Ethernet terminal zero-touch auto-configuration method and system based on identity mapping

Abstract

The application discloses an identity mapping-based Ethernet terminal zero-contact automatic configuration method and system, relates to the technical field of industrial Ethernet communication, and comprises the following steps: broadcasting a detection message to a terminal to be configured at a link layer, receiving a response message carrying a unique identifier returned by the terminal in a scattered time window, allocating a temporary address to the terminal from a temporary address pool based on a concurrent session limit to establish a unicast communication session, issuing target network parameters based on the unique identifier in the session and receiving write confirmation information, recycling the temporary address and instructing the terminal to switch to the target network parameters to enter a service running state after verification, and the beneficial effects are that the configuration host can safely, reliably and without conflict complete the automatic writing of unique network parameters of each terminal under the condition that all newly-accessed terminals share the same factory default IP address, and there is no standard DHCP service and external connection in the network.

Description

Technical Field

[0001] This invention relates to the field of industrial Ethernet communication technology, and in particular to a zero-contact automatic configuration method and system for Ethernet terminals based on identity mapping. Background Technology

[0002] In closed Ethernet environments such as ship engine rooms, industrial production lines, and mines, configuring network parameters for Ethernet communication terminals typically faces the following unique combination of challenges:

[0003] First, the network is closed and lacks DHCP service. Due to the requirements of deterministic address allocation and security isolation in industrial control networks, such networks are typically not allowed to deploy standard DHCP services and are not connected to the public network (no cloud connection).

[0004] Second, terminals may be powered on in batches simultaneously. Due to the influence of the operating environment (such as the starting of the ship's main generator or shift changes on the production line), a large number of terminals often power on at the same time.

[0005] Third, there is a conflict with the default IP address. Due to the wide variety of terminals and different supply batches, manufacturers usually pre-configure the same default IP address for terminals of the same type. This makes it impossible for the configuration host to distinguish and communicate with each terminal individually through the IP layer, and address conflicts will occur if multiple terminals are active on the network at the same time.

[0006] Given the aforementioned combination of problems, traditional manual configuration methods require engineers to carry configuration laptops, connect to each terminal individually, modify IP addresses, and verify parameter tables. This is extremely time-consuming, error-prone, and difficult to complete within a maintenance window when dealing with dozens to hundreds of terminals. Standard zero-touch deployment solutions (such as Cisco PnP and standard DHCP / BOOTP) rely on the presence of a DHCP server or a reachable cloud controller within the network, making them unsuitable for such closed networks. Summary of the Invention

[0007] In view of the above-mentioned prior art, this application is proposed. The embodiments of this application provide an Ethernet terminal zero-contact automatic configuration method and system based on identity mapping. It enables the configuration host to securely, reliably, and conflict-free automatically write unique network parameters for each terminal under the condition that all newly accessed terminals share the same factory default IP address and there is no standard DHCP service or external connection in the network. It also ensures the stability of the configuration process and the overall availability of the network in scenarios where terminals are powered on in batches.

[0008] According to one aspect of this application, a zero-contact automatic configuration method for Ethernet terminals based on identity mapping is provided, applied to a configuration host in a closed Ethernet environment. The environment further includes multiple terminals to be configured, each pre-configured with a unified default IP address. The configuration host pre-stores a mapping relationship between the unique identifier of each terminal to be configured and target network parameters. The method includes: broadcasting probe messages to the terminals to be configured at the link layer; receiving response messages carrying their unique identifiers from the terminals to be configured via unicast frames within a dispersed time window after the probe messages are sent; determining the terminals to be configured that will obtain session slots based on the currently allowed concurrent session limit; and reserving session slots for the terminals to be configured from a temporary address pool independent of the service address range. The terminal is assigned a temporary address, and a session allocation message carrying the temporary address is sent to it at the link layer to instruct it to switch its network interface from the default IP address to the temporary address and establish a unicast communication session. In the unicast communication session, the corresponding target network parameters are queried based on the received unique identifier and sent to the terminal to be configured for local writing, and the terminal to be configured receives the write confirmation information returned by the terminal to be configured for the write result. In response to the successful verification of the write confirmation information, the temporary address is reclaimed to the temporary address pool, and an activation command is sent to the terminal to be configured to instruct the terminal to be configured to release the temporary address and switch the network interface to enter the service operation state according to the target network parameters.

