data consistency, making it particularly suitable for the digital transformation needs of a large number of small and medium-sized manufacturing enterprises in China. Attached Figure Description

[0055] Figure 1 This is an overall flowchart of the data access method for a factory management system based on dual-entry hybrid deployment as described in this invention.

[0056] Figure 2 This is a schematic diagram of the architecture of the factory management system data access system based on dual-entry hybrid deployment as described in this invention. Detailed Implementation

[0057] The present invention will now be described in detail with reference to the specific embodiments shown in the accompanying drawings. However, these embodiments do not limit the present invention, and any structural, methodological, or functional modifications made by those skilled in the art based on these embodiments are included within the scope of protection of the present invention.

[0058] The application scenarios of this invention include:

[0059] Scenario 1: Customer factory intranet personnel view recipe parameters (highly sensitive fields). The system calculates a high degree of awareness of independent deployment tendency and dynamic routing decision factor, enters forced local proxy mode, with strong local data visibility masking, and displays key recipe values ​​as the last synchronized snapshot values ​​with an additional "local data" watermark.

[0060] Scenario 2: The company headquarters remotely views real-time production progress. Data is transmitted directly through the public network, with low dynamic routing decision factors, no obstruction, and direct display of real-time cloud data.

[0061] Scenario 3: Brief network interruption. The local entry server maintains limited viewing functionality based on the last cached data. Upon reconnection, it automatically triggers incremental synchronization and verifies version consistency.

[0062] Embodiments of the present invention are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention.

[0063] In Embodiment 1 of the present invention, the present invention provides a data access method for a factory management system based on a dual-entry hybrid deployment, such as... Figure 1 As shown, the method includes,

[0064] S1: Receive access requests on the local entry server, calculate the access source trust level based on the request source, and calculate the perceived independent deployment tendency based on the trust level, local cache hit rate and cloud latency compensation factor.

[0065] S2: Based on the perceived independent deployment tendency, system security risk index and access source trust classification, calculate dynamic routing decision factors and determine the proxy mode;

[0066] S3: Based on the determined proxy mode and dynamic routing decision factors, calculate the local data visibility masking strength on the local entry server to control the user interface display strategy of sensitive fields. At the same time, based on the proxy mode, send the core business write operation to the cloud data server through an encrypted channel for actual storage.

[0067] In one specific embodiment of the present invention, the access source trust classification is calculated based on the request source, specifically as follows:

[0068] After receiving an access request, the local entry server obtains the authorization indicator value, time decay factor, and intranet indicator value corresponding to the request source in the currently maintained status table through an encrypted channel with the cloud data server.

[0069] Based on the acquired authorization indication value, time decay factor, and internal network indication value, the trust level of the access source is calculated in real time. The formula is:

[0070]

[0071] in, The normalization coefficient is... The weight of the internal network indicator value. This is an indicator value indicating whether the request at time t originated from the customer's internal network. The weight of the authorization instruction value, For the current time t, is the request to determine whether it matches the instruction value authorized by the company headquarters? The weights of the time decay factor, It is the normalized decay factor of the time difference between the current time t and the last successful authentication.

[0072] It should be noted that calculating the access source trust level based on the request source aims to provide a reliable and quantifiable trust basis for subsequent perception independent deployment tendency judgment and dynamic routing decision-making, thereby realizing differentiated treatment in terms of security and perception experience for different access subjects (factory internal personnel and company headquarters / remote management personnel).

[0073] Furthermore, upon receiving any access request, the local entry server first queries and retrieves three key indicators directly corresponding to the source IP address or domain name of this request in real time through a pre-established encrypted channel (TLS 1.3) with the cloud data server, which uses two-way certificate authentication: authorization indicator value, time decay factor, and intranet indicator value.

[0074] The authorization indicator value identifies whether the request originates from a trusted public IP range, domain name, or certificate fingerprint pre-registered by the company headquarters; the intranet indicator value determines whether the request originates from a pre-defined intranet IP address range within the customer's factory; and the time decay factor reflects the time elapsed since the most recent successful authentication or critical operation of the source, reflecting the timeliness of trust. These three indicators are centrally maintained by a cloud data server and periodically synchronized to the local entry server, ensuring that even during brief network fluctuations, the local entry server can still make judgments based on the latest trust status.

