A distributed device container image passive synchronization method, system, device and medium suitable for one-way network

Abstract

The application relates to the technical field of distributed device container and discloses a distributed device container image passive synchronization method, system, equipment and medium suitable for an one-way network, which comprises a self-developed cloud edge virtual node agent and a distributed device special agent, a TLS1.3 encryption channel is established through challenge-response two-way identity authentication, an application scheduling event is intercepted in the cloud, an image is compressed into a.tar.gz and an MD5 check value is generated, and the image is unidirectionally issued in a 4MB fixed block frame structure; after passive reception and completion of the check, the image is imported and loaded according to the specification. The application integrates a batch synchronization optimization mechanism for a large-scale distributed device scene, can efficiently complete multi-node parallel synchronization and image local preloading, and greatly improves deployment efficiency and effectively reduces application start-up time delay.

Description

Technical Field

[0001] This invention relates to the field of distributed device container technology, and in particular to a method, system, device and medium for passive synchronization of distributed device container images adapted to unidirectional networks. Background Technology

[0002] Container technology, with its advantages of lightweight design, portability, and low resource consumption, has become a core technology supporting the unified management of distributed systems. The synchronization consistency of container images directly affects the functional uniformity, version compatibility, and operational stability of distributed devices. Existing image synchronization technologies are generally based on bidirectional network designs, typically employing an active pull mode where edge devices or distributed devices proactively initiate connection requests to the master station or cloud to pull images. However, in high-risk production scenarios, to effectively prevent external unauthorized intrusion and eliminate security risks such as internal data backhaul and leakage, the network architecture often adopts a physical-level unidirectional isolation design: only allowing the cloud or master station to proactively access distributed devices, while the devices themselves are strictly prohibited from initiating any proactive outbound network connections, including requests for image pulling and status reporting. Under this unidirectional isolation architecture, traditional image synchronization solutions relying on devices proactively pulling images completely fail.

[0003] While the industry has proposed several adaptation solutions for unidirectional network environments, these solutions generally suffer from significant drawbacks. Existing solutions fail to fully integrate the lightweight characteristics of distributed devices with the unified cloud-edge orchestration requirements, lacking necessary security mechanisms such as two-way authentication, encrypted transmission, and data integrity verification, making them vulnerable to attacks such as identity forgery and data tampering. For batch synchronization scenarios involving large-scale distributed devices and large-volume images, existing solutions lack optimization mechanisms adapted to unidirectional networks, resulting in low synchronization efficiency and high application startup latency. Furthermore, most solutions are general-purpose designs, not deeply integrated with the container platform architectures actually used in industries such as power grids, making implementation difficult. Therefore, there is an urgent need for a container image synchronization method that strictly adheres to unidirectional network isolation rules, possesses secure and reliable transmission capabilities, and supports large-scale deployment. Summary of the Invention

[0004] In view of the aforementioned existing problems, the present invention is proposed.

[0005] Therefore, this invention provides a method, system, device, and medium for passive synchronization of container images of distributed devices adapted to unidirectional networks. The problem solved by the present invention is that in scenarios where a unidirectional isolated network is used between the cloud and the distributed device and the device is prohibited from actively initiating connections, the traditional active pulling method of container images is completely ineffective. At the same time, the existing solutions lack two-way authentication, encrypted transmission, and large-scale batch synchronization optimization capabilities, resulting in unreliable and inefficient image synchronization.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution: In a first aspect, the present invention provides a method for passive synchronization of distributed device container images adapted to unidirectional networks, comprising: A self-developed cloud-edge virtual node agent is deployed in the cloud and configured with the first authentication information. The distributed device starts the self-developed agent program and enters a passive listening state. Through two-way identity authentication between the cloud and the distributed device, an encrypted and secure transmission channel is established, and the distributed device is registered as a cloud virtual node. The cloud-based system intercepts application scheduling events targeting virtual nodes of distributed devices through a self-developed virtual node proxy, pulls the target image from the image repository, compresses and packages the target image, and generates corresponding integrity verification metadata. The processed image file is divided into blocks of fixed size and sent frame by frame to the distributed device through the encrypted secure transmission channel in the form of a one-way file stream. The device side only passively receives the file and does not provide feedback on the transmission status. The distributed device reassembles and verifies the integrity of the received image blocks. After the verification is successful, it calls the local container engine to import the image and performs tag normalization processing to complete the local loading of the image. For large-scale distributed device scenarios, batch synchronization tasks are created in the cloud, the number of parallel synchronizations is controlled by the token bucket algorithm, and image data is distributed to the target device in batches. The device side uses the passive synchronization process to complete the local preloading of the image.

[0007] As a preferred embodiment of the passive synchronization method for distributed device container images adapted to unidirectional networks described in this invention, the initialization and secure channel establishment between the cloud and the distributed device side include: The cloud generates an asymmetric key pair and certificate chain, configures a distributed device management list and IP whitelist policy; the distributed device starts a self-developed agent program, loads the pre-set root certificate and device credentials, and prohibits active outbound network connections from the kernel level. The cloud sends an authentication request to the distributed device, carrying a unique identifier, a random challenge number, and a timestamp; the distributed device verifies the legality of the request based on preset verification rules and returns a signed response, and the cloud verifies the signature of the response to complete two-way identity authentication; After authentication, the cloud and the distributed device negotiate a session key based on the transport layer security protocol to establish an end-to-end encrypted secure transmission channel. The cloud-based self-developed virtual node agent will register as a virtual node of the cloud orchestration system through certified distributed devices, enabling the devices to receive cloud commands.