[0009] According to another aspect of this application, an Ethernet terminal zero-contact automatic configuration system based on identity mapping is provided, comprising: a probe broadcast module for broadcasting probe messages to a terminal to be configured at the link layer; an acknowledgment receiving module for receiving an acknowledgment message carrying its unique identifier, sent back by the terminal to be configured in unicast frames from the link layer within a dispersed time window after the probe message is sent; and a session allocation module for determining the terminal to be configured that will obtain a session quota based on the currently allowed concurrent session limit, allocating a temporary address to the terminal to be configured that has obtained a session quota from a temporary address pool independent of the service address range, and sending a session allocation message carrying the temporary address to it at the link layer. The system is configured to instruct the terminal to switch its network interface from the default IP address to the temporary address and establish a unicast communication session; a parameter distribution module is configured to query the corresponding target network parameters based on the received unique identifier in the unicast communication session and distribute them to the terminal to be configured for local writing, and receive the write confirmation information returned by the terminal to be configured for the write result; an activation control module is configured to, in response to the successful verification of the write confirmation information, reclaim the temporary address to the temporary address pool, and send an activation instruction to the terminal to be configured to instruct the terminal to release the temporary address and switch the network interface to enter the service operation state according to the target network parameters.

[0010] According to another aspect of this application, an electronic device is provided, including a memory and a processor, the memory being used to store computer-executable instructions, and the processor being used to execute the computer-executable instructions, which, when executed by the processor, implement the steps of the method described above.

[0011] According to another aspect of this application, a computer-readable storage medium is provided that stores computer-executable instructions thereon, which, when executed by a processor, implement the steps of the method described above.

[0012] Compared with the prior art, the Ethernet terminal zero-contact automatic configuration method and system based on identity mapping according to the embodiments of this application can solve the address conflict and indistinguishability problem caused by multiple terminals holding the same factory default IP in a closed Ethernet environment without DHCP service and without access to the public network through link layer communication, and cope with the network stability challenges in the scenario of batch simultaneous power-on through temporary address isolation and adaptive flow control, thereby replacing the traditional manual configuration method for each terminal and realizing the automated deployment of terminal network parameters. Attached Figure Description

[0013] The above and other objects, features, and advantages of this application will become more apparent from the more detailed description of the embodiments of this application in conjunction with the accompanying drawings. The drawings are provided to further illustrate the embodiments of this application and form part of the specification. They are used together with the embodiments of this application to explain this application and do not constitute a limitation thereof. In the drawings, the same reference numerals generally represent the same components or steps.

[0014] Figure 1 This is a flowchart of the Ethernet terminal zero-contact automatic configuration method based on identity mapping according to the present invention.

[0015] Figure 2 This is a block diagram of the Ethernet terminal zero-contact automatic configuration system based on identity mapping according to the present invention.

[0016] Figure 3 This is a block diagram of an electronic device according to the present invention. Detailed Implementation

[0017] Hereinafter, exemplary embodiments according to this application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of this application, and not all embodiments of this application. It should be understood that this application is not limited to the exemplary embodiments described herein.

[0018] Exemplary method:

[0019] The embodiments of this application will now be described in detail with reference to the accompanying drawings.

[0020] Figure 1 The illustration shows a zero-contact automatic configuration method for Ethernet terminals based on identity mapping according to an embodiment of this application, including steps S1 to S5. The method is applied to a configuration host in a closed Ethernet environment. The environment also includes multiple terminals to be configured with a pre-set unified default IP address. The configuration host pre-stores the mapping relationship between the unique identifier of each terminal to be configured and the target network parameters.

[0021] For ease of understanding, this example uses the deployment scenario of a ship's engine room control network. Assume the ship's engine room control network is a closed Ethernet environment, without a standard DHCP server and without access to the shore-based public network. The engine room control zone contains eight Ethernet communication terminals: two steering gear control terminals, three main engine speed monitoring terminals, and three environmental temperature and humidity sensors. Their default factory IP addresses are all 192.168.0.254 / 24. Each terminal carries a globally unique device serial number as its unique identifier and a pre-installed trusted root certificate for verifying the configuration host's identity signature, but does not carry a zone number or other customized information related to the deployment scenario. The configuration host is deployed in the ship's central control room, with a fixed IP address of 10.0.0.1. It has imported a mapping dictionary compiled by the system integrator, recording the unique identifiers of the eight terminals and their respective target network parameters.