[0075] Furthermore, based on the three objective indicators obtained above, the system performs a weighted linear combination and normalization according to preset weights to obtain the access source trust rating ASTL(t) at the current moment, with a value range of [0,1]. The larger the value, the closer the access source is to the trusted entry point of the company headquarters.

[0076] The calculation result of the trust level ASTL(t) will serve as the core input parameter for all subsequent decision chains, and will be used to: calculate the perceived independent deployment tendency POI(t) to determine whether it is necessary to strongly create the user perception of "local independent deployment"; calculate the dynamic routing decision factor DRDF(t) to determine whether this request will ultimately adopt the forced local proxy mode, the progressive hybrid proxy mode, or the direct cloud pass-through mode; and participate in the calculation of the local data visibility masking intensity LVMI(t) to control how sensitive fields are actually presented on the user interface.

[0077] In one specific embodiment of the present invention, the perceived independent deployment tendency is calculated based on the trust classification, local cache hit rate, and cloud latency compensation factor. Specifically,

[0078] Obtain the cache hit ratio in real time from the local cache management module on the local entry server. And the delay compensation factor calculated based on the actual measured cloud round-trip time. ;

[0079] Based on the current cache hit rate, cloud latency compensation factor, and the access source trust classification. Calculate the perceived independent deployment tendency The formula is:

[0080]

[0081] in, The coefficients for the reverse weighting of trust grading. The coefficient for the reverse weight of cache hits. This is the coefficient for the delay compensation weight.

[0082] It should be noted that the computation-aware independent deployment tendency aims to quantify the extent to which the system should strengthen the effect of "customer-aware local independent deployment" in the current access scenario, thereby providing continuous and adjustable tendency guidance for subsequent routing decisions and interface display control.

[0083] Furthermore, after the local entry server receives an access request and completes the calculation of the access source trust classification, it immediately obtains the current cache hit ratio from the local cache management module. This ratio reflects how much of the data required for this request can be directly read from the local entry server's short-term cache without initiating a cloud request. A higher cache hit ratio indicates that the local entry server has strong "local response capabilities," and the customer's perception of "independent deployment" is naturally stronger, thus reducing the system's need for additional enhancements to this perception.

[0084] Furthermore, the local entry server calculates a latency compensation factor by actually measuring the round-trip time (RTT) from the current request to the cloud data server and based on a preset local expected response latency benchmark. This factor characterizes the degree of impact of cloud response latency on customer perception: the greater the cloud latency, the easier it is for customers to perceive the "non-local" characteristic. In this case, the system needs to more strongly mask this difference through local proxies and data masking.

[0085] Furthermore, the system linearly combines the above three inputs—access source trust rating, cache hit rate, and latency compensation factor—according to preset weighting coefficients to obtain the perceived independent deployment tendency. The value range of this tendency is [0,1]. The larger the value, the more proactive measures the system needs to take to strengthen the customer's perception of "local independent deployment" in the current scenario.

[0086] It should be noted that the specific uses of the calculation results of the perceived independent deployment tendency are as follows:

[0087] As the main positive input to the dynamic routing decision factor, it directly affects whether the subsequent choice is to adopt a forced local proxy mode or a progressive hybrid proxy mode.

[0088] By indirectly participating in the calculation of the local data visibility masking intensity, the display strategy of sensitive fields on the user interface (such as real-time value, snapshot value, blurring, or additional local hints) can be determined.

[0089] This forms a closed-loop connection with the subsequent calculation of perceived security satisfaction. When the independent deployment tendency sequence is low, the overall local agent tendency can be indirectly enhanced through an adaptive adjustment mechanism.

[0090] Furthermore, when the perceived independent deployment tendency sequence remains low, the overall local proxy tendency of the system can be indirectly enhanced through the closed-loop adjustment mechanism of subsequent perceived security satisfaction.