[0008] As a preferred embodiment of the passive synchronization method for distributed device container images adapted to unidirectional networks described in this invention, the cloud intercepts application scheduling events targeting distributed device virtual nodes through a self-developed virtual node proxy, pulls the target image from the image repository, and compresses and packages the target image, including: The self-developed virtual node agent monitors the scheduling events of the cloud orchestration system in real time. When it detects that an application has been scheduled to a distributed device virtual node, it parses out the target image address and version information. The cloud retrieves the target image from the image repository and stores it in the local cache directory; The cloud exports the image as an archive file and uses a compression algorithm to package it into a compressed file, while calculating the global integrity check value of the compressed file. The system encapsulates structured metadata containing image metadata, block parameters, and global integrity verification values, and stores it in encrypted form.

[0009] As a preferred embodiment of the distributed device container image passive synchronization method adapted to unidirectional networks described in this invention, the unidirectional block transmission in the cloud includes: The cloud calls the receiving interface of the distributed device agent program to cut the compressed file into multiple data blocks according to a preset byte size; A fixed frame structure containing a frame header, binary data blocks, and a frame trailer is constructed and sent to the distributed device in binary stream form through a one-way network, without the device side providing any feedback confirmation. The cloud maintains the transmission queue. If a chunk transmission timeout is detected, an exponential backoff retransmission mechanism is triggered to continue transmission from the interrupted chunk sequence number. Once all chunks have been transmitted, the cloud encrypted and distributed the structured metadata to the distributed device.

[0010] As a preferred embodiment of the passive synchronization method for distributed device container images adapted to unidirectional networks described in this invention, the distributed device-side image reception and loading includes: The distributed device agent passively receives the segmented data sent from the cloud, parses the frame header to obtain the sequence number, and writes it into the local encrypted temporary cache in sequence. After all segments have been received, the integrity check value of the locally reconstructed file is recalculated and compared with the check value in the metadata sent from the cloud. If the verification matches, the image is imported through the container engine's standard interface, and the image tags are rewritten according to the preset specifications; if the verification does not match, the cache is cleared and the system waits for the image to be retransmitted from the cloud. After the image import is complete, temporary cache files are automatically cleared, and a synchronization completion status indicator is returned to the cloud one-way.

[0011] As a preferred embodiment of the passive synchronization method for distributed device container images adapted to unidirectional networks described in this invention, the batch synchronization optimization includes: Create batch synchronization tasks in the cloud and filter target distributed device nodes based on device tags, unique identifier lists, or maintenance groups; Configure the threshold for the number of parallel synchronizations and the upper limit for the transmission rate, and use the token bucket algorithm to control the number of concurrent connections to prevent the cloud bandwidth from being exhausted; Batch tasks are converted into synchronous instructions for multiple virtual nodes, and then distributed to the target device in parallel through a self-developed virtual node agent; The target device preloads the image locally, allowing the application to directly call the locally cached image at startup without waiting for real-time synchronization.

[0012] As a preferred embodiment of the passive synchronization method for distributed device container images adapted to unidirectional networks described in this invention, the method further includes a batch synchronization state management and exception handling process: The cloud-based self-developed batch synchronization controller has a built-in synchronization state machine. After task initialization, the state machine sequentially flows to the task distribution, image transmission, and verification loading stages. Real-time monitoring of the synchronization status of each target device; if a device times out or returns an error, the node is marked and automatically added to the next batch of retry queue. Once all target devices have completed synchronization or reached the maximum number of retries, the state machine transitions to the synchronization completed or abnormal termination state. Generate traceable synchronization logs containing node IDs, image information, synchronization time, and verification results for operation and maintenance personnel to audit.

[0013] Secondly, the present invention provides a distributed device container image passive synchronization system adapted to unidirectional networks, comprising: The channel establishment module is used to deploy a self-developed cloud-edge virtual node agent in the cloud and configure the first authentication information. The distributed device starts the self-developed agent program and enters a passive listening state. Through two-way identity authentication between the cloud and the distributed device, an encrypted and secure transmission channel is established, and the distributed device is registered as a cloud virtual node. The image preprocessing module is used to intercept application scheduling events targeting virtual nodes of distributed devices through a self-developed virtual node proxy in the cloud, pull target images from the image repository, compress and package the target images, and generate corresponding integrity verification metadata. The block distribution module is used to divide the processed image file into blocks of fixed size and distribute them frame by frame to the distributed device through the encrypted secure transmission channel in the form of a one-way file stream. The device side only passively receives the data and does not provide feedback on the transmission status. The receiving verification loading module is used by the distributed device to reassemble and verify the integrity of the received image blocks. After the verification is passed, the local container engine is called to import the image and perform tag normalization processing to complete the local loading of the image. The batch synchronization module is used for large-scale distributed device scenarios. It creates batch synchronization tasks in the cloud, controls the number of parallel synchronizations through the token bucket algorithm, and sends image data to the target device in batches. The device side uses the passive synchronization process to complete the local preloading of the image.

[0014] Thirdly, the present invention provides an electronic device, including a memory and a processor; the memory is used to store computer-executable instructions, and the processor, when executing the computer-executable instructions, implements the steps of a passive synchronization method for distributed device container images adapted to a unidirectional network.

[0015] Fourthly, the present invention provides a computer-readable storage medium storing computer-executable instructions that, when executed by a processor, implement the steps of a passive synchronization method for distributed device container images adapted to a unidirectional network.

