A distributed data intelligent backup management system

Abstract

This invention discloses a distributed intelligent data backup management system, relating to the field of industrial data storage and disaster recovery backup technology. The invention generates backup records to be closed for operational data packets and controls the data reception and local release processing of candidate receiving nodes by combining the outward transmission deadline, valid copy reception credentials, and phase recovery closure conditions. This prevents operational data packets that have not yet formed readable recovery copies from entering the release object set, reducing the possibility of recovery gaps in industrial field data due to local release during connection interruptions. By including data fragments with the same data packet identifier, data version identifier, and encoding rule identifier in the combined recovery determination, and confirming the phase recovery closure status based on the reconstructed integrity summary, data fragments distributed across multiple candidate receiving nodes can form a confirmed recovery basis.

Description

Technical Field

[0001] This invention relates to the field of industrial data storage and disaster recovery backup technology, and in particular to a distributed intelligent data backup management system. Background Technology

[0002] The distributed intelligent data backup and management system is primarily used for the backup and recovery management of equipment operation data, control configuration data, event log data, and business process data generated in industrial settings. In industrial edge scenarios, industrial field data is typically collected or generated by edge nodes and transmitted to regional centers or cloud storage nodes. Due to factors such as on-site communication conditions, power supply status, and business load, the communication link between edge nodes and remote storage nodes may be intermittently interrupted. Furthermore, the local storage space of edge nodes is limited, necessitating the release of saved data according to the data retention period.

[0003] Existing systems can perform backups using scheduled snapshots, incremental replication, remote replication, or retransmission after link recovery. When the remote storage node is unreachable, the data to be backed up typically remains at the source node, or is only partially transferred during short-term access from adjacent edge nodes, mobile gateways, or regional cache nodes. Therefore, the same data to be backed up may be in different states: only stored at the source node, already replicated at a temporarily reachable node, partially transferred, or already received by the remote storage node.

[0004] In the above process, if the system manages the data to be backed up based solely on the failure, waiting, or retry results of backup tasks, it is difficult to identify whether specific data has already formed external copies, has not yet completed transfers, and whether it is ready for recovery before local release. When the remote storage node has not yet been restored to reachability and the source node needs to release local data, data that has not yet formed a recoverable copy may be released; data that has been partially transferred may also be unusable for subsequent recovery because the reception status has not been confirmed, resulting in recovery gaps in industrial field data.

[0005] Therefore, it is necessary to address the problem of effectively managing the copy transfer process and recovery closure state of backup data before local data release, when remote storage nodes are unreachable but adjacent edge nodes, mobile gateways, or regional cache nodes are only temporarily accessible. Summary of the Invention

[0006] This application provides a distributed intelligent data backup and management system that solves the problem that it is difficult to form and confirm a recoverable copy of the data to be backed up before it is released locally under the condition of disconnection at the industrial edge.

[0007] This invention provides a distributed intelligent data backup management system, which includes a source industrial edge node, a candidate receiving node, a remote storage node, an edge backup agent deployed on the source industrial edge node, and a backup coordination node. The edge backup agent encapsulates industrial field data into operational data packets carrying data packet identifiers and data version identifiers, and generates backup records to be closed that are associated with the external transmission deadline, confirmed copy status, and closure status. The closure status includes unclosed status, staged closure status, and remote closure status. When the remote storage node is unreachable and the candidate receiving node is reachable, the edge backup agent sends the working condition data packet or its data fragment corresponding to the backup record to be closed that is in an unclosed state to the candidate receiving node according to the outward transmission deadline and the confirmed copy status. The candidate receiving node performs integrity verification and generates a replica receiving certificate. The edge backup agent or the backup coordination node determines the replica receiving certificate that matches the data packet identifier and data version identifier with the corresponding backup record to be closed and whose integrity verification result is passed as a valid replica receiving certificate. Based on the valid replica receiving certificate, the closure state is updated to a stage closure state when the corresponding working condition data packet can be recovered. Before the candidate receiving node updates the closing status of the corresponding backup record to the remote closing status, it saves the working condition data packet or data fragment that enables the working condition data packet to be recovered. The edge backup agent can still recover the working condition data packets corresponding to the closed state of the review stage before local data release processing, and excludes the working condition data packets that have not reached the closed state of the stage or whose review result is that they cannot be recovered from the release object set. When the remote storage node becomes reachable again, the backup coordination node transfers the working condition data packet or data fragment corresponding to the phase closure state to the remote storage node. The remote storage node generates a replica reception credential. After the backup coordination node determines the replica reception credential as a valid replica reception credential, it updates the closure state to the remote closure state.

[0008] In some embodiments, the industrial field data includes at least one of equipment operation data, control configuration data, event log data, and business process data; The candidate receiving node includes at least one of adjacent industrial edge nodes, mobile gateways, and regional cache nodes; The remote storage node includes at least one of a regional central storage node and a cloud storage node; The operating condition data packet also carries a data source identifier, an operating condition stage identifier, and an operating condition data packet integrity summary.

[0009] In some embodiments, the operating condition data packet includes an intra-packet data index, which records a data object identifier, a data object version, and a data object summary; The edge backup agent categorizes data objects with recovery relationships into the same operating condition data package according to at least one of the following: device identifier, production batch identifier, alarm event identifier, and control parameter change identifier. The operating condition data package that passes the data index integrity verification within the package is identified as the transfer object.

[0010] In some embodiments, when the candidate receiving node saves the operating condition data packet and the corresponding valid copy receiving certificate is associated with the backup record to be closed, it is determined that the operating condition data packet can be recovered; When the candidate receiving node saves data fragments carrying encoding rule identifiers, the backup coordination node will form a data fragment set by combining data fragments corresponding to the same data packet identifier, the same data version identifier, and the same encoding rule identifier. When the integrity digest of the working condition data packet reconstructed from the data fragment set is consistent with the integrity digest of the working condition data packet carried by the working condition data packet, the data fragment set will be determined as a data fragment set that can be combined and recovered, and the working condition data packet will be determined to be recoverable.

[0011] In some embodiments, the outward transmission deadline is a transfer completion time that is earlier than the local retention expiration time of the operating condition data packet; The edge backup agent generates the outward transfer deadline based on the local retention expiration time and the transfer guarantee period. The transfer guarantee period covers communication authentication, data transmission, return of copy reception credentials, writing of backup records to be closed, and one retransmission process. The term "candidate receiving node reachable" means that the edge backup agent obtains the receiving node identifier, current available storage capacity, remaining connection hold duration, and allowed data write status returned by the candidate receiving node.

[0012] In some embodiments, the edge backup agent determines the transfer order according to the earlier of the outgoing transfer deadline; When the outward transmission deadlines for multiple backup records to be closed are the same, the data packets of the working condition that have not yet formed valid copy reception credentials generated by the candidate receiving node will be transferred before the data packets of the working condition that have formed valid copy reception credentials corresponding to partial data fragments but have not yet reached the stage closure state. When the current available storage capacity and the remaining connection hold duration meet the requirements for sending the working condition data packet and returning the copy reception certificate, the working condition data packet is sent. The data fragment is sent when the current available storage capacity and the remaining connection hold duration satisfy at least one data fragment transmission and copy reception credential return.

[0013] In some embodiments, the copy receiving credential includes a copy receiving credential identifier, a data packet identifier, a data version identifier, a receiving node identifier, a copy type, an integrity verification result, a credential generation time, and a copy retention expiration time. The replica types include working condition data packet replicas and data fragment replicas. The replica receiving credentials corresponding to the data fragment replicas also include fragment identifiers and encoding rule identifiers. The edge backup agent generates a fragment transfer list for the data fragments to be sent, and selects data fragments without corresponding valid copy receiving credentials from the fragment transfer list for transmission after data transmission is interrupted.

[0014] In some embodiments, when the remote storage node becomes reachable, the backup coordination node determines, based on a valid copy reception credential, a candidate receiving node that stores the operational data packet or data fragment that enables the operational data packet to be recovered, and sends a remote transfer instruction to the determined candidate receiving node. After the remote storage node completes the reception and integrity verification, it generates a copy reception certificate. The backup coordination node determines the copy reception certificate that matches the data packet identifier and data version identifier with the corresponding backup record to be closed and passes the integrity verification as a valid copy reception certificate.

