Cascading tree access control system, method, electronic device and computer storage medium

Abstract

The application relates to the technical field of computer communication, in particular to a cascaded tree access control system and method, an electronic device and a computer storage medium. The method system: a parent node judges whether a special communication connection exists between the parent node and a target node indicated by a received device access request in response to the device access request, the device access request carrying a cascaded tree path used for locating the target node in the cascaded tree. If the special communication connection does not exist, the parent node generates a connection establishment instruction and forwards the connection establishment instruction to the target node along the cascaded tree path hop by hop to establish the special communication connection. If the special communication connection exists, the device access request is forwarded to the target node through the special communication connection. After receiving the device access request, the target node performs a device access operation and returns an operation result to the parent node. The application can realize on-demand allocation of connection resources and intranet penetration, and improves the flexibility and communication reliability of cross-level access.

Description

Technical Field

[0001] This application relates to the field of computer communication technology, and in particular to a cascaded tree access control system, method, electronic device, and computer storage medium. Background Technology

[0002] With the continuous development of the Internet of Things, the Industrial Internet, and enterprise informatization, equipment management systems face the need to manage massive numbers of terminal devices. To achieve unified monitoring, configuration, and maintenance of devices in lower-level systems from higher-level systems, a cascading architecture is typically adopted.

[0003] Traditional cascaded data transmission schemes mainly fall into two categories: static pre-configured connection schemes, which establish data transmission channels between all nodes in advance during system initialization; and multi-hop forwarding schemes, which achieve cross-regional data forwarding through relay nodes. The common drawbacks of these schemes are: static channel configuration, parent node actively initiating connections, and path information being implicitly included in the topology configuration. This leads to fixed connection establishment, resulting in resource waste; parent node-initiated connections are difficult to penetrate enterprise intranets and firewalls, leading to complex deployment; the upper-level system needs to know the information of the lower-level devices in advance, resulting in high coupling and poor scalability; path information is only used for static routing, lacking dynamism; and connection management lacks keep-alive and reconnection mechanisms, resulting in insufficient communication reliability. Summary of the Invention

[0004] This application provides a cascaded tree access control system, method, electronic device, and computer storage medium, which can realize on-demand allocation of connection resources and intranet penetration. By combining cascaded tree path propagation and hop-by-hop forwarding, the system coupling is reduced and the flexibility and communication reliability of cross-level access are improved.

[0005] Firstly, this application provides a cascaded tree access control system. The system includes multiple nodes with a parent-child hierarchical relationship, wherein: Upon receiving a device access request, the parent node determines whether a usable dedicated communication connection exists between itself and the target node indicated by the device access request. The device access request carries a cascaded tree path, which is used to locate the target node within the cascaded tree. If no dedicated communication connection exists, the parent node generates a connection establishment instruction and forwards it hop-by-hop along the cascaded tree path to the target node. The connection establishment instruction contains the parent node's network address. After receiving the connection establishment instruction, the target node actively initiates a network connection with the parent node based on the network address to establish a dedicated communication connection. If a dedicated communication connection exists, the parent node forwards the device access request to the target node through the dedicated communication connection. After receiving the device access request, the target node executes the device access operation and returns the operation result to the parent node.

[0006] In some implementations, determining whether a usable dedicated communication connection exists between the target node indicated by the device access request includes: the parent node detecting whether a dedicated communication connection has been established between the parent node and the target node. If established, it checks whether the dedicated communication connection is active. If the dedicated communication connection is established and active, it is determined that a usable dedicated communication connection exists.

[0007] In some implementations, the connection establishment command is forwarded hop-by-hop along the cascading tree path to the target node, including: each intermediate node at each level of the cascading tree path receiving the connection establishment command; each intermediate node determining the next hop node based on the cascading tree path; and each intermediate node continuing to forward the connection establishment command to the next level until it reaches the target node.

[0008] In some implementations, the target node actively initiates a network connection to the parent node based on its network address to establish a dedicated communication connection. This includes: the target node resolving the parent node's network address from a connection establishment command; the target node actively initiating a network connection request to the parent node's proxy server based on the network address; the parent node authenticating the target node; and, upon successful authentication, establishing a dedicated communication connection.

[0009] In some implementations, the system also performs control channel establishment operations: During system initialization, child nodes configure the network address of their parent nodes. Based on the parent node's network address, the child node actively initiates a connection to the parent node, establishing a long-lived control channel. The child node sends a binding request to the parent node through the control channel; this request includes the child node's cascading path and authentication information. The parent node authenticates the binding request; upon successful authentication, it adds the child node to the cascading topology, establishing a parent-child relationship. The control channel is used to transmit node binding, topology maintenance, and connection reconstruction commands.

[0010] In some implementations, after the dedicated communication connection is established, the system further includes: the target node sending a heartbeat message to the parent node at predetermined time intervals. Upon receiving the heartbeat message, the parent node returns an acknowledgment message to the target node. The parent node continuously monitors the time when the last heartbeat message was received; if no heartbeat message is received within a preset timeout threshold, the dedicated communication connection is determined to have timed out, and the dedicated communication connection is disconnected.

[0011] In some implementations, if the dedicated communication connection is broken, the target node automatically attempts to reconnect to the parent node.

[0012] Secondly, this application provides a cascaded tree access control method. The cascaded tree includes multiple nodes with a parent-child hierarchical relationship. The method includes: receiving a device access request, the device access request carrying a cascaded tree path, the cascaded tree path being used to locate a target node in the cascaded tree; determining whether a usable dedicated communication connection exists between the parent node receiving the access request and the target node; if no dedicated communication connection exists, generating a connection establishment instruction and forwarding the connection establishment instruction hop-by-hop along the cascaded tree path to the target node, the connection establishment instruction containing the network address of the parent node, used to instruct the target node to actively initiate a network connection to the parent node to establish a dedicated communication connection; if a dedicated communication connection exists, forwarding the device access request to the target node through the dedicated communication connection to execute the device access operation, and receiving the operation result returned by the target node.