[0016] Compared with existing technologies, the beneficial effects of this invention are as follows: This invention strictly adheres to the one-way network isolation rules between the cloud and distributed devices, and fully meets the security protection requirements of high-risk scenarios such as power grids and industrial control by prohibiting devices from actively making outbound connections at the kernel level; it adopts challenge-response two-way identity authentication, TLS encrypted transmission, and global integrity verification mechanisms to build a trusted security protection system across the entire link, effectively preventing identity forgery, data tampering, and information leakage; relying on self-developed cloud-edge virtual node agents and lightweight device agent programs, it achieves non-intrusive integration with cloud container platforms and friendly adaptation to resource-constrained embedded devices; through image compression, fixed block transmission, and exponential backoff retransmission techniques, it significantly reduces the occupation of one-way network bandwidth and improves the transmission reliability of large-volume images in weak network environments; at the same time, it integrates a batch synchronization optimization mechanism for large-scale distributed device scenarios, which can efficiently complete multi-node parallel synchronization and local image preloading, thereby greatly improving deployment efficiency and effectively reducing application startup latency. Attached Figure Description

[0017] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1This is a schematic diagram of the overall process logic of a passive synchronization method for distributed device container images adapted to unidirectional networks, provided in one embodiment of the present invention.

[0019] Figure 2 This is a schematic diagram illustrating the cloud-edge challenge, response two-way authentication, and TLS encrypted channel establishment process of a passive synchronization method for distributed device container images adapted to unidirectional networks, provided in one embodiment of the present invention.

[0020] Figure 3 This is a schematic diagram illustrating the entire process of passive synchronization of container images in a single distributed device, provided by an embodiment of the present invention, for a distributed device container image passive synchronization method adapted to a unidirectional network.

[0021] Figure 4 This is a schematic diagram of the image fixed-block unidirectional transmission frame structure and transmission control process of a distributed device container image passive synchronization method adapted to unidirectional networks, provided in one embodiment of the present invention.

[0022] Figure 5 This is a schematic diagram illustrating the optimized process for batch passive synchronization of distributed device images, which is adapted to a unidirectional network and is provided as an embodiment of the present invention. Detailed Implementation

[0023] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of the present invention.

[0024] Example 1, referring to Figure 1 As one embodiment of the present invention, a passive synchronization method for distributed device container images adapted to unidirectional networks is provided, such as... Figure 1 The specific steps shown are as follows: S100: Deploy a self-developed cloud-edge virtual node agent in the cloud and configure the first authentication information. The distributed device starts the self-developed agent program and enters a passive listening state. Through two-way identity authentication between the cloud and the distributed device, an encrypted secure transmission channel is established, and the distributed device is registered as a cloud virtual node. S200: The cloud intercepts application scheduling events targeting virtual nodes of distributed devices through a self-developed virtual node proxy, pulls the target image from the image repository, compresses and packages the target image, and generates corresponding integrity verification metadata. S300: The processed image file is divided into blocks of fixed size and sent frame by frame to the distributed device through an encrypted secure transmission channel in the form of a one-way file stream. The device side only passively receives the file and does not provide feedback on the transmission status. S400: The distributed device reassembles and verifies the integrity of the received image blocks. After the verification is successful, it calls the local container engine to import the image and perform tag normalization processing to complete the local loading of the image. S500: For large-scale distributed device scenarios, batch synchronization tasks are created in the cloud, the number of parallel synchronizations is controlled by the token bucket algorithm, and image data is sent to the target device in batches. The device side uses the passive synchronization process to complete the local preloading of the image. It should be noted that this invention strictly adheres to the one-way network isolation rules between the cloud and distributed devices, and fully meets the security protection requirements of high-risk scenarios such as power grids and industrial control by prohibiting devices from actively making outbound connections at the kernel level. It employs challenge-response two-way authentication, TLS encrypted transmission, and a global integrity verification mechanism to construct a trusted security protection system across the entire chain, effectively preventing identity forgery, data tampering, and information leakage. Relying on self-developed cloud-edge virtual node agents and lightweight device agent programs, it achieves non-intrusive integration with cloud container platforms and friendly adaptation to resource-constrained embedded devices. Through image compression, fixed-block transmission, and exponential backoff retransmission techniques, it significantly reduces the occupation of one-way network bandwidth and improves the transmission reliability of large-volume images in weak network environments. Simultaneously, it integrates a batch synchronization optimization mechanism for large-scale distributed device scenarios, which can efficiently complete multi-node parallel synchronization and local image preloading, thereby significantly improving deployment efficiency and effectively reducing application startup latency.

[0025] Example 2, refer to Figures 2-5 Based on the previous embodiment, this embodiment provides a specific implementation method for a passive synchronization method of distributed device container images adapted to unidirectional networks, and explains the technical means of this method.

[0026] In this embodiment of the invention, step S100 involves deploying a self-developed cloud-edge virtual node agent in the cloud and configuring the first authentication information. The distributed device starts the self-developed agent program and enters a passive listening state. Through two-way identity authentication between the cloud and the distributed device, an encrypted secure transmission channel is established, and the distributed device is registered as a cloud virtual node. The specific implementation steps include: Asymmetric key pairs and certificate chains are generated in the cloud, and a distributed device management list and IP whitelist policy are configured. The distributed device starts a self-developed agent program, loads the pre-set root certificate and device credentials, and prohibits active outbound network connections from the kernel level. The cloud sends an authentication request to the distributed device, carrying a unique identifier, a random number of challenges, and a timestamp; the distributed device verifies the legality of the request based on preset verification rules and returns a signed response; the cloud verifies the signature of the response to complete two-way identity authentication. After authentication, the cloud and the distributed device negotiate a session key based on the transport layer security protocol to establish an end-to-end encrypted secure transmission channel. The cloud-based self-developed virtual node agent will register as a virtual node of the cloud orchestration system through certified distributed devices, enabling the devices to receive cloud commands.