[0015] In some embodiments, the edge backup agent forms a set of release objects when the local storage usage reaches a local storage capacity threshold. For a backup record to be closed that is in a phase closure state but has not reached a remote closure state, before the edge backup agent performs local data release, it verifies that the backup record or data fragment that the backup record can recover is still readable, and that the copy retention expiration time recorded in the corresponding valid copy receiving certificate is later than the release execution time. If the review fails, the corresponding working condition data packet will be removed from the set of released objects.

[0016] In some embodiments, a backup metadata storage unit is further included, which stores a closure state change record. The closure state change record includes a data packet identifier, a data version identifier, a closure state before the change, a closure state after the change, a copy receiving credential identifier corresponding to a valid copy receiving credential, and an execution node identifier. After the backup coordination node resumes communication with the source industrial edge node, it matches the backup record summary to be closed with the valid copy receipt certificate. If a valid copy receipt certificate exists but the corresponding confirmed copy status is not recorded, it issues a status completion instruction. If a copy is recorded but the corresponding valid copy receipt certificate is missing, it issues a copy verification instruction. If the verification fails, it issues a retransmission instruction. The backup coordination node generates a recovery read list based on the valid copy receipt certificate.

[0017] Through the above technical solution, the present invention can achieve at least the following beneficial effects: This invention addresses the situation where the communication link between industrial edge nodes and remote storage nodes is interrupted and local data faces release processing. By generating backup records to be closed for the data packets of the situation, and combining the outward transmission deadline, valid copy reception credentials, and phased recovery closure conditions, the invention controls the data reception and local release processing of candidate receiving nodes. This prevents data packets of the situation that have not yet formed a readable recovery copy from entering the release object set, thereby reducing the possibility of recovery gaps in industrial field data due to local release during the disconnection period.

[0018] By incorporating data fragments with the same packet identifier, data version identifier, and encoding rule identifier into the combined recovery determination, and restoring the closed state based on the integrity summary confirmation stage after reconstruction, data fragments distributed across multiple candidate receiving nodes can form a confirmed recovery basis, thus avoiding data that has only completed partial transfer being considered as having met the recovery conditions.

[0019] By determining the transfer order based on the outgoing transmission deadline and sending data fragments when the connection conditions only cover part of the data transmission, the working condition data packets that are close to the local release time and have not yet formed a valid copy will occupy the short-term communication window first, reducing the risk that such working condition data packets will lose the transfer opportunity before the remote link is restored.

[0020] After the remote storage node is made reachable, the working condition data packets or data fragments corresponding to the phase closure state are transferred to the remote storage node. The remote closure state is updated based on the replica reception certificate generated by the remote storage node and determined as a valid replica reception certificate by the backup coordination node, so that the recovery data saved by the candidate receiving node continues to form the basis for remote recovery.

[0021] By reviewing the readable status and copy retention expiration time of the backup transmission data before releasing local data, and matching the backup record to be closed with the valid copy receipt certificate after the source industrial edge node resumes communication with the backup coordination node, the release action, status record and recovery reading basis are kept in correspondence. Attached Figure Description

[0022] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly described below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation on the scope of this application.

[0023] Figure 1 This is a framework diagram of the distributed intelligent data backup management system in the embodiment. Detailed Implementation

[0024] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0025] All terms used in this application (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0026] To facilitate understanding, the relevant terms involved in this embodiment will be introduced below.

[0027] Industrial edge nodes refer to computing nodes deployed in industrial sites for collecting, generating, or storing industrial site data; source industrial edge nodes refer to industrial edge nodes that form operational condition data packets; candidate receiving nodes refer to nodes that establish communication connections with source industrial edge nodes and have the conditions for data writing during the data transfer period; remote storage nodes refer to storage nodes located in regional centers or the cloud for storing remote copies. Backup transmission data refers to at least one of the operational condition data packets used to form copies at candidate receiving nodes or remote storage nodes and data fragments formed by operational condition data packets. Remote storage node unreachable means that after the edge backup agent or backup coordinating node performs connection establishment and data write availability queries for the remote storage node, it does not obtain a write permission return result, or the established data transmission connection is interrupted before the backup transmission data is sent. Remote storage node recoverable means that the backup coordinating node regains the write permission return result from the remote storage node. When the remote storage node is unreachable and no write permission is received from the candidate receiving node, the edge backup agent maintains the current closed state of the corresponding backup record to be closed and excludes the corresponding data packet from the release object set. When the remote storage node is unreachable and a write permission is received from the candidate receiving node, it enters the transfer process towards the candidate receiving node. The release object set refers to the set of data packets to be locally deleted, determined by the source industrial edge node during local data release processing.

[0028] A working condition data packet refers to a backup data object formed by a source industrial edge node for the same industrial operation process. A working condition data packet integrity digest is verification data obtained by performing digest processing on the working condition data packet, used to verify the consistency of the data packet's content. A backup record to be closed is a data record associated with a working condition data packet, used to record the backup status of that working condition data packet from its formation until the recovery closure conditions are met. Recovery closure conditions refer to the conditions under which a working condition data packet meets the requirements for replica composition and confirmation relationships for recovery reading. A working condition data packet replica refers to an unfragmented working condition data packet stored by a candidate receiving node or remote storage node.

[0029] The confirmed replica status refers to the retention status of the backup transmission data confirmed based on the valid replica reception certificate. The outward transfer deadline refers to the deadline for completing the replica transfer before the operational data packet enters the release object set. The closed status refers to the recovery closure process status reflected in the backup record to be closed. The local retention expiration time refers to the release deadline for the corresponding operational data packet in its local storage location, determined by the source industrial edge node based on local storage management; the replica retention expiration time refers to the deadline for the receiving node to keep the corresponding backup transmission data available for reading; the release execution time refers to the time when the source industrial edge node performs a local deletion operation on the corresponding operational data packet in the release object set. The outward transfer deadline, local retention expiration time, replica retention expiration time, release execution time, certificate generation time, and status change time are recorded using the same time base. If a candidate receiving node cannot generate a replica retention expiration time comparable to the release execution time, the corresponding replica reception certificate will not be used as the basis for writing the operational data packet corresponding to the stage closure status into the release object set.

[0030] Before the backup record to be closed reaches the remote closure state and the copy retention period expires, the candidate receiving node continues to keep the copy of the corresponding working condition data packet or data fragment available for reading for recovery; when it can no longer be kept available for reading, the edge backup agent removes the corresponding working condition data packet from the release object set before performing local data deletion.

[0031] The replica retention expiration time refers to the deadline at which the receiving node keeps the corresponding backup transmission data available for reading; the local retention expiration time refers to the deadline determined by the source industrial edge node based on local storage management for releasing the corresponding operating condition data packet from its local storage location. The release execution time refers to the time taken for the source industrial edge node to perform a local deletion operation on the corresponding operating condition data packet in the release object set. A valid replica reception certificate refers to a data record generated by the node receiving the operating condition data packet or data fragment, whose data packet identifier and data version identifier match the corresponding backup record to be closed, and whose integrity verification result is passed. The valid replica reception certificate used for local data release verification also records the replica retention expiration time.