[0013] Thirdly, this application provides a chip for performing the method as described in the second aspect above.

[0014] Fourthly, this application provides an electronic device including a processor and a memory, the processor being configured to execute a computer program stored in the memory to implement the method as described in the second aspect above. Alternatively, the electronic device may include a chip as described in the third aspect.

[0015] Fifthly, this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the method described in the second aspect above.

[0016] In a sixth aspect, this application provides a computer program product that stores a computer program, which, when executed by a processor, implements the method described in the second aspect above.

[0017] In the technical solution provided in this application, the parent node receives a device access request carrying a cascading tree path and determines whether a usable dedicated communication connection exists between itself and the target node. If a connection exists, it forwards the request directly; otherwise, it generates a connection establishment instruction containing the parent node's network address and forwards it hop-by-hop along the cascading tree path to the target node. The target node then actively initiates a connection with the parent node based on the network address to establish a dedicated communication connection. Finally, the request is forwarded to the target node through this dedicated communication connection to perform the operation and return the result. This application achieves on-demand allocation of connection resources by judging the connection status as needed and actively establishing a reverse connection when the connection does not exist, thus avoiding resource waste. Through the reverse connection mode where the target node actively initiates the connection, it can penetrate enterprise intranets and firewalls without complex network configuration. Through the explicit transmission and hop-by-hop forwarding of the cascading tree path, the upper-level system does not need to pre-synchronize the detailed data of the lower-level devices, achieving decoupling at the data access layer. Changes to lower-level devices do not affect the upper-level system, significantly reducing maintenance complexity and improving the flexibility and reliability of cross-level device access. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a schematic diagram of the system architecture of a cascading tree access control system provided in an embodiment of this application; Figure 2 This is a schematic diagram of the system initialization and cascading tree construction process of a cascading tree access control system provided in an embodiment of this application; Figure 3 This is a schematic diagram of the interaction flow of the on-demand proxy access core process of a cascading tree access control system provided in an embodiment of this application; Figure 4 This is a schematic diagram of the agent long connection establishment process of a cascading tree access control system provided in an embodiment of this application; Figure 5 This is an interactive schematic diagram of a connection keep-alive mechanism for a cascading tree access control system provided in an embodiment of this application; Figure 6 This is a schematic diagram of the cascading tree access control process of a cascading tree access control system provided in an embodiment of this application; Figure 7 This is a flowchart illustrating a cascading tree access control method provided in an embodiment of this application; Figure 8This is a schematic diagram of the structure of a cascaded tree access control device provided in an embodiment of this application; Figure 9 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0020] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application can also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0021] It should be understood that, when used in this application specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or a collection thereof.

[0022] It should also be understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0023] As used in this application specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if detected [the described condition or event]" may be interpreted, depending on the context, as meaning "once determined," "in response to determination," "once detected [the described condition or event]," or "in response to detection [the described condition or event]."

[0024] Furthermore, in the description of this application and the appended claims, the terms "first," "second," "third," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0025] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0026] With the continuous development of the Internet of Things (IoT), the Industrial Internet, and enterprise informatization, equipment management systems need to manage a large number of terminal devices. To achieve unified monitoring, configuration, and operation and maintenance of devices managed by lower-level systems from higher-level systems, a cascaded architecture is typically adopted. This architecture establishes a tree-like topology between management systems (nodes) at each level, forwarding device access requests along the hierarchical relationship, thereby enabling cross-system device data interoperability.

[0027] Traditional solutions for achieving the above-mentioned cascaded data transmission mainly include the following: Cascaded transmission scheme based on static preset connections: This type of technical solution establishes data transmission channels in advance between all relevant nodes during the system initialization or pre-configuration phase, based on a pre-defined cascaded topology (i.e., parent-child relationships between nodes). When data needs to be transmitted, nodes at each level directly use these pre-established channels to forward data according to pre-defined transmission rules and destination addresses.

[0028] IoT cascaded transmission scheme based on multi-hop forwarding: This type of solution involves a source node, a relay node, and a target node, achieving cross-regional data transmission through a primary communication connection such as Bluetooth and a secondary communication connection such as the Internet. In this solution, the source node needs to forward data through a relay node, and the relay node needs to receive a connection request from the source node before forwarding the data.

[0029] The above technical solutions share common technical characteristics, including: data transmission channels or communication links between nodes are typically statically configured and established during the system design or initialization phase. Connection establishment is usually initiated proactively by the parent node acting as the manager, with child nodes responding passively. The basis and path information for data transmission are implicit in the system's static routing table or topology configuration, and are not dynamically specified by upper-layer service requests.

[0030] However, in practical applications and deployments, traditional technical solutions have the following drawbacks: First, the connection establishment mode is rigid, resulting in high system resource consumption.

[0031] Traditional technical solutions require establishing all possible data transmission channels during system initialization, lacking flexibility. This means that regardless of whether there is actual data interaction need between nodes, system resources (such as memory and network ports) must be used to maintain these connections. When the number of nodes in the system is large, the overhead of pre-establishing connections and the subsequent maintenance costs are enormous. The inability to flexibly create or release connection resources according to dynamically changing business needs leads to low resource utilization.

[0032] Secondly, it cannot effectively solve the problem of penetrating enterprise intranets, and the deployment and maintenance costs are high.