[0027] Specifically, a self-developed cloud-edge virtual node agent is deployed in the cloud-based Kubernetes cluster. This agent runs as an independent process and maintains a long-term connection to the Kubernetes API Server via a List-Watch mechanism to continuously monitor Pod scheduling and application deployment events for distributed device virtual nodes. The cloud configures a global management list of distributed devices, recording information such as the device's unique identifier (NodeID), physical IP, business region, and operation and maintenance group. The cloud generates an RSA2048 asymmetric key pair and a CA root certificate, configures a device IP whitelist policy, and blocks unauthorized access at the firewall level. The cloud-edge security authentication module is initialized, loading authentication keys, timestamp validity windows, and replay attack protection rules.

[0028] Specifically, the distributed device starts a dedicated self-developed agent service. The agent adopts a lightweight non-blocking IO model, binds to a fixed listening port, and prohibits active outbound network connections at the kernel level, retaining only passive listening capabilities. The agent loads the CA public key certificate issued by the cloud and the device-specific authentication credentials, and configures the local containerd container engine interface parameters (OCI namespace, image storage path, communication socket). The agent initializes the encrypted temporary cache module, creates a local cache directory with permission isolation, with only the agent having read and write permissions, and initializes the block receive buffer. After initialization, the agent enters a passive listening state and does not actively initiate any network interaction.

[0029] Specifically, a challenge-response mode combining random number challenge and private key signature is used to achieve two-way identity verification between the cloud and the device, preventing IP spoofing and replay attacks; for example... Figure 2 The steps shown include: The cloud sends an authentication challenge request to the device agent, and the message carries: device NodeID, random challenge number, timestamp (±30s valid window), cloud private key signature, and CA certificate chain; The device agent verifies the legitimacy of the NodeID and the validity of the timestamp, and filters out illegal requests; The device agent uses the CA public key to verify the legitimacy of the cloud signature and certificate, confirming the legitimacy of the challenge source; The device agent uses its device-specific credentials to sign the random challenge number and returns a response message. The cloud-based verification device verifies the validity of the signature and completes two-way identity authentication.

[0030] Specifically, after authentication, the cloud and edge negotiate the session key based on the TLS 1.3 protocol and the ECDHE elliptic curve algorithm to establish an end-to-end encrypted channel. The channel is encrypted with AES-128-GCM and has a built-in message checksum to prevent data tampering. After the channel is established, the self-developed virtual node agent registers the distributed device as a cloud virtual node and incorporates it into the unified orchestration and management of the cloud.

[0031] It should be noted that in step S100 above, a self-developed cloud-edge virtual node agent is deployed in the cloud and configured with the first authentication information. After the distributed device starts the agent program, it enters a passive listening state and completes two-way identity authentication. While establishing an encrypted and secure transmission channel, the distributed device is registered as a cloud virtual node, thereby realizing unified identity management and secure access of the device in the cloud, laying a reliable and controllable communication foundation for subsequent data transmission and image distribution.

[0032] In this embodiment of the invention, in step S200, the cloud intercepts application scheduling events targeting the virtual nodes of the distributed device through a self-developed virtual node proxy, pulls the target image from the image repository, compresses and packages the target image, and generates corresponding integrity verification metadata. The specific implementation steps include: The self-developed virtual node agent monitors the scheduling events of the cloud orchestration system in real time. When it detects that an application has been scheduled to a distributed device virtual node, it parses out the target image address and version information. The cloud retrieves the target image from the image repository and stores it in the local cache directory; The cloud exports the image as an archive file and uses a compression algorithm to package it into a compressed file, while calculating the global integrity check value of the compressed file. The system encapsulates structured metadata containing image metadata, block parameters, and global integrity verification values, and stores it in encrypted form.

[0033] Specifically, the cloud initiates a distributed device application deployment / upgrade command, the K8s scheduler schedules the Pod to the device virtual node, and the self-developed virtual node agent captures events in real time through List-Watch, parses the image name, version, repository address, and target device ID, and triggers the image passive synchronization process; the agent has a built-in scheduling filter that only allows requests to the distributed device virtual node to avoid invalid synchronization.

[0034] Specifically, the self-developed agent pulls the target image from the cloud image repository, stores it in the local tiered cache directory on the cloud, and names it by image ID + version number. It supports cache reuse and avoids repeated pulling.

[0035] Specifically, the cloud exports the image as an OCI standard tar archive file through the container engine interface, and packages it into .tar.gz format using the gzip (LZ77+Huffman) compression algorithm (6 levels of compression), balancing compression ratio and CPU usage, while preserving the original layered structure of the image.

[0036] Specifically, the cloud performs block MD5 hash calculations on the compressed image to generate a global 128-bit MD5 checksum; the image name, version, file size, global MD5, target NodeID, block size (4MB), total number of blocks, and block sub-hash list are encapsulated into structured image metadata, which is then serialized using JSON and stored in an encrypted manner.

[0037] It should be noted that in step S200 above, the cloud virtual node agent actively intercepts application scheduling events targeting the virtual nodes of the distributed device, pulls the target image from the image repository, compresses and packages it, and generates integrity verification metadata. This preprocessing and packaging of the image is completed in the cloud in advance, which reduces the computational burden on the device side and provides a reliable basis for the secure transmission and integrity verification of the image data.

[0038] In this embodiment of the invention, step S300 divides the processed image file into blocks of fixed size and sends them frame by frame to the distributed device via an encrypted secure transmission channel in the form of a one-way file stream. The device passively receives the data without providing feedback on the transmission status. The specific implementation steps include: The cloud calls the receiving interface of the distributed device agent program to cut the compressed file into multiple data blocks according to a preset byte size; A fixed frame structure containing a frame header, binary data blocks, and a frame trailer is constructed and sent to the distributed device in binary stream form through a one-way network, without the device side providing any feedback confirmation. The cloud maintains the transmission queue. If a chunk transmission timeout is detected, an exponential backoff retransmission mechanism is triggered to continue transmission from the interrupted chunk sequence number. Once all chunks have been transmitted, the cloud sends encrypted structured metadata to the distributed devices.

