Firmware security upgrading method and system of industrial switch

Abstract

The invention discloses a firmware security upgrading method and system for an industrial switch, and the method comprises the steps: dividing an independent region with the same size as a physical sector in an SPI Flash as an environment variable region, and dividing a first system partition and a second system partition with equivalent functions in an eMMC or NAND Flash; when the industrial switch receives a firmware upgrading instruction, detecting a current running system partition of the eMMC or the NAND Flash, and taking the other system partition as a target upgrading partition; obtaining data of the new version firmware, writing the data into the target upgrading partition, and performing firmware integrity verification after writing is completed; after the firmware integrity verification is passed, atomic switching operation is executed; unattended rollback operation is executed; and executing a service health confirmation operation. According to the invention, the problem of unavailability of equipment caused by brick change or zombie online in an industrial field due to power failure is effectively prevented, and high-reliability remote operation and maintenance without manual intervention is realized.

Description

Technical Field

[0001] This invention relates to the field of embedded systems and network communication technology, specifically to a firmware security upgrade method and system for industrial switches. Background Technology

[0002] With the rapid development of Industrial Internet and Internet of Things technologies, industrial switches, as a key infrastructure for network communication, are widely used in complex environments such as smart grids, rail transit, and integrated utility tunnels. To fix security vulnerabilities, add new features, or optimize performance, remote firmware upgrades for switches have become a routine requirement for equipment maintenance.

[0003] Traditional embedded device firmware upgrades typically employ the following methods:

[0004] 1. Single-partition overwrite upgrade solution: Directly write the new firmware to the currently running partition. This solution is simple to implement, but extremely risky. If a power outage, network interruption, or Flash write error occurs during the writing process, the device will be unable to boot due to firmware corruption (commonly known as "bricked") and must be returned to the factory for repair, which is unacceptable in industrial environments.

[0005] 2. Independent Recovery Partition Solution: A miniature recovery system is reserved in Flash memory. It enters recovery mode when the main system fails. However, this solution requires additional storage space (typically 5-10MB), and the recovery mode has limited functionality, cannot maintain normal network services, and still requires manual intervention to restart after an upgrade failure.

[0006] 3. Traditional dual-partition (A / B) switching scheme: This involves creating two system partitions in the storage and upgrading them alternately. While this scheme solves some backup issues, it has the following three problems:

[0007] 1) Lack of atomic switching mechanism: Existing boot flags are usually stored directly in the file system (such as EXT4 or UBIFS) of large-capacity NAND Flash or eMMC. Since file system metadata updates are not atomic operations, and the underlying Flash is susceptible to bit flipping, if a power outage occurs at the moment the flag is modified, it can easily lead to file system corruption or loss of flag data, making it impossible for the bootloader to read the boot parameters, resulting in complete device failure.

[0008] 2) Lack of true unattended operation capability: Existing solutions typically only check whether the Linux kernel has been successfully loaded. However, the core functions of industrial switches rely on dedicated switching chips (ASICs). If the new firmware kernel boots normally, but the switching chip driver fails to initialize or the configuration is incorrectly distributed, the device may be able to ping the management port, but the data forwarding plane will be completely ineffective (i.e., "zombie state"). At this time, the device cannot automatically revert to the old version, resulting in a long-term interruption of the production network. Maintenance personnel must carry serial cables to remote industrial sites for manual recovery, resulting in extremely high maintenance costs.

[0009] 3) Limited storage and bandwidth resources: Industrial switches are typically deployed in bandwidth-constrained network environments (such as 4G / 5G backhaul or low-speed private networks). Downloading a full firmware file of tens of megabytes is extremely time-consuming and prone to failure. In addition, dual-system architectures often result in scattered configuration files, requiring complex configuration migration scripts after upgrades, which can easily lead to the loss of service configurations.

[0010] Therefore, there is an urgent need for a firmware security upgrade method for industrial switch scenarios that combines the advantages of dual-media hardware, atomic power failure protection capabilities, and a service-level automatic rollback mechanism. Summary of the Invention

[0011] To overcome the technical problems existing in the firmware upgrade technology of industrial switches, such as the lack of hardware-level partition switching mechanism which easily leads to device bricking, the lack of deep business status perception capability after upgrade failure which requires manual on-site intervention, and the difficulty in synchronizing business configuration data under dual system architecture, this invention provides a firmware security upgrade method and system for industrial switches.

[0012] The technical solution of this invention is as follows:

[0013] In a first aspect, the present invention provides a firmware security upgrade method for an industrial switch, wherein the industrial switch is configured with a dual-media storage architecture, the dual-media storage architecture including SPIFlash as a first storage medium and eMMC or NAND Flash as a second storage medium, the method comprising the following steps:

[0014] In the SPI Flash, an independent area of ​​the same size as the physical sector is set up as an environment variable area, and in the eMMC or NAND Flash, a first system partition and a second system partition with equivalent functions are set up.

[0015] When an industrial switch receives a firmware upgrade command, it detects the system partition currently running on the eMMC or NAND Flash and selects another system partition as the target upgrade partition.