[0032] Example 1: like Figure 1 As shown, this embodiment employs a distributed intelligent data backup management system, including a source industrial edge node, a candidate receiving node, a remote storage node, an edge backup agent deployed on the source industrial edge node, a backup coordination node, and a backup metadata storage unit. The operational data packet carries a data packet identifier and a data version identifier; the backup record to be closed is associated with a data packet identifier, a data version identifier, recovery closure conditions, confirmed copy status, outgoing transmission deadline, and closure status; the copy receiving certificate at least records the copy receiving certificate identifier, data packet identifier, data version identifier, receiving node identifier, copy type, integrity verification result, certificate generation time, and copy retention expiration time; at least one of the edge backup agent and backup coordination node determines a valid copy receiving certificate as one whose data packet identifier and data version identifier match the corresponding backup record to be closed and whose integrity verification result is passed. Recovery closure conditions include stage recovery closure conditions and remote recovery closure conditions. Closure states include unclosed state, stage closure state, and remote closure state. Stage recovery closure condition is that at least one candidate receiving node has received the operating condition data packet, or one or more candidate receiving nodes have received a set of data fragments corresponding to the same data packet identifier and the same data version identifier, which can be combined to recover the operating condition data packet, and the corresponding valid replica reception certificate is associated with the backup record to be closed. Remote recovery closure condition is that the remote storage node has received the operating condition data packet or a set of data fragments that can be combined to recover the same operating condition data packet, and the corresponding valid replica reception certificate is associated with the backup record to be closed. When the edge backup agent detects that the remote storage node is unreachable and the candidate receiving node is reachable, it determines the transfer target from the backup records that are in an open state and sends the corresponding backup transfer data to the candidate receiving node based on the confirmed copy status and the transfer deadline. Candidate receiving nodes perform integrity checks on the received backup transmission data and generate a copy of the receiving credentials; When the backup coordination node detects that the remote storage node is recoverable, it transfers the backup transmission data corresponding to the phase closure state to the remote storage node; the remote storage node saves the received backup transmission data and generates a valid copy reception certificate; when it confirms that the corresponding working condition data packet can be obtained based on the valid copy reception certificate generated by the remote storage node, it updates the closure state to the remote closure state. When performing local data release processing, the edge backup agent forms a release object set and excludes the condition data packets corresponding to backup records that are in an unclosed state from the release object set. For the condition data packets corresponding to backup records that are in a stage of closure, the condition data packets are only written into the release object set if the condition data packets that enable the condition data packets to be recovered or the data fragments can still be read after review. The composable data fragment set consists of data fragments corresponding to the same data packet identifier, the same data version identifier, and the same encoding rule identifier. The predetermined recovery quantity refers to the number of data fragments required to reconstruct the corresponding operating condition data packet according to the encoding rules. Each data fragment is associated with a fragment identifier, a data version identifier, an encoding rule identifier, a digest algorithm identifier, and a fragment integrity digest. The fragment integrity digest is verification data obtained by performing digest processing on the corresponding data fragment and used to verify the consistency of the data fragment content. The digest algorithm identifier is an identifier that determines the generation method of the operating condition data packet integrity digest and the fragment integrity digest. The receiving node identifier that stores this data fragment is recorded by the corresponding copy receiving certificate. The backup coordination node aggregates the replica reception credentials corresponding to the data fragments according to the data packet identifier and data version identifier. When the fragment identifiers of the data fragments included in the combination are not repeated, the number of data fragments reaches the corresponding predetermined recovery number, the encoding rule identifier is consistent, the digest algorithm identifier is consistent, the data version identifier is consistent, and the integrity verification results are all passed, the combined recovery verification is performed according to the encoding rule. When the integrity digest of the working condition data packet obtained by the combined recovery is consistent with the integrity digest of the working condition data packet associated with the backup record to be closed, the corresponding data fragment set is recorded as the data fragment set that can be combined and recovered.

[0033] When a backup record to be closed is generated, its closure state is unclosed. After a candidate receiving node generates a valid copy receiving certificate that meets the stage recovery closure conditions, the edge backup agent or backup coordination node updates the closure state of the corresponding backup record to be closed to the stage closure state. After a remote storage node generates a valid copy receiving certificate that meets the remote recovery closure conditions, the backup coordination node updates the closure state of the corresponding backup record to be closed to the remote closure state.

[0034] When a backup record to be closed is still in an unclosed state, if the number of data fragments has not reached the predetermined recovery quantity, the data version identifier is inconsistent, the encoding rule identifier is inconsistent, the digest algorithm identifier is inconsistent, the integrity verification result fails, or the integrity digest of the working condition data packet obtained from combined recovery is inconsistent with the integrity digest of the working condition data packet associated with the backup record to be closed, the backup record to be closed will remain in an unclosed state, and the unmet stage recovery closure conditions will be recorded. When a backup record to be closed has reached a stage closure state but has not yet reached a remote closure state, if the working condition data packet replicas or the set of data fragments that can be combined for recovery no longer meet the stage recovery closure conditions after review, the backup coordination node will revert the corresponding closure state to an unclosed state and exclude the corresponding working condition data packet from the set of objects to be released this time. For a backup record to be closed that has reached a remote closure state, a replica anomaly on the candidate receiving node side will not change the remote closure state formed based on the valid replica reception certificate of the remote storage node.

[0035] In one optional implementation, industrial field data includes at least one of equipment operation data, control configuration data, event log data, and business process data; Candidate receiving nodes include adjacent industrial edge nodes, mobile gateways, or regional cache nodes that have established communication connections with the source industrial edge node. Remote storage nodes include at least one of regional central storage nodes and cloud storage nodes; the operational data packet carries a data source identifier, operational stage identifier, data version identifier, and operational data packet integrity summary; In one optional implementation, the operating condition data packet includes an in-packet data index, which records the data object identifier, the data object version, and the data object summary. The edge backup agent groups data objects with recovery relationships into the same operating condition data package according to at least one of the following: device identifier, production batch identifier, alarm event identifier, and control parameter change identifier; and only identifies operating condition data packages whose data indexes pass the integrity verification as transfer objects. The data index within the package also records the data object type and storage location. After the edge backup agent completes the writing of the data index within the package, it performs an integrity check on the data index within the package. If the check passes, the corresponding working condition data package is identified as the transfer object; if the check fails, the corresponding working condition data package is kept in the source industrial edge node, and the identifier of the data object that failed the check is recorded.

[0036] When a new data object is generated in the same industrial operation process or an existing data object undergoes a version change, the edge backup agent configures a new data packet identifier and a data version identifier for the changed operating condition data packet, and generates a corresponding backup record to be closed; each data packet identifier corresponds to a data version identifier, and the copy receiving credentials corresponding to different data versions are recorded separately.

[0037] In one optional implementation, the copy receiving certificate includes a copy receiving certificate identifier, a data packet identifier, a data version identifier, a receiving node identifier, a copy type, an integrity verification result, a certificate generation time, and a copy retention expiration time. The replica types include operational data packet replicas and data fragment replicas; the replica reception credentials corresponding to data fragment replicas also include fragment identifiers; The backup coordinating node generates a confirmed replica status based on valid replica reception credentials with the same data packet identifier and the same data version identifier; for valid replica reception credentials corresponding to data fragment replicas, the backup coordinating node also determines the data fragments that can participate in the combined recovery based on the fragment identifier and encoding rule identifier. In one alternative implementation, the edge backup agent generates a fragment transfer list for the data fragments to be sent; When data transmission is interrupted, the fragment identifier of the fragment for which a valid copy reception certificate has been obtained is written into the backup record to be closed. When a candidate receiving node is detected to be reachable again, select the data fragment without a corresponding valid copy receiving credential from the fragment transfer list and send it; The fragment transfer list also records the data packet identifier, data version identifier, set of fragment identifiers to be sent, set of fragment identifiers for which valid copy reception credentials have been obtained, and target receiving node identifier. Valid copy reception credentials with duplicate credentials are recorded by merging the data packet identifier, data version identifier, receiving node identifier, and fragment identifier; copy reception credentials with mismatched data version identifiers or failed integrity checks are not written into the confirmed copy status.