[0039] Specifically, the cloud uses a TLS encrypted channel to call the device agent image receiving interface (POST / api / v1 / image / receive). The transmission adopts a fixed frame structure: frame header (block sequence number, total number of blocks, frame length, frame checksum) + binary data block + frame trailer (end marker), ensuring that the device can reassemble in order.

[0040] Specifically, such as Figure 3 As shown, the cloud divides the .tar.gz image into fixed 4MB blocks, strictly following the one-way rule: the cloud only sends data, the device passively receives it, does not actively request blocks, does not initiate retransmission, and does not provide status feedback; the cloud has a built-in adaptive transmission rate module that dynamically adjusts the sending rate according to the one-way network bandwidth to avoid network congestion.

[0041] Specifically, the cloud maintains a FIFO queue for image transmission, recording the transmission status, sent segments, timeout time, and number of retransmissions. Transmission timeout (segment not sent within 30 seconds) is considered an interruption, and exponential backoff retransmission is used: 1s→2s→4s, with a maximum of 3 retransmissions, resuming transmission from the interrupted segment without having to start from the beginning.

[0042] Specifically, after all the chunks are transmitted, the cloud encrypts and sends the image metadata as a basis for device-side integrity verification.

[0043] It should be noted that in step S300 above, the processed image file is divided into blocks of fixed size and sent frame by frame to the distributed device through an encrypted secure transmission channel in the form of a one-way file stream. The device side only passively receives the data and does not provide feedback on the transmission status, thereby greatly simplifying the transmission protocol and the processing logic on the device side, avoiding feedback storms and complex handshake overhead when a large number of devices transmit concurrently, and significantly improving the throughput efficiency and transmission stability of image distribution.

[0044] In this embodiment of the invention, the distributed device in step S400 reassembles and verifies the integrity of the received image blocks. After the verification is successful, it calls the local container engine to import the image and performs tag normalization processing to complete the local loading of the image. The specific implementation steps include: The distributed device agent passively receives the segmented data sent from the cloud, parses the frame header to obtain the sequence number, and writes it into the local encrypted temporary cache in sequence. After all segments have been received, the integrity check value of the locally reconstructed file is recalculated and compared with the check value in the metadata sent from the cloud. If the verification matches, the image is imported through the container engine's standard interface, and the image tags are rewritten according to the preset specifications; if the verification does not match, the cache is cleared and the system waits for the image to be retransmitted from the cloud. After the image import is complete, temporary cache files are automatically cleared, and a synchronization completion status indicator is returned to the cloud one-way.

[0045] Specifically, the device agent passively receives image block frames, parses the frame header to obtain the block sequence number, and writes them into the encrypted temporary cache in sequence order; the built-in block sorting engine verifies the continuity of the sequence number, and marks it as abnormal if it is missing, waiting for retransmission from the cloud.

[0046] Specifically, such as Figure 4 As shown, after all chunks are received, the device agent recalculates the global MD5 value and compares it byte by byte with the metadata. If they match, it means the data is complete and has not been tampered with, and the loading process begins; if they do not match, it means the data is corrupted / tampered with, the cache and metadata are cleared, and the device waits for retransmission.

[0047] Specifically, after successful verification, the agent calls the containerd container engine via the OCI standard interface to import the image and specify the k8s.io namespace. It then re-tags the image according to industry standards, in the format: local-registry / {business domain} / {device type} / {image name}:{version number}, adapting to local image management. Once the image is loaded, the agent automatically deletes temporary cache, freeing up device storage space. It then returns a synchronization completion flag via a TLS channel, updating the device synchronization status in the cloud and completing the synchronization loop.

[0048] It should be noted that in step S400 above, the distributed device reassembles and verifies the integrity of the received image blocks. After the verification is successful, the local container engine is called to import the image and perform tag normalization processing to complete the local loading of the image. This ensures the consistency and security of the image on the device side. At the same time, the tag normalization processing enables the image to be directly recognized and run in the local container environment, providing standardized support for the rapid deployment and unified management of subsequent applications.

[0049] In this embodiment of the invention, step S500 is designed for large-scale distributed device scenarios. A batch synchronization task is created in the cloud, the number of parallel synchronizations is controlled using a token bucket algorithm, and image data is distributed in batches to the target device. The device side uses a passive synchronization process to complete local image preloading. Specific implementation steps include: Create batch synchronization tasks in the cloud and filter target distributed device nodes based on device tags, unique identifier lists, or maintenance groups; Configure the threshold for the number of parallel synchronizations and the upper limit for the transmission rate, and use the token bucket algorithm to control the number of concurrent connections to prevent the cloud bandwidth from being exhausted; Batch tasks are converted into synchronous instructions for multiple virtual nodes, and then distributed to the target device in parallel through a self-developed virtual node agent; The target device preloads the image locally, allowing the application to directly call the locally cached image at startup without waiting for real-time synchronization.

[0050] Specifically, the cloud creates batch synchronization tasks through the container platform, supporting single-image / multi-image synchronization, filtering target nodes by device tag, NodeID list, and operation and maintenance group, and configuring the number of parallel synchronizations (1~10), transmission rate limit, and timeout.

[0051] Specifically, the cloud-based self-developed batch synchronization controller parses tasks and uses a token bucket algorithm to control the number of parallel synchronizations, avoiding the exhaustion of cloud bandwidth; it converts batch tasks into virtual node synchronization instructions, which are then distributed to the target distributed devices in batches through the self-developed virtual node agent.

