Unified access and collaborative management method and system for heterogeneous work equipment of multiple security domains

Abstract

The application provides a multi-security-domain heterogeneous operation equipment unified access and collaborative management method and system, which establishes a "model layer + instance layer" hierarchical parameter system, establishes a model-level parameter template for different equipment models, saves equipment instance registration information in the instance layer, and automatically obtains the corresponding model-level parameter template to generate the access configuration of the equipment instance during equipment instance registration, so that the same model equipment can reuse the unified model-level parameter template, and the instance access configuration is generated by combining the same model equipment with the instance parameter. The same model configuration can be reused, the differences between instances are retained, repeated configuration and repeated adaptation for a single equipment are reduced, and the maintenance workload when the equipment model protocol or parameter changes is reduced.

Description

Technical Field

[0001] This invention relates to the field of intelligent traffic management technology, specifically to a method and system for unified access and collaborative management of heterogeneous operating equipment across multiple safety domains. Background Technology

[0002] With the continuous advancement of traffic management informatization, four major platforms—the Comprehensive Traffic Management Application Platform, the National Internet Traffic Safety Comprehensive Service Management Platform, the Integrated Traffic Management Command Platform, and the National Traffic Management Big Data Analysis and Judgment Platform—have been gradually established, forming a comprehensive traffic management business system. This system provides crucial support for traffic management business collaboration, data sharing, and intelligent control, driving traffic management towards digitalization, intelligence, and standardization. Building upon this foundation, management equipment and supporting business systems for scenarios such as traffic management, accident investigation, and examination site supervision are continuously being developed and applied. Traffic management departments and their partners have successively deployed various external equipment-related business systems, such as non-motorized vehicle violation analysis systems and drone duty management platforms, playing a positive role in improving management efficiency, expanding regulatory methods, and assisting police decision-making.

[0003] As traffic management business scenarios continue to expand, the number of business systems continues to increase, and the types of equipment used become increasingly diverse, the existing decentralized construction model is gradually revealing many problems, as follows: 1. Repetitive adaptation for heterogeneous device access; typical operational equipment includes hardware devices and supporting software systems. For example, a capture camera is a hardware device, and it is equipped with external equipment related business systems such as violation analysis systems. Different manufacturers and models of operational equipment differ in communication protocols, data formats, and proprietary parameters. The current design approach is usually to develop access logic separately for each specific device instance. There is a lot of repetitive configuration for the same model of device, and when the model protocol or parameters change, adjustments need to be made for each device, resulting in high access and maintenance costs.

[0004] 2. The interfaces of the traffic management department's business systems are directly coupled with the calling systems; third-party external equipment-related business systems are usually developed directly according to the addresses, parameters and data formats of the internal interfaces of the management department's business platform. When the internal interface addresses, parameter names or data structures of the management department's business platform change, multiple external equipment-related business systems need to be modified and re-integrated, resulting in low interface reusability.

[0005] 3. Lack of dynamic selection of multi-security domain call links; External equipment related business systems, as third-party call platforms, and traffic management department business systems may be deployed on the traffic management department's intranet, video private network, and social private network, respectively. Traditional solutions usually pre-configure fixed call links for specific systems, making it difficult to dynamically select intra-domain direct connection or cross-domain exchange mode according to the source security domain and target security domain of the actual interface call, resulting in greater difficulty in later maintenance. Summary of the Invention

[0006] To address the problems of high access costs and difficult system maintenance when integrating existing traffic management equipment into traffic management systems—namely, repetitive adaptation of heterogeneous devices, direct coupling between the interfaces of traffic management departments' business systems and the calling systems, and the lack of dynamic selection in multi-security-domain call links—this invention provides a unified access and collaborative management method for heterogeneous operational equipment across multiple security domains. This method enables standardized access for heterogeneous traffic management operational equipment, reuse of traffic management business interfaces, and dynamic collaborative calling in a multi-security-domain environment, effectively reducing access costs and post-maintenance difficulties. Simultaneously, this application also discloses a unified access and collaborative management system for heterogeneous operational equipment across multiple security domains.

[0007] The technical solution of this invention is as follows: a method for unified access and collaborative management of heterogeneous operating equipment across multiple security domains, characterized by comprising the following steps: S1: Construct a unified access and collaborative management system for multi-safety domain operating equipment, denoted as: management system, and set up the management system between the external third-party calling platform and the traffic management business system; The control system receives login requests submitted by users, performs user authentication, and verifies access permissions based on user identity information and permission information. S2: Construct a hierarchical parameter system to manage the access of operational equipment; The operational equipment includes: operational equipment and its associated external equipment business system; wherein, the operational equipment is a hardware device for performing data acquisition or on-site operations, and the associated external equipment business system is a software business system that is compatible with the operational equipment and is used to receive or process data from the operational equipment. The hierarchical parameter system includes: model-level parameter templates and equipment instance registration information; The equipment provider, equipment model, equipment instance, and associated external equipment business system are registered. The model-level parameter template is established for different equipment models. The model-level parameter template is called according to the equipment model corresponding to the equipment instance. The equipment instance access configuration is generated by combining the instance-level parameters corresponding to the equipment instance registration information. The working equipment can access the management system through its associated external equipment business system according to the equipment instance access configuration. S3: Execute interface collaborative management. The control system registers the external third-party calling platform, the external service interface of the control system, and the internal target interface of the traffic management business system. It establishes the authorization relationship between the external third-party calling platform and the external service interface of the control system, as well as the interface mapping relationship and parameter mapping rules between the external service interface of the control system and the internal target interface of the traffic management business system. The management and control system receives the interface call request initiated by the external third-party calling platform for the external service interface, and completes identity verification, access verification, internal target interface determination and request parameter conversion according to the authorization relationship, the interface mapping relationship and the parameter mapping rules; S4: After determining the internal target interface corresponding to the external third-party calling platform, confirm the network security domain to which the external third-party calling platform belongs, and confirm the network security domain to which the traffic management business system corresponding to the internal target interface belongs; compare the two network security domains, and determine the type of this interface call link; When both belong to the same network security domain, the interface call is completed within the current network security domain; When the two belong to different network security domains, a cross-domain data transmission task is generated and cross-domain data exchange is performed.

[0008] Its further features are: Step S2, the equipment access management operation includes the following steps: B1: Register the equipment provider and equipment model, establish the association between the equipment provider and equipment model, and create a corresponding model-level parameter template for each equipment model; The model-level parameter template includes: communication protocol, data format, common parameters, and unique parameters; wherein, the common parameters are used to describe equipment attributes common to the same type of work equipment, and the unique parameters are used to describe special attributes that distinguish the corresponding equipment model from other equipment models; B2: Receive equipment instance registration information for the operating equipment. The equipment instance registration information includes at least: equipment serial number, equipment model identifier, user unit, deployment address, network address, and network security domain. Obtain the corresponding model-level parameter template based on the device model identifier, and combine the model-level parameter template with the device instance registration information to generate a device access configuration for the device instance, while assigning a unique device identifier to the device instance; B3: Register the external equipment business systems associated with the operating equipment, assign system identifiers to the external equipment business systems, and establish the association between the external equipment business systems, equipment instances, equipment models, equipment providers, and their respective network security domains; the association is used to determine the identity information, network address, and network security domain of the external equipment business systems associated with the operating equipment during subsequent interface calls. B4: The operating equipment connects to the management and control system through its associated external equipment business system according to the equipment access configuration, and uploads equipment identification, equipment status data or business data; the management and control system receives activation information and operation information sent by the operating equipment or its associated external equipment business system, and updates the equipment operation status according to the activation information and operation information; Step S3, the interface collaborative management operation includes the following steps: C1: The unified business call interface provided by the management and control system to the external third-party call platform is referred to as the external service interface; The interface provided by the traffic management business system to the control system for calling data or services is denoted as: internal target interface; Register the external third-party calling platform, the external service interface, and the internal target interface, and assign a unique identifier to each of them; C2: Receives access permission requests submitted by external third-party calling platforms for the external service interface, and establishes an authorization relationship between the external third-party calling platform and the external service interface after approval, so that the external third-party calling platform can only access the corresponding traffic management business services through the authorized external service interface; C3: Configure internal target interface configuration information, which includes: call address, request method, request parameters, response parameters, and access rules; establish the interface mapping relationship between the external service interface and the internal target interface, and configure the parameter-level mapping relationship between the external service interface and the internal target interface, which includes: request parameter mapping rules and response parameter mapping rules; The request parameter mapping rule is used to convert the external request parameters submitted by the external calling platform according to the external service interface into the internal request parameters required by the internal target interface; the response parameter mapping rule is used to convert the internal response parameters returned by the internal target interface into the external response parameters corresponding to the external service interface. C4: Receives the interface call request initiated by the external third-party calling platform for the external service interface; verifies the interface call request based on the external third-party calling platform's registration information; performs access verification based on the authorization relationship; after successful verification, determines the corresponding internal target interface based on the interface mapping relationship; converts the request parameters of the external service interface into the request parameters corresponding to the internal target interface according to the request parameter mapping rules; after obtaining the response data returned by the internal target interface, converts the response parameters of the internal target interface into the response parameters corresponding to the external service interface according to the response parameter mapping rules, and returns them to the external third-party calling platform. Step S3 also includes the following steps: C5: When the call address, request parameters, response parameters or access rules of the target interface inside the traffic management business system change, the corresponding internal target interface configuration or parameter mapping rules are updated so that the external third-party calling platform can continue to call the interface according to the original external service interface and its calling method. Step S4 specifically includes the following steps: D1: Obtain the source network security domain identifier of the external third-party calling platform based on the external third-party calling platform filing information, determine the internal target interface corresponding to the external third-party calling platform based on the interface mapping relationship, find the traffic management business system registration information corresponding to the internal target interface, and obtain the target network security domain identifier. Compare the source network security domain identifier with the target network security domain identifier; When the two are consistent, the intra-domain interface call link is selected, and the interface request data after parameter conversion is sent to the internal target interface within the current network security domain to realize data transmission. When the two are inconsistent, select the cross-domain interface call chain, generate a cross-domain data transmission task, assign a transmission task identifier to the cross-domain data transmission task, and establish an association between the cross-domain data transmission task and the current interface call record; execute step D2. D2: Perform format, size, and integrity checks on the interface data to be transmitted across domains. Encapsulate the interface data that passes the checks with the transmission task identifier, the source network security domain identifier, the target network security domain identifier, the data type, and the data generation time, and encrypt it according to the preset encryption rules to form a cross-domain transmission data packet and the corresponding integrity check information. D3: Transmit the cross-domain data packet from the switching location corresponding to the source network security domain to the switching location corresponding to the target network security domain through a secure isolation switching device; D4: The target network security domain determines the corresponding cross-domain data transmission task based on the transmission task identifier, performs integrity verification, decryption, and parsing on the received cross-domain transmission data packet; when the parsed data is interface request data, it determines the corresponding internal target interface in the target network security domain based on the interface call record associated with the cross-domain data transmission task, and sends the interface request data to the internal target interface.