[0033] Traditional technical solutions typically involve the parent node actively initiating connections to child nodes. However, in real-world enterprise deployments, lower-level systems (child nodes) are usually behind firewalls and have network address translation (NAT) deployed. In such network environments, connection requests initiated by external networks (the parent node's network) are blocked by the firewall and cannot directly reach the child nodes. To make it work, complex network configurations are often required, such as enabling port forwarding on the firewall or setting up a virtual private network (VPN). These operations not only increase deployment complexity and cost but also introduce additional security risks and high maintenance costs.

[0034] Third, the systems are highly coupled and have poor scalability.

[0035] Traditional technical solutions typically require the upper-level system to know and configure the device information of all lower-level nodes in advance, including device models, interface protocols, and data models. This results in tight coupling between the device data models of the upper-level and lower-level systems. Any addition, removal, model replacement, or interface upgrade of devices in any lower-level subsystem may require synchronous updates to the configurations of all upper-level systems, leading to a large maintenance workload and a high risk of errors. This strong coupling limits the system's scalability and cannot support the independent development and iteration of subsystems.

[0036] Fourth, the use of route information is limited and lacks dynamism.

[0037] In traditional technical solutions, cascading path information is mainly used to determine the topology and forwarding rules during the system configuration phase; its role is static and implicit. Path information is not explicitly carried and utilized as a dynamic, transitive parameter in business requests. This limits the system's ability to implement more flexible routing strategies and on-demand operations; for example, it cannot dynamically initiate connections to specific nodes based on path information in the request.

[0038] Fifth, the connection management mechanism is imperfect, resulting in insufficient communication reliability. Traditional technical solutions lack detailed descriptions of dedicated inter-node connections, keep-alive mechanisms, and fault recovery mechanisms. In actual operation, network fluctuations or device restarts may cause unexpected connection interruptions. Without dedicated keep-alive and reconnection mechanisms, the system may fail to detect and restore interrupted connections in a timely manner, leading to data access failures or the need for frequent connection rebuilds, increasing network overhead and response latency.

[0039] In summary, traditional technical solutions suffer from problems such as wasted connection resources, difficulty in network penetration, high system coupling, limited path utilization, and imperfect connection management in multi-level system cascading access scenarios. Therefore, there is an urgent need for a cross-system device data access method and system that can achieve on-demand connection, dynamic routing, strong network penetration, system decoupling, and efficient connection management.

[0040] In view of this, this application provides a cascaded tree access control system that can determine the status of dedicated communication connections on demand through the parent node and actively establish connections in reverse only when they do not exist. This realizes on-demand allocation of connection resources and penetration of enterprise intranets. At the same time, by utilizing the transmission and hop-by-hop forwarding of cascaded tree paths, the system coupling is reduced and the flexibility and communication reliability of cross-level device access are improved.

[0041] Figure 1 This is a schematic diagram of the system architecture of a cascading tree access control system provided in an embodiment of this application. Figure 1 As shown, the system includes multiple nodes with a parent-child hierarchical relationship, and each node can exist as either a parent node or a child node.

[0042] The system mainly includes a user front-end, nodes, a proxy server, local devices, a control channel, and a dedicated communication connection (proxy long connection), among which: The user frontend is used by users to initiate device access requests. These requests carry the complete cascading tree path. The user frontend can obtain the path information by querying the topology of the cascading tree.

[0043] For example, the format of a cascading tree path can be: node A_ID / node B_ID / node C_ID / , where node A is the parent node of the user's front-end, node B is an intermediate node, and node C is the target node. The node ID can use the node's MAC address as a unique identifier; for example, a complete node ID can be 02FD56A1ED78, 02BE8D6CBDDA, or 04BA2F5CBADB.

[0044] Each node can be an independent device management system, and can exist as a parent node or a child node. Each node can include the following modules: (1) Controller module The controller module handles control channel messages and manages parent-child relationships. Specifically, the controller module is responsible for receiving binding requests from child nodes, verifying authentication information, maintaining the cascade tree topology, and processing topology change notifications.

[0045] (2) Proxy server module The proxy server module is used to manage dedicated communication connections, process the encapsulation and forwarding of device access requests, receive proactive connections from child nodes, and control the on-demand establishment and release of dedicated communication connections.

[0046] (3) Routing module The routing module is used to parse the cascade tree path and determine the forwarding direction or target node of the instruction based on the cascade tree path. Specifically, the routing module extracts the cascade tree path from the device access request, parses the node identifiers in the path level by level, determines the next-hop node, or determines whether the current node is the target node.

[0047] (4) Device interface module The device interface module is used to manage the connection and operation of local devices. Specifically, the device interface module can communicate with various IoT devices and industrial devices connected to this node, execute device access commands (such as reading device status, configuring device parameters, etc.), and return the operation results.

[0048] A proxy server can be deployed on the parent node side, and its functions may include: managing the proxy long connection pool, checking the existence of connections, encapsulating and forwarding front-end access requests, and / or receiving proactive connections from child nodes.

[0049] The local device can be any type of IoT device, industrial equipment, etc. connected to the child node, and is the final target of the device access request.

[0050] The control channel can be a fixed-length connection established during the system initialization phase, used to bind parent-child relationships and maintain the cascading tree topology. The control channel can be a management-level connection and is not used for transmitting device access data.

[0051] Dedicated communication connections (proxy long connections) are dedicated long connections established on demand according to business needs, used for device access data transmission between parent and child nodes. Dedicated communication connections can be used to implement keep-alive mechanisms; once the connection is established, all access requests are transmitted through this channel. Dedicated communication connections differ from the aforementioned control channels: control channels are pre-established during system initialization and can be used for topology management; dedicated communication connections are established on demand and can be used for business data transmission.

[0052] In the technical solution provided in this application embodiment, the dedicated communication connection can be a proxy long connection based on the TCP protocol. The control channel and the dedicated communication connection can communicate using a TCP SSL / TLS encrypted long connection, distinguished by different port numbers, and encapsulated using different proprietary protocols in the message format.