[0091] In one specific embodiment of the present invention, based on the perceived independent deployment tendency, system security risk index, and access source trust classification, a dynamic routing decision factor is calculated to determine the proxy mode. Specifically,

[0092] The local entry server receives the current system security risk index from the cloud data server. ;

[0093] Combined with the aforementioned perception of independent deployment tendency and the access source trust classification Calculate the dynamic routing decision factor The formula is:

[0094]

[0095] in, This is a sensitivity adjustment parameter;

[0096] The calculated Each is compared with the preset forced local proxy trigger threshold. and direct cloud pass-through security acceptance threshold The comparison is performed, and the proxy mode for the current access is determined based on the comparison result.

[0097] when At that time, it is determined to be in forced local proxy mode;

[0098] when At that time, it was determined to be a progressive hybrid proxy model;

[0099] when At that time, it was determined to be in direct cloud pass-through mode.

[0100] It should be noted that the calculation of dynamic routing decision factors and the determination of the proxy mode are intended to comprehensively consider customer perceived needs, overall system security posture and the trustworthiness of the access source, and dynamically determine the specific data access path for this request, thereby achieving an intelligent and controllable balance between strengthening the customer's perception of "local independent deployment" and ensuring efficient access for the company headquarters.

[0101] Furthermore, after the local entry server completes the calculation of the perceived independent deployment tendency, it receives the current system security risk index from the cloud in real time through an encrypted channel with the cloud data server. This index is derived by the cloud data server based on a comprehensive evaluation of global security monitoring modules (such as intrusion detection, abnormal traffic analysis, threat intelligence, etc.) and is used to reflect the current security risk level of the entire system.

[0102] Furthermore, the system nonlinearly combines the perceived independent deployment tendency, system security risk index, and access source trust level to obtain a dynamic routing decision factor. The value range of this decision factor is [0,1]. The larger the value, the more the system tends to perform strong proxy processing through the local entry server in order to prioritize meeting the customer's perceived need for local independent deployment.

[0103] Furthermore, based on the calculated values ​​and two preset thresholds (forced local agent trigger threshold), and direct cloud pass-through security acceptance threshold By comparing the two, we can determine the proxy mode to be used for this access: forced local proxy mode, progressive hybrid proxy mode, or direct cloud pass-through mode.

[0104] It should be noted that the specific uses of determining dynamic routing decision factors and agent patterns are as follows:

[0105] The calculation basis directly determines the intensity of subsequent local data visibility masking, thereby affecting how sensitive fields are presented on the user interface (such as real-time display, snapshot replacement, blurring, or additional local visual cues).

[0106] Determine the specific processing path for core business write operations, including whether local temporary storage is required, transaction packaging and uploading, and the interface refresh strategy after returning from the cloud;

[0107] By implementing differentiated execution through three proxy modes, we achieve strong local awareness protection when customers access the internal network and efficient direct connection when the company headquarters accesses the public network, thus supporting the fundamental goal of a dual-entry hybrid deployment architecture.

[0108] The results indirectly participate in the closed-loop calculation of subsequent perceived security satisfaction. When the overall security risk increases or the perceived tendency is insufficient, the local agent tendency can be further strengthened through adaptive threshold adjustment.

[0109] In a specific embodiment of the present invention, the initial threshold is set to... , , This set of parameters can be fine-tuned in actual deployment according to the network environment and security requirements of different customer groups (such as discrete manufacturing or process manufacturing plants).

[0110] In one specific embodiment of the present invention, based on the determined proxy mode and dynamic routing decision factor, the local data visibility masking strength is calculated on the local entry server to control the user interface display strategy for sensitive fields. Specifically,

[0111] When entering forced local proxy mode or progressive hybrid proxy mode, the local entry server counts the number of sensitive fields involved in this request. and request depth ;

[0112] Combining the dynamic routing decision factors Trust rating of access sources Calculate the local data visibility masking intensity. The formula is:

[0113]

[0114] in, This is the adjustment coefficient;

[0115] according to The value determines the strength of the masking applied to sensitive fields. The higher the value, the stronger the hiding, blurring, or visual cues for sensitive fields;

[0116] After determining to enter the progressive hybrid proxy mode, an appropriate masking intensity is determined and applied on the local entry server based on the DRDF(t) value to achieve transitional control of the display of sensitive fields;

[0117] When entering the direct cloud pass-through mode, the user interface display request is directly passed through to the cloud data server for processing.