[0016] Obtain the data of the new firmware version and write it to the target upgrade partition. After the writing is completed, perform firmware integrity verification.

[0017] After the firmware integrity verification passes, an atomic switching operation is performed: a cyclic redundancy check code containing partition identifier variables is calculated, and the physical sector erasure characteristics of the SPIFlash are used to perform a one-time erasure and write operation on the physical sector where the environment variable area is located.

[0018] Perform unattended rollback operation: The bootloader reads and increments the boot attempt counter stored in the SPIFlash during startup. When the count of the boot attempt counter reaches a preset threshold, it automatically switches the partition identifier variable back to the system partition that was running normally last time and resets the boot attempt counter.

[0019] Perform a business health verification operation: After the operating system starts, a monitoring daemon runs in user space, polling the status register of the switch chip driver and the port status of the network management protocol. Only when the switch chip driver is successfully loaded and the port status of the network management protocol is reachable, the detection is deemed successful and the startup attempt counter is cleared.

[0020] As a preferred embodiment of the present invention, the atomic switching operation includes the following steps:

[0021] Before performing the write operation, calculate the cyclic redundancy check code of the environment variable data to be written;

[0022] The partition identifier variable is combined with the cyclic redundancy check code to fill one physical sector of the SPIFlash;

[0023] When the bootloader reads the environment variable area, it first calculates and compares the cyclic redundancy check code. If the check fails, it determines that a power failure occurred during the atomic write process and automatically loads the preset security partition or the partition that was successfully started last time.

[0024] As a preferred embodiment of the present invention, the eMMC or NAND Flash is further divided into a shared data partition that is independent of the first system partition and the second system partition;

[0025] The shared data partition is independent of the first system partition and the second system partition, and is used to store the port configuration files, VLAN configuration data and system logs of the industrial switch;

[0026] When the operating system starts, it reads the partition table information and mounts the shared data partition to the same fixed logical path of the file system.

[0027] As a preferred embodiment of the present invention, the step of writing to the target upgrade partition includes the following steps:

[0028] The industrial switch receives binary differential packets generated by the server.

[0029] Read the image of the old firmware from the target upgrade partition into the memory buffer of the operating system;

[0030] The old firmware image is reassembled with the binary differential packet using a binary differential synthesis algorithm in the memory buffer to restore the complete new firmware image, and then written to the target upgrade partition.

[0031] As a preferred embodiment of the present invention, the bootloader is configured as follows:

[0032] After each power-on reset, the environment variable area in the SPIFlash is read first.

[0033] If the read data verification fails, or if the count of the read startup attempt counter exceeds the preset threshold, the indication of the partition identifier variable is ignored, the preset security partition or the partition that was successfully started last time is forcibly loaded, and the forced loading event is recorded in the system log of the shared data partition.

[0034] As a preferred embodiment of the present invention, the business health confirmation operation further includes a watchdog linkage mechanism:

[0035] The monitoring daemon starts a watchdog timer upon startup;

[0036] If the monitoring daemon process fails to confirm that the switching chip driver has been successfully loaded and the port status of the network management protocol is normal within the preset time window, it will stop sending the watchdog feed signal to the watchdog.

[0037] The watchdog timeout reset function is used to forcibly restart the industrial switch, thereby triggering the bootloader to increment the startup attempt counter and perform an automatic rollback process.

[0038] Secondly, the present invention provides a firmware security upgrade system for an industrial switch, and a firmware security upgrade method for an industrial switch performing any of the above-described schemes, comprising:

[0039] A dual-media storage module includes an SPIFlash connected via an SPI bus and serving as the first storage medium, and an eMMC or NAND Flash connected via an eMMC or NAND interface and serving as the second storage medium. The SPIFlash is divided into an environment variable area with the same size as the physical sector, and the eMMC or NAND Flash is divided into a first system partition and a second system partition with equivalent functions.

[0040] The firmware download module is used to detect the currently running system partition of the eMMC or NAND Flash when the industrial switch receives a firmware upgrade instruction, select another system partition as the target upgrade partition, and start downloading the new version of firmware.

[0041] The firmware verification module is used to obtain the data of the new version firmware downloaded by the firmware download module and write it into the target upgrade partition, and perform firmware integrity verification after the writing is completed.

[0042] The partition switching control module is used to calculate the cyclic redundancy check code containing the partition identifier variable after the firmware integrity verification passes, and to perform a one-time erase and write operation on the physical sector where the environment variable area is located by utilizing the physical sector erase characteristics of the SPIFlash.

[0043] The intelligent boot module, which runs in the boot program, is used to manage the boot attempt counter stored in the SPIFlash and execute boot count accumulation, threshold judgment and automatic fault rollback logic.

[0044] The health monitoring module runs as a daemon process in the user space of the operating system. It polls the status register of the switch chip driver and the port status of the network management protocol. Only when the switch chip driver is successfully loaded and the port status of the network management protocol is reachable, the detection is deemed successful and the startup attempt counter is cleared.

[0045] As a preferred embodiment of the present invention, the hardware connection configuration of the dual-media storage module is as follows:

[0046] The SPIFlash serves as the sole boot source for the operating system, storing the boot program area and the environment variable area.