[0052] Specifically, the cloud configures the parallelism and distributes image blocks and metadata to the target device in batches; the device follows the standard passive synchronization process to complete the reception, verification, and loading, and preloads the image into the local container engine cache. When the application starts, it directly calls the local image without real-time synchronization.

[0053] Specifically, such as Figure 5 As shown, the self-developed controller has a built-in synchronization state machine: pending initialization → task distribution → image transmission → verification loading → synchronization completion / abnormal termination; after all devices are synchronized, a traceable synchronization log is generated, recording the node ID, image information, synchronization time, and verification result.

[0054] It should be noted that the method in this embodiment also includes batch synchronization state management and exception handling procedures: The cloud-based self-developed batch synchronization controller has a built-in synchronization state machine. After task initialization, the state machine sequentially flows to the task distribution, image transmission, and verification loading stages. Real-time monitoring of the synchronization status of each target device; if a device times out or returns an error, the node is marked and automatically added to the next batch of retry queue. Once all target devices have completed synchronization or reached the maximum number of retries, the state machine transitions to the synchronization completed or abnormal termination state. Generate traceable synchronization logs containing node IDs, image information, synchronization time, and verification results for operation and maintenance personnel to audit.

[0055] It should be noted that the above step S500 is designed for large-scale distributed device scenarios. The cloud creates batch synchronization tasks and uses the token bucket algorithm to precisely control the number of parallel synchronizations. Image data is distributed to the target device in batches. The device side uses the passive synchronization process to complete the local preloading of the image. This achieves batch distribution of images to large-scale devices while ensuring that cloud and network resources are not impacted by instantaneous surges. It effectively solves the problems of concurrent scheduling and resource balancing in scenarios with massive edge nodes.

[0056] Example 3 provides an application example of a passive synchronization method for container images of distributed devices adapted to unidirectional networks, and verifies and explains the technical effects of this method.

[0057] In one specific implementation, the present invention is applied to the distributed device edge cloud platform of a provincial company of State Grid. The cloud adopts a Kubernetes v1.24.10 high-availability cluster with x86 architecture, and the distributed device is an ARM Cortex-A72 embedded terminal in the power field. The cloud-edge network adopts a physical one-way isolation architecture. The cloud can actively access the device, and the device side prohibits any active outbound connection through kernel-level iptables rules. Thus, under the premise of ensuring network security isolation, the efficient and secure synchronization of container images is achieved.

[0058] In one specific implementation, during the initialization configuration and cloud-edge authentication phase, a self-developed cloud-edge virtual node agent is deployed in the cloud. This agent loads a configuration file containing the node IDs of 50 distributed devices, an IP whitelist (10.120.30.0 / 24), CA root certificates, and RSA2048 asymmetric keys. It also listens for K8s scheduling events via a List-Watch mechanism. Each distributed device deploys a self-developed agent service, configured to listen only on TCP port 8088 and enable TLS 1.3 encryption verification. Simultaneously, the containerd container engine interface is initialized. Subsequently, the cloud sends an authentication request to the device carrying a random challenge number and a timestamp. After verifying the signature and time window, the device returns a response. Once both parties complete two-way authentication, a TLS 1.3 encrypted channel is established, and the device is registered as a virtual node in the K8s cluster, enabling it to receive scheduling requests.

[0059] In one specific implementation, during the image scheduling interception and cloud processing phase, when the cloud creates a power grid edge monitoring application Deployment and specifies scheduling to edge-device-01, the self-developed virtual node agent immediately intercepts the event, parses the target image address harbor.grid.sgcc.com / edge / power-monitor:v2.1; the cloud then pulls the image from the Harbor image repository and stores it in a local hierarchical cache, compresses it into a 268MB tar.gz file using the docker save | gzip -6 command, calculates the global MD5 checksum 5f7d9c2b8e1a3f6d470b925e8c1a7d4b, and finally encapsulates structured metadata containing file size, number of blocks (64 blocks), block hash list, and target node ID, preparing for one-way transmission.

[0060] In one specific implementation, the cloud calls the receiving interface of the device agent through the established encrypted channel to divide the 268MB image file into 64 data blocks of fixed size (4MB each). A fixed frame structure containing a frame header, binary data blocks, and a frame tail is constructed and sent frame by frame in the form of a unidirectional file stream. During transmission, the cloud manages the block sequence number through a FIFO queue and uses a token bucket algorithm to control the rate within 80Mbps to avoid unidirectional network congestion. When the 32nd block times out due to network fluctuations, the cloud automatically triggers an exponential backoff retransmission mechanism and retransmits the block after a 1-second interval. After all blocks have been transmitted, the encrypted metadata is sent to the device side.

[0061] In one specific implementation, on the distributed device side, the agent service is in a passive listening state throughout. After receiving the segmented data sent from the cloud, it writes it to the encrypted cache directory according to the frame header sequence number and sorts and reassembles it. After all 64 segments have been received, the agent recalculates the MD5 value of the reassembled file and compares it with the metadata sent from the cloud. After verification, it imports the image into the containerd k8s.io namespace via the ctr command and rewrites the image tag to local-registry / power / terminal / power-monitor:v2.1 according to the power grid specification. After loading is complete, the agent automatically cleans up the temporary cache file and returns a synchronization completion flag to the cloud one-way, realizing stateless and lightweight operation.

