Controller online upgrade security management method and system

Abstract

The present application relates to the technical field of multi-core central processor, in particular to a controller online upgrade security management method and system, comprising the following steps: obtaining upgrade file header information, identifying controller version and authorization mark, and generating upgrade permission; reading page-level data and registration information according to the permission, and writing target storage page effective program into the mirror area. After checking the package sequence, data length and correct verification result, the target page is written; after all pages are written, the whole is verified, and when consistent, the new version is switched. If the communication is timed out, the sequence is wrong, the length is abnormal or the verification is inconsistent, the original program is rolled back according to the mirror record and the start is maintained. In the present application, through the linkage of upgrade access, page-level registration check, pre-writing mirror, post-writing verification and abnormal rollback, the version authorization and controller identity are constrained, the page writing integrity and switching basis are continuously verified, the risk of false upgrade, page damage and start abnormality is reduced, and the online upgrade security, reliability and maintenance efficiency are improved.

Description

Technical Field

[0001] This invention relates to the field of multi-core central processing unit technology, and in particular to a method and system for online upgrade and security management of controllers. Background Technology

[0002] The field of multi-core central processing unit (CPU) technology relates to data security processing methods in computer systems where the processor performs integrity verification on program data, verification fields, version records, and storage images. Among these, the traditional online controller upgrade security management system is a hardware and software collaborative system consisting of an upgrade server, communication interface, controller processor, program memory, version information table, and status record area. The upgrade server issues upgrade files, the controller processor receives program data and writes it to a designated storage area, and simultaneously performs consistency verification on the written content based on the verification data in the upgrade file.

[0003] Online upgrades of existing controllers typically rely on upgrade servers to send program data, which is then written to a designated storage area by the controller. Verification processes are mostly focused on checking the consistency of content after writing. Before the upgrade, there is insufficient verification of the association between the controller's identification software number, version status, and authorization status. Page-level data sequence length verification and registration lack continuous constraints. After abnormal interruptions and communication timeouts, the original valid program lacks traceable mirror records, which can easily lead to version errors, program page corruption, uncertain startup status, increased maintenance costs, and make it difficult to form a stable closed loop in the field upgrade process. Summary of the Invention

[0004] To achieve the above objectives, the present invention adopts the following technical solution: a method for online upgrade and security management of controllers, comprising the following steps: Obtain the upgrade file header information, controller version information, and authorization mark; compare the controller identifier, software number, and target version number in the upgrade file header information with the controller version information and the authorization mark to generate an upgrade license mark. Based on the upgrade license tag, obtain the page-level data segment, determine the target storage page address, sub-packet order, page length and page check field of the page-level data segment, and read the page registration information from the upgrade package version information database; Based on the target storage page address, read the currently valid program content, write the currently valid program content into the rollback mirror area, calculate the mirror verification field, and generate a rollback mirror record; The packet order, page length, page internal verification field and page registration information are compared. If they match, the target storage page is erased and written to the page-level data segment. The target storage page is read back to generate a write completion marker. Based on the write completion marker, calculate the overall verification field after the upgrade. When the overall verification field after the upgrade is consistent with the overall verification field in the header information of the upgrade file, generate a version switching instruction. When communication reception timeout and verification are inconsistent, write the current valid program content back to the target storage page based on the rollback mirror record, and generate a rollback completion marker and a start-up hold instruction.

[0005] As a further aspect of the present invention, the step of generating the upgrade license mark includes: Obtain the header information of the upgrade file, parse the fields in the header information of the upgrade file, extract the controller identifier, software number, target version number and overall verification field, and generate a header parsing record when the field parsing results meet the preset field length and field arrangement order; Obtain controller version information, read the local controller identifier, current software number, and current version number from the controller version information, compare the controller identifier, software number, and target version number with the local controller identifier, current software number, and current version number respectively, and generate a version matching record; Obtain the authorization token, associate the authorization token with the version matching record, and generate an upgrade license token when the controller identifier, software number and target version number all match and the authorization token is in the upgrade allowed state.

[0006] As a further aspect of the present invention, the steps of acquiring page-level data segments and reading page registration information include: Obtain the upgrade license tag, determine the license status of the upgrade license tag, and when the license status is "allow to obtain", read the page-level data segment from the upgrade communication buffer, and parse the page header field of the page-level data segment to determine the target storage page address, packet order, page length and page check field; A page registration index is generated based on the target storage page address and the packet order. Page registration information corresponding to the page registration index is read from the upgrade package version information database, and a correspondence is established between the page registration information and the page-level data segment to generate a page-level receiving record.

[0007] As a further aspect of the present invention, the step of generating a rollback mirror record includes: The currently valid program content in the program storage area is read based on the target storage page address, and the read currently valid program content is verified against the address range of the target storage page boundary. When the read range is consistent with the storage page range corresponding to the target storage page address, a valid program read record is generated. The currently valid program content is written into the mirror page location associated with the target storage page address in the rollback mirror area. The mirror page location after writing is read back and verified, and the mirror verification field is calculated based on the read-back content. The target storage page address, the mirror page location, the mirror verification field, and the valid program read record are associated and stored to generate the rollback mirror record.