[0047] The eMMC or NAND Flash serves as a high-capacity storage source, storing the Linux kernel image, root file system, and independently partitioned shared data.

[0048] As a preferred embodiment of the present invention, the firmware verification module is configured with an incremental synthesis unit, which is configured as follows:

[0049] The old firmware version read from the target upgrade partition and the obtained binary differential packet are loaded into the memory buffer of the operating system. The differential algorithm is used to restore the complete image of the new firmware version and write it directly to the target upgrade partition.

[0050] As a preferred embodiment of the present invention, the health monitoring module is configured with a watchdog interface unit:

[0051] The watchdog interface unit activates the watchdog when the operating system starts.

[0052] If the health monitoring module fails to confirm normal operation within the preset time window, the watchdog interface unit stops sending feed signals to the watchdog and waits for the watchdog to time out and reset to trigger the automatic rollback logic of the smart guidance module.

[0053] According to the above-described solution, the beneficial effects of this invention are as follows:

[0054] 1. Absolute hardware-level reliability (anti-bricking): This invention does not rely on the file system. It directly utilizes the physical sector erasure characteristics of SPIFlash in conjunction with CRC verification to achieve atomic modification of the boot flag, ensuring that data writing either succeeds completely or automatically rolls back due to CRC failure. This completely eliminates the risk of boot parameters being damaged and the device failing to boot due to power failure during writing.

[0055] 2. Deep business awareness-based zero-contact operation and maintenance (intelligent rollback): Unlike general kernel detection, this invention can identify the zombie online (i.e., kernel running but data plane paralyzed) fault unique to industrial switches by polling the status register of the switching chip; once the anomaly is identified, through the linkage of the watchdog and the startup attempt counter, the device can automatically and losslessly roll back to the old version in a very short time, which significantly reduces the cost of remote operation and maintenance.

[0056] 3. Optimized storage and configuration management: The dual-media storage architecture balances the high security of the bootloader (SPIFlash) and the large capacity requirements of the system image (eMMC or NAND Flash); at the same time, the shared data partition design based on the mount mechanism avoids the risk of configuration loss during the upgrade process and ensures the seamless inheritance of critical business configurations such as VLANs and ports. Attached Figure Description

[0057] Figure 1 This is a schematic diagram of the storage address layout based on a dual-media storage architecture of SPIFlash and eMMC in one embodiment of the present invention;

[0058] Figure 2 This is an overall flowchart of a firmware security upgrade method for an industrial switch according to an embodiment of the present invention;

[0059] Figure 3 This is a flowchart of the incremental upgrade data processing in one embodiment of the present invention;

[0060] Figure 4 This is a timing diagram of the intelligent start-up counting and automatic rollback mechanism in one embodiment of the present invention;

[0061] Figure 5 This is a schematic diagram of the architecture of an industrial switch firmware security upgrade system according to one embodiment of the present invention;

[0062] Figure 6 This is a schematic diagram of the structure of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0063] To make the technical problems to be solved, the technical solutions, and the beneficial effects of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0064] It should be noted that the terms "comprising" and "having," and any variations thereof, in the specification and claims of this invention are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or units is not limited to the steps or units listed, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products, or devices.

[0065] like Figure 1 As shown, the industrial switch used in this invention is configured with a dual-media storage architecture consisting of a small-capacity, high-reliability medium and a large-capacity, high-speed medium, including SPIFlash as the first storage medium and eMMC or NAND Flash as the second storage medium.

[0066] Specifically, the first storage medium (SPIFlash) uses NOR Flash (e.g., model GD25Q64, 8MB), connected to the main control chip of the industrial switch via the SPI bus. The key reason for choosing this medium is its physical characteristic of supporting independent erasure in fixed-size (typically 4KB) sectors. This medium is used to store:

[0067] 1) Bootloader area (U-Boot): Stores the bootloader, ensuring the device's lowest-level boot capability.

[0068] 2) Environment Variable Area: Physical address such as 0x300000. The size of the environment variable area is the same as the physical sector (4KB) or an integer multiple of the physical sector size. This environment variable area is physically independent of the system image in eMMC and is specifically used to store the partition identifier variable (bootflag) and the boot attempt counter (boot_attempt).

[0069] Specifically, the second storage medium (eMMC or NAND Flash): uses high-capacity Flash (e.g., model SCA08G, 8GB), connected via an SDIO interface. This medium is used for storage:

[0070] 1) Dual system partitions (SystemA / B): A first system partition (SystemA) and a second system partition (SystemB) with equivalent functions take turns as the running partition and the upgrade target partition. The size of the first system partition and the second system partition is 512MB.

[0071] 2) SharedData Partition: Approximately 4GB in size, independent of the dual-system partition, used to store the industrial switch's port configuration files, VLAN configuration data, and system logs. This invention addresses the configuration inconsistency issue in dual-system architectures by creating an independent shared data partition (mount point: / mnt / flash) within the eMMC or NAND Flash. The shared data partition uses a compatible file system (such as EXT4). Regardless of whether the device boots from the first or second system partition, the operating system kernel, when loading the file system, will read the partition table information and mount the physical partition to the same fixed logical path (e.g., / mnt / flash). This ensures that VLAN database or SSH keys modified by the user in the first system partition remain effective after switching to the second system partition because they are read from the same physical location, eliminating the need for complex configuration migration scripts.