[0118] It should be noted that calculating the local data visibility masking strength to control the user interface display strategy for sensitive fields aims to refine and dynamically control the presentation of sensitive fields related to core business on the customer interface based on the current agent mode and decision-making tendency, thereby maximizing the perception of "local independent deployment" while ensuring an overall balance between data authenticity and security.

[0119] Furthermore, when the system determines that the current access is in forced local proxy mode or progressive hybrid proxy mode, the local entry server first analyzes the business context of this request, counts the number of sensitive fields involved in this request (such as formula parameters, key values ​​of production processes, accurate inventory quantities, quality inspection results, etc.), and the depth of the request operation. (Defined by hierarchy: 1 indicates viewing only the dashboard, 2 indicates querying details, and 3 indicates operations involving modification or submission).

[0120] Furthermore, the system combines the above statistical results with dynamic routing decision factors and access source trust levels to calculate the local data visibility masking strength. This strength value is directly used to quantify the masking intensity required for sensitive fields in this request: the higher the value, the stronger the system's judgment that the customer has a stronger need for "local data security" in the current scenario, and therefore stronger protection measures should be taken.

[0121] Furthermore, based on the calculation results of the local data visibility masking intensity, the local entry server implements differentiated display strategies for sensitive fields when rendering the user interface, including but not limited to:

[0122] Displays the value of the last successfully synchronized local snapshot instead of the real-time cloud value;

[0123] Perform range fuzzing processing on numerical sensitive fields (e.g., display the exact inventory value as "500~1000 pieces");

[0124] Overlay visual prompts such as "Local server data" or "Local cache" near the field or in a prominent position on the interface;

[0125] For high-depth operations, further limit the real-time refresh rate or display temporary placeholders.

[0126] Furthermore, in the progressive hybrid agent mode, the system adopts an appropriate masking intensity based on the intermediate value range of the dynamic routing decision factor to achieve a smooth transition from "near local perception" to "near real-time cloud display" and avoid abrupt changes in user perception.

[0127] Furthermore, when the system determines that it is in direct cloud pass-through mode (usually corresponding to access from the company headquarters or a high-trust source), the local entry server no longer performs any masking calculations or local rendering interventions, but directly passes through the user interface display request to the cloud data server. The cloud is responsible for the complete and real-time interface generation and data presentation, thereby ensuring that headquarters managers obtain the most efficient and accurate data view.

[0128] It should be noted that the specific role of the local data visibility masking strength in the entire access control process is as follows:

[0129] As a direct downstream product of dynamic routing decision factors, the results of routing decisions are concretized into specific user experience differences visible at the interface layer.

[0130] Achieving a delicate balance between "perceptual protection" and "data authenticity": enhancing the sense of local independence through a masking mechanism when accessing the customer's intranet, while fully releasing the real data when accessing the headquarters;

[0131] By dynamically controlling sensitive fields on a request-by-request and depth-by-depth basis, it effectively supports the secure display requirements of highly confidential data such as formula processes, production parameters, and quality records.

[0132] Its historical sequence values ​​are used in the calculation of subsequent perceived security satisfaction, forming a closed-loop feedback mechanism. When the masking intensity is consistently low, it can trigger threshold adaptive adjustment, further enhancing the overall local proxy tendency.

[0133] In one specific embodiment of the present invention, a mapping relationship between masking intensity and specific display strategies is pre-established, such as: when Real-time cloud values ​​are displayed. Displays the last synchronized snapshot value with a "Local Cache" badge; Display range values ​​for numeric fields; A strong "local server data" watermark is applied and real-time refresh is restricted. This mapping table can be dynamically adjusted in the system configuration.