[0053] Figure 2 This is a schematic diagram illustrating the system initialization and cascading tree construction process of a cascading tree access control system provided in an embodiment of this application. Figure 2 As shown, the system initialization and cascading tree construction process is as follows: Step S201: Start the child node.

[0054] The child node device starts up and prepares to join the cascade tree.

[0055] Step S202: Configure the parent node address for the child node.

[0056] The child node is configured with the target parent node's network address (including IP address and port number). The parent node's proxy server address is sent to the child node by the parent node through the control channel, and the child node actively connects to this address. Therefore, this address can be dynamically changed for the child node, while for the parent node, it can be either fixed or dynamically obtained.

[0057] Step S203: The child node actively establishes a control channel.

[0058] The child node actively initiates a connection to the parent node based on the configured parent node network address, establishing a fixed long-lived control channel.

[0059] Step S204: The child node establishes a control channel and reports its identity information.

[0060] The child node initiates a connection to the parent node based on the configured parent node network address, establishes a control channel with a fixed long connection, and reports the child node's identity information to the parent node through the control channel.

[0061] Step S205: The parent node verifies the identity of the child node.

[0062] After receiving the identity information reported by the child node, the parent node verifies the child node's identity. If the verification passes, the parent node caches the child node's identity information.

[0063] Step S206: The parent node initiates a binding request.

[0064] The parent node sends a binding request to the child node, and the binding request carries the management password of the child node.

[0065] Step S207: Child node verifies binding request.

[0066] After receiving the binding request, the child node verifies the management password and returns a successful binding response to the parent node upon successful verification.

[0067] Step S208: The parent node completes the binding.

[0068] After receiving a successful binding response, the parent node confirms that the child node is successfully bound, adds the child node information to the cascade topology, and establishes the parent-child relationship. The cascade path of the child node is constructed by the parent node based on the current cascade topology.

[0069] Step S209: Keep the control channel alive.

[0070] The established control channel is kept connected for subsequent topology management message exchange, such as topology change notifications and connection reconstruction commands.

[0071] Repeating the above process, multiple child nodes can be bound to a parent node in sequence to form a complete cascading tree structure. A child node can also act as a parent node, continuing to bind to its subordinate child nodes to form a multi-level cascading structure.

[0072] In this embodiment, if the proxy long connection is accidentally disconnected, when the parent node triggers a request to the child node again at the user's front end, it will determine whether the proxy long connection exists. If it does not exist, it will use the control channel to resend the connection establishment instruction to the target child node to assist in rebuilding, and then use the rebuilt long connection to send the request.

[0073] Figure 3 This is a schematic diagram illustrating the interaction flow of the on-demand proxy access core process of a cascading tree access control system provided in an embodiment of this application. Figure 3 As shown, when a parent node needs to access a device under a descendant child node, the interaction process between the parent node, intermediate nodes, and the target node can include: Step S301: The user initiates a device access request on the front end.

[0074] Users can initiate device access requests from the front end to read device status, configure device parameters, and so on. The access request carries a complete cascading tree path. For example, the path format can be node A_ID / node B_ID / node C_ID / , indicating that the path travels from node A through node B to node C.

[0075] Step S302: The proxy server of the parent node receives the access request and resolves the cascading tree path.

[0076] The parent node can extract the IDs of all nodes on the path, and the ID of the last node on the path is the target node.

[0077] Step S303: The proxy server checks whether a dedicated long-lived proxy connection has been established with the target node.

[0078] A proxy server can check only whether a long-lived proxy connection has been established at the final target node, without checking intermediate nodes along the path.

[0079] If the connection already exists and is in good condition, use that connection directly and proceed to step S309.

[0080] Step S304: If the connection does not exist, the proxy server generates a proxy connection establishment instruction.

[0081] The proxy connection establishment command can be encapsulated using a custom private protocol message, containing the following information: parent_address: The network address of the parent node's proxy server; node_path: The complete path of the cascading tree.

[0082] Step S305: The proxy server forwards the connection establishment command hop by hop down the cascading tree path.

[0083] After receiving the instruction, each intermediate node determines the next hop child node based on the path and continues forwarding until it reaches the target node.

[0084] Example: When the path is A / C / C1 / , node A forwards the instruction to node C, and node C forwards the instruction to node C1 (the target node).

[0085] Step S306: The target node receives the connection establishment instruction and resolves the address of the parent node's proxy server.

[0086] Step S307: The target node initiates a network connection based on the resolved address of the parent node's proxy server.

[0087] The network connection is used to connect to the parent node's proxy server, establishing a dedicated, stable, bidirectional long-lived proxy connection. This connection is reserved for subsequent communication between the parent node and the child node.

[0088] Step S308: The parent node authenticates the target node. Once authentication is successful, the connection is established.

[0089] The parent node can initiate a keep-alive mechanism, which keeps the connection active for a certain period of time when there are no requests. If the timeout occurs (e.g., 10 minutes, which is configurable), the parent node will automatically close the proxy long-lived connection to save resources.

[0090] Step S309: The parent node's proxy server encapsulates the original access request into a private protocol data packet format and sends it to the target child node through a dedicated proxy long connection.

[0091] Private protocol messages for proxy long-connection communication can be encapsulated on top of an SSL TCP connection. The protocol message format is shown in the table below:

[0092] Step S310: The target child node receives the encapsulated request, parses out the device access command, and executes the corresponding device access operation locally.

[0093] Specifically, the target sub-node communicates with the local device through the device interface module to perform operations such as reading device status and configuring parameters.

[0094] Step S311: The target child node returns the operation result to the parent node through the same long-lived proxy connection.