[0009] A unified access and collaborative management system for heterogeneous operating equipment with multiple security domains, characterized in that it includes: an identity authentication and access control module, an equipment management module, an interface collaborative management module, and a cross-domain data exchange module; The identity authentication and access control module is used to authenticate the user's identity and verify the access request based on the user's identity information and permission information. The equipment management module is used to uniformly register the operating equipment and its associated external equipment business systems, and to establish the association between equipment providers, equipment models, equipment instances and associated external equipment business systems. For different equipment models, model-level access parameters are maintained. These model-level access parameters include: communication protocol, data format, common parameters, and unique parameters. The model-level access parameters are called according to the equipment model corresponding to the equipment instance. Combined with the instance-level parameters corresponding to the equipment instance, the equipment access configuration for that equipment instance is generated. This enables the working equipment to access this system through its associated external equipment business system according to the equipment access configuration, and to maintain the operating status of the working equipment. The interface collaboration management module is used to register external third-party calling platforms, external service interfaces provided by this system to external third-party calling platforms, and internal target interfaces provided by the traffic management business system to this system; establish authorization relationships between external third-party calling platforms and external service interfaces, as well as interface mapping relationships and parameter mapping rules between external service interfaces and internal target interfaces; upon receiving an interface call request initiated by an external third-party calling platform for an external service interface, it performs access verification according to the authorization relationship, determines the corresponding internal target interface according to the interface mapping relationship, and completes request parameter conversion and response parameter conversion between external service interfaces and internal target interfaces according to the parameter mapping rules. The cross-domain data exchange module is used to determine the interface call link based on the network security domain of the external third-party calling platform and the network security domain of the traffic management business system corresponding to the internal target interface after the interface collaboration management module determines the internal target interface; when the two belong to the same network security domain, the intra-domain interface call link is used; when the two belong to different network security domains, a cross-domain data transmission task is generated and cross-domain data exchange is performed.

[0010] Its further features are: The equipment management module includes: a provider registration unit, an equipment model maintenance unit, an equipment instance registration unit, a system information registration unit, and an equipment status management unit; The provider registration unit is used to register the provider information of the operating equipment or associated external equipment business system, and to assign a provider identifier to each provider; the provider information includes the provider name, provider type and the operating equipment or external equipment business system information provided. The equipment model maintenance unit is used to register the equipment type, model name, manufacturer, and corresponding model-level access parameters of the operating equipment, and to assign equipment model identifiers to different equipment models, establishing an association between equipment models and equipment providers. The model-level access parameters form a model-level parameter template for the corresponding equipment model. The model-level parameter template includes at least a communication protocol, data format, common parameters, and unique parameters. The common parameters are used to describe equipment attributes shared by similar types of operating equipment, and the unique parameters are used to describe the special attributes that distinguish the corresponding equipment model from other equipment models. The device instance registration unit is used to receive device instance registration information for specific operating devices. The device instance registration information includes at least the device serial number, device model identifier, user unit, deployment address, network address, and network security domain. The device instance registration unit obtains the corresponding model-level parameter template based on the device model identifier in the device instance registration information, combines the model-level parameter template with the instance-level parameters in the device instance registration information to form a device access configuration for the device instance, assigns a unique device identifier to the device instance, and establishes the association between the device instance, device model, and device provider. The system information registration unit is used to register the basic information of external equipment business systems associated with the operating equipment, and to assign a unique system identifier to each business system. The basic information of the business system includes the system name, user unit, provider, server network address, operating status, network security domain, and associated device identifier. The system information registration unit is also used to establish the association between business systems, providers, equipment instances, and network security domains. The equipment status management unit is used to receive equipment activation information and periodic operation information sent by the operating equipment or its associated external equipment business system, and dynamically update the operation status of the operating equipment according to the equipment identifier, heartbeat reception time, equipment operation parameters and data upload status. The operation status includes at least one of the following: activated, online, offline, abnormal and deactivated. The interface collaboration management module includes: an interface filing unit, an external calling platform filing unit, an interface authorization application unit, an internal target interface configuration unit, and an interface calling unit; The interface registration unit is used to register the basic information of the external service interfaces provided by this system to external third-party calling platforms and the internal target interfaces provided by the traffic management business system to this system, and to assign a unique interface identifier to each interface; the basic interface information includes: interface name, interface type, interface address and operation type; The external calling platform registration unit is used to register the basic information of external calling platforms that access this system and to assign a unique platform identifier to each external third-party calling platform; the basic information of the external calling platform includes at least the platform name, network address, network security domain to which it belongs, and information used for authentication. The interface authorization application unit is used to receive access permission applications submitted by external third-party calling platforms for external service interfaces, record the applying platform, the applying interface, the scope of permission, and the review status, and review the access permission application; if the review is successful, an authorization relationship is established between the external third-party calling platform and the external service interface, enabling the external third-party calling platform to obtain access permission to the corresponding external service interface; if the review fails, the access permission application is rejected and the review result is recorded. The internal target interface configuration unit is used to maintain the calling address, request method, request parameters, response parameters, and access rules of the internal target interfaces of the traffic management business system, and to establish the interface mapping relationship between the external service interfaces of this system and the internal target interfaces of the traffic management business system. The interface mapping relationship includes: interface-level mapping relationship and parameter-level mapping relationship. The interface-level mapping relationship is used to determine the corresponding internal target interface according to the external service interface. The parameter-level mapping relationship includes request parameter mapping rules and response parameter mapping rules. The request parameter mapping rules are used to convert the external request parameters submitted by the external third-party calling platform according to the external service interface into the internal request parameters corresponding to the internal target interface. The response parameter mapping rules are used to convert the internal response parameters returned by the internal target interface into the external response parameters corresponding to the external service interface. The interface invocation unit is used to receive interface invocation requests initiated by an external third-party invocation platform for external service interfaces, perform identity verification and access verification based on the platform's filing information and interface authorization relationship; after verification, determine the corresponding internal target interface according to the interface-level mapping relationship, convert the external request parameters corresponding to the external service interface into the internal request parameters corresponding to the internal target interface according to the request parameter mapping rules; after obtaining the response data returned by the internal target interface, convert the internal response parameters into the external response parameters corresponding to the external service interface according to the response parameter mapping rules, and return them to the external third-party invocation platform; The cross-domain data exchange module includes: a security domain determination unit, a transmission task generation unit, a data preprocessing unit, a data encryption unit, a data sending unit, a data receiving unit, and a data processing unit; The security domain determination unit is used to obtain the source network security domain identifier of the external third-party calling platform based on the external calling platform filing information, obtain the registration information of the corresponding traffic management business system based on the internal target interface determined by the interface collaboration management module, obtain the target network security domain identifier based on the traffic management business system registration information, and compare the source network security domain identifier with the target network security domain identifier. When the source network security domain identifier is consistent with the target network security domain identifier, the security domain determination unit determines to use an intra-domain interface call link and sends the interface request data after parameter conversion to the corresponding internal target interface within the current network security domain; when the source network security domain identifier is inconsistent with the target network security domain identifier, the security domain determination unit determines to use a cross-domain interface call link. The transmission task generation unit is used to generate a cross-domain data transmission task when using a cross-domain interface call link, assign a unique transmission task identifier to the cross-domain data transmission task, and establish an association between the cross-domain data transmission task and the corresponding interface call record. The data preprocessing unit is used to classify the interface data to be transmitted across domains according to the data type, verify the data format, data size and integrity of the interface data to be transmitted, and encapsulate the verified interface data with the transmission task identifier, source network security domain identifier, target network security domain identifier, data type and data generation time to form a data packet to be encrypted and transmitted. The data encryption unit is used to encrypt the data packet to be encrypted according to a preset encryption rule, and generate verification information for verifying the integrity of cross-domain transmitted data, thus forming a cross-domain transmitted data packet. The data sending unit is used to write the cross-domain transmission data packet into the switching location corresponding to the source network security domain, and transmit the cross-domain transmission data packet to the switching location corresponding to the target network security domain through a secure isolation switching device; The data receiving unit is used to read the cross-domain transmission data packet from the exchange location corresponding to the target network security domain, and determine the corresponding cross-domain data transmission task and the interface call record associated with the cross-domain data transmission task according to the transmission task identifier; The data processing unit is used to perform integrity verification, decryption, and parsing of the received cross-domain transmission data packets in the target network security domain, and to perform corresponding processing according to the data type obtained from the parsing. When the parsed data is interface request data, the corresponding internal target interface is determined according to the interface call record associated with the cross-domain data transmission task, and the parsed interface request data is sent to the internal target interface. When the parsed data is interface response data, the corresponding external third-party calling platform is determined according to the interface call record associated with the cross-domain data transmission task, and the interface response data is returned to the external third-party calling platform; When the parsed data is business data that needs to be saved, it is classified and stored according to the data type of the business data. When the interface response data returned by the internal target interface needs to be returned from the network security domain where the traffic management business system is located to another network security domain where the external third-party calling platform is located, the network security domain where the traffic management business system is located is taken as the new source network security domain, the network security domain where the external third-party calling platform is located is taken as the new target network security domain, and the interface call link is redefined for the interface response data; when cross-domain transmission is required, a corresponding reverse cross-domain data transmission task is generated and cross-domain data exchange is performed.

[0011] This application provides a unified access and collaborative management method and system for heterogeneous operating equipment across multiple security domains. It establishes a layered parameter system of "model layer + instance layer." Model-level parameter templates are created for different equipment models, while the instance layer stores equipment instance registration information. During equipment instance registration, the corresponding model-level parameter template is automatically retrieved based on the equipment model to generate the access configuration for the equipment instance. This allows equipment of the same model to reuse a unified model-level parameter template, which is then combined with instance parameters to generate the instance access configuration. Equipment of the same model can reuse model configurations while preserving instance differences, reducing repetitive configuration and adaptation for individual devices and lowering maintenance workload when equipment model protocols or parameters change. This method decouples external calling permissions from internal interface adaptation. A two-layer interface model consisting of external service interfaces and internal target interfaces is established in the management system. An access authorization relationship is established between the external third-party calling platform and the external service interface to limit the external service capabilities that the external third-party calling platform can access. Interface-level and parameter-level mapping relationships are established between the external service interface and the internal target interface of the traffic management business system to determine the actual internal target interface and complete the conversion of request and response parameters. External third-party calling platforms only gain access to external service interfaces, not directly to internal target interfaces, and have no need to know the calling addresses and internal parameter definitions of internal target interfaces. When the internal target interfaces of the traffic management business system change, the calling method of the external service interfaces can be maintained by adjusting the configuration of the internal target interfaces or the corresponding mapping relationships. Because external third-party calling platforms and traffic management department business platforms may be deployed on the traffic management department's intranet, video private network, and social private network, this method does not configure a fixed call link between the external third-party calling platform and the traffic management department's business platform. Instead, it first obtains the external service interface corresponding to the external service interface in the control system from the external third-party calling platform's access permission request. Then, through the interface mapping relationship, it finds the internal target interface from the external service interface, and then finds the corresponding traffic management business system registration through the internal target interface. Finally, it obtains the target network security domain corresponding to the traffic management business system registration. The call link in this method is dynamically determined. Each call link is driven by the "actual interface mapping result" rather than statically bound. Even if the security domain of either party changes, the link mode can be accurately adapted, dynamically determining the intra-domain interface call link or the cross-domain interface call link. In the case of cross-domain, it generates a cross-domain data transmission task associated with the current interface call record. Based on this solution, the cost of accessing traffic management operation equipment to the traffic management business system and the difficulty of subsequent maintenance can be reduced. Attached Figure Description

[0012] Figure 1 This is a schematic diagram illustrating a heterogeneous equipment application scenario for multiple network security domains.