[0062] In one specific implementation, for large-scale batch synchronization optimization, a synchronization task is created in the cloud, specifying 20 devices from edge-device-01 to edge-device-20 as the target, configuring a parallel synchronization number of 5 and a rate limit of 80Mbps; the self-developed batch synchronization controller uses the token bucket algorithm to control concurrent connections, converting the task into synchronization instructions for each virtual node and issuing them in parallel; each device uses the above passive synchronization process to complete image preloading, so that the application can directly call the locally cached image when it starts up, without waiting for real-time synchronization; the controller monitors the status of each node in real time and automatically generates traceable logs containing node ID, time consumption and verification results, thereby reducing the application startup latency from 45s to 8s while meeting the unidirectional network restrictions, significantly improving edge computing efficiency.

[0063] Example 4: This example provides a passive synchronization system for distributed device container images adapted to unidirectional networks, including: The channel establishment module is used to deploy a self-developed cloud-edge virtual node agent in the cloud and configure the first authentication information. The distributed device starts the self-developed agent program and enters a passive listening state. Through two-way identity authentication between the cloud and the distributed device, an encrypted and secure transmission channel is established, and the distributed device is registered as a cloud virtual node. The image preprocessing module is used to intercept application scheduling events targeting virtual nodes of distributed devices in the cloud through a self-developed virtual node proxy, pull target images from the image repository, compress and package the target images, and generate corresponding integrity verification metadata. The block distribution module is used to divide the processed image file into blocks of fixed size and distribute them frame by frame to the distributed device through an encrypted and secure transmission channel in the form of a one-way file stream. The device side only passively receives the data and does not provide feedback on the transmission status. The receiving, verification, and loading module is used by the distributed device to reassemble and verify the integrity of the received image blocks. After the verification is successful, the local container engine is called to import the image and perform tag normalization processing to complete the local loading of the image. The batch synchronization module is used for large-scale distributed device scenarios. It creates batch synchronization tasks in the cloud, controls the number of parallel synchronizations through the token bucket algorithm, and sends image data to the target device in batches. The device side uses the passive synchronization process to complete the local preloading of the image.

[0064] It should be noted that the technical solution of the passive synchronization system for distributed device container images adapted to unidirectional networks is based on the same concept as the technical solution of the passive synchronization method for distributed device container images adapted to unidirectional networks described above. For details not described in detail in the technical solution of the passive synchronization system for distributed device container images adapted to unidirectional networks described above, please refer to the description of the technical solution of the passive synchronization method for distributed device container images adapted to unidirectional networks described above.

[0065] The above-mentioned unit modules can be embedded in the processor of the electronic device in hardware form or independent of it, or they can be stored in the memory of the electronic device in software form, so that the processor can call and execute the corresponding operations of the above modules.

[0066] This embodiment also provides an electronic device, which includes a processor, a memory, a communication interface, a display screen, and an input device connected via a system bus. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, carrier networks, NFC (Near Field Communication), or other technologies. When the computer program is executed by the processor, it implements a passive synchronization method for distributed device container images adapted to unidirectional networks. The display screen can be a liquid crystal display (LCD) or an e-ink display. The input device can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the device's casing, or an external keyboard, touchpad, or mouse.

[0067] This embodiment also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method proposed in the above embodiments.

[0068] The storage medium proposed in this embodiment belongs to the same inventive concept as the method proposed in the above embodiments. Technical details not described in detail in this embodiment can be found in the above embodiments, and this embodiment has the same beneficial effects as the above embodiments.

[0069] Based on the above description of the implementation methods, those skilled in the art can clearly understand that the present invention can be implemented using software and necessary general-purpose hardware, and of course, it can also be implemented using hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory, random access memory, flash memory, hard disk, or optical disk, and includes several instructions to cause an electronic device (which may be a personal computer, server, or network device, etc.) to execute the method of the embodiments of the present invention.

[0070] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the present invention.

Claims

1. A method for adapting a distributed device container image passive synchronization of unidirectional networks, characterized in that, include: A self-developed cloud-edge virtual node agent is deployed in the cloud and configured with the first authentication information. The distributed device starts the self-developed agent program and enters a passive listening state. Through two-way identity authentication between the cloud and the distributed device, an encrypted and secure transmission channel is established, and the distributed device is registered as a cloud virtual node. The cloud-based system intercepts application scheduling events targeting virtual nodes of distributed devices through a self-developed virtual node proxy, pulls the target image from the image repository, compresses and packages the target image, and generates corresponding integrity verification metadata. The processed image file is divided into blocks of fixed size and sent frame by frame to the distributed device through the encrypted secure transmission channel in the form of a one-way file stream. The device side only passively receives the file and does not provide feedback on the transmission status. The distributed device reassembles and verifies the integrity of the received image blocks. After the verification is successful, it calls the local container engine to import the image and performs tag normalization processing to complete the local loading of the image. For large-scale distributed device scenarios, batch synchronization tasks are created in the cloud, the number of parallel synchronizations is controlled by the token bucket algorithm, and image data is distributed to the target device in batches. The device side uses the passive synchronization process to complete the local preloading of the image.

2. The method of claim 1, wherein the method is performed by a distributed device container image passive synchronization method adapted for a unidirectional network. The initialization and secure channel establishment between the cloud and distributed devices include: The cloud generates an asymmetric key pair and certificate chain, configures a distributed device management list and IP whitelist policy; the distributed device starts a self-developed agent program, loads the pre-set root certificate and device credentials, and prohibits active outbound network connections from the kernel level. The cloud sends an authentication request to the distributed device, carrying a unique identifier, a random challenge number, and a timestamp; the distributed device verifies the legality of the request based on preset verification rules and returns a signed response, and the cloud verifies the signature of the response to complete two-way identity authentication; After authentication, the cloud and the distributed device negotiate a session key based on the transport layer security protocol to establish an end-to-end encrypted secure transmission channel. The cloud-based self-developed virtual node agent will register as a virtual node of the cloud orchestration system through certified distributed devices, enabling the devices to receive cloud commands.