[0095] The parent node's proxy server can return the parsed results to the user's front end.

[0096] Step S312: The user's front end receives the access result.

[0097] The technical solution provided in this application embodiment is transparent to the user throughout the entire access process, enabling the user to directly operate the local device and achieve transparent access across multiple systems.

[0098] Figure 4 This is a schematic diagram illustrating the agent long-connection establishment process of a cascading tree access control system provided in an embodiment of this application. Figure 4 As shown, the interaction process between the parent node, intermediate nodes, and target node can include: Step S401: The parent node checks the connection status as needed.

[0099] When a parent node needs to access a target node, it checks if a connection exists, without needing to establish all connections beforehand. Specifically, upon receiving a device access request carrying a cascading tree path, the parent node's proxy server only checks if a usable dedicated communication connection has been established for the final target node, without checking intermediate nodes along the path. This step ensures that connection resources are precisely matched to actual business needs.

[0100] Step S402: The parent node generates and sends a connection establishment command.

[0101] If the parent node determines that no available dedicated communication connection exists between it and the target node, the parent node's proxy server generates a connection establishment command. This command is encapsulated using a custom private protocol message and includes the following information: parent_address: The network address of the parent node's proxy server; node_path: The complete path of the cascading tree.

[0102] The parent node sends the connection establishment command down the cascade tree path.

[0103] Step S403: Intermediate nodes forward instructions hop by hop.

[0104] The connection establishment command is forwarded hop-by-hop down the cascade tree path. Each intermediate node on the path receives the connection establishment command, determines the next hop node according to the cascade tree path, and continues to forward the connection establishment command to the next level until it reaches the target node.

[0105] Example: When the path is A / C / C1 / , node A forwards the instruction to node C, and node C forwards the instruction to node C1 (the target node).

[0106] Step S404: The target node parses the instructions and obtains the address of the parent node.

[0107] After receiving the connection establishment instruction, the target node parses the network address of the parent node's proxy server from the connection establishment instruction.

[0108] Step S405: The target node actively initiates a network connection.

[0109] The target node actively initiates a network connection request to the parent node's proxy server based on the resolved network address of the parent node's proxy server. This step uses a reverse connection mode, where the target child node actively initiates the connection to the parent node, without the parent node actively connecting to the child node, thus resolving the issue of intranet penetration within enterprises.

[0110] Step S406: The parent node authenticates the target node.

[0111] After receiving the connection request from the target node, the parent node's proxy server authenticates the target node and verifies its legitimacy.

[0112] Step S407: Establish a dedicated communication connection.

[0113] After successful authentication, a dedicated, stable, bidirectional proxy long connection (i.e., a dedicated communication connection) is established between the parent node and the target node. This connection is used exclusively for device access data transmission between the parent node and the target node and is not shared with other nodes.

[0114] Step S408: Activate the keep-alive mechanism.

[0115] After a dedicated communication connection is successfully established, a keep-alive mechanism is initiated. The target node sends a heartbeat message to the parent node at predetermined time intervals; upon receiving the heartbeat message, the parent node returns an acknowledgment message and continuously monitors the time when the last heartbeat message was received. If no heartbeat message is received within a preset timeout threshold, the connection is deemed to have timed out and is closed. Connections that have not been used for a long time can also be proactively closed to release connection resources.

[0116] Through steps S401 to S408 described above, this embodiment of the application achieves on-demand establishment of dedicated communication connections. The parent node only triggers connection establishment when access is needed, avoiding the resource waste caused by pre-establishing all connections; the problem of enterprise intranet penetration is solved by the target node actively making a reverse connection; the precise transmission of instructions at multiple levels is achieved through hop-by-hop forwarding of the cascading tree path; and the reliability and efficiency of communication are ensured through dedicated point-to-point connections and keep-alive mechanisms.

[0117] Figure 5 This is an interactive schematic diagram illustrating a connection keep-alive mechanism for a cascading tree access control system provided in an embodiment of this application. Figure 5 As shown, the interaction process between the parent node, intermediate nodes, and target node can include: Step S501: The target node sends a heartbeat message to the parent node at fixed intervals.

[0118] The target node can send a heartbeat message to the parent node at fixed intervals, such as 30 seconds. The heartbeat message can be encapsulated using the private protocol message format of the proxy long connection, where dataType is the heartbeat message type. The heartbeat interval parameter can be a fixed value or a configurable parameter; it is not limited here.

[0119] Step S502: The parent node returns an acknowledgment message after receiving the heartbeat.

[0120] Step S503: The parent node continuously monitors the time when the last heartbeat was received.

[0121] If no heartbeat is received within a certain threshold (e.g., 120 seconds), the connection is considered to have timed out, and the parent node will actively disconnect the long connection.

[0122] Step S504: After the child node detects a connection interruption, it automatically attempts to reconnect to the parent node.

[0123] In the technical solution provided in this application, connections that have not been used for a long time can be actively disconnected, releasing connection resources. When a parent node receives a device access request, it can determine on demand whether a dedicated communication connection exists between itself and the target node. Only when the connection does not exist will the target node actively establish a reverse connection, realizing on-demand allocation of connection resources and enterprise intranet penetration. At the same time, through explicit transmission and hop-by-hop forwarding of the cascading tree path, the upper-level system does not need to pre-synchronize the device detail data of the lower-level system, reducing system coupling and improving the flexibility and communication reliability of cross-level device access.

[0124] Figure 6 This is a schematic diagram of the cascading tree access control flow of a cascading tree access control system provided in an embodiment of this application. Figure 6As shown, it includes the following steps: Step S601: In response to the received device access request, the parent node determines whether there is an available dedicated communication connection between itself and the target node indicated by the device access request. The device access request carries a cascading tree path, which is used to locate the target node in the cascading tree.