[0013] Figure 2 This is a schematic diagram of the overall system architecture.

[0014] Figure 3 This is a flowchart for the instantiation and access of heterogeneous equipment based on model-level parameter templates.

[0015] Figure 4 This is a flowchart of interface authorization, mapping, and invocation based on a two-layer interface model.

[0016] Figure 5 This is a flowchart illustrating the process of determining the interface call chain and cross-domain data exchange based on security domain identifiers. Detailed Implementation

[0017] The operational equipment in this application includes: operational equipment and associated external equipment business systems. Each type of traffic management operational equipment will have a corresponding associated external equipment business system. For example, when the operational equipment is a non-motorized vehicle capture device, the associated external equipment business system corresponding to the non-motorized vehicle capture device is the "Non-motorized Vehicle Violation Analysis System of a Certain City". When the traffic management business platform is built on a provincial basis, all prefecture-level cities under that province need to connect their non-motorized vehicle capture devices and their associated non-motorized vehicle violation analysis systems to the provincial traffic management business platform. A specific application scenario is as follows: when a non-motorized vehicle capture device collects video frames, it first sends the video frames to the corresponding non-motorized vehicle violation analysis system for data analysis. The non-motorized vehicle violation analysis system parses the video frames to obtain the license plate number of the non-motorized vehicle. When it needs to retrieve the corresponding vehicle owner, it needs to retrieve relevant vehicle registration data from the integrated application platform of the traffic management business system. At this time, it needs to send a data request to the traffic management business system. In actual operation, massive amounts of data requests are sent to the traffic management business system in real time every day.

[0018] The external third-party calling platform mentioned in this application refers to the associated external equipment business systems of various types of operational equipment. This application aims to address the problems of repetitive development for access adaptation due to differences in equipment models, communication protocols, and data formats; the direct connection of different operational equipment's associated external equipment business systems to the traffic management business platform, resulting in changes to internal interfaces being transmitted to the external calling system; and the fixed interface call links and dispersed cross-domain exchange configurations when business systems are deployed across different network security domains. To address these issues, this application constructs a unified access and collaborative management system for operational equipment across multiple security domains, considering that the external third-party calling platform and the traffic management department's business systems may be deployed separately on the traffic management department's intranet, video private network, and social private network. The management system is positioned between the external third-party calling platform and the traffic management business system, specifically as follows: Figure 2As shown. The traffic management business system in this embodiment includes: a comprehensive traffic management application platform, an integrated command platform, an internet service platform, and a big data analysis platform. These four platforms are located within the dedicated traffic management system network, while data from common traffic management video equipment, such as cameras, robots, examination room cameras, and traffic management drones, are stored in the dedicated video network. Common external third-party calling platforms include: intelligent examination audio and video analysis systems, non-motorized vehicle violation analysis systems, inter-provincial checkpoint drone duty management systems, vehicle and driver management business guidance systems, and intelligent patrol drone systems. Most of these third-party calling platforms are located within the social dedicated network. If new traffic management business platforms / systems or new third-party calling platforms / systems emerge in the future, they can be directly added to the architecture of this application.

[0019] This application constructs a unified access and collaborative management system for heterogeneous operating equipment across multiple security domains, such as... Figure 1 and Figure 2 As shown, it includes: business application layer, basic service layer and data acquisition layer for various scenarios and devices.

[0020] The basic service layer primarily provides unified, universal, and reusable underlying capabilities to support various business modules of the platform, including basic services such as gateway access, message processing, log recording, file storage, and scheduled tasks. This layer reduces redundant construction among various business modules by centrally encapsulating common technical capabilities and provides unified technical support for device access, interface calls, and cross-domain data exchange, thereby improving the overall reusability, stability, and maintainability of the platform.

[0021] The data acquisition layer for each scenario is primarily responsible for the unified collection and access of real-time data, status information, and business data generated by heterogeneous devices for various business scenarios such as traffic management. This layer uses standardized data access methods to perform preliminary parsing, encapsulation, and uploading of data from different devices, and provides the collection results to upper-level business application modules such as equipment management, operation monitoring, and data exchange. This shields the differences in communication methods, data formats, and data types among different devices, providing fundamental data support for the platform to achieve unified management of various devices and cross-scenario data applications.

[0022] In this solution, the modules that specifically implement standardized access to heterogeneous traffic management equipment, reuse of traffic management business interfaces, and dynamic collaboration in multi-security domain environments are located in the business application layer.

[0023] The business application layer includes: identity authentication and access control module, equipment management module, interface collaboration management module, cross-domain data exchange module, operation monitoring module, and system management module; The identity authentication and access control module is used to authenticate users and verify access requests based on user identity information and permission information.

[0024] The identity authentication and access control module includes: an identity authentication unit and an access control unit; The identity authentication unit is used to receive the identity authentication information submitted by the user, verify the identity authentication information, and generate an identity credential containing the user identifier, role identifier, permission scope, and validity period after the verification is successful. The access control unit is used to determine the permissions of access requests based on user roles, departments, data access scope, and authorization validity period.

[0025] When both identity authentication and permission verification pass, the identity authentication and access control module allows the access request to enter the corresponding functional module; when identity authentication or permission verification fails, the access request is denied.

[0026] The equipment management module is used to uniformly register and manage operational equipment and its associated external equipment business systems, and to establish the relationship between equipment providers, equipment models, equipment instances and associated external equipment business systems; it also establishes model-level access parameter templates for different equipment models, and the parameter templates include: communication protocols, data formats, common parameters and unique parameters; Based on the device model corresponding to the device instance, the system calls the model-level access parameters and combines them with the instance-level parameters corresponding to the device instance to generate the device access configuration for that device instance. This enables the working equipment to access this system through its associated external equipment business system according to the device access configuration and to maintain the operating status of the working equipment.

[0027] The equipment management module includes: provider registration unit, equipment model maintenance unit, equipment instance registration unit, system information registration unit, and equipment status management unit.

[0028] The provider registration unit is used to register the provider information of the operating equipment or associated external equipment business system, and to assign a provider identifier to each provider; the provider information includes the provider name, provider type and the operating equipment or external equipment business system information provided.

[0029] The equipment model maintenance unit is used to register the equipment type, model name, manufacturer, and corresponding model-level access parameters of the operating equipment, and to assign equipment model identifiers to different equipment models, establishing the association between equipment models and equipment providers. The model-level access parameters form a model-level parameter template for the corresponding equipment model. The model-level parameter template includes at least: communication protocol, data format, common parameters, and unique parameters. Among them, common parameters are used to describe equipment attributes common to the same type of operating equipment, and unique parameters are used to describe the special attributes that distinguish the corresponding equipment model from other equipment models.

[0030] The equipment instance registration unit is used to receive equipment instance registration information for specific operational equipment. The equipment instance registration information includes at least: equipment serial number, equipment model identifier, user unit, deployment address, network address, and network security domain. The equipment instance registration unit obtains the corresponding model-level parameter template based on the equipment model identifier in the equipment instance registration information, combines the model-level parameter template with the instance-level parameters in the equipment instance registration information to form the equipment access configuration for that equipment instance, assigns a unique equipment identifier to the equipment instance, and establishes the association between the equipment instance, equipment model, and equipment provider.

[0031] The system information registration unit is used to register the basic information of external equipment business systems associated with the operating equipment and to assign a unique system identifier to each business system. The basic information of the business system includes: system name, user unit, provider, server network address, operating status, network security domain, and associated device identifier. The system information registration unit is also used to establish the association between business systems, providers, equipment instances, and network security domains.

[0032] The equipment status management unit is used to receive equipment activation information and periodic operation information sent by the operating equipment or its associated external equipment business system, and dynamically update the operating status of the operating equipment according to the equipment identifier, heartbeat reception time, equipment operating parameters and data upload status. The operating status includes at least one of the following: activated, online, offline, abnormal and deactivated.

[0033] Traffic management operation equipment connects to this system through its associated external equipment business system according to the corresponding equipment access configuration, and sends equipment identification, equipment status data or business data to this system, thereby enabling instantiation of traffic management operation equipment from different manufacturers and of different models based on model-level parameter templates.

[0034] The interface collaboration management module is used to register and manage external third-party calling platforms, external service interfaces provided by this system to external third-party calling platforms, and internal target interfaces provided by the traffic management business system to this system. It establishes authorization relationships between external third-party calling platforms and external service interfaces, as well as interface mapping relationships and parameter mapping rules between external service interfaces and internal target interfaces. This forms a two-layer interface model consisting of external service interfaces and internal target interfaces, enabling decoupled calls between external calling platforms and the internal interfaces of the traffic management business system. Upon receiving an interface call request from an external third-party calling platform for an external service interface, it performs access verification based on the authorization relationship, determines the corresponding internal target interface based on the interface mapping relationship, and completes the request parameter conversion and response parameter conversion between the external service interface and the internal target interface according to the parameter mapping rules.

[0035] The interface collaboration management module includes: interface filing unit, external calling platform filing unit, interface authorization application unit, internal target interface configuration unit, interface calling unit, and interface log unit.

[0036] The interface registration unit is used to register the basic information of the external service interfaces provided by this system to external third-party calling platforms and the internal target interfaces provided by the traffic management business system to this system, and to assign a unique interface identifier to each interface; the basic interface information includes: interface name, interface type, interface address and operation type.

[0037] The External Calling Platform Filing Unit is used to register the basic information of external calling platforms that access this system and to assign a unique platform identifier to each external third-party calling platform. The basic information of the external calling platform includes at least the platform name, network address, network security domain, and information used for authentication.

[0038] The interface authorization application unit is used to receive access permission applications submitted by external third-party calling platforms for external service interfaces, record the applying platform, the applying interface, the scope of permission, and the review status, and review the access permission applications; if the review is approved, an authorization relationship is established between the external third-party calling platform and the external service interface, enabling the external third-party calling platform to obtain access permission to the corresponding external service interface; if the review is not approved, the access permission application is rejected and the review result is recorded.

[0039] The internal target interface configuration unit is used to maintain the calling addresses, request methods, request parameters, response parameters, and access rules of the internal target interfaces of the traffic management business system, and to establish the interface mapping relationship between the external service interfaces of this system and the internal target interfaces of the traffic management business system. The interface mapping relationship includes interface-level mapping relationships and parameter-level mapping relationships. Interface-level mapping relationships are used to determine the corresponding internal target interfaces based on the external service interfaces. Parameter-level mapping relationships include request parameter mapping rules and response parameter mapping rules. Request parameter mapping rules are used to convert the external request parameters submitted by the external third-party calling platform according to the external service interface into the internal request parameters corresponding to the internal target interface. Response parameter mapping rules are used to convert the internal response parameters returned by the internal target interface into the external response parameters corresponding to the external service interface.

[0040] The interface invocation unit is used to receive interface invocation requests initiated by external third-party invocation platforms for external service interfaces, and to perform identity verification and access validation based on the platform's filing information and interface authorization relationship. After successful validation, the corresponding internal target interface is determined according to the interface-level mapping relationship, and the external request parameters corresponding to the external service interface are converted into the internal request parameters corresponding to the internal target interface according to the request parameter mapping rules. After obtaining the response data returned by the internal target interface, the internal response parameters are converted into the external response parameters corresponding to the external service interface according to the response parameter mapping rules, and then returned to the external third-party invocation platform.