[0038] In one alternative implementation, when the backup coordination node detects that the remote storage node is recoverable, it selects the working condition data packet from the backup records to be closed in the staged closure state, determines the candidate receiving node that stores the working condition data packet or data fragment that enables the working condition data packet to be recovered based on the valid copy receiving certificate, and sends a remote transfer instruction to the determined candidate receiving node. The remote storage node saves the received backup transmission data and generates a valid copy reception certificate. The backup coordination node updates the corresponding closed state to the remote closed state based on the valid copy reception certificate generated by the remote storage node. In one alternative implementation, the local data release process includes forming a set of release objects according to a local storage capacity threshold; For a backup record to be closed that is in a phase closure state but has not reached the remote closure state, the edge backup agent writes the working data packet into the release object set only when the working data packet or data fragment that can be recovered by the review is still readable, and the copy retention expiration time recorded in the corresponding valid copy receiving certificate is later than the release execution time. In one optional implementation, the backup metadata storage unit stores a closure status change record, which includes a data packet identifier, a data version identifier, a closure status before the change, a closure status after the change, a copy receiving credential identifier corresponding to a valid copy receiving credential, and an execution node identifier. After the backup coordination node resumes communication with the source industrial edge node, it matches the backup record summary to be closed saved by the source industrial edge node with the valid copy receiving certificate. If the valid copy receiving certificate exists but the backup record summary to be closed does not record the corresponding confirmed copy status, it issues a status completion instruction. If the backup record summary to be closed records a copy but lacks the corresponding valid copy receiving certificate, the backup coordination node issues a copy verification instruction. When the verification result returned by the replica verification command is unsuccessful, the backup coordinating node issues a retransmission command; the backup coordinating node generates a recovery read list based on the valid replica reception credentials; The release object set records the data packet identifier, closure status, local retention expiration time, and release execution status. Data packets corresponding to backup records in an unclosed state are not written to the release object set; when data packets corresponding to backup records in a partially closed state are removed from the release object set, their local storage status in the source industrial edge node is maintained; data packets with a remotely closed state are released according to the local storage management order.

[0039] The closure status change record also includes the status change time. The summary of the backup record to be closed includes the data packet identifier, data version identifier, closure status, replica reception credential identifier corresponding to the valid replica reception credential, and the most recent status change time. When the closure status recorded by the source industrial edge node is inconsistent with the closure status determined by the backup coordination node based on the valid replica reception credential, the backup coordination node re-determines the remote closure status, staged closure status, or unclosed status based on the valid replica reception credential generated by the remote storage node, the data readability status saved by the candidate receiving node, and the replica retention expiration time.

[0040] The recovery read list refers to the recovery data read record generated by the backup coordinating node based on the valid copy reception certificate. The recovery read list includes the data packet identifier, data version identifier, closure status, copy type, receiving node identifier, fragment identifier set, and read order. For a working data packet that stores a copy of the working data packet, the backup coordinating node reads the corresponding working data packet copy according to the receiving node identifier; for a working data packet that stores a set of data fragments that can be recombined for recovery, the backup coordinating node reads the corresponding data fragments according to the fragment identifier set and read order, and completes the recovery read when the integrity summary of the reconstructed working data packet matches the integrity summary of the working data packet associated with the backup record to be closed.

[0041] In a preferred embodiment of Example 1, when the edge backup agent generates the operational data packet and the corresponding backup record to be closed, it reserves a transfer guarantee period for completing communication authentication, data transmission, return of copy reception credentials, writing of the backup record to be closed, and one retransmission processing, based on the local retention expiration time of the operational data packet. This generates the outward transfer deadline in the following manner: , in, This is the data packet identifier corresponding to the operating condition data packet; The data packet is identified as The corresponding outgoing transmission deadline for the working condition data packet; The data packet is identified as The local retention expiration time corresponding to the working condition data packet; The data packet is identified as The transfer guarantee period corresponding to the working condition data packet.

[0042] The transfer assurance period is recorded in the configuration data of the backup metadata storage unit or edge backup agent, and registered according to the industrial field data type and operating condition stage identifier. The transfer assurance period is determined by the time required for communication authentication, data transmission, copy reception certificate return, writing of backup records to be closed, and one retransmission process corresponding to the operating condition data packet transmission path and data fragment transmission path; when the transmission path has not yet been determined, the longer time period corresponding to the two transmission paths is used.

[0043] When the corresponding industrial site data type and operating condition stage identifier lack transfer guarantee period records, the edge backup agent determines the generation time of the backup record to be closed as the external transmission deadline; when the generation time of the backup record to be closed is not earlier than the local retention expiration time, the corresponding operating condition data packet is kept in an unclosed state and excluded from the release object set.

[0044] When generating a working condition data packet and a corresponding backup record to be closed, the edge backup agent writes the working condition stage identifier, industrial field data type, external transmission deadline, data version identifier, working condition data packet integrity summary, and the summary algorithm identifier used to generate the working condition data packet integrity summary into the backup record to be closed.

[0045] The pre-configured fragmentation rule table is a configuration record used to record the conditions for fragmentation formation and combined recovery of operational data packets. This table is formed during system deployment or operational configuration distribution and includes at least the encoding rule identifier, digest algorithm identifier, total number of fragments, planned recovery quantity, number of redundant fragments to be recovered, expected combined recovery completion time, minimum applicable storage capacity, and minimum applicable remaining connection hold duration. When the remote storage node is unreachable, the candidate receiving node completes communication authentication and short data exchange used to determine the payload transmission rate, and the current connection window is insufficient to send operational data packets, the edge backup agent selects fragmentation rules from the pre-configured fragmentation rule table based on the operational stage identifier, industrial field data type, outbound transmission deadline, current available storage capacity, and remaining connection hold duration. The selected encoding rule identifier, total number of fragments, planned recovery quantity, and number of redundant fragments to be recovered are then written into the backup record to be closed.

[0046] The current connection window refers to the period during which data can be transmitted after the candidate receiving node completes its current communication authentication, until the remaining connection hold time expires or the communication connection is interrupted. Short data interaction refers to the data transmission process after the candidate receiving node completes its communication authentication, whereby the edge backup agent sends data and receives confirmation, recording the payload data volume and transmission duration. The payload transmission rate refers to the current connection transmission rate determined based on the payload data volume and transmission duration. The expected combined recovery completion time, minimum applicable storage capacity, and minimum applicable remaining connection hold time are obtained by performing fragmented transmission, combined recovery, and post-recovery digest verification using test condition data packets corresponding to the industrial field data types. The expected combined recovery completion time, minimum applicable storage capacity, and minimum applicable remaining connection hold time are used for fragmentation rule selection and current connection window adaptation verification, and do not participate in the determination of the confirmed copy status and closed status.

[0047] When selecting sharding rules, the edge backup agent identifies rule entries with a minimum applicable storage capacity less than or equal to the current available storage capacity returned by the candidate receiving node, and a minimum applicable remaining connection hold duration less than or equal to the remaining connection hold duration returned by the candidate receiving node, as candidate rule entries. If there are candidate rule entries with an expected combined recovery completion time less than or equal to the remaining time from the current time to the outbound transmission deadline, the rule entry with the shorter expected combined recovery completion time is selected; if there are no aforementioned candidate rule entries but other candidate rule entries exist, the candidate rule entry with the shorter expected combined recovery completion time is selected, and the corresponding working condition data packet is excluded from the release object set before the formation phase closure state; if there are no candidate rule entries, the corresponding working condition data packet remains in an unclosed state and is excluded from the release object set.

[0048] For each data packet, the unique associated data version is identified, and the fragmentation rule remains unchanged after the initial determination to use data fragmentation for transfer and writing to the pending backup record. If the current available storage capacity and remaining connection hold duration returned by subsequent candidate receiving nodes are sufficient to complete the transmission and return of at least one data fragment without a valid copy of the receiving credential according to the selected fragmentation rule, the edge backup agent continues to perform transmission according to the selected fragmentation rule. If the aforementioned transmission and credential return cannot be completed, the current data fragmentation transmission is paused, no new fragmentation rule is selected, and data packets that have not yet met the phase recovery closure conditions are excluded from the current release object set.

[0049] When performing a transfer using data fragmentation, the edge backup agent divides the operational data packet into source data fragments and generates recovery redundancy fragments according to the selected encoding rules, forming a set of data fragments corresponding to the same operational data packet. The relationship between these fragments is as follows: , , in, This is the data packet identifier corresponding to the operating condition data packet; For the corresponding data packet identifier Total number of fragments; The predetermined number of data packets required to restore the corresponding operating condition; The number of recovery redundancy fragments generated according to the coding rules; This is a collection of data fragments formed for the corresponding operating condition data packets; For the first data shard in the collection Data shards; This is the shard number in the data shard set.