[0072] like Figure 2 As shown, one embodiment of the present invention provides a firmware security upgrade method for an industrial switch, the industrial switch being configured with... Figure 1 The dual-media storage architecture is shown. The method includes the following steps:

[0073] Step S1: In SPIFlash, allocate an independent area of ​​the same size as the physical sector as an environment variable area. In eMMC or NAND Flash, create a functionally equivalent first system partition and second system partition, as well as a shared data partition independent of the first and second system partitions. When the operating system starts, it reads the partition table information and mounts the shared data partition to the same fixed logical path in the file system, ensuring that the service configuration data of the industrial switch remains consistent before and after the upgrade without requiring migration operations.

[0074] Step S2: When the industrial switch receives a firmware upgrade command, it detects whether the currently running system partition of the eMMC or NAND Flash is the first system partition or the second system partition, and selects the other system partition as the target upgrade partition. For example, if the currently running system partition of the eMMC or NAND Flash is the first system partition, then the second system partition (i.e., the non-running partition) is selected as the target upgrade partition. Simultaneously, the new firmware version is downloaded, employing 256KB block transmission and a resume mechanism to ensure successful transmission even in unstable industrial networks.

[0075] Step S3: Obtain the data of the new firmware version and write it to the target upgrade partition. After writing is completed, perform firmware integrity and signature verification.

[0076] like Figure 3 As shown, specifically, writing to the target upgrade partition includes the following steps:

[0077] 1) Industrial switches receive binary differential packets (Patches) generated by the server for new and old firmware versions. The size of the binary differential packets is usually only 20%-30% of the full firmware.

[0078] 2) The industrial switch reads the image of the old firmware version from the target upgrade partition into the operating system's memory buffer (RAM);

[0079] 3) In the memory buffer, a binary differential synthesis algorithm (such as bspatch) is used to reassemble the image of the old firmware version with the binary differential package to restore the complete image of the new firmware version, and write it directly to the target upgrade partition. No intermediate temporary files are generated throughout the process, thereby saving storage space and extending the life of the storage medium.

[0080] The above-mentioned step of writing to the target upgrade partition adopts an incremental upgrade mode. For scenarios with limited bandwidth in industrial sites (such as 4G backhaul), compared with the full upgrade mode, it can save a lot of network traffic, significantly reduce the bandwidth occupation of the industrial production network, and greatly shorten the total upgrade time.

[0081] Step S4: After firmware integrity and signature verification pass, an atomic switching operation is performed: a cyclic redundancy check (CRC) code containing the partition identifier variable is calculated, and the physical sector erase capability of the SPI Flash is used to perform a one-time erase and write operation on the physical sector containing the environment variable area, enabling the industrial switch to boot from the target upgrade partition upon the next startup. Existing technologies typically modify flag bits in the file system, involving metadata updates, which are not atomic operations; however, this step in the present invention utilizes the hardware characteristics of SPI Flash to achieve an absolutely atomic operation.

[0082] Specifically, atomic switching operations include:

[0083] 1) Prepare data: Read a complete 4KB physical sector of data (i.e., environment variable data) from the environment variable area in the SPIFlash into the memory buffer, modify the partition identifier variable to point to the new system partition (such as the second system partition), and reset the boot attempt counter to 0.

[0084] 2) Calculate the verification: Before performing the write operation, calculate the cyclic redundancy check code (CRC32) of the environment variable data to be written;

[0085] 3) Sector filling: Combine the partition identifier variable with the cyclic redundancy check code, and fill the cyclic redundancy check code after combining the partition identifier variable to the end of a 4KB physical sector data, filling the 4KB physical sector data.

[0086] 4) Hardware atomic write: Call the SPIFlash driver interface to execute the sector erase instruction on the target physical address (0x300000), and then execute the page program instruction to write the data.

[0087] 5) When the bootloader reads the environment variable area, it first calculates and compares the cyclic redundancy check (CRC) code. If the check fails, it determines that a power outage occurred during the atomic write process and automatically loads the preset safe partition or the partition from the last successful boot. Due to the physical characteristics of SPIFlash, sector erasure is an indivisible physical process, thus constituting the following power-off protection logic:

[0088] A. If a power outage occurs before the sector erase instruction is executed: the target 4KB physical sector data in the SPIFlash remains unchanged, the partition identifier variable still points to the original system partition (such as the first system partition), and the operating system will boot from the original system partition after restarting, ensuring boot security;

[0089] B. If a power outage occurs after sector erasure but before page programming is completed: the target 4KB physical sector data will be in a state of all 0xFF null values ​​or in a state of partial garbled characters; after the system restarts, when the boot program reads the 4KB physical sector data, it will perform check code calculation and comparison operations, and the check will fail due to incomplete data.