[0008] As a further aspect of the present invention, the process of reading the currently valid program content includes: Read the valid program area identifier and page valid identifier from the controller startup status table, determine the program partition to be read based on the valid program area identifier, and determine whether the storage page corresponding to the target storage page address is in a valid state based on the page valid identifier; When the storage page corresponding to the target storage page address is in a valid state, the page content corresponding to the target storage page address is read from the program partition to be read, and the page content is length-verified with the storage page capacity to generate the currently valid program content.

[0009] As a further aspect of the present invention, the step of generating the write completion marker includes: Obtain the packet order, page length, page in-page verification field, and page registration information; read the registered packet order, registered page length, and registered verification field from the page registration information; and perform consistency comparison between the packet order, page length, and page in-page verification field and the registered packet order, page length, and registered verification field to generate a page write permission record. When the page write permission record is in the write permission state, the target storage page is erased and the page blank state after erasure is read. When the page blank state meets the blank determination condition, the page-level data segment is written to the target storage page, the written page content in the target storage page is read back, and a write completion mark is generated.

[0010] As a further aspect of the present invention, the process of generating the page write permission record includes: The registration page address, registration sub-packet order, registration page length, and registration verification field are read from the page registration information. The registration page address is compared with the target storage page address for address consistency, and the registration sub-packet order is compared with the sub-packet order for order consistency to obtain the address order comparison result. The registration page length is compared with the page length for consistency, and the registration verification field is compared with the page internal verification field for consistency. When the address order comparison result, length consistency comparison result, and verification consistency comparison result are all in a pass state, the page write permission record is generated.

[0011] As a further aspect of the present invention, the steps for generating the version switching instruction, the rollback completion flag, and the startup hold instruction include: Obtain the write completion flag. When the write completion flag is in a valid write state, read the page content already written to the program area and perform overall verification calculation according to the upgrade package page registration order to generate the overall verification field after the upgrade. The overall verification field after the upgrade is compared with the overall verification field in the header information of the upgrade file. When they match, the target version number, the startup partition identifier and the switching time marker are written into the version switching cache area to generate a version switching instruction. When the communication reception timeout and the overall verification field comparison are inconsistent, the rollback image record is read and the currently valid program content is written back to the target storage page, generating a rollback completion flag and a start hold instruction.

[0012] As a further aspect of the present invention, the calculation process of the upgraded overall verification field includes: Read the contents of multiple written pages corresponding to the page registration information in the program area, determine the splicing order of the multiple written page contents based on the registration sub-packet order, and perform continuity judgment and empty page judgment on the multiple written page contents; When the concatenation order of multiple written page contents is consecutive and there are no empty pages, the overall digest calculation of the multiple written page contents is performed according to the concatenation order, and the overall digest calculation result is associated with the target version number and software number to generate the upgraded overall verification field.

[0013] An image processing-based controller online upgrade security management system includes: The upgrade license tag generation module is used to: obtain upgrade file header information, controller version information and license tag; compare the controller identifier, software number and target version number in the upgrade file header information with the controller version information and the license tag to generate an upgrade license tag; The page-level data segment parsing module is used to: obtain page-level data segments based on the upgrade license mark, determine the target storage page address, packet order, page length and page check field of the page-level data segment, and read page registration information from the upgrade package version information database; The rollback image record generation module is used to: read the currently valid program content based on the target storage page address, write the currently valid program content into the rollback image area, calculate the image verification field, and generate a rollback image record; The target storage page update module is used to: compare the packet order, the page length, the page internal verification field and the page registration information; when the comparison is consistent, erase the target storage page and write the page-level data segment; and read back the target storage page to generate a write completion mark. The upgrade verification and rollback control module is used to: calculate the overall verification field after the upgrade based on the write completion flag; generate a version switching instruction when the overall verification field after the upgrade is consistent with the overall verification field in the header information of the upgrade file; and write the currently valid program content back to the target storage page based on the rollback mirror record when the communication reception timeout and verification are inconsistent, thereby generating a rollback completion flag and a start-up hold instruction.

[0014] Compared with the prior art, the advantages and positive effects of the present invention are as follows: In this invention, a continuous secure link is constructed around the upgrade license page-level write rollback recovery and version switching. The upgrade file header information controller version information and authorization mark are synchronously compared to limit the upgrade entry. The page-level data segment is then constrained by sequential length address verification with the registration information. Before writing, the current valid program content is saved and a mirror verification record is generated. After writing, the integrity of the program is verified by combining page readback and overall verification. When communication timeout or verification inconsistency occurs, the target storage page is restored according to the mirror record and the original startup state is maintained. A closed loop is formed from the abnormal recovery of upgrade access data page fallback to startup maintenance, reducing the risk of erroneous upgrade page corruption and version switching out of control, and improving the reliability and maintainability of online upgrades. Attached Figure Description

[0015] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0016] Figure 1 This is a flowchart of the online upgrade and security management method for the controller of the present invention; Figure 2 This is a module relationship diagram of the online upgrade safety management system for the controller of the present invention; Figure 3 This is a schematic diagram showing the correspondence between page-level writing and rollback mirroring in this invention; Figure 4 This is a schematic diagram illustrating the associated status of the upgrade process of this invention; Figure 5 This is a schematic diagram illustrating the abnormal state suppression and startup maintenance effects of the present invention. Detailed Implementation

[0017] The technical solution of the present invention will now be described with reference to the accompanying drawings.