[0050] The source data fragments in the data fragment set carry the original data content of the operational data packet after being divided, while the recovery redundant fragments carry the recovered data content generated according to the encoding rules. The fragment header of each data fragment records at least the data packet identifier, fragment identifier, data version identifier, fragment integrity digest, encoding rule identifier, digest algorithm identifier, and predetermined recovery quantity.

[0051] The edge backup agent allocates data fragments to be sent to one or more candidate receiving nodes based on the fragment transfer list. Upon receiving a data fragment, the candidate receiving node locates the corresponding data fragment based on the packet identifier, fragment identifier, and data version identifier, and performs integrity verification based on the fragment integrity digest and digest algorithm identifier. After integrity verification, it generates a replica reception certificate corresponding to the data fragment replica. The replica reception certificate corresponding to the data fragment replica includes at least the packet identifier, fragment identifier, receiving node identifier, replica type, replica reception certificate identifier, data version identifier, encoding rule identifier, digest algorithm identifier, integrity verification result, certificate generation time, and replica retention expiration time. The edge backup agent or backup coordination node recognizes the replica reception certificate as a valid replica reception certificate when the replica type is a data fragment replica, the packet identifier, fragment identifier, receiving node identifier, and data version identifier match the corresponding entries in the fragment transfer list, the encoding rule identifier and digest algorithm identifier match the corresponding entries in the backup record to be closed, and the integrity verification result is passed.

[0052] After receiving the operational data packet, the candidate receiving node locates the corresponding operational data packet based on the data packet identifier and data version identifier, and performs integrity verification based on the operational data packet integrity digest and digest algorithm identifier. After completing the integrity verification, a replica reception certificate corresponding to the operational data packet replica is generated. The replica reception certificate corresponding to the operational data packet replica includes at least the data packet identifier, receiving node identifier, replica type, replica reception certificate identifier, data version identifier, digest algorithm identifier, integrity verification result, certificate generation time, and replica retention expiration time. When the replica type is operational data packet replica, and the data packet identifier, receiving node identifier, data version identifier, and digest algorithm identifier match the corresponding registration content in the backup record to be closed, and the integrity verification result is passed, the edge backup agent or backup coordination node recognizes the replica reception certificate as a valid replica reception certificate. The replica retention expiration time is associated with the corresponding replica reception certificate and written into the backup record to be closed for use in closure status verification, local release verification, read location selection, and remote transfer order determination.

[0053] For operational data packets intended to be included in the release object set based on the phase closure state, a pre-check condition after the transfer is completed is that the replica retention expiration time is no earlier than the external transmission deadline. Before executing the local data deletion of the corresponding operational data packet, the edge backup agent verifies that the operational data packet replica or data fragment that the operational data packet can recover is still readable, and that the corresponding replica retention expiration time is later than the release execution time. If the verification fails, the corresponding operational data packet will be excluded from the release object set in this instance.

[0054] For any candidate receiving node, the data fragments that have been acknowledged and those that are still to be retransmitted are determined according to the following formula: , , in, The receiver node is identified as Candidate receiving nodes are identified as packets Data version identifier is The data packets under the operating conditions have been confirmed as received, and the data fragments have been collected. The identifier assigned to the receiving node in the fragment transfer list is... Candidate receiving nodes, and the corresponding data packets are identified as and data version identifier The set of data fragments to be sent; This is a set of data fragments for which candidate receiving nodes currently lack confirmation of receipt; The receiver node identifier for the candidate receiver node; For data version identification; The value is 1 for the matching result of the replica receiving certificate field corresponding to the data fragment replica. The data packet identifier, fragment identifier, receiving node identifier and data version identifier in the replica receiving certificate match the corresponding registration content in the fragment transfer list, and the encoding rule identifier and digest algorithm identifier in the replica receiving certificate match the corresponding registration content in the backup record to be closed. Otherwise, the value is 0. The result of the data fragment integrity verification is 1 if the integrity digest verification of the data fragment passes, and 0 otherwise. , and The meaning is consistent with the aforementioned definition.

[0055] When data fragments of the same operating condition data packet are allocated to different candidate receiving nodes, the absence of a data fragment in a single candidate receiving node does not directly indicate that the data packet for that operating condition cannot be recovered. Whether it can be recovered is determined by combining the data fragments with valid copy receiving credentials stored by multiple candidate receiving nodes.

[0056] The backup coordinating node aggregates replica reception credentials generated by multiple candidate receiving nodes based on packet identifiers and data version identifiers. When initially forming a set of data fragments that can be combined for recovery, only data fragments with matching fields and passed integrity verification are included in the combination scope. Before writing the corresponding operating condition data packet to the release object set or before performing a remote transfer, only data fragments with matching fields, passed integrity verification, and whose replica retention period has not yet expired are included in the combination scope. In cases where multiple candidate receiving nodes store data fragments corresponding to the same fragment identifier, the backup coordinating node only counts one data fragment during the combination determination and records other candidate receiving nodes storing the same data fragment as alternative read locations.

[0057] When the number of data fragments included in the combination range after deduplication by fragment identifier reaches the predetermined recovery quantity, the backup coordination node selects a group of data fragments from this group that are equal in number to the predetermined recovery quantity, have consistent data version identifiers, consistent encoding rule identifiers, consistent digest algorithm identifiers, and whose fragment identifiers are mutually unique, as the data fragments for this combination verification. The node then performs a data packet reconstruction based on this group of data fragments. If there are data fragments with valid copy reception credentials that are not selected for this combination verification, after this combination verification fails, the backup coordination node replaces the corresponding combination verification fragment with at least one different data fragment with a valid copy reception credential and performs the combination verification again. When none of the replaceable data fragments with valid copy reception credentials can form a reconstruction result with a consistent digest, it is determined that the corresponding data fragments have not formed a data fragment set record that can be combined and recovered. The method for determining whether a backup coordinating node can form a set of data fragments that can be combined for recovery is as follows: , , in, For data packets identified as Data version identifier is The set of candidate combined data fragments is formed by deduplicating the data packets based on the fragmentation identifier. To determine the fragment sequence number that corresponds one-to-one with the fragment identifier Perform deduplication; To save the data packet identifier as Data version identifier is And a set of candidate receiving nodes for data fragments with valid copy receiving credentials; This is the result of determining whether the data fragments can be combined and recovered for the corresponding data version. A value of 1 indicates that a set of data fragments that can be combined and recovered has been formed, while a value of 0 indicates that a set of data fragments that can be combined and recovered has not been formed. The corresponding data packet registered in the backup record to be closed is identified as And the data version identifier is registered in the backup record to be closed; The number of unique data shards in the candidate combination data shard set; The integrity summary of the working condition data packet is obtained by reconstructing a group of current combination verification fragments after selecting a group of current combination verification fragments from the candidate combination data fragment set that has an equal number of predetermined recovery fragments, consistent data version identifiers, consistent encoding rule identifiers, consistent digest algorithm identifiers, and unique fragment identifiers. Integrity summary of the operating condition data packets associated with the backup record to be closed; , , , , and The meaning is consistent with the aforementioned definition.

[0058] When the data fragment recovery determination result is 1, the backup coordinating node generates a record of recoverable data fragment sets. The record of recoverable data fragment sets includes at least the data packet identifier, data version identifier, encoding rule identifier, digest algorithm identifier, predetermined recovery quantity, fragment identifier of the fragment to be combined and verified in this case, the receiving node identifier corresponding to each fragment to be combined and verified in this case, the replica receiving certificate identifier, and the combined verification result.

[0059] After the set of recoverable data fragments is formed, if the fragment to be combined and verified becomes unreachable during subsequent reading, the copy retention period expires, or the integrity verification fails again, the backup coordination node will re-execute the combination determination based on the data fragment that still has a valid copy reception certificate.