[0022] After the ship's main generator starts, the engine room power distribution circuit closes, and the eight terminals are powered on almost simultaneously. The following steps describe how the configuration host completes the automated network parameter configuration for all terminals.

[0023] like Figure 1 As shown, in step S1, a probe message is broadcast to the terminal to be configured at the link layer.

[0024] In a closed industrial Ethernet environment, since all terminals to be configured share the same default IP address, sending probe messages through the IP layer presents two problems: first, the configuration host cannot distinguish the source of each terminal's response at the IP layer because all responses originate from the same IP address; second, multiple terminals simultaneously holding the same IP address will cause address conflicts at the IP layer, leading to unreliable communication. Therefore, in this application, the configuration host uses Ethernet link layer broadcast probe messages. Link layer communication uses MAC addresses as addressing identifiers, and each terminal's MAC address is globally unique—in the aforementioned example, although the eight terminals share the same IP address 192.168.0.254, their MAC addresses are all different (e.g., AA:BB:CC:00:00:01 to AA:BB:CC:00:00:08). The configuration host can uniquely distinguish each terminal through the source MAC address of subsequent response frames, fundamentally avoiding the conflict problem caused by the same default IP.

[0025] Specifically, the configuration host sends probe packets in the form of Ethernet link layer broadcast frames, with the destination MAC address being FF:FF:FF:FF:FF:FF, and the frame type field using a custom EtherType value defined in this method. The payload of the probe packet includes: the configuration host identity signature (a digital signature of the packet content based on the configuration host's pre-configured private key, used by the terminal to verify the legitimacy of the probe source), the current discovery round number (a monotonically increasing sequence number used by the terminal for deduplication and replay protection), the upper limit of the dispersion time window (a parameter determined by the configuration host based on the current network status, used to guide the terminal to adjust the maximum waiting time before responding; when the network is congested, the configuration host can increase this value to make the terminal responses more dispersed), and the current timestamp.

[0026] Furthermore, in closed industrial networks, the network is typically divided into multiple switching partitions based on physical areas or functional units, each corresponding to an independent Layer 2 broadcast domain or VLAN. Taking a ship's network as an example, typical partitions include engine room control partitions, bridge navigation partitions, cargo hold monitoring partitions, and living quarters network partitions. A key physical characteristic of these partitions is that terminals within the same partition are powered by the same power distribution circuit. Therefore, devices within the same partition tend to power on or off almost simultaneously, while there are usually significant intervals between the power-on and power-off times of different partitions. If the configuration host indiscriminately broadcasts probe packets to the entire network, terminals in all partitions may respond simultaneously, and the superimposed response packets may cause link congestion.

[0027] Therefore, in a preferred embodiment, the configuration host sends probe packets in a targeted manner according to a partition polling strategy. Specifically, broadcasting probe packets to the terminal to be configured at the link layer includes: determining the physical reachability range of the probe packets as the current target partition according to a preset partition polling strategy; and broadcasting probe packets to the current target partition in a targeted manner through at least one network-side control method among physical interface targeted sending, virtual LAN VLAN targeted sending, and switch port group targeted sending, so that only the terminal to be configured in the current target partition receives the probe packets at any given time.

[0028] It should be noted that partition identification is performed by the configuration host from the network side, and does not rely on the terminal carrying partition information itself. The configuration host infers the terminal's partition affiliation through one or more of the following network-side information:

[0029] The first method is switch port topology mapping. The configuration host pre-stores a port-partition mapping table compiled by the system integrator based on the cabling topology. The configuration host determines the switch port accessed by the terminal through the MAC address forwarding table of the switch or the physical interface of the terminal response frame, and then maps it to the partition.

[0030] The second method is LLDP neighbor information. If the access layer switch supports the Link Layer Discovery Protocol (LLDP), the configuration host can obtain the switch identifier and port identifier directly connected to the terminal through LLDP, thereby determining the partition affiliation.

[0031] The third method is to configure the host to have multiple physical interfaces for isolation. The host is configured to connect to switches in different partitions through multiple physical network interfaces. The partition where the terminal is located can be directly determined from which response frame is received.