[0018] To make the technical problems, technical solutions and advantages of the present invention clearer, a detailed description will be given below in conjunction with the accompanying drawings and specific embodiments.

[0019] Example Please see Figures 1 to 5 This embodiment provides a controller online upgrade security management method and system. In the actual operation process where the controller receives the upgrade package online and maintains the original valid program that can be started, the upgrade file header information, page-level data segments, page registration information, rollback mirror records and version switching control status flow in a fixed order, so that upgrade writing, overall verification and abnormal rollback are within the same control boundary. It includes a controller online upgrade security management method and a controller online upgrade security management system based on image processing.

[0020] During online controller upgrades, directly erasing and writing the program storage area based solely on the received upgrade data can lead to issues such as inconsistencies between the upgrade file and the local version, disordered packet order, page content verification failures, and communication interruptions, all of which can affect the retention status of the currently valid program. This embodiment first compares the consistency of the upgrade file header information, controller version information, and authorization flags. Then, it performs registration and verification, rollback mirroring, target storage page writing, and readback confirmation at the page-level data segment level. Finally, it uses the overall verification results to determine version switching and rollback retention, ensuring that traceable original program content exists before each page is written and that abnormal states can be restored to the valid startup state before the upgrade by following the rollback mirror record.

[0021] Method Implementation Examples

[0022] S1: Obtain the upgrade file header information, controller version information, and authorization flag. Compare the controller identifier, software number, and target version number in the upgrade file header information with the controller version information and authorization flag to generate an upgrade permission flag. The upgrade file header information refers to the header data received before the page-level data segment, carrying the controller identifier, software number, target version number, and overall verification field. The controller version information refers to the local controller identifier, current software number, and current version number stored by the controller in its current active program running state. The authorization flag refers to the allowed and prohibited upgrade states pre-set by the upgrade management process, used to limit whether the current upgrade file can enter the page-level reception stage. The upgrade permission flag is a process state formed by the header field matching result, version matching result, and authorization status, used to determine whether to subsequently read the page-level data segment.

[0023] S101: Obtain the upgrade file header information, parse the fields in the upgrade file header information, extract the controller identifier, software number, target version number, and overall verification field, and generate a header parsing record when the field parsing results meet the preset field length and field arrangement order. The preset field length and field arrangement order are derived from the upgrade package format convention. During field parsing, fields are extracted sequentially according to their position in the header. The controller identifier is used to limit the target controlled object, the software number is used to limit the software object to be upgraded, the target version number is used to limit the version status after the upgrade is completed, and the overall verification field is used for subsequent overall consistency judgment on the written program area. The header parsing record is a process record that includes the header field extraction status, field completeness status, and field arrangement status. Subsequent version comparisons only accept header parsing records with a parsing status of "passed".

[0024] S102: Obtain controller version information. Read the local controller identifier, current software number, and current version number from the controller version information. Compare the controller identifier, software number, and target version number with the local controller identifier, current software number, and current version number respectively, generating a version matching record. During the comparison, first check if the controller identifier and the local controller identifier point to the same controller, then check if the software number and the current software number point to the same software object, and finally check if the target version number and the current version number meet the upgrade direction rules. The version matching record refers to the data recording the comparison status and version direction status of the fields. The version direction rules are predetermined by the upgrade package version management rules to prevent non-local files, non-corresponding software files, and files that do not conform to the upgrade direction from entering the writing process.

[0025] S103: Obtain the authorization tag and associate it with the version matching record. If the controller identifier, software number, and target version number all match and the authorization tag is in an upgrade-allowed state, generate an upgrade license tag. During the association judgment, if the header parsing record fails, any version matching record has a mismatch, or the authorization tag is in an upgrade-prohibited state, the upgrade license tag is set to an unacceptable state, and reading page-level data segments is stopped. If all the above conditions are met, the upgrade license tag is set to an acceptable state and used as input conditions for subsequent page-level data segment acquisition steps.

[0026] In this embodiment, the upgrade file header information is processed by field parsing, version comparison, and authorization association judgment to prevent non-target controller files, non-corresponding software files, and unauthorized files from entering the page-level writing process, thereby enabling the upgrade license mark to form a clear access boundary before page-level data reading.

[0027] S2: Based on the upgrade license tag, obtain the page-level data segment, determine the target storage page address, packet order, page length, and page checksum field of the page-level data segment, and read the page registration information from the upgrade package version information database. Here, a page-level data segment refers to a data block in the upgrade file organized with program storage pages as the write boundary, carrying the page content to be written and the page header field. The target storage page address refers to the program storage page location where the page-level data segment is intended to be written. The packet order refers to the registration order of the page-level data segments within the upgrade package. The page length refers to the valid write boundary state of the page content corresponding to the page-level data segment. The page checksum field is the verification information used to determine whether the page-level data segment remains consistent before and after receiving and writing. The upgrade package version information database is a collection of registration information formed with the upgrade package and the upgrade management process, carrying the registered page address, registered packet order, registered page length, and registered checksum field corresponding to the page. Page registration information refers to the registration record read from the upgrade package version information database that corresponds to the target storage page address and packet order.