[0090] C. Fallback Protection Mechanism: The bootloader is pre-programmed to first read the environment variable area in the SPIFlash after each device power-on reset; if the cyclic redundancy check (CRC) verification of the read environment variable area fails, or the count of the boot attempt counter exceeds a preset threshold, the partition identifier variable's indication is ignored, and the preset security partition or the partition that was successfully booted last time (such as the first system partition) is forcibly loaded, and this forced loading event is recorded in the system log of the shared data partition.

[0091] Step S5: Perform unattended rollback operation: The bootloader reads and increments the boot attempt counter stored in SPIFlash during startup. When the boot attempt counter reaches the preset threshold, it automatically switches the partition identifier variable back to the system partition that was running normally last time and resets the boot attempt counter.

[0092] like Figure 4 As shown, the specific unattended rollback operation includes:

[0093] 1) After the device restarts, the bootloader first reads the boot attempt counter stored in the SPIFlash;

[0094] 2) If the count of the startup attempt counter is <3 (preset threshold): it means that it is still within the attempt range. The bootloader increments the count of the startup attempt counter by 1 and uses the aforementioned atomic write mechanism to write back to the SPIFlash. Then it attempts to load the new system partition kernel in the eMMC or NAND Flash.

[0095] 3) If the boot attempt counter count is ≥3: This means that the new system partition has failed to boot 3 times in a row (including kernel crash or business layer watchdog reset); the bootloader executes the rollback logic, modifies the partition identifier variable back to the original system partition, and resets the boot attempt counter to force boot from the old version.

[0096] Step S6: Perform business health confirmation operation: After the operating system starts, a monitoring daemon runs in user space, polling the status register of the switch chip driver and the port status of the network management protocol. Only when the switch chip driver is successfully loaded and the port status of the network management protocol is reachable, the detection is deemed successful and the start attempt counter is cleared.

[0097] Switching chip drivers are typically provided in the form of Software Development Kits (SDKs), which are used to develop and manage the software core of switching chips. They encapsulate direct operations on the underlying hardware and provide an abstract interface for upper-layer applications.

[0098] Specifically, if the new system partition kernel loads successfully, it does not guarantee normal operation (for example, the switching chip driver of an industrial switch may fail to initialize). Figure 4 As shown, this invention runs a monitoring daemon process named health_monitor in the user space of the operating system (such as Linux):

[0099] 1) Test items:

[0100] A. Deep Hardware Inspection: Read the status register of the switching chip through the application programming interface (API) provided by the switching chip driver to confirm whether the ASIC has completed initialization and the data forwarding plane is ready;

[0101] B. Management Service Detection: Poll the port status of network management protocols (SNMP / SSH) to confirm that the management plane (ControlPlane) is reachable;

[0102] C. Link Status Detection: Confirm that the physical status of the uplink is UP.

[0103] 2) Watchdog linkage mechanism;

[0104] A. The monitoring daemon starts the watchdog timer when it starts up and sends a feed signal to the watchdog periodically;

[0105] B. If the monitoring daemon fails to confirm that the switch chip driver has been successfully loaded and the port status of the network management protocol is normal within the preset time window, it will stop sending the watchdog feed signal to the watchdog.

[0106] C. Use the watchdog timeout reset function to force a restart of the industrial switch, thereby triggering the bootloader to increment the startup attempt counter and perform an automatic rollback process.

[0107] 3) Clearing logic:

[0108] Only when all the above business indicators are normal and have been maintained for a preset time (such as 30 seconds) will the monitoring daemon call the tool to clear the startup attempt counter in SPIFlash; at this time, the upgrade is marked as finally successful.

[0109] The firmware security upgrade method for industrial switches in this embodiment does not rely on a file system. It directly utilizes the physical sector erasure characteristics of SPIFlash in conjunction with CRC verification to achieve atomic modification of the boot flag, ensuring that data writing either succeeds completely or automatically rolls back due to CRC failure. This completely eliminates the risk of boot parameter corruption and device failure caused by power failure during writing. By polling the status register of the switching chip, it can identify the zombie online fault (i.e., the kernel is running but the data plane is paralyzed) unique to industrial switches. Once an anomaly is identified, the device can automatically and losslessly roll back to the old version in a very short time through the linkage of the watchdog and the boot attempt counter, significantly reducing remote operation and maintenance costs. The dual-media storage architecture takes into account both the high security of the boot program (SPIFlash) and the large capacity requirements of the system image (eMMC or NANDFlash). At the same time, the shared data partition design based on the mount mechanism avoids the risk of configuration loss during the upgrade process and ensures the seamless inheritance of critical service configurations such as VLANs and ports.

[0110] like Figure 5 As shown, one embodiment of the present invention provides a firmware security upgrade system for an industrial switch, comprising:

[0111] The dual-media storage module 1 includes an SPI Flash connected via an SPI bus as the first storage medium and an eMMC or NAND Flash connected via an eMMC or NAND interface as the second storage medium. The SPI Flash is divided into an environment variable area of ​​the same size as the physical sector, and the eMMC or NAND Flash is divided into a first system partition and a second system partition with equivalent functions. The hardware connection configuration of the dual-media storage module 1 is as follows: the SPI Flash serves as the sole boot source of the operating system, storing the boot program area and the environment variable area; the eMMC or NAND Flash serves as a large-capacity storage source, storing the Linux kernel image, the root file system, and an independently partitioned shared data partition.