[0041] The interface log unit is used to record the caller identifier, interface identifier, request time, request parameter summary, response status, response time, call result, and exception information.

[0042] Through the interface collaboration management module, external third-party calling platforms only call the unified external service interface. This system adapts the internal target interface of the traffic management business system according to the interface mapping relationship and parameter mapping rules, thereby reducing the coupling between the external calling platform and the internal interface of the traffic management business system and realizing the unified reuse of traffic management business interface capabilities.

[0043] The cross-domain data exchange module is used to determine the interface call chain based on the network security domain of the external third-party calling platform and the network security domain of the traffic management business system corresponding to the internal target interface after the interface collaboration management module determines the internal target interface. When the two belong to the same network security domain, the intra-domain interface call chain is used. When the external calling platform and the traffic management business system belong to different network security domains, the cross-domain interface call chain is used to generate cross-domain data transmission tasks and execute cross-domain data exchange.

[0044] The cross-domain data exchange module includes: a security domain determination unit, a transmission task generation unit, a data preprocessing unit, a data encryption unit, a data sending unit, a data receiving unit, a data processing unit, and a transmission log unit.

[0045] The security domain determination unit is used to obtain the source network security domain identifier of the external third-party calling platform based on the external calling platform's registration information, obtain the registration information of the corresponding traffic management business system based on the internal target interface determined by the interface collaboration management module, obtain the target network security domain identifier based on the traffic management business system's registration information, and compare the source network security domain identifier with the target network security domain identifier. When the source network security domain identifier and the target network security domain identifier are the same, the security domain determination unit determines to use the intra-domain interface call link and sends the interface request data after parameter conversion to the corresponding internal target interface within the current network security domain; when the source network security domain identifier and the target network security domain identifier are different, the security domain determination unit determines to use the cross-domain interface call link. The transmission task generation unit is used to generate cross-domain data transmission tasks when using cross-domain interface call links, assign a unique transmission task identifier to the cross-domain data transmission task, and establish the association between the cross-domain data transmission task and the corresponding interface call record. The data preprocessing unit is used to classify the interface data to be transmitted across domains according to the data type, verify the data format, data size and integrity of the interface data to be transmitted, and encapsulate the verified interface data with the transmission task identifier, source network security domain identifier, target network security domain identifier, data type and data generation time to form a data packet to be encrypted and transmitted. The data encryption unit is used to encrypt the data packet to be encrypted according to the preset encryption rules, and generate verification information for verifying the integrity of cross-domain transmitted data, thus forming a cross-domain transmitted data packet. The data sending unit is used to write cross-domain transmission data packets into the switching location corresponding to the source network security domain, and transmit the cross-domain transmission data packets to the switching location corresponding to the target network security domain through a secure isolation switching device. The data receiving unit is used to read cross-domain transmission data packets from the exchange location corresponding to the target network security domain, and determine the corresponding cross-domain data transmission task and the interface call record associated with the cross-domain data transmission task based on the transmission task identifier. The specific data sending and receiving technologies are based on existing technologies such as FTP service combined with optical gateways or network gateways.

[0046] The data processing unit is used to perform integrity verification, decryption, and parsing of received cross-domain transmission data packets in the target network security domain, and to perform corresponding processing based on the data type obtained from the parsing. When the parsed data is interface request data, the corresponding internal target interface is determined based on the interface call record associated with the cross-domain data transmission task, and the parsed interface request data is sent to the internal target interface. When the parsed data is interface response data, the corresponding external third-party calling platform is determined based on the interface call record associated with the cross-domain data transmission task, and the interface response data is returned to the external third-party calling platform; When the parsed data is business data that needs to be saved, it is stored according to the data type of the business data. When the interface response data returned by the internal target interface needs to be returned from the network security domain where the traffic management business system is located to another network security domain where the external third-party calling platform is located, the network security domain where the traffic management business system is located is used as the new source network security domain, and the network security domain where the external third-party calling platform is located is used as the new target network security domain. The interface call chain is redefined for the interface response data. When cross-domain transmission is required, the corresponding reverse cross-domain data transmission task is generated and cross-domain data exchange is performed.

[0047] The transmission log unit is used to record the transmission task identifier, associated interface call records, data source, source network security domain, target network security domain, data type, data size, sending time, receiving time, integrity verification result, decryption result, parsing result, interface processing result, and storage result.

[0048] Categorized storage includes storing structured data in a business database and storing at least one type of unstructured data, such as images, audio, video, and documents, in a file storage system.

[0049] When data transfer fails due to errors such as data verification failure, integrity verification failure, decryption failure, parsing failure, interface call failure, or storage failure, the cross-domain data exchange module sets the corresponding cross-domain data transfer task to an abnormal state and records the corresponding abnormal information in the transmission log.

[0050] The operation monitoring module is used to monitor the platform's operation, equipment operation, interface call status, and data transmission status; the system management module is mainly for system administrators, providing user and role management, menu and permission management, department dictionary management, and service parameter management to ensure the normal daily operation of the system.

[0051] Based on the above-mentioned unified access and collaborative management system for heterogeneous operating equipment with multiple security domains, this method also provides a unified access and collaborative management method for heterogeneous equipment with multiple security domains, which includes the following steps.

[0052] S1: User authentication and access control; The above-mentioned multi-safety domain operation equipment is uniformly connected to the collaborative management and control system, referred to as the "management and control system". The management and control system is set up between the external third-party calling platform and the traffic management business system. The management and control system receives login requests submitted by users, performs user authentication, and verifies access permissions based on user identity and permission information.

[0053] Specifically, the control system receives login requests submitted by users and determines the authentication method corresponding to the login request; the authentication method includes at least one of account password authentication and PKI digital certificate authentication.

[0054] When using account and password authentication, the system obtains the user's submitted account and password information, matches and verifies the account and password information against the pre-stored user identity information, and verifies the user's account status.

[0055] When using PKI digital certificate authentication, the PKI digital certificate submitted by the user is obtained, and the integrity, validity period, issuing authority and certificate holder identity information of the PKI digital certificate are verified. The corresponding user identity is determined based on the verified PKI digital certificate.

[0056] After successful identity authentication, the system retrieves the corresponding user identifier, role identifier, department, scope of permissions, and validity period of the credentials based on the user's identity, and generates identity credentials.

[0057] The system receives access requests initiated by users based on their identity credentials and performs permission verification on the access requests according to the user's role, department, data access scope, and authorization validity period. When the permission verification is successful, the access request is allowed to enter the corresponding functional module; when the identity authentication or permission verification fails, the access request is rejected.

[0058] S2: Construct a hierarchical parameter system and implement equipment access management; The hierarchical parameter system includes: model-level parameter templates and equipment instance registration information; The system registers equipment providers, equipment models, equipment instances, and associated external equipment business systems. It establishes model-level parameter templates for different equipment models and calls the model-level parameter templates according to the equipment model corresponding to the equipment instance. It then generates the equipment instance access configuration by combining the instance-level parameters corresponding to the equipment instance registration information. This enables the operating equipment to access the management and control system through its associated external equipment business systems according to the equipment instance access configuration.

[0059] In step S2, during the equipment access management operation, such as... Figure 3 As shown, the specific steps include:

[0060] B1: Registration of operating equipment providers and establishment of model-level parameter templates; Register the equipment providers and equipment models, assign provider identifiers to the equipment providers, and register the provider name, provider type, and business system information of the equipment or related external equipment they provide; establish the association between equipment providers and equipment models; receive equipment model information submitted by equipment providers, including equipment type, model name, manufacturer, communication protocol, data format, common parameters, and unique parameters.

[0061] Create a corresponding model-level parameter template for each equipment model; The model-level parameter template includes: communication protocol, data format, common parameters, and unique parameters; among them, common parameters are used to describe equipment attributes shared by the same type of work equipment, and unique parameters are used to describe the special attributes that distinguish the corresponding equipment model from other equipment models.

[0062] For different device instances belonging to the same device model, reuse the model-level parameter template to reduce the need to repeatedly configure communication protocols, data formats, and model-related parameters for a single device instance.

[0063] B2: Registration of work equipment instances and generation of instantiation access configuration; Receive equipment instance registration information for operational equipment. The equipment instance registration information shall include at least: equipment serial number, equipment model identifier, user unit, deployment address, network address, and network security domain. The system retrieves the corresponding model-level parameter template based on the device model identifier and performs integrity and validity checks on the device instance registration information. If the check fails, a check failure message is returned and recorded.

[0064] After verification, the association between the device instance, device model and device provider is established, and the model-level parameter template is combined with the device instance registration information to generate the device access configuration for the device instance. At the same time, a unique device identifier is assigned to the device instance.

[0065] Among them, the device access configuration is used to determine the communication protocol, data format and corresponding device parameters used when the device instance accesses this management and control system.

[0066] When the communication protocol, data format, common parameters, or unique parameters corresponding to a device model change, the corresponding model-level parameter template is updated to achieve unified maintenance of access parameters for devices of the same model.

[0067] The operating equipment connects to this management and control system through its associated external equipment business system according to the equipment access configuration, and uploads equipment identification, equipment status data or business data, thereby enabling instantiation of operating equipment from different manufacturers and of different models based on model-level parameter templates.

[0068] B3: Registration of information in the business system for external equipment related to operating equipment; Receive registration information from external equipment business systems associated with the operating equipment. The registration information of external equipment business systems includes system name, user unit, provider, server network address, operating status, network security domain, and associated equipment identifier.

[0069] Register the external equipment business systems associated with the operating equipment, assign a unique system identifier to each external equipment business system, and establish the association between the external equipment business system, equipment instance, equipment model, equipment provider, and network security domain. The association is used to determine the identity information, network address, and network security domain of the external equipment business system associated with the operating equipment during subsequent interface calls.

[0070] B4: Equipment activation and equipment status management; Receive the equipment activation request submitted by the business system of the operating equipment or its associated external equipment, query the corresponding equipment instance registration information according to the equipment identifier, and set the equipment status of the operating equipment to the activated state.

[0071] The operating equipment connects to the management and control system through its associated external equipment business system according to the equipment access configuration, and uploads equipment identification, equipment status data or business data; the management and control system receives activation information and operation information sent by the operating equipment or its associated external equipment business system, and updates the equipment operation status according to the activation information and operation information.

[0072] During normal operation of the equipment, the system receives heartbeat information periodically sent by the equipment or its associated external equipment business system. The heartbeat information includes the equipment identifier, heartbeat sending time, equipment operating parameters, and data upload status.

[0073] The operating status of the work equipment is dynamically updated based on the heartbeat reception time, equipment operating parameters, and data upload status: when a heartbeat message is received within a preset time range and the equipment operating parameters meet the preset operating conditions, the equipment status is set to online; when no heartbeat message is received within the preset time range, the equipment status is set to offline; when the equipment operating parameters or data upload status do not meet the preset operating conditions, the equipment status is set to abnormal; when the work equipment is stopped or its access permission is revoked, the equipment status is set to disabled.