[0125] Specifically, the user initiates a device access request from the front end, such as to read the device status or configure device parameters. The access request must carry a complete cascading tree path. The path format is node A_ID / node B_ID / node C_ID / , indicating the path from node A through node B to node C. The parent node's proxy server receives the access request.

[0126] The parent node's proxy server parses the cascading tree path carried in the device access request and extracts the IDs of all nodes along the path. The ID of the last node in the path is the target node.

[0127] The parent node determines whether a dedicated communication connection exists between itself and the target node indicated by the device access request.

[0128] Specifically, the parent node's proxy server checks whether a dedicated long-lived proxy connection has been established with the target node. It only checks whether a long-lived proxy connection has been established with the final target node, not intermediate nodes along the path.

[0129] If a dedicated communication connection exists, proceed to step S604, where the parent node directly reuses that connection to forward requests.

[0130] Step S602: If no dedicated communication connection exists, the parent node generates a connection establishment instruction and forwards the connection establishment instruction hop by hop along the cascading tree path to the target node. The connection establishment instruction contains the network address of the parent node.

[0131] If no dedicated communication connection exists, the parent node generates a connection establishment command and forwards it hop-by-hop along the cascading tree path to the target node. The connection establishment command contains the network address of the parent node.

[0132] Specifically, the parent node's proxy server generates a proxy connection establishment command. This command is encapsulated using a custom private protocol message and contains the following information: parent_address: The network address of the parent node's proxy server; node_path: The complete path of the cascading tree.

[0133] The parent node sends the connection establishment command down the cascade tree path.

[0134] The connection establishment command is forwarded hop-by-hop down the cascade tree path. Each intermediate node on the path receives the connection establishment command, determines the next hop node according to the cascade tree path, and continues to forward the connection establishment command to the next level until it reaches the target node.

[0135] Example: When the path is A / C / C1 / , node A forwards the instruction to node C, and node C forwards the instruction to node C1 (the target node).

[0136] Step S603: After receiving the connection establishment instruction, the target node actively initiates a network connection to the parent node based on the network address to establish a dedicated communication connection.

[0137] After receiving the connection establishment instruction, the target node actively initiates a network connection to the parent node based on the network address in order to establish a dedicated communication connection.

[0138] Specifically, the target node resolves the network address of the parent node's proxy server from the connection establishment command, and then actively initiates a network connection request to the parent node's proxy server based on that network address. This step adopts a reverse connection mode, where the target child node actively initiates a connection to the parent node, rather than the parent node actively connecting to the child node, thus effectively solving the problem of traversing through enterprise intranets.

[0139] After receiving the connection request from the target node, the parent node's proxy server authenticates the target node. Once authentication is successful, a dedicated, stable, bidirectional long-lived proxy connection is established.

[0140] Step S604: If a dedicated communication connection exists, the parent node forwards the device access request to the target node through the dedicated communication connection.

[0141] If a dedicated communication connection already exists or has just been established, the parent node forwards the device access request to the target node through the dedicated communication connection.

[0142] Specifically, the parent node's proxy server encapsulates the original access request into a private protocol data packet format and sends it to the target child node through a dedicated proxy long connection.

[0143] After a dedicated communication connection is successfully established, a keep-alive mechanism is initiated. The target node sends a heartbeat message to the parent node at predetermined time intervals; upon receiving the heartbeat message, the parent node returns an acknowledgment message and continuously monitors the time when the last heartbeat message was received. If no heartbeat message is received within a preset timeout threshold, the connection is deemed to have timed out and is closed. Connections that have not been used for a long time can also be proactively closed to release connection resources.

[0144] Step S605: After receiving the device access request, the target node performs the device access operation and returns the operation result to the parent node.

[0145] After receiving the device access request, the target node executes the device access operation.

[0146] Specifically, the target child node receives the encapsulated request, parses out the device access command, and executes the corresponding device access operation locally. The target child node communicates with the local device through the device interface module to perform operations such as reading device status and configuring parameters.

[0147] The target node returns the operation result to the parent node. Specifically, the target child node returns the operation result to the parent node through the same proxy long connection, and the parent node's proxy server parses the result and returns it to the user's front end.

[0148] In the technical solution provided in this application embodiment, the parent node receives a device access request carrying a cascading tree path and determines whether a usable dedicated communication connection exists between it and the target node. If a connection exists, the request is forwarded directly; otherwise, a connection establishment instruction containing the parent node's network address is generated and forwarded hop-by-hop along the cascading tree path to the target node. The target node then actively initiates a connection with the parent node based on the network address to establish a dedicated communication connection. Finally, the request is forwarded to the target node through this dedicated communication connection to perform the operation and return the result. This application achieves on-demand allocation of connection resources by judging the connection status as needed and actively establishing a reverse connection when the connection does not exist, thus avoiding resource waste. Through the reverse connection mode where the target node actively initiates the connection, it can penetrate the enterprise intranet and firewall without complex network configuration. Through the explicit transmission and hop-by-hop forwarding of the cascading tree path, the upper-level system does not need to pre-synchronize the detailed data of the lower-level devices, achieving decoupling at the data access layer. Changes to lower-level devices do not affect the upper-level system, significantly reducing maintenance complexity and improving the flexibility and reliability of cross-level device access.

[0149] It should be understood that, provided there are no logical conflicts, the above-described embodiments can be combined and implemented to adapt to actual application needs. These combined embodiments or implementation schemes are still within the scope of protection of this application.

[0150] This application also provides a cascading tree access control method. The cascading tree includes multiple nodes with parent-child hierarchical relationships. The specific implementation of this method is based on the same concept as the above system embodiment. Its specific functions and technical effects can be found in the system embodiment section, and will not be repeated here.