[0060] Based on the composable recovery determination result, the backup coordination node maintains backup records awaiting closure that use composable recoverable data fragment sets as the basis for phase recovery closure but have not yet reached remote closure. For backup records awaiting closure that use valid copy receipt credentials corresponding to the operational data packet as the basis for phase recovery closure but have not yet reached remote closure, a status review is performed based on the validity of the copy receipt credentials, the copy retention expiration time, and the integrity verification result during the review read. If the corresponding copy receipt credentials are found to be invalid, the copy retention expiration time of the corresponding operational data packet copy has expired, or the integrity verification during the review read fails, the backup record awaiting closure is updated from phase closure to unclosed and excluded from the current release object set. The following data fragment composable recovery determination rules do not apply to this type of backup record awaiting closure.

[0061] For backup records to be closed that use the aforementioned composable recoverable data fragment set records as the basis for phase recovery closure, the phase closure status processing method is as follows: like ,but , like ,but , Other situations ; in, The data packet is identified as The closed state of the working condition data packet before this combination judgment; The data packet is identified as The closed state of the working condition data packet after this combination judgment; It is in an unclosed state; This is a closed-loop state. The data fragments corresponding to the registered target data version can be combined to determine the recovery results; and The meaning is consistent with the aforementioned definition.

[0062] Status verification and phase closure status processing are performed before the following events: when a new copy receiving certificate is added and written; when the certificate verification result changes; when the retention period of the copy corresponding to the copy participating in forming the phase closure status expires; when certificate matching is performed after communication is restored at the source industrial edge node; before the work condition data packet corresponding to the phase closure status is written into the release object set; and before the remote transfer is executed. If the data fragment versions are inconsistent, the integrity verification of the data fragment included in the combined verification fails, the number of data fragments included in the combined range after deduplication does not reach the predetermined recovery quantity, or the integrity summary of the work condition data packet after combined reconstruction is inconsistent with the integrity summary of the work condition data packet associated with the backup record to be closed, the result of this judgment is that no data fragment set record that can be combined and recovered has been formed. If the corresponding work condition data packet was originally in an unclosed state, it will remain in an unclosed state; if it was originally in a phase closure state but has not yet reached the remote closure state, it will revert to an unclosed state and be excluded from the release object set.

[0063] For operational data packets that use a set of composable recoverable data fragments as the basis for phase recovery closure, if a candidate receiving node becomes temporarily unreachable or experiences a read connection interruption during a data fragment read request, and it has not yet been confirmed that the corresponding data fragment has been deleted, the replica retention period has expired, or the integrity verification has failed, the backup coordinating node will record the corresponding read position as a read position to be reviewed, and will not revert the phase closure state to an unclosed state based solely on this read anomaly. If the aforementioned read anomaly occurs before local release processing, the corresponding operational data packet will not be written into the release object set; if the aforementioned read anomaly occurs during remote transfer, the backup coordinating node will maintain its phase closure state and select an alternative read position to continue the remote transfer. The aforementioned rollback process will only be performed when it is confirmed that a data fragment with valid replica reception credentials can no longer form a set of composable recoverable data fragments.

[0064] For data packets that have entered the remote closed state based on the valid copy receiving credentials generated by the remote storage node, the copy anomaly record on the candidate receiving node side is used for copy maintenance and does not change the remote closed state formed based on the valid remote copy.

[0065] For operational data packets whose closure status is in a staged closure state and has not yet reached the remote closure state, the edge backup agent, before performing local data deletion, verifies that the copy of the operational data packet or the set of data fragments that can be combined for recovery by the candidate receiving node can still recover the corresponding operational data packet. If the verification result is that it cannot be recovered, the corresponding operational data packet is excluded from the release object set, and the local storage status of the operational data packet in the source industrial edge node is maintained. For operational data packets that have already undergone local data deletion but have not yet reached the remote closure state, the candidate receiving node keeps a copy of the operational data packet or data fragments that enable the recovery of the corresponding operational data packet available for reading until the remote storage node achieves the remote closure state.

[0066] Example 2: Based on Example 1, this example provides a specific method for determining the transfer order in a distributed intelligent data backup and management system according to the outgoing transfer deadline and unmet recovery closure conditions; The outward transfer deadline is the transfer completion time before the local retention expiration time of the working condition data packet; the local retention expiration time is determined by the source industrial edge node for the corresponding working condition data packet when performing local storage management; The edge backup agent reserves a transfer guarantee period based on the local retention expiration time for completing communication authentication, data transmission, return of copy reception credentials, writing of backup records to be closed, and one retransmission processing. It generates an outward transfer deadline and associates the outward transfer deadline with the data packet identifier into the backup record to be closed. The outward transfer deadline remains unchanged during the transfer of the corresponding data version. Candidate receiving node reachability means that the edge backup agent completes communication authentication with the candidate receiving node and obtains the receiving node identifier, current available storage capacity, remaining connection hold duration and data write status returned by the candidate receiving node, and the data write status is allowed to write. When the outward transmission deadlines for multiple backup records to be closed are the same, the data packets for which a valid copy receiving certificate corresponding to a candidate receiving node has not yet been formed will be transferred before the data packets for which a valid copy receiving certificate corresponding to a partial data fragment has been formed but the phase recovery closure conditions have not yet been met; if the aforementioned conditions are still the same, the data packets for which the backup records to be closed were generated earlier will be transferred first. For a working condition data packet for which a valid replica reception credential has not yet been generated by a candidate receiving node, the edge backup agent sends the working condition data packet when the current available storage capacity is sufficient to store the data packet and the remaining connection retention time is sufficient to cover the sending of the working condition data packet, the return of the valid replica reception credential, and the update of the backup record to be closed; the edge backup agent sends the data fragment when the current available storage capacity is sufficient to store at least one data fragment and the remaining connection retention time is sufficient to cover the sending of the corresponding data fragment, the return of the valid replica reception credential, and the update of the backup record to be closed. For operational data packets that have formed valid copy reception credentials corresponding to some data fragments but have not yet met the phase recovery closure conditions, the edge backup agent sends data fragments that do not yet have corresponding valid copy reception credentials and are used to meet the phase recovery closure conditions. If the phase recovery closure condition is not met after the current connection ends, the edge backup agent will maintain the unclosed state of the corresponding backup record to be closed and exclude the corresponding working condition data packet from the release object set; A candidate transfer sequence refers to an ordered set of backup records that are yet to reach the stage closure state but are still in a closed state, arranged in the aforementioned transfer order. Each record item includes a data packet identifier, a data version identifier, an outward transfer deadline, a closure state, unmet stage recovery closure conditions, and a data identifier to be sent. Data packets that have reached the stage closure state but have not yet reached the remote closure state will enter remote transfer processing after being made accessible at the remote storage node.

[0067] When a valid copy reception credential is obtained during this connection process, the edge backup agent or backup coordination node updates the confirmed copy status. When the updated confirmed copy status meets the phase recovery closure condition, the closure status of the corresponding backup record to be closed is updated to the phase closure status. If the phase recovery closure condition is not met after the current connection ends, the corresponding backup record to be closed remains in an unclosed state, and the corresponding working condition data packet is excluded from the release object set.

[0068] In a preferred embodiment of Example 2, the candidate transition sequences are arranged in ascending order according to the following sorting tuples: , in, The data packet is identified as The sorted tuples formed by the working condition data packets facing the candidate receiving nodes; The meaning is consistent with the aforementioned definition; This represents the closure gap level value of the corresponding operating condition data packet in the candidate transfer sequence; This corresponds to the generation time of the backup record to be closed; The meaning is consistent with the aforementioned definition.

[0069] In the candidate transfer sequence, the closure gap level value corresponding to the backup record to be closed that has not yet formed any valid copy receiving credentials generated by the candidate receiving node is set to zero. The closure gap level value corresponding to the backup record to be closed that has formed valid copy receiving credentials for some data fragments but has not yet formed a set of data fragments that can be combined and recovered is set to one. Backup records to be closed that have reached the stage closure state do not enter the candidate transfer sequence.

[0070] After completing communication authentication and short data exchange to determine the payload transmission rate, the candidate receiving node returns the current available storage capacity and remaining connection hold duration to the edge backup agent.