[0032] The above three methods can be selected or combined according to deployment conditions. The core principle is that partition identification is the responsibility of the configuration host, and the terminal is completely unaware of it.

[0033] Regarding the order of partition polling, if the mapping dictionary pre-stores power-on timing hints between partitions (e.g., "the bridge partition is usually powered on about 3 minutes after the engine room partition," which is provided by the system integrator based on the power distribution system design), the configuration host can optimize the polling arrangement accordingly.

[0034] Furthermore, upon receiving a response from the terminal, the configuration host determines the terminal's actual physical access location using the aforementioned network-side partition identification mechanism and compares it with the planned partitions pre-stored in the mapping dictionary. If there is a discrepancy (for example, a terminal that should have been installed in the engine room is mistakenly installed in the cockpit partition), the configuration host records a partition deviation alarm, and the operations and maintenance personnel decide whether to continue configuring or adjust the mapping dictionary. This verification incidentally provides the deployment process with automatic verification capabilities for the terminal installation location.

[0035] return Figure 1 In step S2, the terminal to be configured receives a response message carrying its unique identifier, sent back from the link layer as a unicast frame within a dispersed time window after the probe message is sent.

[0036] In this step, the terminal to be configured does not immediately send back a response after receiving the probe message. Instead, each terminal sends back a response after waiting for different delays within a dispersed time window. This staggers the responses of each terminal on the timeline, avoiding link congestion caused by all terminals responding at the same time.

[0037] After powering on, the terminal enters a configuration-ready state (hereinafter referred to as the sleep-waiting state). In this state, it holds the factory default IP address but does not actively initiate any network communication—it does not send ARP requests, broadcast messages, or respond to service layer data. The terminal's network interface is physically enabled but logically silent. The terminal starts a random delay timer locally. The delay value is calculated based on the low-order byte of the terminal's MAC address and a hardware random seed, and its range is the lower limit T of the dispersed time window. min (Typical value 0.5 seconds) to upper limit T max(Typical value 30 seconds). Due to the different MAC addresses of different terminals, the latency values ​​of each terminal are statistically evenly distributed throughout the window.

[0038] It should be noted that the calculation of the above random delay differs between the first power-on and subsequent power-on events. When a terminal powers on for the first time (when its local non-volatile memory does not contain information written during previous configuration processes), all terminals use the same distributed time window range, and the delay value is determined solely by the MAC address and the hardware random seed; the order in which terminals are discovered is random. When a terminal powers on subsequent power-ons (when it has completed at least one round of configuration processes, and its local non-volatile memory already contains information written during previous configuration processes), a weighting coefficient is introduced in the delay calculation, compressing the distributed time window of a specific terminal to a narrower range, thus prioritizing its entry into the discoverable state.

[0039] After the random delay timer expires, the terminal transitions from the delay waiting phase to the listen-ready phase and begins responding to probe messages. When the terminal receives a probe message from the configuration host and simultaneously meets the following conditions, it sends a response message back to the configuration host: the configuration host's identity signature verification is successful; and the message round number is greater than the maximum round number the terminal has already responded to. The response message is sent as a link-layer unicast frame, with the destination MAC address being the configuration host's MAC address (not a broadcast), and the payload containing the terminal device's unique identifier, the terminal's MAC address, and the round number already responded to.

[0040] This section requires further explanation of the message processing rules for the terminal during the delay waiting phase (i.e., before the random delay timer expires). During this phase, although the terminal does not send any messages, it continuously and passively listens to Ethernet link layer frames and performs strictly differentiated processing on different types of messages:

[0041] For probe messages: The terminal receives and parses them, extracts the upper limit of the dispersed time window and the configuration host identity signature from the payload. If the signature verification passes and the upper limit is different from the value currently used by the terminal, the terminal silently updates the local upper limit parameter of the dispersed time window, but does not send back a response message or generate any external communication.

[0042] For the silent command (a flow control command broadcast by the configuration host when the network is congested): after the terminal receives and verifies the configuration host signature, it silently performs local operations (resets the delay timer and expands the distributed time window as required by the command), without generating any external communication;

[0043] For all other message types (including ARP requests, business data frames, etc.): discard, do not process, do not respond.