[0112] Firmware download module 2 is used to detect the currently running system partition of eMMC or NANDFlash when the industrial switch receives a firmware upgrade command, select another system partition as the target upgrade partition, and start downloading the new version of firmware.

[0113] Firmware verification module 3 is used to obtain the data of the new version firmware downloaded by firmware download module 2 and write it to the target upgrade partition. After writing, firmware integrity and signature verification are performed. Firmware verification module 3 is configured with an incremental synthesis unit, which is configured to load the old version firmware read from the target upgrade partition and the obtained binary differential packet into the operating system's memory buffer, use the differential algorithm to restore the complete image of the new version firmware, and write it directly to the target upgrade partition without generating intermediate temporary files.

[0114] The partition switching control module 4 is used to calculate the cyclic redundancy check code containing the partition identifier variable after the firmware integrity and signature verification are passed. It then uses the physical sector erasure feature of SPIFlash to perform a one-time erasure and write operation on the physical sector where the environment variable area is located.

[0115] The intelligent boot module 5 runs in the boot program and is used to manage the boot attempt counter stored in SPIFlash, and to execute boot count accumulation, threshold judgment and automatic fault rollback logic.

[0116] Health monitoring module 6 runs as a daemon in the operating system's user space. It polls the status register of the switch chip driver and the port status of the network management protocol. Only when the switch chip driver is successfully loaded and the network management protocol port status is reachable is the detection considered successful and the startup attempt counter cleared. Health monitoring module 6 is equipped with a watchdog interface unit: the watchdog interface unit activates the watchdog when the operating system starts; if health monitoring module 6 fails to confirm normal service within a preset time window, the watchdog interface unit stops sending feed signals to the watchdog and waits for the watchdog timeout reset to trigger the automatic rollback logic of the intelligent boot module 5.

[0117] The firmware security upgrade system for industrial switches provided in this application embodiment can execute the above method embodiment, and its implementation principle and technical effect are similar, so it will not be described again here.

[0118] like Figure 6 The diagram shown is a structural schematic of the electronic device that implements the firmware security upgrade method for industrial switches according to the present invention.

[0119] The electronic device may include a processor 10, a memory 11, a communication bus 12 and a communication interface 13, and may also include a computer program stored in the memory 11 and that can run on the processor 10, such as a firmware security upgrade program for an industrial switch.

[0120] In some embodiments, the processor 10 may be composed of integrated circuits, such as a single packaged integrated circuit or multiple integrated circuits with the same or different functions, including combinations of one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors, and various control chips. The processor 10 is the control unit of the electronic device, connecting various components of the entire electronic device through various interfaces and lines. It executes programs or modules stored in the memory 11 (e.g., executing firmware security upgrade programs for industrial switches) and calls data stored in the memory 11 to perform various functions of the electronic device and process data.

[0121] The memory 11 includes at least one type of readable storage medium, including flash memory, portable hard drive, multimedia card, card-type memory (e.g., SD or DX memory), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the memory 11 can be an internal storage unit of an electronic device, such as a portable hard drive. In other embodiments, the memory 11 can be an external storage device of the electronic device, such as a plug-in portable hard drive, SmartMedia Card (SMC), Secure Digital (SD) card, FlashCard, etc. Furthermore, the memory 11 can include both internal and external storage units of the electronic device. The memory 11 can be used not only to store application software and various types of data installed on the electronic device, such as the code for firmware security upgrade programs of industrial switches, but also to temporarily store data that has been output or will be output.

[0122] The communication bus 12 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This bus can be divided into an address bus, a data bus, a control bus, etc. The bus is configured to enable communication between the memory 11 and at least one processor 10, etc.

[0123] Communication interface 13 is used for communication between the aforementioned electronic device and other devices, including a network interface and a user interface. Optionally, the network interface may include a wired interface and / or a wireless interface (such as a Wi-Fi interface, Bluetooth interface, etc.), typically used to establish communication connections between the electronic device and other electronic devices. The user interface may be a display, an input unit (such as a keyboard), or, optionally, a standard wired or wireless interface. Optionally, in some embodiments, the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, or an OLED (Organic Light-Emitting Diode) touchscreen, etc. The display may also be appropriately referred to as a screen or display unit, used to display information processed in the electronic device and to display a visual user interface.

[0124] Figure 6 Only electronic devices with components are shown; it will be understood by those skilled in the art that... Figure 6 The structure shown does not constitute a limitation on the electronic device and may include fewer or more components than shown, or combine certain components, or have different component arrangements.

[0125] For example, a power supply, although not shown, may also include a power source (such as a battery) to power various components. Preferably, the power supply can be logically connected to at least one processor 10 via a power management device, thereby enabling functions such as charging management, discharging management, and power consumption management. The power supply may also include one or more DC or AC power sources, recharging devices, power fault detection circuits, power converters or inverters, power status indicators, and other arbitrary components. The electronic device may also include various sensors, Bluetooth modules, Wi-Fi modules, etc., which will not be elaborated further here.