[0071] The edge backup agent determines the amount of data that can be sent in the current connection window based on the currently available storage capacity, remaining connection hold time, current connection payload transmission rate, and the control processing period reserved for returning copy reception credentials and writing backup records to be closed. The method is as follows: , in, The receiver node is identified as The amount of payload data that candidate receiving nodes are allowed to send within the current connection window; The receiver node is identified as The current available storage capacity returned by the candidate receiving node after completing a short data exchange; This is the identifier of the receiving node corresponding to the candidate receiving node; The payload transmission rate measured by the candidate receiving node based on the current connection after completing communication authentication; The duration to retain the remaining connections returned by the candidate receiving node; Reserve a total control processing period in the current connection window for the return of the copy receiving certificate and the writing of the backup record to be closed for one or more working condition data packets or data fragments to be sent this time.

[0072] The payload transmission rate is determined by the payload data volume and transmission duration corresponding to the short data interaction that has been sent and received confirmation after communication authentication within the current connection window. The control processing period is calibrated using the configuration value corresponding to the candidate receiving node type, and adjacent industrial edge nodes, mobile gateways, and regional cache nodes register the corresponding configuration values ​​respectively. If no reception confirmation is obtained for the short data interaction, the current available storage capacity returned by the candidate receiving node is zero, or the remaining connection duration is less than or equal to the control processing period, the edge backup agent sets the data volume allowed to be sent in the current connection window to zero, records the detection result and communication authentication result of the candidate receiving node, maintains the current closed state of the corresponding working condition data packet, and excludes it from the set of objects to be released this time.

[0073] For the top-ranked operational data packet that has not yet generated a valid replica reception credential from a candidate receiving node, the edge backup agent sends the operational data packet if the current connection window allows the amount of data that can be sent to accommodate it; if the current connection window does not allow the amount of data that can be sent to accommodate the operational data packet, but can accommodate at least one data fragment to be sent, the edge backup agent performs the transfer using data fragmentation. For the top-ranked operational data packet that has generated partial replicas of data fragments with valid replica reception credentials but has not yet met the phase recovery closure conditions, the edge backup agent sends the data fragments that have not yet obtained valid replica reception credentials according to the selected fragmentation rules.

[0074] The amount of data that can be sent within the current connection window is only applicable to the connection window corresponding to this communication authentication. If a candidate receiving node updates its available storage capacity, prematurely terminates the remaining connection hold time, or experiences a connection interruption during the transmission process, the edge backup agent terminates the subsequent transmission of the current connection window, writes the data for which a valid copy of the receiving credential has been obtained into the pending backup record, and recalculates the amount of data that can be sent within the current connection window after the next candidate receiving node completes communication authentication. The recalculation process does not change the fragmentation rules already written into the pending backup record.

[0075] After switching to data fragment transmission, the edge backup agent selects data fragments from the fragment transfer list corresponding to the top-ranked scenario data packets. These fragments must not yet have corresponding valid replica reception credentials, have data version identifiers consistent with the backup record to be closed, and have unique fragment identifiers. If the current connection window can accommodate the missing data fragments needed to achieve the stage recovery closure condition, the agent prioritizes sending data fragments that enable the scenario data packet to form a composable recoverable data fragment set record. If the current connection window is insufficient to fill the missing data fragments, the agent sends data fragments that can complete the transmission and credential return within the current connection window, while maintaining the unclosed state of the scenario data packet. If the current connection window cannot accommodate any data fragment to be sent, the edge backup agent waits for the next candidate receiving node reachability event or the remote storage node recovery reachability event.

[0076] During data fragment transmission, the edge backup agent writes the data fragment identifier, receiving node identifier, credential generation time, and integrity verification result that have obtained valid copy reception credentials into the backup record to be closed, and determines the data fragments that still do not have corresponding valid copy reception credentials based on the fragment transfer list; data fragments that have been sent but have not yet obtained valid copy reception credentials are not written into the confirmed copy status. When the phase recovery closure conditions are met within the current connection window, the corresponding closure status is updated to the phase closure status; if the corresponding working condition data packet cannot be recovered after the current connection window ends, the unclosed state is maintained, the data fragments that have not obtained valid copy reception credentials are retained in the next transmission range, and the corresponding working condition data packet is excluded from the release object set.

[0077] When the remote storage node becomes accessible, the backup coordinating node reads backup records whose closure status is in a stage closure state but have not yet obtained a valid copy reception certificate generated by the remote storage node, and forms a remote transfer sequence. For a working data packet that has reached a stage closure state based on the working data packet copy, the copy retention expiration time corresponding to that working data packet copy is used as the sorting basis; for a working data packet that has reached a stage closure state based on a set of recoverable data fragments, the earliest copy retention expiration time corresponding to the data fragment participating in this remote transfer is used as the sorting basis. The remote transfer sequence is arranged in the order of earlier copy retention expiration time, earlier outward transfer deadline, and earlier generation time of the backup record to be closed. The backup coordinating node sends a remote transfer instruction to the candidate receiving node that stores the data that enables the working data packet to be recovered; after the remote storage node generates a valid copy reception certificate, it updates the corresponding closure status to the remote closure state. If the read connection is interrupted or the read verification fails, the backup coordinating node selects a read position that still has a valid copy reception certificate to continue the remote transfer; if there is no read position that can recover the working data packet, the closure status is updated according to the stage closure status verification result. The remote storage node generates a replica reception credential. The backup coordinating node determines a valid replica reception credential as one that matches the data packet identifier and data version identifier with the corresponding backup record to be closed and whose integrity verification result is passed.

[0078] In one specific implementation scenario, the local storage usage of the source industrial edge node reaches its local storage capacity threshold, and the remote storage node is unreachable. The mobile gateway completes communication authentication and briefly connects to the source industrial edge node. The available storage capacity returned by the mobile gateway is sufficient to store the operational data packets or data fragments to be sent, and the current connection window allows a data transmission volume of 32 megabytes.

[0079] The source industrial edge node stores the first, second, and third operating condition data packets. The first operating condition data packet has not yet formed a valid copy of the receiving certificate generated by the candidate receiving node; its outward transmission deadline is 14:06, and the data size of the operating condition data packet is 24 megabytes. The outward transmission deadline for the second operating condition data packet is 14:07. Its backup record to be closed has been associated with the selected fragmentation rules, and three data fragments with valid copy receiving certificates have been formed on the regional cache node. It is missing one 8-megabyte data fragment to reach the predetermined recovery quantity and enter the combined verification process. The backup record to be closed corresponding to the third operating condition data packet has reached the stage closure state, but has not yet reached the remote closure state.

[0080] Since the remote storage node is currently unreachable, the third-condition data packet is reserved as a transferable object after remote recovery and does not occupy the current short-term connection window of the mobile gateway. The outward transmission deadline of the first-condition data packet is earlier than that of the second-condition data packet, and a valid copy reception certificate generated by the candidate receiving node has not yet been formed. Since the current connection window allows the amount of data to be sent to accommodate the data volume of the first-condition data packet, the edge backup agent first sends the first-condition data packet to the mobile gateway as a condition data packet, occupying 24 megabytes of transmission capacity. After the mobile gateway performs integrity verification on the condition data packet and returns a valid copy reception certificate corresponding to the condition data packet copy, the edge backup agent or backup coordination node updates the closure status of the backup record to be closed corresponding to the first-condition data packet to a staged closure status.

[0081] The current connection window has 8 megabytes of remaining transmission capacity, which can accommodate one missing data fragment from the second scenario data packet. The edge backup agent continues to send this data fragment according to the selected fragment rules corresponding to the second scenario data packet. After the mobile gateway returns the corresponding valid replica reception credential, the backup coordination node combines and verifies this replica reception credential with the three valid replica reception credentials previously formed by the regional cache node. If the data version identifiers of the four data fragments are consistent, the encoding rule identifiers are consistent, the digest algorithm identifiers are consistent, the fragment identifiers are not duplicated, the integrity verification results are all passed, and the integrity digest of the scenario data packet obtained by combining and reconstructing is consistent with the integrity digest of the scenario data packet associated with the corresponding backup record to be closed, the closure status of the backup record to be closed corresponding to the second scenario data packet is updated to a staged closure status.