[0134] In one specific embodiment of the present invention, according to the proxy mode, the core business write operation is sent to the cloud data server for actual storage via an encrypted channel. Specifically,

[0135] In the forced local proxy mode, when a core business write operation is received, the local entry server generates a temporary transaction identifier and associates the write operation content, the temporary transaction identifier, and the trust level of the current access source. and dynamic routing decision factors The data is sent to the cloud data server via an encrypted channel for actual writing.

[0136] In the progressive hybrid proxy mode, the local entry server temporarily stores some of the core business write operations locally, while sending the remaining operation content to the cloud data server through an encrypted channel. After the cloud data server returns a new version number and verification value, the local temporary storage and cloud data are merged.

[0137] In the direct cloud pass-through mode, the local entry server directly transmits the core business write operation content along with the temporary transaction identifier to the cloud data server through the encrypted channel to perform a complete write.

[0138] After the cloud data server completes the write operation, it returns a new version number and checksum to the local entry server. The local entry server then uses this information to determine the correct version number and checksum. The value and the agent mode are used to update the user interface using partial real-time refresh, gradual synchronous refresh, or delayed polling.

[0139] It should be noted that sending core business write operations to the cloud data server for actual storage is intended to ensure that all modifications to core business data are ultimately persisted by the cloud data server, thereby achieving the goals of centralized data management, reliable backup, and real-time multi-point synchronization. At the same time, the processing path for write operations is designed differently according to different proxy modes to balance customer perception consistency, data security, and user interface responsiveness.

[0140] Furthermore, in the forced local proxy mode, when the local entry server receives a user's core business write operation (such as production order entry, formula adjustment, inventory deduction, etc.), it immediately generates a unique temporary transaction identifier. It then packages the specific content of the write operation, the temporary transaction identifier, the current access source trust level, and dynamic routing decision factors, and sends this complete message to the cloud data server through a pre-established two-way authentication encrypted channel. The cloud then executes the actual data write operation. This path emphasizes that the local entry server does not perform any persistence, acting only as a relay proxy to maintain the customer's perception of "data being stored locally" to the greatest extent possible.

[0141] Furthermore, in the progressive hybrid proxy mode, the local entry server first performs partial local temporary storage for write operations (e.g., only storing non-critical fields or temporary states), while simultaneously uploading the core modifications to the cloud data server via an encrypted channel for execution. Once the cloud completes the operation and returns a new version number and verification value, the local entry server then merges and verifies the locally stored data based on the returned results. This path retains a limited temporary state locally, facilitating a smoother user experience during brief network fluctuations, while ensuring that final data consistency remains primarily cloud-driven.

[0142] Furthermore, in the direct cloud pass-through mode, the local entry server does not perform any local processing on write operations. After generating a temporary transaction identifier, it directly transmits the entire write operation content along with the temporary transaction identifier to the cloud data server through an encrypted channel, whereby the cloud directly executes the complete write operation. This path is suitable for access from high-trust sources, ensuring maximum efficiency and minimum latency.

[0143] Furthermore, regardless of the path chosen, the cloud data server will return a new version number and checksum to the local entry server after completing the write operation. Upon receiving this information, the local entry server will update the user interface using one of the following three refresh strategies, based on the current value of the dynamic routing decision factor DRDF(t) and its current proxy mode:

[0144] Local instant refresh: Immediately updates the affected interface area, suitable for scenarios that require maintaining strong perceptual continuity under forced local proxy mode;

[0145] Progressive synchronous refresh: Updates the interface in batches or with a short delay. Suitable for progressive hybrid proxy mode to balance perception and performance.

[0146] Delayed polling refresh: Updates the interface through a timed polling mechanism, suitable for direct cloud pass-through mode or low-priority scenarios to reduce real-time communication overhead.

[0147] In a specific implementation scenario of the present invention, during the merging process in the progressive hybrid proxy mode, an optimistic locking mechanism based on version number is adopted: if the new version number returned by the cloud is inconsistent with the locally stored version, the cloud version shall prevail, and a conflict log shall be recorded for subsequent auditing.