[0028] S201: Obtain the upgrade license flag and determine its license status. If the license status is "allowed to obtain," read the page-level data segment from the upgrade communication buffer and parse the page header field of the page-level data segment to determine the target storage page address, packet order, page length, and page checksum field. The upgrade communication buffer is a buffer area that temporarily stores received upgrade data during the online upgrade process. After the page-level data segment enters this buffer area, the page header and page content are separated according to the order of the page header fields. Then, the target storage page address, packet order, page length, and page checksum field are determined based on the page header fields. If the upgrade license flag is "not allowed to obtain," or if the page header fields are missing, the arrangement does not conform to the page-level data segment format, or the page length does not match the page content boundary, then no writable page-level receive record is generated, and the page-level data segment remains in an unlicensed processing state.

[0029] S202: Generate a page registration index based on the target storage page address and packet order. Read the page registration information corresponding to the page registration index from the upgrade package version information database, and establish a correspondence between the page registration information and page-level data segments to generate a page-level receive record. The page registration index is a retrieval field jointly determined by the target storage page address and packet order, used to locate unique page registration information in the upgrade package version information database. The page-level receive record is a process record that associates page-level data segments, page header resolution status, page registration information, and correspondence. Subsequent rollback mirroring and write permission judgments all use the page-level receive record as input. If the page registration index cannot match the page registration information, the page-level receive record is marked as missing, and writing to the target storage page is blocked.

[0030] In this embodiment, page-level data segment reading is controlled by upgrading the license flag, and a correspondence is established between the received page and the registered page through the page registration index. This ensures that the target storage page address, packet order, page length, and page check fields form a verifiable data source before writing, thereby preventing unregistered page content in the receive cache from being directly written to the program storage area.

[0031] S3: Read the currently valid program content based on the target storage page address, write the currently valid program content to the rollback mirror area, calculate the mirror verification field, and generate a rollback mirror record. Here, the currently valid program content refers to the page content corresponding to the target storage page address within the currently valid program area before the upgrade. The rollback mirror area is a mirror region used to store the page content before the upgrade; its mirror page location has a pre-established association with the target storage page address. The mirror verification field is a field formed by verifying the read-back content after writing to the rollback mirror area, used to confirm that the rollback mirror content is consistent with the content read before writing. The rollback mirror record is a record that associates and saves the target storage page address, mirror page location, mirror verification field, and valid program read record, used to restore the currently valid program content in case of communication reception timeout or overall verification inconsistency.

[0032] S301: Read the currently valid program content in the program storage area based on the target storage page address, and verify the address range of the read current valid program content against the target storage page boundary. When the read range matches the storage page range corresponding to the target storage page address, a valid program read record is generated. The program storage area refers to the storage area that stores the content of the controller's startable program, and the target storage page boundary refers to the start and end boundaries of the page corresponding to the target storage page address. During address range verification, first locate the page to be read based on the target storage page address, then confirm that the read range has not exceeded the page boundary, and after the read content completely covers the valid content of the page, a valid program read record is generated. If the read range exceeds the boundary, the page content is unreadable, or the page's valid state does not meet the subsequent rollback requirements, the target storage page erase write is not performed.

[0033] S302: Read the valid program area identifier and page valid identifier from the controller startup status table. Based on the valid program area identifier, determine the program partition to be read, and based on the page valid identifier, determine whether the storage page corresponding to the target storage page address is in a valid state. The controller startup status table records the current startup program partitions and the valid state of storage pages. The valid program area identifier points to the program partition on which the controller startup depended before the upgrade, and the page valid identifier marks whether the page corresponding to the target storage page address belongs to the currently valid program content. After the program partition to be read is determined, only when the page valid identifier indicates that the storage page is in a valid state, read the page content corresponding to the target storage page address from the program partition to be read, and verify the length of the page content against the storage page capacity to generate the currently valid program content. If the page valid identifier is not in a valid state, stop forming the rollback mirror record and maintain the startup state without switching.

[0034] S303: Write the currently valid program content to the mirror page location associated with the target storage page address in the rollback mirror area. Perform readback verification on the mirror page location after writing, and calculate the mirror verification field based on the readback content. When writing to the rollback mirror area, first determine the mirror page location based on the target storage page address, then write the currently valid program content to that mirror page location, and then read back the content of the mirror page location and verify its consistency with the currently valid program content before writing. The mirror verification field is formed by the readback content according to the upgrade management preset verification rules. Its result is associated with the target storage page address, mirror page location, and valid program read record and stored together to generate a rollback mirror record. If the readback verification is inconsistent, the rollback mirror record is marked as unusable, and the target storage page does not enter the erase and write stage.

[0035] In this embodiment, by reading the currently valid program content and writing it to the rollback mirror area before erasing the target storage page, each page has writable content corresponding to the target storage page address before the upgrade is written, so that the page state before the upgrade can be restored based on the rollback mirror record when communication is interrupted or the overall verification fails.