[0074] This application establishes model-level parameter templates for different device models, including communication protocols, data formats, common parameters, and unique parameters. When registering a device instance, the application automatically obtains the corresponding model-level parameter template based on the device model to generate the access configuration of the device instance. This allows devices of the same model to reuse a unified model-level parameter template, reducing repeated configuration and adaptation for individual devices and reducing the maintenance workload when the device model protocol or parameters change.

[0075] S3: Execute interface collaboration management. The control system registers external third-party calling platforms, external service interfaces of the control system, and internal target interfaces of the traffic management business system. It establishes the authorization relationship between external third-party calling platforms and external service interfaces of the control system, as well as the interface mapping relationship and parameter mapping rules between external service interfaces of the control system and internal target interfaces of the traffic management business system. The management and control system receives interface call requests initiated by external third-party calling platforms for external service interfaces, and completes authentication, access verification, internal target interface determination, and request parameter conversion based on authorization relationships, interface mapping relationships, and parameter mapping rules.

[0076] In step S3, during the interface collaborative management operation, such as Figure 4 The specific steps shown are as follows.

[0077] C1: Filing for external calling platforms and dual-layer interfaces; The system receives platform registration information submitted by the external equipment business system associated with the operating equipment as an external calling platform. The platform registration information includes the platform name, platform address, platform public key, network address, and network security domain. After verifying the platform registration information, a unique platform identifier is assigned to the external calling platform.

[0078] It receives the registration information of external service interfaces provided by this control system to external calling platforms, as well as the registration information of internal target interfaces provided by the traffic management business system to this control system.

[0079] The unified business call entry point provided by the control system to external third-party calling platforms is denoted as: external service interface; the interface used to call the actual data or services provided by the traffic management business system is denoted as: internal target interface; The external service interface is used to provide a unified business call entry point to external calling platforms, while the internal target interface is used to call the actual data or services provided by the traffic management business system. Together, they form a two-layer interface model.

[0080] Register external third-party calling platforms, external service interfaces, and internal target interfaces; among them, the interface filing information corresponding to external service interfaces and internal target interfaces includes: interface name, interface type, interface address, and operation type; and assign a unique interface identifier to each external service interface and internal target interface.

[0081] C2: External service interface permission application and call rule configuration; It receives access permission requests submitted by external third-party calling platforms for their external service interfaces. From these requests, it retrieves the requesting platform identifier, the external service interface identifier, the scope of the requested permissions, the authorization effective date, the authorization expiration date, the network address whitelist, and the maximum daily number of calls. Based on the external calling platform's registration information and the external service interface's registration information, it verifies the validity of the requesting platform and the external service interface, and reviews the access permission requests.

[0082] After approval, an authorization relationship is established between the external third-party calling platform and the external service interface. This authorization relationship also includes: the scope of permissions and interface access rules; ensuring that the external third-party calling platform can only access the corresponding traffic management business services through the authorized external service interface. The approval status of the access permission application is updated to "approved." If the approval fails, no authorization relationship is established, and the approval result and status are recorded.

[0083] C3: Internal target interface configuration and parameter mapping rule establishment; Receive the internal target interface configuration information of the traffic management business system. The internal target interface configuration information includes: call address, request method, request parameters, response parameters and access rules. Based on the internal target interface configuration information, establish the interface mapping relationship between the external service interface and the internal target interface, and establish the parameter-level mapping relationship between the external service interface and the internal target interface. The parameter-level mapping relationship includes: request parameter mapping rules and response parameter mapping rules.

[0084] The request parameter mapping rules are used to convert the external request parameters submitted by the external calling platform according to the external service interface into the internal request parameters required by the internal target interface; the response parameter mapping rules are used to convert the internal response parameters returned by the internal target interface into the external response parameters corresponding to the external service interface.

[0085] Generate corresponding internal target interface call rules based on interface-level mapping relationships and parameter-level mapping relationships.

[0086] When any item in the internal target interface configuration information of the traffic management business system changes, the corresponding internal target interface configuration, interface mapping relationship or parameter mapping rule is updated, while the external service interface used by the external calling platform and its calling method remain unchanged.

[0087] C4: Interface calls, parameter conversion, and call log generation; Receive API call requests from external third-party platforms for their external service interfaces. These requests include: the external platform identifier, the external service interface identifier, request parameters, request time, the caller's network address, and signature information. Verify the API call request against the external third-party platform's registration information, specifically including the following operations: The system queries the corresponding platform registration information based on the external calling platform identifier and obtains the platform public key of the external calling platform; it generates data to be verified according to the preset signature rules, and uses the platform public key to verify the signature information in the interface call request in order to determine the source and integrity of the interface call request.

[0088] After signature verification is successful, access verification is performed based on the authorization relationship between the external calling platform and the external service interface, and the authorization effective time, authorization expiration time, network address whitelist and daily maximum number of calls are verified.

[0089] After the access verification is passed, the corresponding internal target interface is determined according to the interface mapping relationship. Then, the steps of determining the interface call chain and cross-domain data exchange in step S4 are executed. The interface call chain is determined according to the network security domain to which the traffic management business system corresponding to the external calling platform and the internal target interface belongs. The system converts the request parameters of the external service interface into the corresponding request parameters of the internal target interface according to the request parameter mapping rules. After obtaining the response data returned by the internal target interface, it converts the response parameters of the internal target interface into the corresponding response parameters of the external service interface according to the response parameter mapping rules and returns them to the external third-party calling platform. After the interface request and response data processing is completed, the interface call record is updated, recording the external calling platform identifier, external service interface identifier, internal target interface identifier, request time, response status, response time, call result, and exception information.

[0090] If signature verification or authorization verification fails, the API call request will be rejected and the reason for rejection will be recorded.

[0091] C5: When the call address, request parameters, response parameters or access rules of the target interface inside the traffic management business system change, the corresponding internal target interface configuration or parameter mapping rules are updated so that the external third-party calling platform can continue to call the interface according to the original external service interface and its calling method.

[0092] This application establishes a two-layer interface model consisting of an external service interface and an internal target interface of the traffic management business system. The external calling platform only interacts with the external service interface. This control system completes the conversion between the external service interface and the internal target interface according to the interface mapping relationship and the request parameter mapping rules and response parameter mapping rules. This ensures that when the address, parameters or access rules of the internal target interface of the traffic management business system change, it is not necessary to synchronously modify the external service interface used by the external calling platform, thereby reducing the coupling between the external third-party calling platform and the internal interface of traffic management and improving the interface resource reuse capability.

[0093] S4: Interface call chain determination and cross-domain data exchange; After identifying the internal target interface corresponding to the external third-party calling platform, confirm the network security domain to which the external third-party calling platform belongs, and confirm the network security domain to which the traffic management business system corresponding to the internal target interface belongs; compare the two network security domains, and determine the type of this interface call chain; When both belong to the same network security domain, the interface call is completed within the current network security domain; When the two belong to different network security domains, a cross-domain data transmission task is generated and cross-domain data exchange is performed.

[0094] In step S4, for the transmission of business data, the interface call chain is determined and data exchange is performed.

[0095] The business data in this application includes: request data submitted by external third-party platforms to the traffic management business system, and response data returned by the traffic management business system. Regardless of whether it pertains to the transmission of request data or response data, such as... Figure 5 As shown, all steps D1 to D4 are executed according to a unified business data transmission method.

[0096] The following example, using a data request, illustrates the data transmission steps in detail: D1: Dynamic selection of interface call chains and generation of cross-domain tasks based on security domain identifiers; After determining the internal target interface in step C4, the source network security domain identifier of the external third-party calling platform is obtained based on the external third-party calling platform filing information. The internal target interface corresponding to the external third-party calling platform is determined based on the interface mapping relationship. The target network security domain identifier is obtained by finding the traffic management business system registration information corresponding to the internal target interface. The source network security domain identifier is compared with the target network security domain identifier to determine the actual call chain used by the current interface call.

[0097] When the two are consistent, the intra-domain interface call chain is selected, and the interface request data transformed by the request parameter mapping rule is sent to the internal target interface within the current network security domain to realize data transmission. When the two are inconsistent, select the cross-domain interface call chain, generate a cross-domain data transmission task, assign a unique transmission task identifier to the cross-domain data transmission task, and establish the association between the transmission task identifier and the current interface call record, data source, source network security domain, target network security domain and the interface data to be transmitted, and execute step D2.

[0098] Therefore, the interface call chain is not pre-configured for the external calling platform, but is dynamically determined after the specific internal target interface is determined, based on the actual network security domain relationship between the external calling platform and the target traffic management business system. It is driven by the "actual interface mapping result" rather than statically bound.

[0099] This method generates device instance access configurations by establishing a model-level parameter template and an instance-level parameter hierarchical mechanism, and establishes the association between device instances and associated business systems and their respective network security domains. During the interface call phase, the associated business system is used as the call platform. The actual internal target interface and its corresponding business system are determined by the authorization relationship between the call platform and the external service interface, as well as the mapping relationship between the external service interface and the internal target interface. Furthermore, the network security domain of the actual target business system is used as the target security domain, and compared with the source network security domain of the third-party call platform to dynamically determine the intra-domain interface call chain or cross-domain interface call chain. In the case of cross-domain calls, a cross-domain data transmission task associated with the current interface call record is generated, forming a complete technology chain with data dependencies and processing order.

[0100] D2: Cross-domain data preprocessing, encapsulation, and encryption; The interface data to be transmitted across domains is categorized according to data type, and its format, size, and integrity are verified. The verified interface data, along with the transmission task identifier, source network security domain identifier, destination network security domain identifier, data type, and data generation time, is encapsulated into a data packet to be encrypted for transmission.

[0101] The data packets to be transmitted are encrypted according to the preset encryption rules, and verification information for verifying data integrity is generated based on the content of the data packets, thus forming cross-domain data packets.

[0102] If the data verification of the transmission interface fails, the corresponding cross-domain data transmission task will be set to an abnormal state, and the reason for the data verification failure will be written to the transmission log.

[0103] D3: Cross-domain data sending and receiving; The cross-domain data packet is written to the exchange location corresponding to the source network security domain, and then transmitted from the exchange location corresponding to the source network security domain to the exchange location corresponding to the target network security domain through a secure isolation exchange device.

[0104] After the target network security domain detects the cross-domain data packet, it reads the cross-domain data packet from the exchange location corresponding to the target network security domain, and queries the corresponding cross-domain data transmission task and the interface call record associated with the cross-domain data transmission task based on the transmission task identifier.

[0105] Security isolation switching equipment includes at least one of network gateways and optical gateways.

[0106] D4: Cross-domain data verification, decryption, and business processing; The target network security domain performs integrity verification on the received cross-domain transmission data packets based on the integrity verification information; after the integrity verification is passed, the cross-domain transmission data packets are decrypted and parsed to obtain the corresponding business data and data types.

[0107] When the parsed data is interface request data, the corresponding internal target interface is determined based on the interface call record associated with the cross-domain data transfer task, and the parsed interface request data is sent to the internal target interface, and the response data returned by the internal target interface is received.