[0148] In one specific embodiment of the present invention, after each periodic incremental data synchronization is completed, the cloud data server issues the system security risk index for the current period;

[0149] The local entry server collects the recent historical average of the perceived independent deployment tendency. and the average visibility masking intensity of recent historical local data ;

[0150] Calculate perceived security satisfaction based on current security risk assessment values. The formula is:

[0151]

[0152] in, The parameter representing the nonlinear influence of the masking intensity is... Contributes parameters to perceived tendency;

[0153] when When the threshold is below the preset minimum perceived security threshold, increase the forced local agent trigger threshold. This enhances the local proxy tendency for subsequent access requests.

[0154] It should be noted that the adaptive adjustment of perceived security aims to achieve dynamic optimization of the agent mode decision threshold by continuously monitoring the overall perceived security status of the system. In this way, when external security risks change or customer usage behavior fluctuates, it can automatically enhance or maintain the customer's subjective security perception of "local independent deployment", ensuring that the hybrid deployment architecture maintains a high level of user acceptance and psychological stability throughout the long-term operation.

[0155] Furthermore, after each periodic incremental data synchronization task is completed, the cloud data server sends the system security risk index calculated for the current period to the local entry server.

[0156] Furthermore, the local entry server then collects and calculates recent historical data sequences, including:

[0157] The recent average of the perceived independent deployment tendency, which reflects the overall responsiveness of the system to customer on-premises perceived needs over a period of time;

[0158] The recent average of the local data visibility masking strength, which represents the average enforcement of sensitive field protection measures over a past period.

[0159] Furthermore, based on the aforementioned historical average and the currently received system security risk index, the system calculates the perceived security satisfaction at the current moment. This satisfaction index comprehensively evaluates the customer's subjective satisfaction with the system's "local data storage experience" in the current security environment.

[0160] When the calculated perceived security satisfaction level is lower than the preset minimum perceived security threshold, the system automatically raises the forced local agent trigger threshold. The value of makes it easier for subsequent access requests to enter the forced local proxy mode or the progressive hybrid proxy mode, thereby increasing the local proxy tendency and the data masking strength accordingly.

[0161] In one specific implementation of the present invention, the initial perceived safety minimum threshold is set to 0.72. When the perceived safety satisfaction level is lower than this value, Each adjustment will be made by 0.05 to 0.10 (with a maximum of 0.90) to prevent excessive adjustment from causing fluctuations.

[0162] In a second embodiment of the present invention, the present invention provides a data access system for a factory management system based on a dual-entry hybrid deployment, such as... Figure 2 As shown, the system includes a perception tendency calculation module 12, a dynamic routing decision module, and a write operation control module 3;

[0163] The perception tendency calculation module 1 is used to receive access requests on the local entry server, calculate the access source trust level according to the request source, and calculate the perception independent deployment tendency based on the trust level, local cache hit rate and cloud latency compensation factor.

[0164] The dynamic routing decision module 2 is used to calculate dynamic routing decision factors and determine the proxy mode based on the perceived independent deployment tendency, system security risk index and access source trust level.

[0165] The write operation control module 3 is used to calculate the local data visibility masking strength on the local entry server according to the determined proxy mode and dynamic routing decision factor in order to control the user interface display strategy of sensitive fields. At the same time, according to the proxy mode, the core business write operation is sent to the cloud data server through an encrypted channel for actual storage.

[0166] In a third embodiment of the present invention, the present invention provides an electronic device, including a memory and a processor, characterized in that the memory stores a computer program that can run on the processor, and when the program is executed on the processor, it implements the steps in the factory management system data access method based on dual-entry hybrid deployment as described above.

[0167] In Embodiment 4 of the present invention, a storage medium is provided, the storage medium storing a computer program, characterized in that, when the computer program is executed by a processor, it implements the steps in the factory management system data access method based on dual-entry hybrid deployment as described above.