[0036] S4: Compare the packet order, page length, and page checksum fields with the page registration information. If they match, erase the target storage page and write it to the page-level data segment. Read back the target storage page to generate a write completion flag. The write completion flag is a status flag formed after the target storage page has undergone registration verification, erasure, writing, and readback. It indicates whether the page can be included in the overall verification after the upgrade. Before erasing the target storage page, it must be confirmed that the page-level receive record is in a registration matching state and the rollback mirror record is in a usable state to avoid changing the currently valid program content when registration verification and rollback guarantees are lacking.

[0037] S401: Obtain the packet order, page length, page internal checksum field, and page registration information. Read the registered packet order, registered page length, and registered checksum field from the page registration information. Compare the packet order, page length, and page internal checksum field with the registered packet order, registered page length, and registered checksum field respectively to generate a page write permission record. The page write permission record is a write access record formed by verifying the page address, packet order, page length, and page internal checksum field. During the comparison, first confirm that the packet order of the received page matches the registered packet order, then confirm that the page length corresponds to the registered page length, and finally confirm that the page internal checksum field matches the registered checksum field. If any comparison is inconsistent, the page write permission record is in a write-prohibited state, and the page-level data segment is kept in a pending or abnormal state; the target storage page is not erased.

[0038] S402: Read the registered page address, registered packet order, registered page length, and registered verification field from the page registration information. Compare the registered page address with the target storage page address for address consistency, and compare the registered packet order with the packet order for sequence consistency, obtaining the address order comparison result. Then, compare the registered page length with the page length for length consistency, and compare the registered verification field with the page internal verification field for verification consistency. When the address order comparison result, length consistency comparison result, and verification consistency comparison result are all successful, generate a page write permission record. Address consistency comparison is used to prevent page-level data segments from being written to locations other than the registered page address; sequence consistency comparison is used to prevent page-level data segments from entering the written program area out of order; length consistency comparison is used to prevent page content boundaries from being inconsistent with registration boundaries; and verification consistency comparison is used to prevent received content from not corresponding to registered content.

[0039] S403: When the page write permission record is in the write permission state, erase the target storage page and read the page blank state after erasure. If the page blank state meets the blank judgment condition, write the page-level data segment to the target storage page, read back the written page content in the target storage page, and generate a write completion marker. The page blank state refers to the blank judgment result obtained after the target storage page is erased. The blank judgment condition comes from the preset blank rules after the program storage area is erased. After the written page content is read back, it is checked for consistency with the page content of the page-level data segment and the page internal check fields. If the confirmation is successful, the write completion marker is marked as a valid write state, and the target storage page is allowed to enter the overall verification scope. If the blank judgment condition is not met after erasure, the read back after writing is inconsistent, or the page internal check is inconsistent, the write completion marker is marked as an invalid write state, and the call condition for the corresponding rollback mirror record of the target storage page is triggered.

[0040] In this embodiment, the packet order, page length, page internal verification field, and target storage page address are verified before writing by using page registration information. This ensures that the target storage page is only erased and written when the received content matches the registered content, thus giving the page-level update process order constraints, address constraints, and content constraints.

[0041] S5: Calculate the overall verification field after the upgrade based on the write completion flag. If the overall verification field after the upgrade matches the overall verification field in the upgrade file header information, a version switching instruction is generated. If communication reception times out or verification is inconsistent, the currently valid program content is written back to the target storage page based on the rollback mirror record, generating a rollback completion flag and a startup hold instruction. The overall verification field after the upgrade refers to the field formed after performing overall verification on the page content that has been written to the program area according to the upgrade package page registration order. The version switching instruction refers to the startup partition switching control information generated after the overall verification is consistent. The rollback completion flag is the status flag formed after the current valid program content is written back based on the rollback mirror record. The startup hold instruction is the control instruction to maintain the original startup state when the upgrade does not meet the switching conditions.

[0042] S501: Obtain the write completion flag. When the write completion flag indicates a valid write status, read the page content of the written program area and perform overall verification calculation according to the upgrade package page registration order to generate the upgraded overall verification field. The written program area refers to the program area used to form the target version program content after receiving page-level data segments. During overall verification processing, first read the content of multiple written pages corresponding to the page registration information, then determine the splicing order according to the registration sub-package order, and perform continuity judgment and missing page judgment on the written page content. The continuity judgment is used to confirm that the registration sub-package order is not interrupted, and the missing page judgment is used to confirm that all registered pages have a valid write status. Only when the splicing order is continuous and there are no missing pages, perform overall summary processing on the multiple written page contents according to the splicing order, and associate the overall summary processing result with the target version number and software number to generate the upgraded overall verification field.

[0043] S502: Compare the overall verification field after the upgrade with the overall verification field in the header information of the upgrade file. If they match, write the target version number, startup partition identifier, and switch timestamp to the version switching cache and generate a version switching instruction. The version switching cache is a data area used to temporarily store the state of the version to be switched. The startup partition identifier indicates that the next startup process will use the written program area, and the switch timestamp records the process state when the version switching instruction is generated. If the overall verification field after the upgrade matches the overall verification field in the header, it indicates that the written program area matches the overall content registered in the header of the upgrade file, and the version switching instruction enters the startup state update process.