[0108] After the internal target interface INNER returns the interface response data, the network security domain of the traffic management business system corresponding to the internal target interface INNER is used as the new source network security domain (sourceDomain), and the network security domain of the external third-party calling platform is used as the new target network security domain (targetDomain). The interface response data is then used as the new data to be transmitted, and step D1 is executed again. When the new source network security domain and the new target network security domain are consistent, the interface response data is returned using the intra-domain interface call link. When the two are inconsistent, a reverse cross-domain data transmission task is generated, and steps D2 to D4 are executed to complete the cross-domain return of the interface response data.

[0109] Assume the direction of the requested data transmission is: The message was sent from the social intranet DOMAIN-SOCIAL to the traffic management intranet DOMAIN-POLICE.

[0110] After the internal target interface INNER returns data, redefine it: sourceDomain = DOMAIN-POLICE; targetDomain = DOMAIN-SOCIAL; Then re-execute the D1 check once: Determine if two security domains are consistent: DOMAIN-POLICE = DOMAIN-SOCIAL? If not, generate a reverse task; If both are the same, then return directly within the domain.

[0111] When the business data is interface response data, the corresponding external third-party calling platform is determined based on the interface call record associated with the cross-domain data transmission task. After completing the response parameter conversion according to the response parameter mapping rules, the interface response data is returned to the corresponding external third-party calling platform.

[0112] When the business data is data that needs to be saved, it is classified and stored according to the data type. The structured data is stored in the business database, and at least one of the unstructured data, such as images, audio, video, and documents, is stored in the file storage system, and the corresponding storage location is recorded.

[0113] Based on the integrity verification results, decryption results, parsing results, interface call results, response return results, and storage results, update the cross-domain data transmission task status and the corresponding interface call records; when data verification fails, integrity verification fails, decryption fails, parsing fails, interface call fails, or storage fails, set the corresponding cross-domain data transmission task to an abnormal state and record the corresponding abnormal information.

[0114] This method, after identifying the internal target interface, dynamically determines the interface call chain based on the network security domain of the external calling platform and the network security domain of the traffic management business system corresponding to the internal target interface. When both are in the same network security domain, an intra-domain call chain is used; when they are in different network security domains, a cross-domain data transmission task is automatically generated and the data exchange is completed through a secure isolation switching device. This allows the interface call method to adapt to the actual deployment relationships of different network security domains. This method establishes a correlation between interface call records and cross-domain data transmission tasks, and uses transmission task identifiers throughout the cross-domain data encapsulation, sending, receiving, parsing, and response return processes. This achieves a correlation record between the interface business call process and the cross-domain data exchange process, improving anomaly localization capabilities and the traceability of cross-security domain data exchange processes.

[0115] The implementation of this solution is illustrated below with specific examples. One example is a city's non-motorized vehicle violation analysis system and its associated non-motorized vehicle capture equipment connected to the multi-security-domain heterogeneous operation equipment unified access and collaborative management system (hereinafter referred to as "this system") designed in this application. The example demonstrates how the non-motorized vehicle violation analysis system calls the vehicle basic information query service provided by the traffic management integrated command platform through this system. This illustrates the process of heterogeneous equipment instantiation, two-layer interface mapping calls, and dynamic selection of interface call links based on network security domains.

[0116] A: User authentication and access permission verification; Users enter the unified login page and choose either account password authentication or PKI digital certificate authentication to log in. After successful authentication, the system obtains the user's corresponding role, department, and data access scope, and then accesses the appropriate functional modules based on the user's permissions.

[0117] B: Equipment access management; B1: Registration of operating equipment providers and establishment of model-level parameter templates; Before the equipment is connected to this system, the user enters the equipment provider information through the provider registration page. This system verifies the provider name and provider type, and automatically assigns a unique provider identifier to the equipment provider after successful verification.

[0118] After completing the provider registration, users can access the equipment model maintenance page and enter the equipment model information corresponding to the equipment to be connected. Equipment model information includes equipment type, model name, manufacturer, communication protocol, data format, common parameters, and unique parameters. This system assigns a unique equipment model identifier to each equipment model and establishes a relationship between the equipment model and the equipment provider.

[0119] This system further establishes model-level parameter templates based on the communication protocols, data formats, common parameters, and unique parameters corresponding to each device model. Common parameters describe the access attributes shared by devices of the same type, while unique parameters describe the exclusive access attributes that distinguish this device model from other device models.

[0120] For example, for the non-motorized vehicle capture device in this embodiment, the data communication method, uploaded data format, and common capture parameters and model-specific parameters of the device model can be configured in the corresponding model-level parameter template. When other non-motorized vehicle capture devices of the same model are subsequently connected, it is not necessary to reconfigure the above-mentioned model-level parameters; instead, the corresponding model-level parameter template can be directly reused.

[0121] B2: Registration and instantiation of work equipment instances; After the device model maintenance is completed, the user enters the device information registration page, selects the registered provider and device model, and enters the specific device instance information. This system obtains the corresponding model-level parameter template based on the device model identifier in the device instance registration information. It then combines the communication protocol, data format, common parameters, and unique parameters in the model-level parameter template with instance-level parameters such as the device serial number, user organization, deployment address, network address, and network security domain of the current device instance to generate a device access configuration specific to the current device instance.

[0122] After successful verification, the system assigns a unique device identifier to each specific device instance and establishes an association between the device instance, device model, and device provider. The registration information for the operating device instances in this embodiment is shown in Table 1.

[0123] Table 1. Examples of Operating Equipment

[0124] For other MODEL001 model non-motorized vehicle capture devices that are subsequently connected, this system can directly call the model-level parameter template corresponding to MODEL001, and only configure the instance-level parameters such as the corresponding device serial number, user unit, deployment address, network address and network security domain to generate a new device instance access configuration.

[0125] When the communication protocol, data format, common parameters, or unique parameters corresponding to MODEL001 change, the access parameters of devices of the same model can be uniformly maintained by updating the model-level parameter template corresponding to MODEL001, without having to modify the model-level access parameters of each device instance individually.

[0126] B3: Registration of information related to external equipment business systems; User registration details the deployment information of external equipment business systems associated with the operating equipment. This system assigns a unique system identifier to each external equipment business system and establishes associations between the external equipment business system, equipment instance, equipment model, equipment provider, and their respective network security domain. The registration information for external equipment business system instances in this embodiment is shown in Table 2.

[0127] Table 2. Example of registration information for external equipment business system instances

[0128] B4: Equipment activation and equipment status management; After device instance registration is completed and device access configuration is generated, the non-motorized vehicle violation analysis system of a certain city sends device activation information to this system. This system queries the corresponding device instance registration information and device access configuration based on the device identifier, and performs activation verification on the device identifier, device model, and access information; if the activation verification passes, the corresponding device status is updated to "activated". If the activation verification fails, a verification failure message is returned and recorded. During normal operation of the device, the device or its associated external equipment business system periodically sends heartbeat information. When this system receives the device heartbeat normally within a preset time range and the device operating parameters meet the preset conditions, the device status is updated to online; when no device heartbeat is received within the preset time range, the device status is updated to offline; when the device operating parameters or data upload status are abnormal, the device status is updated to abnormal; when the device is stopped or its access permission is revoked, this system updates the corresponding device status to disabled.

[0129] C: Interface collaborative management; C1: Filing for external calling platforms and dual-layer interfaces; When a city's non-motorized vehicle violation analysis system needs to access data or services from the traffic management integrated command platform, it must first register as an external calling platform within this system. The registration information for the external calling platform in this embodiment is shown in Table 3.

[0130] Table 3. Example of external calling platform filing information

[0131] This system registers both external service interfaces provided to external calling platforms and internal target interfaces provided by the traffic management business system to this system. The external service interfaces serve as a unified business entry point that external calling platforms can perceive and invoke; the internal target interfaces serve as the interfaces through which this system actually calls data or services from the traffic management business system. These two interfaces are separate and together form a two-layer interface model. The interface registration information in this embodiment is shown in Table 4.

[0132] Table 4. Example of Interface Filing Information

[0133] External calling platforms can only request access to external service interfaces OUT001 or OUT002, and cannot directly obtain access permissions to internal target interfaces INNER001 or INNER002, nor do they need to obtain the actual calling address and internal parameter definition of the internal target interfaces.

[0134] C2: External service interface permission application and call rule configuration; A city's non-motorized vehicle violation analysis system selects an external service interface and submits an access permission request. The interface permission request information in this embodiment is shown in Table 5.

[0135] Table 5. Example of Interface Permission Request Information

[0136] C3: Internal target interface configuration and parameter mapping; The system administrator establishes a mapping relationship between the external service interface and the internal target interface of the traffic management business system on the internal target interface configuration page.

[0137] This embodiment employs a two-layer interface model that separates external service interfaces from internal target interfaces. The external calling platform only perceives and invokes the external service interface; this system determines the corresponding internal target interface of the traffic management business system based on the interface-level mapping relationship, and completes the conversion between the external interface parameter model and the traffic management internal interface parameter model through request parameter mapping rules and response parameter mapping rules. The interface mapping relationship in this embodiment is shown in Table 6.

[0138] Table 6. Examples of mapping between external service interfaces and internal target interfaces

[0139] Taking the query interface for basic vehicle information as an example, the parameter names submitted by the external calling platform are vehicleNo and vehicleType, while the parameter names corresponding to the target interface within the traffic management business system are hphm and hpzl. The system completes the field conversion according to the mapping relationship shown in Table 6.

[0140] When the address or parameters of the internal target interface of the traffic management integrated command platform change, only the internal target interface configuration and mapping relationship need to be updated, and the external calling platform can still continue to call the original external service interface.

[0141] C4: Interface calls, parameter conversion, and call log generation; A non-motorized vehicle violation analysis system in a certain city initiated a vehicle basic information query request to the OUT001 interface. The interface request header information is shown in Table 7.

[0142] Table 7. Examples of Interface Request Headers

[0143] After receiving the request, this system queries the platform registration information of PLAT001 to obtain the corresponding platform public key. It then generates signature-to-be-verified data according to a preset order of platform identifier, interface identifier, timestamp, and request parameter digest, and verifies the Sign using the platform public key. After successful signature verification, it verifies the authorization validity period, the caller's IP address, and the number of calls. Upon successful verification, OUT001 is mapped to the internal interface INNER001, corresponding to the traffic management integrated command platform. Based on the mapping relationship in Table 6, vehicleNo is converted to hphm, and vehicleType is converted to hpzl, forming internal request parameters that meet the INNER001 call requirements. Subsequently, after determining the internal target interface INNER001 and its corresponding traffic management business system, the system proceeds to step D1, determining the actual call chain used for this interface call based on the network security domain to which PLAT001 and the traffic management integrated command platform belong.

[0144] D: Determining the interface call chain and cross-domain data exchange based on security domain identifiers; D1: Dynamic selection of interface call links and generation of cross-domain transmission tasks; Based on the platform registration information of PLAT001, this system determines that the network security domain of the external calling platform PLAT001 is the social private network DOMAIN-SOCIAL; based on the registration information of the traffic management integrated command platform corresponding to INNER001, it determines that the network security domain of the target traffic management business system is the traffic management intranet DOMAIN-POLICE. This system determines that the interface call from OUT001 to INNER001 uses a cross-domain interface call link and generates a cross-domain data transmission task TASK202608030001. The transmission task information in this embodiment is shown in Table 8.