[0168] In summary, this invention provides a data access method and system for a factory management system based on a dual-entry hybrid deployment. Through a dual-entry hybrid deployment architecture and a dynamic perception control mechanism, it effectively decouples the "sense of independent deployment" on the customer side from actual cloud storage. This allows SMEs to perceive it as a traditional on-premises system, eliminating psychological barriers to data migration to the cloud. Simultaneously, core production data is centrally stored in the cloud, fully leveraging the professional security capabilities and low-cost storage advantages of cloud service providers. Furthermore, the company headquarters can access the customer's factory's production and operation data in real-time and directly through an independent public network entry point, achieving efficient remote management and unified coordination across multiple factories. This solution effectively balances the contradictions of security, cost, and management efficiency without increasing the burden on the customer's local hardware or sacrificing data consistency, making it particularly suitable for the digital transformation needs of a large number of small and medium-sized manufacturing enterprises in China.

[0169] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working process of the modules described above can be referred to the corresponding process in the aforementioned method implementation, and will not be repeated here.

[0170] The modules described as separate components may or may not be physically separate. Similarly, the components shown as modules may or may not be physical modules; they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this embodiment, depending on actual needs.

[0171] Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The integrated module can be implemented in hardware or in a combination of hardware and software functional modules.

[0172] The integrated modules implemented as software functional modules described above can be stored in a computer-readable storage medium. These software functional modules, stored in a storage medium, include several instructions to cause a computer system (which may be a personal computer, server, or network system, etc.) or processor to execute some steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0173] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A data access method for a factory management system based on a dual-entry hybrid deployment, characterized in that: include, The local entry server receives access requests, calculates the access source trust level based on the request source, and calculates the perceived independent deployment tendency based on the trust level, local cache hit rate and cloud latency compensation factor. Based on the perceived independent deployment tendency, system security risk index and access source trust classification, dynamic routing decision factors are calculated to determine the proxy mode; Based on the determined proxy mode and dynamic routing decision factors, the local data visibility masking strength is calculated on the local entry server to control the user interface display strategy of sensitive fields. At the same time, according to the proxy mode, the core business write operations are sent to the cloud data server through an encrypted channel for actual storage.

2. The data access method for a factory management system based on dual-entry hybrid deployment according to claim 1, characterized in that: The calculation of access source trust classification based on request source includes... After receiving an access request, the local entry server obtains the authorization indicator value, time decay factor, and intranet indicator value corresponding to the request source in the currently maintained status table through an encrypted channel with the cloud data server. Based on the acquired authorization indication value, time decay factor, and internal network indication value, the trust level of the access source is calculated in real time. The formula is: ； in, The normalization coefficient is... The weight of the internal network indicator value. This is an indicator value indicating whether the request at time t originated from the customer's internal network. The weight of the authorization instruction value, For the current time t, is the request to determine whether it matches the instruction value authorized by the company headquarters? The weights of the time decay factor, It is the normalized decay factor of the time difference between the current time t and the last successful authentication.

3. The data access method for a factory management system based on dual-entry hybrid deployment according to claim 2, characterized in that: The calculation of the perceived independent deployment tendency based on the trust level, local cache hit rate, and cloud latency compensation factor includes: Obtain the cache hit ratio in real time from the local cache management module on the local entry server. And the delay compensation factor calculated based on the actual measured cloud round-trip time. ; Based on the current cache hit rate, cloud latency compensation factor, and the access source trust classification. Calculate the perceived independent deployment tendency The formula is: ； in, The coefficients for the reverse weighting of trust grading. The coefficient for the reverse weight of cache hits. This is the coefficient for the delay compensation weight.

4. The data access method for a factory management system based on dual-entry hybrid deployment according to claim 3, characterized in that: The process of calculating dynamic routing decision factors and determining proxy modes based on perceived independent deployment tendency, system security risk index, and access source trust classification includes: The local entry server receives the current system security risk index from the cloud data server. ; Combined with the aforementioned perception of independent deployment tendency and the access source trust classification Calculate the dynamic routing decision factor The formula is: ； in, This is a sensitivity adjustment parameter; The calculated Each is compared with the preset forced local proxy trigger threshold. and direct cloud pass-through security acceptance threshold The comparison is performed, and the proxy mode for the current access is determined based on the comparison result. when At that time, it is determined to be in forced local proxy mode; when At that time, it was determined to be a progressive hybrid proxy model; when At that time, it was determined to be in direct cloud pass-through mode.