[0044] S503: When communication reception times out and the overall verification field comparison is inconsistent, read the rollback mirror record and write the currently valid program content back to the target storage page, generating a rollback completion flag and a start-up hold instruction. Communication reception timeout refers to the state where the upgrade communication buffer fails to obtain a complete page-level data segment and subsequent page registration information within the preset reception conditions. The preset reception conditions are determined by the reception rules of the upgrade communication process. Inconsistent overall verification field comparison means that the overall verification field after the upgrade does not correspond to the overall verification field in the upgrade file header information. When triggering a rollback, first read the rollback mirror record corresponding to the target storage page address, confirm that the mirror verification field and mirror page position are in an available state, then write the currently valid program content in the mirror page position back to the target storage page, and perform a readback confirmation on the written target storage page. After successful readback confirmation, generate a rollback completion flag and a start-up hold instruction, ensuring the start state continues to point to the valid program area before the upgrade. If the rollback mirror record is unavailable, no version switching instruction is generated, and the start-up hold instruction remains valid to prevent the start state from pointing to a program area that has failed verification.

[0045] In this embodiment, the overall verification scope is controlled by the write completion flag, and the version switching and rollback are determined by comparing the consistency of the overall verification field after the upgrade with the overall verification field in the header. This ensures that the page-level write result only enters the switching process when the overall content is continuous, without missing pages, and is consistent. This allows the controller's online upgrade process to maintain the original effective program startup conditions even in abnormal states.

[0046] In one embodiment, the header parsing record, version matching record, page-level reception record, rollback image record, page write permission record, write completion flag, rollback completion flag, and start hold instruction are all associated with the same upgrade process identifier in the order of their generation. The upgrade process identifier is a process association field formed at the start of an online upgrade process, used to connect the states of header verification, page-level reception, image saving, page writing, overall verification, and rollback control into the same traceability chain. If an abnormal state is generated at any stage, subsequent steps, after reading the abnormal state, will not execute write and switch actions that conflict with the abnormal state. Instead, they will enter the corresponding hold and rollback branches based on the already formed rollback image record, write completion flag, and start hold instruction.

[0047] In this embodiment, by associating stage records according to the upgrade process identifier, a continuous data stream is formed between header permission, page-level registration, image rollback, write status and version switching, so that abnormal states can be located to the corresponding target storage page and the corresponding processing stage, which facilitates rollback and startup persistence.

[0048] System Implementation Examples

[0049] This embodiment also provides an image processing-based online controller upgrade security management system, which implements the aforementioned online controller upgrade security management method. The system processes upgrade file header information, controller version information, authorization flags, page-level data segments, page registration information, rollback mirror records, and upgrade verification status during the online controller upgrade process. The system includes an upgrade license flag generation module, a page-level data segment parsing module, a rollback mirror record generation module, a target storage page update module, and an upgrade verification and rollback control module. These modules transmit data and status flags sequentially according to the online upgrade process.

[0050] The upgrade license tag generation module obtains the upgrade file header information, controller version information, and license tag. It compares the controller identifier, software number, and target version number in the upgrade file header with the controller version information and license tag to generate an upgrade license tag. The module takes the upgrade file header information, controller version information, and license tag as input and outputs a header parsing record, a version matching record, and the upgrade license tag. This module only handles upgrade admission judgment; it does not perform page-level data segment writing or change the content of the target storage page. When the upgrade license tag is in an "allow" state, it outputs to the page-level data segment parsing module. When the upgrade license tag is in an "disallow" state, it outputs a "prohibit" state, preventing subsequent page-level data segment parsing from entering the write path.

[0051] The page-level data segment parsing module is used to obtain page-level data segments based on upgrade license tags, determine the target storage page address, packet order, page length, and page checksum field of the page-level data segment, and read page registration information from the upgrade package version information database. The page-level data segment parsing module receives the upgrade license tag output by the upgrade license tag generation module and reads the page-level data segment when allowed. After parsing the page header fields, this module forms the target storage page address, packet order, page length, and page checksum field. Then, it forms a page registration index using the target storage page address and packet order, reads page registration information from the upgrade package version information database, and outputs a page-level receive record. The page-level receive record is output to the rollback mirror record generation module and the target storage page update module, ensuring that rollback mirroring and write license determination use the same target storage page address and the same page registration information.

[0052] The rollback mirror record generation module reads the currently valid program content based on the target storage page address, writes it to the rollback mirror area, calculates the mirror verification field, and generates a rollback mirror record. The module receives the target storage page address and page-level receive record output by the page-level data segment parsing module, reads the valid program area identifier and page validity identifier from the controller startup status table, and determines the source page of the currently valid program content. This module writes the currently valid program content to the mirror page location associated with the target storage page address and performs readback verification on the mirror page location. After successful readback verification, the rollback mirror record is output. The rollback mirror record is output to the target storage page update module as a pre-write guarantee status and to the upgrade verification and rollback control module as a basis for abnormal write-back.