[0151] Figure 7 This is a flowchart illustrating a cascading tree access control method provided in an embodiment of this application. Figure 7 As shown, it includes the following steps: Step S701: Receive a device access request. The device access request carries a cascade tree path, which is used to locate the target node in the cascade tree.

[0152] Step S702: Determine whether there is an available dedicated communication connection between the parent node that received the access request and the target node.

[0153] Step S703: If no dedicated communication connection exists, a connection establishment instruction is generated and forwarded hop by hop along the cascading tree path to the target node. The connection establishment instruction contains the network address of the parent node and is used to instruct the target node to actively initiate a network connection to the parent node to establish a dedicated communication connection based on the network address.

[0154] Step S704: If a dedicated communication connection exists, the device access request is forwarded to the target node through the dedicated communication connection to perform the device access operation and receive the operation result returned by the target node.

[0155] It should be noted that the execution process between the above steps is based on the same concept as the system embodiment of this application. For details on its specific functions and technical effects, please refer to the system embodiment section. It will not be repeated here.

[0156] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0157] Corresponding to the cascading tree access control method in the above embodiments, this application provides a cascading tree access control device 80. The cascading tree access control device 80 can be implemented as part or all of a computer device by software, hardware, or a combination of both, and is used to execute the steps in the cascading tree access control method in the above embodiments.

[0158] Figure 8 The diagram shows a schematic of a cascading tree access control device 80 provided in an embodiment of this application. For ease of explanation, only the parts related to the embodiment of this application are shown.

[0159] Reference Figure 8 The cascaded tree access control device 80 includes a receiving module 810 and a processing module 820.

[0160] The receiving module 810 is used to receive device access requests. The device access requests carry a cascade tree path, which is used to locate the target node in the cascade tree.

[0161] The processing module 820 determines whether a usable dedicated communication connection exists between the parent node receiving the access request and the target node. If no dedicated communication connection exists, a connection establishment instruction is generated and forwarded hop-by-hop along the cascading tree path to the target node. The connection establishment instruction contains the network address of the parent node, instructing the target node to actively initiate a network connection with the parent node to establish a dedicated communication connection. If a dedicated communication connection exists, the device access request is forwarded to the target node through the dedicated communication connection to execute the device access operation and the operation result returned by the target node is received.

[0162] In some embodiments, the processing module 820 is specifically configured to: detect whether a dedicated communication connection has been established between the parent node and the target node. If established, detect whether the dedicated communication connection is active. If the dedicated communication connection is established and active, determine that an available dedicated communication connection exists.

[0163] In some embodiments, the processing module 820 is specifically configured to: receive a connection establishment instruction at each intermediate node in the cascaded tree path; determine the next hop node based on the cascaded tree path; and forward the connection establishment instruction to the next level until it reaches the target node.

[0164] In some embodiments, the processing module 820 is specifically configured to: The target node parses the network address of the parent node from the connection establishment instruction; the target node actively initiates a network connection request to the parent node's proxy server based on the network address; the parent node authenticates the target node; and after successful authentication, a dedicated communication connection is established.

[0165] In some embodiments, the processing module 820 is further configured to: during the system initialization phase, configure the network address of the parent node for the child node. The child node actively initiates a connection to the parent node based on the parent node's network address, establishing a control channel for a fixed-long connection. The child node sends a binding request to the parent node through the control channel; the binding request includes the child node's cascading path and authentication information. The parent node authenticates the binding request; upon successful authentication, it adds the child node to the cascading topology, establishing a parent-child relationship. The control channel is used to transmit node binding, topology maintenance, and connection reconstruction instructions.

[0166] In some embodiments, the processing module 820 is further configured to: send a heartbeat message to the parent node at predetermined time intervals. After receiving the heartbeat message, the parent node returns an acknowledgment message to the target node. The parent node continuously monitors the time when the last heartbeat message was received, and if it does not receive a heartbeat message within a preset timeout threshold, it determines that the dedicated communication connection has timed out and disconnects the dedicated communication connection.

[0167] In some embodiments, if the dedicated communication connection is lost, the target node automatically attempts to reconnect to the parent node.

[0168] It should be noted that the information interaction and execution process between the above-mentioned devices / units are based on the same concept as the method embodiments of this application. For details on their specific functions and technical effects, please refer to the method embodiments section, and they will not be repeated here.

[0169] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0170] Based on the same inventive concept, embodiments of this application also provide an electronic device.

[0171] Figure 9 This is a schematic diagram of the structure of the electronic device provided in an embodiment of this application. For example... Figure 9 As shown, the electronic device 90 of this embodiment includes: at least one processor 910 ( Figure 9 Only one is shown in the diagram), memory 920, and communication module 930. Memory 920 stores a computer program 940 that may run on processor 910. When processor 910 executes computer program 940, it implements the steps in the above-described cascading tree access control method embodiment, for example... Figure 7 Steps S701 to S704 are shown. Alternatively, when the processor 910 executes the computer program 940, it implements the functions of each module / unit in the above-described device embodiments, for example... Figure 8 The functions of the receiving module 810 to the processing module 820 are shown. The communication module 930 can be a separate communication unit used to communicate with external servers or terminal devices.

[0172] Electronic device 90 may include, but is not limited to, a processor 910 and a memory 920. Those skilled in the art will understand that... Figure 9 This is merely an example of electronic device 90 and does not constitute a limitation on electronic device 90. It may include more or fewer components than shown, or combine certain components, or different components. For example, electronic device 90 may also include input transmitting devices, network access devices, buses, etc.

[0173] The processor 910 can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor.