[0145] Table 8. Examples of Transmission Task Information

[0146] In another implementation, when the source network security domain of the external calling platform is the same as the target network security domain of the traffic management business system corresponding to the internal target interface, the system determines to use the intra-domain interface call link, does not generate cross-domain data transmission tasks, and directly sends the interface request data after being converted by the request parameter mapping rules to the internal target interface; after the internal target interface returns response data, it completes the response parameter conversion according to the response parameter mapping rules and directly returns to the external calling platform.

[0147] D2: Cross-domain data preprocessing, encapsulation, and encryption; The system performs format, size, and integrity checks on the data requested by the interface to be transmitted. After the checks pass, the interface request data and transmission task information are encapsulated into a cross-domain transmission data packet. The cross-domain transmission data packet is then encrypted according to preset encryption rules, and integrity verification information is generated. The main information in the cross-domain transmission data packet is shown in Table 9.

[0148] Table 9. Examples of cross-domain data packet information

[0149] D3: Cross-domain data sending and receiving; The source security domain data transmission service writes data packets to the social private network exchange location and transmits them to the traffic management intranet exchange location via a network gateway or optical gateway.

[0150] D4: Cross-domain data verification, decryption, internal interface calls, and response returns; The traffic management intranet data transmission service reads data packets, determines the corresponding transmission task based on the transmission task identifier TASK202608030001, verifies the data packets according to integrity verification information, and decrypts and parses the data packets after successful verification. Upon successful parsing, the request parameters are sent to the internal target interface INNER001. After the traffic management business system returns the vehicle basic information, this system generates a reverse cross-domain data transmission task TASK202608030002 and transmits the interface response data from the traffic management intranet to the social private network. The reverse transmission tasks are shown in Table 10.

[0151] Table 10. Example of Transmission Task Information

[0152] After the reverse cross-domain transfer is completed, this system determines the external calling platform PLAT001 and the external service interface OUT001 based on the interface call record corresponding to REQ202608030001. According to the response parameter mapping rules shown in Table 6, the internal response parameter syr returned by INNER001 is converted to ownerName, and zt is converted to status, forming interface response data that conforms to the external response parameter model of OUT001, and this data is returned to the external calling platform PLAT001. The interface response information is shown in Table 11.

[0153] Table 11. Example of Interface Response Data

[0154] After processing is complete, the system updates the interface call records and cross-domain transfer task status, as shown in Table 12.

[0155] Table 12. Examples of Interface Call and Cross-Domain Transfer Results

[0156] When a verification failure, parsing failure, interface call failure, or storage failure occurs during the transmission process, the system will set the corresponding transmission task to an abnormal state and record the reason for the abnormality in the transmission log.

[0157] Step S1 of this method is executed when a user accesses this management and control system to complete user authentication and access permission verification; Step S2 includes steps B1 to B4, which are used to complete the registration of equipment providers, equipment models, equipment instances and associated business systems based on equipment model-level parameter templates, and generate equipment instance access configurations by establishing a hierarchical mechanism between model-level parameter templates and instance-level parameters to realize the instantiation access and operation status management of heterogeneous equipment; Step S3 includes steps C1 to C4, which are used to establish the authorization relationship between the external calling platform and the external service interface, as well as the interface mapping relationship and parameter mapping rules between the external service interface and the internal target interface of the traffic management business system, to realize the decoupled calling between the external calling interface and the internal interface of traffic management; Step S4 includes steps D1 to D4, which, after determining the internal target interface, dynamically selects the intra-domain interface calling link or the cross-domain interface calling link according to the network security domain to which the external calling platform and the target traffic management business system belong, and completes cross-domain data exchange when cross-network security domain transmission is required. The execution order of each registration and configuration step can be adjusted according to the system deployment and management needs; among them, after step S3 completes the determination of the internal target interface, step S4 is entered to determine the actual call chain of the corresponding interface request data.

[0158] Through the above steps, this application generates device instance access configurations based on device model-level parameter templates and device instance parameters, enabling standardized instantiation access for operating devices from different manufacturers and of different models. Through a two-layer interface model consisting of external service interfaces and internal target interfaces of the traffic management business system, along with interface-level and parameter-level mapping relationships, it achieves decoupling and interface capability reuse between the external calling platform and the internal interfaces of traffic management. Furthermore, after determining the internal target interfaces, it dynamically selects intra-domain or cross-domain interface call links based on the network security domain to which the external calling platform and the target traffic management business system belong, thereby enabling collaborative calling and secure data exchange between heterogeneous equipment, related business systems, and the traffic management business system in multi-security domain environments such as the traffic management intranet, video private network, and social private network.

[0159] Using the technical solution of this application, model-level parameter templates containing communication protocols, data formats, common parameters, and unique parameters are established for different equipment models. A unique template is determined based on the equipment model identifier, and then combined with instance parameters to generate instance access configuration. A two-layer interface model consisting of external service interfaces and internal target interfaces of the traffic management business system is established. External calls and internal traffic management interfaces are decoupled through interface authorization relationships, interface mapping relationships, and parameter mapping rules. During interface calls, the intra-domain or cross-domain call link is dynamically determined based on the network security domain of the external calling platform and the network security domain of the traffic management business system corresponding to the internal target interface. When cross-domain transmission is required, a cross-domain data transmission task is generated, and data encapsulation, encryption, isolation exchange, verification, decryption, and parsing are completed. This enables standardized access for heterogeneous operating equipment, reuse of traffic management business interfaces, and dynamic collaborative calls in multi-security-domain environments. This application can improve the access reuse capability of heterogeneous equipment, reduce the coupling degree between the external calling system and the internal traffic management interface, and improve the flexibility and traceability of multi-security-domain interface calls and data exchange.

Claims

1. A method for unified access and collaborative management of heterogeneous operating equipment across multiple security domains, characterized in that, It includes the following steps: S1: Construct a unified access and collaborative management system for multi-safety domain operating equipment, denoted as: management system, and set up the management system between the external third-party calling platform and the traffic management business system; The control system receives login requests submitted by users, performs user authentication, and verifies access permissions based on user identity information and permission information. S2: Construct a hierarchical parameter system to manage the access of work equipment; The operational equipment includes: operational equipment and its associated external equipment business system; wherein, the operational equipment is a hardware device for performing data acquisition or on-site operations, and the associated external equipment business system is a software business system that is compatible with the operational equipment for receiving or processing data from the operational equipment. The hierarchical parameter system includes: model-level parameter templates and equipment instance registration information; The equipment provider, equipment model, equipment instance, and associated external equipment business system are registered. The model-level parameter template is established for different equipment models. The model-level parameter template is called according to the equipment model corresponding to the equipment instance. The equipment instance access configuration is generated by combining the instance-level parameters corresponding to the equipment instance registration information. The working equipment can access the management system through its associated external equipment business system according to the equipment instance access configuration. S3: Execute interface collaborative management. The control system registers the external third-party calling platform, the external service interface of the control system, and the internal target interface of the traffic management business system. It establishes the authorization relationship between the external third-party calling platform and the external service interface of the control system, as well as the interface mapping relationship and parameter mapping rules between the external service interface of the control system and the internal target interface of the traffic management business system. The management and control system receives the interface call request initiated by the external third-party calling platform for the external service interface, and completes identity verification, access verification, internal target interface determination and request parameter conversion according to the authorization relationship, the interface mapping relationship and the parameter mapping rules; S4: After determining the internal target interface corresponding to the external third-party calling platform, confirm the network security domain to which the external third-party calling platform belongs, and confirm the network security domain to which the traffic management business system corresponding to the internal target interface belongs; compare the two network security domains, and determine the type of this interface call link; When both belong to the same network security domain, the interface call is completed within the current network security domain; When the two belong to different network security domains, a cross-domain data transmission task is generated and cross-domain data exchange is performed.

2. The method for unified access and collaborative management of heterogeneous operating equipment with multiple security domains according to claim 1, characterized in that: Step S2, the equipment access management operation includes the following steps: B1: Register the equipment provider and equipment model, establish the association between the equipment provider and equipment model, and create a corresponding model-level parameter template for each equipment model; The model-level parameter template includes: communication protocol, data format, common parameters, and unique parameters; wherein, the common parameters are used to describe equipment attributes common to the same type of work equipment, and the unique parameters are used to describe special attributes that distinguish the corresponding equipment model from other equipment models; B2: Receive equipment instance registration information for the operating equipment. The equipment instance registration information includes at least: equipment serial number, equipment model identifier, user unit, deployment address, network address, and network security domain. Obtain the corresponding model-level parameter template based on the device model identifier, and combine the model-level parameter template with the device instance registration information to generate a device access configuration for the device instance, while assigning a unique device identifier to the device instance; B3: Register the external equipment business systems associated with the operating equipment, assign system identifiers to the external equipment business systems, and establish the association between the external equipment business systems, equipment instances, equipment models, equipment providers, and their respective network security domains; the association is used to determine the identity information, network address, and network security domain of the external equipment business systems associated with the operating equipment during subsequent interface calls. B4: The operating equipment connects to the management and control system through its associated external equipment business system according to the equipment access configuration, and uploads equipment identification, equipment status data or business data; the management and control system receives activation information and operation information sent by the operating equipment or its associated external equipment business system, and updates the equipment operation status according to the activation information and operation information.

3. The method for unified access and collaborative management of heterogeneous operating equipment in multiple security domains according to claim 1, characterized in that: Step S3, the interface collaborative management operation includes the following steps: C1: The unified business call interface provided by the management and control system to the external third-party call platform is referred to as the external service interface; The interface provided by the traffic management business system to the control system for calling data or services is denoted as: internal target interface; Register the external third-party calling platform, the external service interface, and the internal target interface, and assign a unique identifier to each of them; C2: Receives access permission requests submitted by external third-party calling platforms for the external service interface, and establishes an authorization relationship between the external third-party calling platform and the external service interface after approval, so that the external third-party calling platform can only access the corresponding traffic management business services through the authorized external service interface; C3: Configure internal target interface configuration information, which includes: call address, request method, request parameters, response parameters, and access rules; establish the interface mapping relationship between the external service interface and the internal target interface, and configure the parameter-level mapping relationship between the external service interface and the internal target interface, which includes: request parameter mapping rules and response parameter mapping rules; The request parameter mapping rule is used to convert the external request parameters submitted by the external calling platform according to the external service interface into the internal request parameters required by the internal target interface; the response parameter mapping rule is used to convert the internal response parameters returned by the internal target interface into the external response parameters corresponding to the external service interface. C4: Receives the interface call request initiated by the external third-party calling platform for the external service interface; verifies the interface call request based on the external third-party calling platform's registration information; performs access verification according to the authorization relationship; after successful verification, determines the corresponding internal target interface according to the interface mapping relationship; converts the request parameters of the external service interface into the request parameters corresponding to the internal target interface according to the request parameter mapping rules; after obtaining the response data returned by the internal target interface, converts the response parameters of the internal target interface into the response parameters corresponding to the external service interface according to the response parameter mapping rules, and returns them to the external third-party calling platform.

4. The method for unified access and collaborative management of heterogeneous operating equipment in multiple security domains according to claim 3, characterized in that: In step S3, also Includes the following steps: C5: When the call address, request parameters, response parameters or access rules of the target interface inside the traffic management business system change, the corresponding internal target interface configuration or parameter mapping rules are updated so that the external third-party calling platform can continue to call the interface according to the original external service interface and its calling method.