[0053] The target storage page update module compares the packet order, page length, and page checksum field with the page registration information. If they match, it erases the target storage page and writes it to a page-level data segment, then reads back the target storage page to generate a write completion marker. The target storage page update module receives the page-level receive record output by the page-level data segment parsing module and the rollback mirror record output by the rollback mirror record generation module. It first reads the registered page address, registered packet order, registered page length, and registered checksum field from the page registration information, then performs address consistency comparison, order consistency comparison, length consistency comparison, and checksum consistency comparison respectively. If the comparisons pass and the rollback mirror record is in an available state, the target storage page update module erases the target storage page, reads the page blank status, writes it to a page-level data segment after blankness determination passes, and reads back the target storage page to form a write completion marker. The write completion marker is output to the upgrade verification and rollback control module.

[0054] The upgrade verification and rollback control module calculates the overall verification field after the upgrade based on the write completion flag. When the overall verification field matches the overall verification field in the upgrade file header, a version switching instruction is generated. If communication reception times out or verification is inconsistent, the module writes the currently valid program content back to the target storage page based on the rollback mirror record, generating a rollback completion flag and a start-up hold instruction. The upgrade verification and rollback control module receives the write completion flag output by the target storage page update module, the rollback mirror record output by the rollback mirror record generation module, and the overall verification field parsed by the upgrade license flag generation module. This module reads the written page content corresponding to the page registration information in the written program area, confirms the continuity and empty page status according to the registration packet order, and forms the overall verification field after the upgrade. When the overall verification matches, the upgrade verification and rollback control module writes the target version number, start partition identifier, and switch time flag to the version switching cache, generating a version switching instruction. When communication reception times out and overall verification is inconsistent, the upgrade verification and rollback control module reads the corresponding rollback image record, writes the currently valid program content back to the target storage page, and generates a rollback completion flag and a start-up hold instruction after reading back confirmation.

[0055] In one embodiment, data transfer between the upgrade license marker generation module, page-level data segment parsing module, rollback image record generation module, target storage page update module, and upgrade verification and rollback control module is triggered according to status markers. The page-level data segment parsing module reads the page-level data segment only after the upgrade license marker generation module outputs an "allow acquisition" status. The rollback image record generation module reads the currently valid program content only after the page-level data segment parsing module outputs a page-level receive record. The target storage page update module performs an erase write only after the rollback image record generation module outputs an "available rollback image record." The upgrade verification and rollback control module performs overall verification and version switching judgment only after the target storage page update module outputs a "write valid" status. When any module outputs a prohibited, missing, invalid, or inconsistent status, subsequent modules do not perform write and switching actions that conflict with that status and pass the abnormal status to the upgrade verification and rollback control module for processing.

[0056] In this embodiment, data is transmitted between modules in the order of upgrade license flag, page-level reception record, rollback mirror record, write completion flag, and overall verification result. This ensures that the boundaries of access judgment, page-level resolution, rollback mirror, target page update, and abnormal rollback within the system remain clear, thereby enabling the controller's online upgrade process to complete pre-write protection, in-write verification, and post-write rollback control within the same process.

[0057] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of protection of the technical solution.

Claims

1. A method for online upgrade and security management of a controller, characterized in that, Includes the following steps: Obtain the upgrade file header information, controller version information, and authorization mark; compare the controller identifier, software number, and target version number in the upgrade file header information with the controller version information and the authorization mark to generate an upgrade license mark. Based on the upgrade license tag, obtain the page-level data segment, determine the target storage page address, sub-packet order, page length and page check field of the page-level data segment, and read the page registration information from the upgrade package version information database; Based on the target storage page address, read the currently valid program content, write the currently valid program content into the rollback mirror area, calculate the mirror verification field, and generate a rollback mirror record; The packet order, page length, page in-page verification field and page registration information are compared. If they match, the target storage page is erased and written to the page-level data segment. The target storage page is read back to generate a write completion marker. Based on the write completion marker, calculate the overall verification field after the upgrade. When the overall verification field after the upgrade is consistent with the overall verification field in the header information of the upgrade file, generate a version switching instruction. When communication reception timeout and verification are inconsistent, write the current valid program content back to the target storage page based on the rollback mirror record, and generate a rollback completion marker and a start-up hold instruction.

2. The controller online upgrade security management method according to claim 1, characterized in that, The steps to generate an upgrade license tag include: Obtain the header information of the upgrade file, parse the fields in the header information of the upgrade file, extract the controller identifier, software number, target version number and overall verification field, and generate a header parsing record when the field parsing results meet the preset field length and field arrangement order; Obtain controller version information, read the local controller identifier, current software number, and current version number from the controller version information, compare the controller identifier, software number, and target version number with the local controller identifier, current software number, and current version number respectively, and generate a version matching record; Obtain the authorization token, associate the authorization token with the version matching record, and generate an upgrade license token when the controller identifier, software number and target version number all match and the authorization token is in the upgrade allowed state.