[0174] In some embodiments, memory 920 may be an internal storage unit of electronic device 90, such as a hard disk or memory of electronic device 90. Memory 920 may also be an external storage device of electronic device 90, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., provided on electronic device 90. Memory 920 may also include both internal and external storage units of electronic device 90. Memory 920 is used to store operating system, applications, bootloader, data, and other programs, such as the program code of computer program 940. Memory 920 may also be used for temporary storage of data that has been sent or will be sent.

[0175] Furthermore, those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. In the various embodiments of this application, each functional unit can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0176] This application provides a computer-readable storage medium storing a computer program that, when run on an electronic device, causes the electronic device to perform the steps described in the various method embodiments above.

[0177] This application provides a chip, which includes a processor and a memory. The memory stores a computer program, which, when executed by the processor, implements the steps in the above-described method embodiments.

[0178] This application provides a computer program product that, when run on an electronic device, causes the electronic device to execute the steps described in the various method embodiments above.

[0179] It should be understood that the processor mentioned in the embodiments of this application can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor.

[0180] It should also be understood that the memory mentioned in the embodiments of this application can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static RAM (SRAM), Dynamic RAM (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDR SDRAM), Enhanced SDRAM (ESDRAM), Synchlink DRAM (SLDRAM), and Direct Rambus RAM (DR RAM).

[0181] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units and modules in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0182] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0183] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0184] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the system embodiments described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection between apparatuses or units through some interfaces, and may be electrical, mechanical, or other forms.

[0185] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0186] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0187] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments of this application can be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include at least: any entity or device capable of carrying computer program code to a large-screen device, a recording medium, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium. Examples include USB flash drives, portable hard drives, magnetic disks, or optical disks. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electrical carrier signals or telecommunication signals.

[0188] Finally, it should be noted that the above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A cascaded tree access control system, characterized in that, The system includes multiple nodes with a parent-child hierarchical relationship, wherein: In response to a received device access request, the parent node determines whether a dedicated communication connection exists between itself and the target node indicated by the device access request. The device access request carries a cascading tree path, which is used to locate the target node in the cascading tree. If the dedicated communication connection does not exist, the parent node generates a connection establishment instruction and forwards the connection establishment instruction hop-by-hop along the cascade tree path to the target node. The connection establishment instruction contains the network address of the parent node. After receiving the connection establishment instruction, the target node actively initiates a network connection to the parent node based on the network address in order to establish the dedicated communication connection. If the dedicated communication connection exists, the parent node forwards the device access request to the target node through the dedicated communication connection; After receiving the device access request, the target node performs the device access operation and returns the operation result to the parent node.

2. The cascading tree access control system according to claim 1, characterized in that, The determination of whether a dedicated communication connection exists between the target node indicated by the device access request includes: The parent node detects whether the dedicated communication connection has been established between the parent node and the target node; If established, check whether the dedicated communication connection is active; If the dedicated communication connection has been established and is active, then it is determined that there is an available dedicated communication connection.

3. The cascading tree access control system according to claim 1, characterized in that, The step of forwarding the connection establishment instruction hop-by-hop along the cascade tree path to the target node includes: Each intermediate node in the cascaded tree path receives the connection establishment instruction; Each intermediate node at each level determines the next hop node based on the cascaded tree path; Each intermediate node at each level forwards the connection establishment instruction to the next level until it reaches the target node.

4. The cascading tree access control system according to claim 1, characterized in that, The step of actively initiating a network connection to the parent node based on the network address to establish the dedicated communication connection includes: The target node parses the network address of the parent node from the connection establishment instruction; The target node actively initiates a network connection request to the proxy server of the parent node based on the network address; The parent node performs identity authentication on the target node; Once authentication is successful, the dedicated communication connection is established.

5. The cascading tree access control system according to claim 1, characterized in that, The system is also used to perform control channel establishment operations: During the system initialization phase, child nodes configure the network address of their parent nodes; The child node actively initiates a connection to the parent node based on the parent node's network address to establish a fixed long-lived connection control channel; The child node sends a binding request to the parent node through the control channel. The binding request includes the child node's cascading path and authentication information. The parent node authenticates the binding request. Once the authentication is successful, the child node is added to the cascade topology, establishing a parent-child relationship. The control channel is used to transmit node binding, topology maintenance, and connection reconstruction commands.

6. The cascading tree access control system according to any one of claims 1 to 5, characterized in that, After the dedicated communication connection is established, the system is also used for: The target node sends a heartbeat message to the parent node at predetermined time intervals; After receiving the heartbeat message, the parent node returns an acknowledgment message to the target node; The parent node continuously monitors the time when the last heartbeat message was received. If no heartbeat message is received within the preset timeout threshold, the dedicated communication connection is determined to have timed out and the dedicated communication connection is disconnected.

7. The cascading tree access control system according to claim 6, characterized in that, If the dedicated communication connection is broken, the target node will automatically attempt to reconnect to the parent node.

8. A cascading tree access control method, characterized in that, The cascaded tree includes multiple nodes with parent-child hierarchical relationships, and the method includes: Receive a device access request, the device access request carrying a cascade tree path, the cascade tree path being used to locate the target node in the cascade tree; Determine whether a usable dedicated communication connection exists between the parent node that received the access request and the target node; If the dedicated communication connection does not exist, a connection establishment instruction is generated and forwarded hop-by-hop along the cascading tree path to the target node. The connection establishment instruction contains the network address of the parent node and is used to instruct the target node to actively initiate a network connection to the parent node based on the network address in order to establish the dedicated communication connection. If the dedicated communication connection exists, the device access request is forwarded to the target node through the dedicated communication connection to perform the device access operation and receive the operation result returned by the target node.

9. An electronic device, characterized in that, It includes a processor and a memory, the processor being used to execute a computer program stored in the memory to implement the cascading tree access control method as described in claim 8.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the cascading tree access control method as described in claim 8.

Images