5. The method for unified access and collaborative management of heterogeneous operating equipment with multiple security domains according to claim 1, characterized in that: Step S4 specifically includes the following steps: D1: Obtain the source network security domain identifier of the external third-party calling platform based on the external third-party calling platform filing information, determine the internal target interface corresponding to the external third-party calling platform based on the interface mapping relationship, find the traffic management business system registration information corresponding to the internal target interface, and obtain the target network security domain identifier. Compare the source network security domain identifier with the target network security domain identifier; When the two are consistent, the intra-domain interface call link is selected, and the interface request data after parameter conversion is sent to the internal target interface within the current network security domain to realize data transmission. When the two are inconsistent, select the cross-domain interface call chain, generate a cross-domain data transmission task, assign a transmission task identifier to the cross-domain data transmission task, and establish an association between the cross-domain data transmission task and the current interface call record; execute step D2. D2: Perform format, size, and integrity checks on the interface data to be transmitted across domains. Encapsulate the interface data that passes the checks with the transmission task identifier, the source network security domain identifier, the target network security domain identifier, the data type, and the data generation time, and encrypt it according to the preset encryption rules to form a cross-domain transmission data packet and the corresponding integrity check information. D3: Transmit the cross-domain data packet from the switching location corresponding to the source network security domain to the switching location corresponding to the target network security domain through a secure isolation switching device; D4: The target network security domain determines the corresponding cross-domain data transmission task based on the transmission task identifier, performs integrity verification, decryption, and parsing on the received cross-domain transmission data packet; when the parsed data is interface request data, it determines the corresponding internal target interface in the target network security domain based on the interface call record associated with the cross-domain data transmission task, and sends the interface request data to the internal target interface.

6. A unified access and collaborative management system for heterogeneous operating equipment across multiple security domains, characterized in that, It includes: The module includes identity authentication and access control, equipment management, interface collaboration management, and cross-domain data exchange. The identity authentication and access control module is used to authenticate the user's identity and verify the access request's permissions based on the user's identity information and permission information. The equipment management module is used to uniformly register the operating equipment and its associated external equipment business systems, and to establish the association between equipment providers, equipment models, equipment instances and associated external equipment business systems. For different equipment models, model-level access parameters are maintained. These model-level access parameters include: communication protocol, data format, common parameters, and unique parameters. The model-level access parameters are called according to the equipment model corresponding to the equipment instance. Combined with the instance-level parameters corresponding to the equipment instance, the equipment access configuration for that equipment instance is generated. This enables the working equipment to access this system through its associated external equipment business system according to the equipment access configuration, and to maintain the operating status of the working equipment. The interface collaboration management module is used to register external third-party calling platforms, external service interfaces provided by this system to external third-party calling platforms, and internal target interfaces provided by the traffic management business system to this system; establish authorization relationships between external third-party calling platforms and external service interfaces, as well as interface mapping relationships and parameter mapping rules between external service interfaces and internal target interfaces; upon receiving an interface call request initiated by an external third-party calling platform for an external service interface, it performs access verification according to the authorization relationship, determines the corresponding internal target interface according to the interface mapping relationship, and completes request parameter conversion and response parameter conversion between external service interfaces and internal target interfaces according to the parameter mapping rules. The cross-domain data exchange module is used to determine the interface call link based on the network security domain of the external third-party calling platform and the network security domain of the traffic management business system corresponding to the internal target interface after the interface collaboration management module determines the internal target interface; when the two belong to the same network security domain, the intra-domain interface call link is used; when the two belong to different network security domains, a cross-domain data transmission task is generated and cross-domain data exchange is performed.

7. The unified access and collaborative management system for heterogeneous operating equipment with multiple security domains according to claim 6, characterized in that: The equipment management module includes: a provider registration unit, an equipment model maintenance unit, an equipment instance registration unit, a system information registration unit, and an equipment status management unit; The provider registration unit is used to register the provider information of the operating equipment or associated external equipment business system, and to assign a provider identifier to each provider; the provider information includes the provider name, provider type and the operating equipment or external equipment business system information provided. The equipment model maintenance unit is used to register the equipment type, model name, manufacturer, and corresponding model-level access parameters of the operating equipment, and to assign equipment model identifiers to different equipment models, establishing an association between equipment models and equipment providers. The model-level access parameters form a model-level parameter template for the corresponding equipment model. The model-level parameter template includes at least a communication protocol, data format, common parameters, and unique parameters. The common parameters are used to describe equipment attributes shared by similar types of operating equipment, and the unique parameters are used to describe the special attributes that distinguish the corresponding equipment model from other equipment models. The device instance registration unit is used to receive device instance registration information for specific operating devices. The device instance registration information includes at least the device serial number, device model identifier, user unit, deployment address, network address, and network security domain. The device instance registration unit obtains the corresponding model-level parameter template based on the device model identifier in the device instance registration information, combines the model-level parameter template with the instance-level parameters in the device instance registration information to form a device access configuration for the device instance, assigns a unique device identifier to the device instance, and establishes the association between the device instance, device model, and device provider. The system information registration unit is used to register the basic information of external equipment business systems associated with the operating equipment, and to assign a unique system identifier to each business system. The basic information of the business system includes the system name, user unit, provider, server network address, operating status, network security domain, and associated device identifier. The system information registration unit is also used to establish the association between business systems, providers, equipment instances, and network security domains. The equipment status management unit is used to receive equipment activation information and periodic operation information sent by the operating equipment or its associated external equipment business system, and dynamically update the operating status of the operating equipment according to the equipment identifier, heartbeat reception time, equipment operating parameters and data upload status. The operating status includes at least one of the following: activated, online, offline, abnormal and deactivated.

8. The unified access and collaborative management system for heterogeneous operating equipment with multiple security domains according to claim 6, characterized in that: The interface collaboration management module includes: an interface filing unit, an external calling platform filing unit, an interface authorization application unit, an internal target interface configuration unit, and an interface calling unit; The interface registration unit is used to register the basic information of the external service interfaces provided by this system to external third-party calling platforms and the internal target interfaces provided by the traffic management business system to this system, and to assign a unique interface identifier to each interface; the basic interface information includes: interface name, interface type, interface address and operation type; The external calling platform registration unit is used to register the basic information of external calling platforms that access this system and to assign a unique platform identifier to each external third-party calling platform; the basic information of the external calling platform includes at least the platform name, network address, network security domain to which it belongs, and information used for authentication. The interface authorization application unit is used to receive access permission applications submitted by external third-party calling platforms for external service interfaces, record the applying platform, the applying interface, the scope of permission, and the review status, and review the access permission application; if the review is successful, an authorization relationship is established between the external third-party calling platform and the external service interface, enabling the external third-party calling platform to obtain access permission to the corresponding external service interface; if the review fails, the access permission application is rejected and the review result is recorded. The internal target interface configuration unit is used to maintain the calling address, request method, request parameters, response parameters, and access rules of the internal target interfaces of the traffic management business system, and to establish the interface mapping relationship between the external service interfaces of this system and the internal target interfaces of the traffic management business system. The interface mapping relationship includes: interface-level mapping relationship and parameter-level mapping relationship. The interface-level mapping relationship is used to determine the corresponding internal target interface according to the external service interface. The parameter-level mapping relationship includes request parameter mapping rules and response parameter mapping rules. The request parameter mapping rules are used to convert the external request parameters submitted by the external third-party calling platform according to the external service interface into the internal request parameters corresponding to the internal target interface. The response parameter mapping rules are used to convert the internal response parameters returned by the internal target interface into the external response parameters corresponding to the external service interface. The interface invocation unit is used to receive interface invocation requests initiated by an external third-party invocation platform for external service interfaces, and to perform identity verification and access validation based on the platform's filing information and interface authorization relationship. After successful validation, the unit determines the corresponding internal target interface based on the interface-level mapping relationship, and converts the external request parameters corresponding to the external service interface into the internal request parameters corresponding to the internal target interface according to the request parameter mapping rules. After obtaining the response data returned by the internal target interface, the unit converts the internal response parameters into the external response parameters corresponding to the external service interface according to the response parameter mapping rules, and returns the data to the external third-party invocation platform.

9. The unified access and collaborative management system for heterogeneous operating equipment with multiple security domains according to claim 6, characterized in that: The cross-domain data exchange module includes: a security domain determination unit, a transmission task generation unit, a data preprocessing unit, a data encryption unit, a data sending unit, a data receiving unit, and a data processing unit; The security domain determination unit is used to obtain the source network security domain identifier of the external third-party calling platform based on the external calling platform filing information, obtain the registration information of the corresponding traffic management business system based on the internal target interface determined by the interface collaboration management module, obtain the target network security domain identifier based on the traffic management business system registration information, and compare the source network security domain identifier with the target network security domain identifier. When the source network security domain identifier is consistent with the target network security domain identifier, the security domain determination unit determines to use an intra-domain interface call link and sends the interface request data after parameter conversion to the corresponding internal target interface within the current network security domain; when the source network security domain identifier is inconsistent with the target network security domain identifier, the security domain determination unit determines to use a cross-domain interface call link. The transmission task generation unit is used to generate a cross-domain data transmission task when using a cross-domain interface call link, assign a unique transmission task identifier to the cross-domain data transmission task, and establish an association between the cross-domain data transmission task and the corresponding interface call record. The data preprocessing unit is used to classify the interface data to be transmitted across domains according to the data type, verify the data format, data size and integrity of the interface data to be transmitted, and encapsulate the verified interface data with the transmission task identifier, source network security domain identifier, target network security domain identifier, data type and data generation time to form a data packet to be encrypted and transmitted. The data encryption unit is used to encrypt the data packet to be encrypted according to a preset encryption rule, and generate verification information for verifying the integrity of cross-domain transmitted data, thus forming a cross-domain transmitted data packet. The data sending unit is used to write the cross-domain transmission data packet into the switching location corresponding to the source network security domain, and transmit the cross-domain transmission data packet to the switching location corresponding to the target network security domain through a secure isolation switching device; The data receiving unit is used to read the cross-domain transmission data packet from the exchange location corresponding to the target network security domain, and determine the corresponding cross-domain data transmission task and the interface call record associated with the cross-domain data transmission task according to the transmission task identifier; The data processing unit is used to perform integrity verification, decryption, and parsing of the received cross-domain transmission data packets in the target network security domain, and to perform corresponding processing according to the data type obtained from the parsing. When the parsed data is interface request data, the corresponding internal target interface is determined according to the interface call record associated with the cross-domain data transmission task, and the parsed interface request data is sent to the internal target interface. When the parsed data is interface response data, the corresponding external third-party calling platform is determined according to the interface call record associated with the cross-domain data transmission task, and the interface response data is returned to the external third-party calling platform; When the parsed data is business data that needs to be saved, it is classified and stored according to the data type of the business data. When the interface response data returned by the internal target interface needs to be returned from the network security domain where the traffic management business system is located to another network security domain where the external third-party calling platform is located, the network security domain where the traffic management business system is located is taken as the new source network security domain, the network security domain where the external third-party calling platform is located is taken as the new target network security domain, and the interface call link is redefined for the interface response data; when cross-domain transmission is required, a corresponding reverse cross-domain data transmission task is generated and cross-domain data exchange is performed.

Images