3. The controller online upgrade security management method according to claim 1, characterized in that, The steps for obtaining page-level data segments and reading page registration information include: Obtain the upgrade license tag, determine the license status of the upgrade license tag, and when the license status is "allow to obtain", read the page-level data segment from the upgrade communication buffer, and parse the page header field of the page-level data segment to determine the target storage page address, packet order, page length and page check field; A page registration index is generated based on the target storage page address and the packet order. Page registration information corresponding to the page registration index is read from the upgrade package version information database, and a correspondence is established between the page registration information and the page-level data segment to generate a page-level receiving record.

4. The controller online upgrade security management method according to claim 1, characterized in that, The steps to generate a rollback mirror record include: The currently valid program content in the program storage area is read based on the target storage page address, and the read currently valid program content is verified against the address range of the target storage page boundary. When the read range is consistent with the storage page range corresponding to the target storage page address, a valid program read record is generated. The currently valid program content is written into the mirror page location associated with the target storage page address in the rollback mirror area. The mirror page location after writing is read back and verified, and the mirror verification field is calculated based on the read-back content. The target storage page address, the mirror page location, the mirror verification field, and the valid program read record are associated and stored to generate the rollback mirror record.

5. The controller online upgrade security management method according to claim 4, characterized in that, The process of reading the currently valid program content includes: Read the valid program area identifier and page valid identifier from the controller startup status table, determine the program partition to be read based on the valid program area identifier, and determine whether the storage page corresponding to the target storage page address is in a valid state based on the page valid identifier; When the storage page corresponding to the target storage page address is in a valid state, the page content corresponding to the target storage page address is read from the program partition to be read, and the page content is length-verified with the storage page capacity to generate the currently valid program content.

6. The controller online upgrade security management method according to claim 1, characterized in that, The steps to generate a write completion marker include: Obtain the packet order, page length, page in-page verification field, and page registration information; read the registered packet order, registered page length, and registered verification field from the page registration information; and perform consistency comparison between the packet order, page length, and page in-page verification field and the registered packet order, page length, and registered verification field to generate a page write permission record. When the page write permission record is in the write permission state, the target storage page is erased and the page blank state after erasure is read. When the page blank state meets the blank determination condition, the page-level data segment is written to the target storage page, the written page content in the target storage page is read back, and a write completion mark is generated.

7. The controller online upgrade security management method according to claim 6, characterized in that, The process of generating the page write permission record includes: The registration page address, registration sub-packet order, registration page length, and registration verification field are read from the page registration information. The registration page address is compared with the target storage page address for address consistency, and the registration sub-packet order is compared with the sub-packet order for order consistency to obtain the address order comparison result. The registration page length is compared with the page length for consistency, and the registration verification field is compared with the page internal verification field for consistency. When the address order comparison result, length consistency comparison result, and verification consistency comparison result are all in a pass state, the page write permission record is generated.

8. The controller online upgrade security management method according to claim 1, characterized in that, The steps for generating version switching instructions, rollback completion markers, and startup hold instructions include: Obtain the write completion flag. When the write completion flag is in a valid write state, read the page content already written to the program area and perform overall verification calculation according to the upgrade package page registration order to generate the overall verification field after the upgrade. The overall verification field after the upgrade is compared with the overall verification field in the header information of the upgrade file. When they match, the target version number, the startup partition identifier and the switching time marker are written into the version switching cache area to generate a version switching instruction. When the communication reception timeout and the overall verification field comparison are inconsistent, the rollback image record is read and the currently valid program content is written back to the target storage page, generating a rollback completion flag and a start hold instruction.

9. The controller online upgrade security management method according to claim 8, characterized in that, The calculation process for the upgraded overall verification field includes: Read the contents of multiple written pages corresponding to the page registration information in the program area, determine the splicing order of the multiple written page contents based on the registration sub-packet order, and perform continuity judgment and empty page judgment on the multiple written page contents; When the concatenation order of multiple written page contents is consecutive and there are no empty pages, the overall digest calculation of the multiple written page contents is performed according to the concatenation order, and the overall digest calculation result is associated with the target version number and software number to generate the upgraded overall verification field.

10. A controller online upgrade security management system based on image processing, characterized in that, The system is used to implement the controller online upgrade security management method according to any one of claims 1-9, including: The upgrade license tag generation module is used to: obtain upgrade file header information, controller version information and license tag; compare the controller identifier, software number and target version number in the upgrade file header information with the controller version information and the license tag to generate an upgrade license tag; The page-level data segment parsing module is used to: obtain page-level data segments based on the upgrade license mark, determine the target storage page address, packet order, page length and page check field of the page-level data segment, and read page registration information from the upgrade package version information database; The rollback image record generation module is used to: read the currently valid program content based on the target storage page address, write the currently valid program content into the rollback image area, calculate the image verification field, and generate a rollback image record; The target storage page update module is used to: compare the packet order, the page length, the page internal verification field and the page registration information; when the comparison is consistent, erase the target storage page and write the page-level data segment; and read back the target storage page to generate a write completion mark. The upgrade verification and rollback control module is used to: calculate the overall verification field after the upgrade based on the write completion flag; generate a version switching instruction when the overall verification field after the upgrade is consistent with the overall verification field in the header information of the upgrade file; and write the currently valid program content back to the target storage page based on the rollback mirror record when the communication reception timeout and verification are inconsistent, thereby generating a rollback completion flag and a start-up hold instruction.

Images