[0126] It should be understood that the embodiments are for illustrative purposes only and are not limited to this structure in the scope of the patent application.

[0127] The firmware security upgrade program for the industrial switch stored in memory 11 of the electronic device is a combination of multiple computer programs that, when run in processor 10, can achieve the following:

[0128] In SPIFlash, an independent area of ​​the same size as the physical sector is set up as an environment variable area. In eMMC or NAND Flash, a first system partition and a second system partition with equivalent functions are set up, as well as a shared data partition independent of the first system partition and the second system partition.

[0129] When an industrial switch receives a firmware upgrade command, it detects whether the system partition currently running on the eMMC or NAND Flash is the first system partition or the second system partition, and uses the other system partition as the target upgrade partition; for example, if the system partition currently running on the eMMC or NAND Flash is the first system partition, then the second system partition is used as the target upgrade partition.

[0130] Obtain the data of the new firmware version and write it to the target upgrade partition. After writing is completed, verify the firmware integrity and signature.

[0131] After firmware integrity and signature verification pass, perform an atomic handover operation;

[0132] Perform an unattended rollback operation;

[0133] Perform a business health confirmation operation.

[0134] Specifically, the specific implementation method of the above computer program by the processor 10 can be found in [reference needed]. Figure 2 The descriptions of the relevant steps in the corresponding embodiments are not repeated here.

[0135] Furthermore, if the modules / units integrated into an electronic device are implemented as software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium. The computer-readable storage medium can be either volatile or non-volatile. For example, a computer-readable medium can include: any entity or device capable of carrying computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, and read-only memory (ROM).

[0136] The present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor of an electronic device, can perform the following:

[0137] In SPIFlash, an independent area of ​​the same size as the physical sector is set up as an environment variable area. In eMMC or NAND Flash, a first system partition and a second system partition with equivalent functions are set up, as well as a shared data partition independent of the first system partition and the second system partition.

[0138] When an industrial switch receives a firmware upgrade command, it detects whether the system partition currently running on the eMMC or NAND Flash is the first system partition or the second system partition, and uses the other system partition as the target upgrade partition; for example, if the system partition currently running on the eMMC or NAND Flash is the first system partition, then the second system partition is used as the target upgrade partition.

[0139] Obtain the data of the new firmware version and write it to the target upgrade partition. After writing is completed, verify the firmware integrity and signature.

[0140] After firmware integrity and signature verification pass, perform an atomic handover operation;

[0141] Perform an unattended rollback operation;

[0142] Perform a business health confirmation operation.

[0143] In the several embodiments provided by this invention, it should be understood that the disclosed devices, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and other division methods may be used in actual implementation.

[0144] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0145] Furthermore, the functional modules in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or in the form of hardware plus software functional modules.

[0146] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present invention.

[0147] Therefore, the embodiments should be considered exemplary and non-limiting in all respects, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be embraced within the invention. No appended diagram markings in the claims should be construed as limiting the scope of the claims.

[0148] The embodiments of this application can acquire and process relevant data based on artificial intelligence technology. Artificial intelligence (AI) refers to the theories, methods, technologies, and application systems that use digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to obtain optimal results.

[0149] Furthermore, although the operations of the method of the present invention are described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0150] It should be understood that those skilled in the art can make improvements or modifications based on the above description, and all such improvements and modifications should fall within the protection scope of the appended claims.

[0151] The present invention has been described above with reference to the accompanying drawings. Obviously, the implementation of the present invention is not limited to the above-described manner. Any improvements made using the inventive concept and technical solution of the present invention, or the direct application of the inventive concept and technical solution of the present invention to other situations without modification, are all within the protection scope of the present invention.

Claims

1. A firmware security upgrade method for an industrial switch, characterized in that, The industrial switch is configured with a dual-media storage architecture, which includes SPI Flash as the first storage medium and eMMC or NAND Flash as the second storage medium. The method includes the following steps: In the SPI Flash, an independent area of ​​the same size as the physical sector is set up as an environment variable area, and in the eMMC or NAND Flash, a first system partition and a second system partition with equivalent functions are set up. When the industrial switch receives a firmware upgrade command, it detects the system partition currently running on the eMMC or NAND Flash and selects another system partition as the target upgrade partition. Obtain the data of the new firmware version and write it to the target upgrade partition. After the writing is completed, perform firmware integrity verification. After the firmware integrity verification passes, an atomic switching operation is performed: a cyclic redundancy check code containing partition identifier variables is calculated, and the physical sector erasure characteristics of the SPIFlash are used to perform a one-time erasure and write operation on the physical sector where the environment variable area is located. Perform unattended rollback operation: The bootloader reads and increments the boot attempt counter stored in the SPIFlash during startup. When the count of the boot attempt counter reaches a preset threshold, it automatically switches the partition identifier variable back to the system partition that was running normally last time and resets the boot attempt counter. Perform a business health verification operation: After the operating system starts, a monitoring daemon runs in user space, polling the status register of the switch chip driver and the port status of the network management protocol. Only when the switch chip driver is successfully loaded and the port status of the network management protocol is reachable, the detection is deemed successful and the startup attempt counter is cleared.