5. The data access method for a factory management system based on dual-entry hybrid deployment according to claim 4, characterized in that: The step of calculating the local data visibility masking strength on the local entry server to control the user interface display strategy for sensitive fields based on the determined proxy mode and dynamic routing decision factors includes: When entering forced local proxy mode or progressive hybrid proxy mode, the local entry server counts the number of sensitive fields involved in this request. and request depth ; Combining the dynamic routing decision factors Trust rating of access sources Calculate the local data visibility masking intensity. The formula is: ； in, This is the adjustment coefficient; according to The value determines the strength of the masking applied to sensitive fields. The higher the value, the stronger the hiding, blurring, or visual cues for sensitive fields; After determining to enter the progressive hybrid proxy mode, an appropriate masking intensity is determined and applied on the local entry server based on the DRDF(t) value to achieve transitional control of the display of sensitive fields; When entering the direct cloud pass-through mode, the user interface display request is directly passed through to the cloud data server for processing.

6. The data access method for a factory management system based on dual-entry hybrid deployment according to claim 5, characterized in that: The step of sending core business write operations to the cloud data server for actual storage via an encrypted channel according to the proxy model includes... In the forced local proxy mode, when a core business write operation is received, the local entry server generates a temporary transaction identifier and associates the write operation content, the temporary transaction identifier, and the trust level of the current access source. and dynamic routing decision factors The data is sent to the cloud data server via an encrypted channel for actual writing. In the progressive hybrid proxy mode, the local entry server temporarily stores some of the core business write operations locally, while sending the remaining operation content to the cloud data server through an encrypted channel. After the cloud data server returns a new version number and verification value, the local temporary storage and cloud data are merged. In the direct cloud pass-through mode, the local entry server directly transmits the core business write operation content along with the temporary transaction identifier to the cloud data server through the encrypted channel to perform a complete write. After the cloud data server completes the write operation, it returns a new version number and checksum to the local entry server. The local entry server then uses this information to determine the correct version number and checksum. The value and the agent mode are used to update the user interface using partial real-time refresh, gradual synchronous refresh, or delayed polling.

7. The data access method for a factory management system based on dual-entry hybrid deployment according to claim 1, characterized in that: It also includes, After each periodic incremental data synchronization is completed, the cloud data server issues the system security risk index for the current period. The local entry server collects the recent historical average of the perceived independent deployment tendency. and the average visibility masking intensity of recent historical local data ; Calculate perceived security satisfaction based on current security risk assessment values. The formula is: ； in, The parameter representing the nonlinear influence of the masking intensity is... Contributes parameters to perceived tendency; when When the threshold is below the preset minimum perceived security threshold, increase the forced local agent trigger threshold. This enhances the local proxy tendency for subsequent access requests.

8. A data access system for a factory management system based on a dual-entry hybrid deployment, characterized in that: It includes a perception tendency calculation module, a dynamic routing decision module, and a write operation control module; The perception tendency calculation module is used to receive access requests on the local entry server, calculate the access source trust level according to the request source, and calculate the perception independent deployment tendency based on the trust level, local cache hit rate and cloud latency compensation factor. The dynamic routing decision module is used to calculate dynamic routing decision factors and determine the proxy mode based on perceived independent deployment tendency, system security risk index and access source trust level. The write operation control module is used to calculate the local data visibility masking strength on the local entry server according to the determined proxy mode and dynamic routing decision factor in order to control the user interface display strategy of sensitive fields. At the same time, according to the proxy mode, the core business write operation is sent to the cloud data server through an encrypted channel for actual storage.

9. An electronic device, comprising a memory and a processor, characterized in that: The memory stores a computer program that can run on the processor, and when the program is executed on the processor, it implements the steps in the factory management system data access method based on dual-entry hybrid deployment as described in any one of claims 1-7.

10. A storage medium storing a computer program, characterized in that: When the computer program is executed by the processor, it implements the steps in the factory management system data access method based on dual-entry hybrid deployment as described in any one of claims 1-7.

Images