3. The method of claim 2, wherein the method is performed by a distributed device container image passive synchronization method adapted for a unidirectional network. The cloud-based system intercepts application scheduling events targeting distributed device virtual nodes via a self-developed virtual node proxy, pulls the target image from the image repository, and compresses and packages the target image, including: The self-developed virtual node agent monitors the scheduling events of the cloud orchestration system in real time. When it detects that an application has been scheduled to a distributed device virtual node, it parses out the target image address and version information. The cloud retrieves the target image from the image repository and stores it in the local cache directory; The cloud exports the image as an archive file and uses a compression algorithm to package it into a compressed file, while calculating the global integrity check value of the compressed file. The system encapsulates structured metadata containing image metadata, block parameters, and global integrity verification values, and stores it in encrypted form.

4. The passive synchronization method for distributed device container images adapted to unidirectional networks as described in claim 3, characterized in that, Cloud-based one-way chunked transmission includes: The cloud calls the receiving interface of the distributed device agent program to cut the compressed file into multiple data blocks according to a preset byte size; A fixed frame structure containing a frame header, binary data blocks, and a frame trailer is constructed and sent to the distributed device in binary stream form through a one-way network, without the device side providing any feedback confirmation. The cloud maintains the transmission queue. If a chunk transmission timeout is detected, an exponential backoff retransmission mechanism is triggered to continue transmission from the interrupted chunk sequence number. Once all chunks have been transmitted, the cloud encrypted and distributed the structured metadata to the distributed device.

5. The passive synchronization method for distributed device container images adapted to unidirectional networks as described in claim 4, characterized in that, Distributed device-side image reception and loading includes: The distributed device agent passively receives the segmented data sent from the cloud, parses the frame header to obtain the sequence number, and writes it into the local encrypted temporary cache in sequence. After all segments have been received, the integrity check value of the locally reconstructed file is recalculated and compared with the check value in the metadata sent from the cloud. If the verification matches, the image is imported through the container engine's standard interface, and the image tags are rewritten according to the preset specifications; if the verification does not match, the cache is cleared and the system waits for the image to be retransmitted from the cloud. After the image import is complete, temporary cache files are automatically cleared, and a synchronization completion status indicator is returned to the cloud one-way.

6. The passive synchronization method for distributed device container images adapted to unidirectional networks as described in claim 5, characterized in that, The batch synchronization optimization includes: Create batch synchronization tasks in the cloud and filter target distributed device nodes based on device tags, unique identifier lists, or maintenance groups; Configure the threshold for the number of parallel synchronizations and the upper limit for the transmission rate, and use the token bucket algorithm to control the number of concurrent connections to prevent the cloud bandwidth from being exhausted; Batch tasks are converted into synchronous instructions for multiple virtual nodes, and then distributed to the target device in parallel through a self-developed virtual node agent; The target device preloads the image locally, allowing the application to directly call the locally cached image at startup without waiting for real-time synchronization.

7. The passive synchronization method for distributed device container images adapted to unidirectional networks as described in claim 6, characterized in that, The method also includes batch synchronization state management and exception handling procedures: The cloud-based self-developed batch synchronization controller has a built-in synchronization state machine. After task initialization, the state machine sequentially flows to the task distribution, image transmission, and verification loading stages. Real-time monitoring of the synchronization status of each target device; if a device times out or returns an error, the node is marked and automatically added to the next batch of retry queue. Once all target devices have completed synchronization or reached the maximum number of retries, the state machine transitions to the synchronization completed or abnormal termination state. Generate traceable synchronization logs containing node IDs, image information, synchronization time, and verification results for operation and maintenance personnel to audit.

8. A passive synchronization system for distributed device container images adapted to unidirectional networks, employing the passive synchronization method for distributed device container images adapted to unidirectional networks as described in any one of claims 1 to 7, characterized in that, include: The channel establishment module is used to deploy a self-developed cloud-edge virtual node agent in the cloud and configure the first authentication information. The distributed device starts the self-developed agent program and enters a passive listening state. Through two-way identity authentication between the cloud and the distributed device, an encrypted and secure transmission channel is established, and the distributed device is registered as a cloud virtual node. The image preprocessing module is used to intercept application scheduling events targeting virtual nodes of distributed devices through a self-developed virtual node proxy in the cloud, pull target images from the image repository, compress and package the target images, and generate corresponding integrity verification metadata. The block distribution module is used to divide the processed image file into blocks of fixed size and distribute them frame by frame to the distributed device through the encrypted secure transmission channel in the form of a one-way file stream. The device side only passively receives the data and does not provide feedback on the transmission status. The receiving verification loading module is used by the distributed device to reassemble and verify the integrity of the received image blocks. After the verification is passed, the local container engine is called to import the image and perform tag normalization processing to complete the local loading of the image. The batch synchronization module is used for large-scale distributed device scenarios. It creates batch synchronization tasks in the cloud, controls the number of parallel synchronizations through the token bucket algorithm, and sends image data to the target device in batches. The device side uses the passive synchronization process to complete the local preloading of the image.

9. An electronic device comprising a memory and a processor, characterized in that: The memory is used to store computer-executable instructions, and when the processor executes the computer-executable instructions, it implements the steps of the passive synchronization method for distributed device container images adapted to unidirectional networks as described in any one of claims 1 to 7.

10. A computer-readable storage medium having computer-executable instructions stored thereon, characterized in that: When the computer-executable instructions are executed by the processor, they implement the steps of the passive synchronization method for distributed device container images adapted to unidirectional networks as described in any one of claims 1 to 7.

Images