2. The firmware security upgrade method for industrial switches according to claim 1, characterized in that, The atomic switching operation includes the following steps: Before performing the write operation, calculate the cyclic redundancy check code of the environment variable data to be written; The partition identifier variable is combined with the cyclic redundancy check code to fill one physical sector of the SPIFlash; When the bootloader reads the environment variable area, it first calculates and compares the cyclic redundancy check code. If the check fails, it determines that a power failure occurred during the atomic write process and automatically loads the preset security partition or the partition that was successfully started last time.

3. The firmware security upgrade method for industrial switches according to claim 1, characterized in that, The eMMC or NAND Flash also includes a shared data partition that is independent of the first system partition and the second system partition; The shared data partition is independent of the first system partition and the second system partition, and is used to store the port configuration files, VLAN configuration data and system logs of the industrial switch; When the operating system starts, it reads the partition table information and mounts the shared data partition to the same fixed logical path of the file system.

4. The firmware security upgrade method for industrial switches according to claim 3, characterized in that, The process of writing to the target upgrade partition includes the following steps: The industrial switch receives binary differential packets generated by the server. Read the image of the old firmware from the target upgrade partition into the memory buffer of the operating system; The old firmware image is reassembled with the binary differential packet using a binary differential synthesis algorithm in the memory buffer to restore the complete new firmware image, and then written to the target upgrade partition.

5. The firmware security upgrade method for industrial switches according to claim 3, characterized in that, The bootloader is configured to: After each power-on reset, the environment variable area in the SPIFlash is read first. If the read data verification fails, or if the count of the read startup attempt counter exceeds the preset threshold, the indication of the partition identifier variable is ignored, the preset security partition or the partition that was successfully started last time is forcibly loaded, and the forced loading event is recorded in the system log of the shared data partition.

6. The firmware security upgrade method for industrial switches according to claim 1, characterized in that, The business health confirmation operation also includes a watchdog linkage mechanism: The monitoring daemon starts a watchdog timer upon startup; If the monitoring daemon fails to confirm that the switching chip driver has been successfully loaded and the port status of the network management protocol is normal within the preset time window, it will stop sending the watchdog feed signal to the watchdog. The watchdog timeout reset function is used to force a restart of the industrial switch, thereby triggering the bootloader to increment the startup attempt counter and perform an automatic rollback process.

7. A firmware security upgrade system for an industrial switch, used to execute the firmware security upgrade method for an industrial switch as described in any one of claims 1 to 6, comprising: A dual-media storage module includes an SPIFlash connected via an SPI bus and serving as the first storage medium, and an eMMC or NAND Flash connected via an eMMC or NAND interface and serving as the second storage medium. The SPIFlash is divided into an environment variable area with the same size as the physical sector, and the eMMC or NAND Flash is divided into a first system partition and a second system partition with equivalent functions. The firmware download module is used to detect the currently running system partition of the eMMC or NANDFlash when the industrial switch receives a firmware upgrade instruction, select another system partition as the target upgrade partition, and start downloading the new version of firmware. The firmware verification module is used to obtain the data of the new version firmware downloaded by the firmware download module and write it into the target upgrade partition, and perform firmware integrity verification after the writing is completed. The partition switching control module is used to calculate the cyclic redundancy check code containing the partition identifier variable after the firmware integrity verification passes, and to perform a one-time erase and write operation on the physical sector where the environment variable area is located by utilizing the physical sector erase characteristics of the SPIFlash. The intelligent boot module, which runs in the boot program, is used to manage the boot attempt counter stored in the SPIFlash and execute boot count accumulation, threshold judgment and automatic fault rollback logic. The health monitoring module runs as a daemon process in the user space of the operating system. It polls the status register of the switch chip driver and the port status of the network management protocol. Only when the switch chip driver is successfully loaded and the port status of the network management protocol is reachable, the detection is deemed successful and the startup attempt counter is cleared.

8. The firmware security upgrade system for industrial switches according to claim 7, characterized in that, The hardware connection configuration of the dual-media storage module is as follows: The SPIFlash serves as the sole boot source for the operating system, storing the boot program area and the environment variable area. The eMMC or NAND Flash serves as a high-capacity storage source, storing the Linux kernel image, root file system, and independently partitioned shared data.

9. The firmware security upgrade system for industrial switches according to claim 7, characterized in that, The firmware verification module is configured with an incremental synthesis unit, which is configured as follows: The old firmware version read from the target upgrade partition and the obtained binary differential packet are loaded into the memory buffer of the operating system. The differential algorithm is used to restore the complete image of the new firmware version and write it directly to the target upgrade partition.

10. The firmware security upgrade system for industrial switches according to claim 7, characterized in that, The health monitoring module is equipped with a watchdog interface unit: The watchdog interface unit activates the watchdog when the operating system starts. If the health monitoring module fails to confirm normal operation within the preset time window, the watchdog interface unit stops sending feed signals to the watchdog and waits for the watchdog to time out and reset to trigger the automatic rollback logic of the smart guidance module.

Images