[0044] The core principle of the above rules is that during the delay waiting phase, terminals can passively receive probe messages and flow control commands and silently update their local parameters, but they must not engage in any external communication. "Not initiating communication" and "not receiving information" are two different constraints; terminals adhere to the former but not the latter during this phase. This distinction is crucial—if a terminal does not receive any messages at all during the delay waiting phase, the configuration host cannot influence the waiting behavior of terminals whose time windows have not yet expired through the upper limit of the dispersed time window carried in the probe messages. Subsequent adaptive flow control will not reach these terminals, and the control loop will break. Conversely, if a terminal engages in external communication due to receiving messages, in a scenario where dozens of terminals are simultaneously in the delay waiting phase, these response messages themselves will constitute additional network load, violating the original intention of the silent design of the dormant waiting state.

[0045] In scenarios involving a large number of terminals powering on in batches, even with random delay mechanisms to distribute response time, a large number of terminals may still respond simultaneously within a short period, or network congestion may cause established configuration sessions to frequently time out and roll back. To address this, the configuration host performs adaptive flow control based on real-time network conditions, dynamically adjusting the configuration rhythm. In a preferred embodiment, probe packets carry an upper limit for the distributed time window, and the configuration host maintains the following monitoring metrics for the current target partition: the number of response packets received per unit time (reflecting the density of currently incoming terminals to be configured), the number of detected link collision events (reflecting the degree of interference caused by the same default IP at the link layer), and the number of session timeout rollbacks (reflecting the degree of congestion or reliability degradation of the configuration channel).

[0046] It should be noted that the configuration host also maintains a timeout count for each active session. If the expected response message from the terminal is not received within the session timeout period, the configuration host determines that the session has timed out and failed, reclaims the corresponding temporary address, and decrements the active session count by one. This event is counted in the aforementioned session timeout rollback count.

[0047] Configure the host to adjust three control parameters based on the above monitoring indicators: concurrent session limit, probe packet sending period, and upper limit of the distributed time window.

[0048] When the number of response messages exceeds the preset first threshold, or the number of link conflict events exceeds the preset second threshold, the concurrent session limit is reduced (reducing the number of configuration sessions running simultaneously), the transmission period of probe messages is extended (reducing the broadcast probe frequency to free up bandwidth for existing configuration sessions), and the upper limit of the dispersion time window is increased (by carrying a larger upper limit value in the probe messages, the terminals that are still in the delay waiting phase can silently update their parameters and then disperse their responses within a wider window).

[0049] When the number of session timeout rollbacks exceeds a preset third threshold, the broadcast of probe packets to the current target partition stops, and a silence command is broadcast. The silence command is sent in the form of a link-layer broadcast frame. Terminals in the sleep waiting state passively receive the command and silently reset the random delay timer and recalculate the waiting delay with the increased upper limit value. Terminals in the listen-ready state receive the command and fall back to the delay waiting state, recalculating the waiting delay with the increased upper limit value. During the entire process, the terminal does not generate any external packets. After the configuration host waits for a preset cooldown period (typically 60 to 120 seconds), it re-broadcasts probe packets to the current target partition with the preset minimum concurrent session limit, gradually restoring the configuration rhythm.

[0050] The adjustments to the three control parameters described above form a linked negative feedback control loop: reducing the concurrent session limit → reducing simultaneous configuration sessions → reducing network load → increasing session success rate → gradually restoring the concurrent session limit; extending the transmission cycle → reducing broadcast probe frequency → reducing the influx of new terminals → existing sessions gain more bandwidth → gradually restoring the transmission cycle; increasing the upper limit of the dispersion time window → waiting terminal responses are more dispersed → the response density in the next round is reduced → new session establishment is more relaxed → gradually restoring the upper limit. The simultaneous action of these three feedback paths enables the system to automatically converge to a stable configuration throughput rhythm when facing various scale scenarios from one to hundreds of terminals powering on simultaneously. This avoids both overly conservative approaches leading to low configuration efficiency and overly aggressive approaches causing link congestion or widespread session timeouts.