[0082] If the mobile gateway prematurely terminates the remaining connection hold time or experiences a connection interruption after the first condition data packet is sent, the backup record to be closed corresponding to the second condition data packet remains unclosed. The edge backup agent records its missing data fragment as the object to be sent in the next connection window and excludes the second condition data packet from the set of objects to be released. The first condition data packet only enters the local release processing scope if the replica retention expiration time promised by the mobile gateway is not earlier than the outward transmission deadline of the first condition data packet, and if the corresponding replica retention expiration time has not expired and the phase closure state is still valid before the local data deletion of the first condition data packet is executed. After the third condition data packet is made reachable from the remote storage node, the backup coordinating node sends a remote transfer instruction, and updates the remote closure state after the remote storage node generates a valid replica reception certificate.

[0083] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

[0084] Furthermore, those skilled in the art will understand that although some embodiments herein include certain features included in other embodiments but not others, combinations of features from different embodiments are meant to be within the scope of this application and form different embodiments. For example, all the embodiments above can be used in any combination. The information disclosed in this background section is intended only to enhance the understanding of the general background of this application and should not be construed as an admission or in any way implying that such information constitutes prior art known to those skilled in the art.

Claims

1. A distributed intelligent data backup management system, characterized in that, This includes source industrial edge nodes, candidate receiving nodes, remote storage nodes, edge backup agents deployed on the source industrial edge nodes, and backup coordination nodes; The edge backup agent encapsulates industrial field data into operational data packets carrying data packet identifiers and data version identifiers, and generates backup records to be closed that are associated with the external transmission deadline, confirmed copy status, and closure status. The closure status includes unclosed status, staged closure status, and remote closure status. When the remote storage node is unreachable and the candidate receiving node is reachable, the edge backup agent sends the working condition data packet or its data fragment corresponding to the backup record to be closed that is in an unclosed state to the candidate receiving node according to the outward transmission deadline and the confirmed copy status. The candidate receiving node performs integrity verification and generates a replica receiving certificate. The edge backup agent or the backup coordination node determines the replica receiving certificate that matches the data packet identifier and data version identifier with the corresponding backup record to be closed and whose integrity verification result is passed as a valid replica receiving certificate. Based on the valid replica receiving certificate, the closure state is updated to a stage closure state when the corresponding working condition data packet can be recovered. Before the candidate receiving node updates the closing status of the corresponding backup record to the remote closing status, it saves the working condition data packet or data fragment that enables the working condition data packet to be recovered. The edge backup agent can still recover the working condition data packets corresponding to the closed state of the review stage before local data release processing, and excludes the working condition data packets that have not reached the closed state of the stage or whose review result is that they cannot be recovered from the release object set. When the remote storage node becomes reachable again, the backup coordination node transfers the working condition data packet or data fragment corresponding to the phase closure state to the remote storage node. The remote storage node generates a replica reception credential. After the backup coordination node determines the replica reception credential as a valid replica reception credential, it updates the closure state to the remote closure state.

2. The distributed intelligent data backup management system according to claim 1, characterized in that, The industrial field data includes at least one of equipment operation data, control configuration data, event log data, and business process data; The candidate receiving node includes at least one of adjacent industrial edge nodes, mobile gateways, and regional cache nodes; The remote storage node includes at least one of a regional central storage node and a cloud storage node; The operating condition data packet also carries a data source identifier, an operating condition stage identifier, and an operating condition data packet integrity summary.

3. The distributed intelligent data backup management system according to claim 2, characterized in that, The operating condition data packet includes an in-packet data index, which records the data object identifier, data object version, and data object summary. The edge backup agent categorizes data objects with recovery relationships into the same operating condition data package according to at least one of the following: device identifier, production batch identifier, alarm event identifier, and control parameter change identifier. The operating condition data package that passes the data index integrity verification within the package is identified as the transfer object.

4. The distributed intelligent data backup management system according to claim 2, characterized in that, When the candidate receiving node saves the operating condition data packet and the corresponding valid copy receiving certificate is associated with the backup record to be closed, it is determined that the operating condition data packet can be recovered; When the candidate receiving node saves data fragments carrying encoding rule identifiers, the backup coordination node will form a data fragment set by combining data fragments corresponding to the same data packet identifier, the same data version identifier, and the same encoding rule identifier. When the integrity digest of the working condition data packet reconstructed from the data fragment set is consistent with the integrity digest of the working condition data packet carried by the working condition data packet, the data fragment set will be determined as a data fragment set that can be combined and recovered, and the working condition data packet will be determined to be recoverable.

5. The distributed intelligent data backup management system according to claim 1, characterized in that, The outward transmission deadline is the transfer completion time, which is earlier than the local retention expiration time of the working condition data packet. The edge backup agent generates the outward transfer deadline based on the local retention expiration time and the transfer guarantee period. The transfer guarantee period covers communication authentication, data transmission, return of copy reception credentials, writing of backup records to be closed, and one retransmission process. The term "candidate receiving node reachable" means that the edge backup agent obtains the receiving node identifier, current available storage capacity, remaining connection hold duration, and allowed data write status returned by the candidate receiving node.

6. The distributed intelligent data backup management system according to claim 5, characterized in that, The edge backup agent determines the transfer order according to the earlier transfer deadline. When the outward transmission deadlines for multiple backup records to be closed are the same, the data packets of the working condition that have not yet formed a valid copy reception certificate generated by the candidate receiving node will be transferred before the data packets of the working condition that have formed a valid copy reception certificate corresponding to a partial data fragment but have not yet reached the stage closure state. When the current available storage capacity and the remaining connection hold duration meet the requirements for sending the working condition data packet and returning the copy reception certificate, the working condition data packet is sent. The data fragment is sent when the current available storage capacity and the remaining connection hold duration satisfy at least one data fragment transmission and copy reception credential return.

7. The distributed intelligent data backup management system according to claim 4, characterized in that, The copy receiving certificate includes a copy receiving certificate identifier, a data packet identifier, a data version identifier, a receiving node identifier, a copy type, an integrity verification result, a certificate generation time, and a copy retention expiration time. The replica types include working condition data packet replicas and data fragment replicas. The replica receiving credentials corresponding to the data fragment replicas also include fragment identifiers and encoding rule identifiers. The edge backup agent generates a fragment transfer list for the data fragments to be sent, and selects data fragments without corresponding valid copy receiving credentials from the fragment transfer list for transmission after data transmission is interrupted.

8. The distributed intelligent data backup management system according to claim 7, characterized in that, When the remote storage node becomes reachable again, the backup coordination node determines, based on the valid copy reception certificate, a candidate receiving node that stores the working condition data packet or data fragment that enables the working condition data packet to be recovered, and sends a remote transfer instruction to the determined candidate receiving node. After the remote storage node completes the reception and integrity verification, it generates a copy reception certificate. The backup coordination node determines the copy reception certificate that matches the data packet identifier and data version identifier with the corresponding backup record to be closed and passes the integrity verification as a valid copy reception certificate.

9. The distributed intelligent data backup management system according to claim 7, characterized in that, The edge backup agent generates a set of release objects when the local storage usage reaches the local storage capacity threshold. For a backup record to be closed that is in a phase closure state but has not reached a remote closure state, before the edge backup agent performs local data release, it verifies that the backup record or data fragment that the backup record can recover is still readable, and that the copy retention expiration time recorded in the corresponding valid copy receiving certificate is later than the release execution time. If the review fails, the corresponding working condition data packet will be removed from the set of released objects.

10. The distributed intelligent data backup management system according to claim 1, characterized in that, It also includes a backup metadata storage unit, which stores closure status change records. The closure status change records include a data packet identifier, a data version identifier, a closure status before the change, a closure status after the change, a copy receiving credential identifier corresponding to a valid copy receiving credential, and an execution node identifier. After the backup coordination node resumes communication with the source industrial edge node, it matches the backup record summary to be closed with the valid copy receipt certificate. If a valid copy receipt certificate exists but the corresponding confirmed copy status is not recorded, it issues a status completion instruction. If a copy is recorded but the corresponding valid copy receipt certificate is missing, it issues a copy verification instruction. If the verification fails, it issues a retransmission instruction. The backup coordination node generates a recovery read list based on the valid copy receipt certificate.

Images