[0051] return Figure 1 In step S3, the terminal to be configured to obtain a session quota is determined based on the current allowed concurrent session quota. A temporary address is allocated to the terminal to be configured to obtain a session quota from a temporary address pool that is independent of the service address range. A session allocation message carrying the temporary address is sent to the terminal at the link layer to instruct it to switch the network interface from the default IP address to the temporary address and establish a unicast communication session.

[0052] In this step, after receiving the response message from the terminal, the configuration host does not immediately establish configuration sessions for all responding terminals simultaneously. Instead, it controls the number of concurrent sessions based on the currently allowed concurrent session limit. The purpose of the concurrent session limit is to prevent too many terminals from simultaneously entering the configuration process, which could lead to network bandwidth exhaustion and overload of the configuration host's processing capacity. This limit is dynamically adjusted by the configuration host according to the monitoring indicators described in step S2.

[0053] When selecting a terminal from multiple responding terminals to receive a session slot, a basic implementation is to allocate slots according to the arrival time of the response messages. However, in closed industrial networks, the functional roles and security importance of different terminals within the business system often differ significantly—even a one-second delay in network configuration for a ship's steering gear control terminal poses a navigation safety risk, while a few minutes' delay in configuration for an environmental temperature and humidity sensor does not affect system safety. If allocation is based solely on arrival time, the configuration timing of safety-critical terminals depends entirely on random delays, failing to guarantee their priority access to service.

[0054] Therefore, in a preferred embodiment, the mapping relationship includes not only the target network parameters of each terminal but also the security level information of each terminal to be configured. The security level information includes safety-critical level, operational-critical level, and general level. The security level is assigned by the system integrator when compiling the mapping dictionary based on the terminal's functional role in a specific project—the same model of sensor is labeled as safety-critical in a fire alarm system and as general in an environmental monitoring system; this decision is independent of the terminal hardware.

[0055] At this point, the configuration terminal to obtain a session quota is determined based on the current allowed concurrent session limit, including: determining whether the number of configuration terminals sending response messages in the current target partition exceeds the concurrent session limit; if so, querying the corresponding security level information based on the received unique identifier, and determining the configuration terminal to obtain a session quota in the order of security critical level taking precedence over operation critical level, and operation critical level taking precedence over general level.

[0056] The aforementioned security level priority arbitration is entirely completed on the configuration host side. After receiving the response message, the configuration host can determine the terminal's security level by querying the mapping dictionary using the unique identifier carried within. The entire arbitration process does not rely on any information carried by the terminal itself, thus it is fully effective in the initial deployment scenario. The delayed terminal does not lose its state; it remains in a dormant waiting state during the listening-ready phase and will respond again in the next round of probing.

[0057] It should be noted that the security level information mentioned above can also be used to determine the partition polling order in step S1—the configuration host prioritizes scanning partitions containing security-critical terminals based on the security level distribution of each partition in the mapping dictionary, thereby enabling the partition containing the security-critical terminal to obtain an earlier configuration opportunity as a whole.

[0058] In the aforementioned ship engine room example, the mapping dictionary indicates the safety level of each terminal: 2 steering gear control terminals are safety-critical, 3 main engine monitoring terminals are operational-critical, and 3 environmental sensors are general-level. Assuming the current concurrent session limit is 3, in step S2, the 8 terminals respond sequentially. Due to the completely random initial power-on delay, the arrival order might be: environmental sensors arrive first, followed by the 2 steering gear control terminals as the third and sixth, respectively. In the basic method without safety-level priority arbitration, the first 3 arriving terminals directly obtain a slot, while the 2 steering gear control terminals might be ranked later. However, in the preferred method using safety-level priority arbitration, after the main engine receives all responses, it queries the mapping dictionary. Regardless of the arrival order, it prioritizes allocating slots to the 2 safety-critical steering gear control terminals, and allocates the remaining slot to the earliest arriving operational-critical main engine monitoring terminal. The remaining terminals continue to wait for the next round of slot release.

[0059] For a terminal that obtains a session quota, the configuration host retrieves a free address from the reserved temporary address pool. The temporary address pool uses an address space completely isolated from the service IP address range (e.g., a subset of the 169.254.xx / 16 link-local address range), and its capacity is no less than the maximum concurrent session limit for a single partition. The reason for using a temporary address independent of the service address range is that if the target service IP is directly assigned to the terminal for session configuration, and the configuration fails and rolls back, the ARP cache in the switch and network may remain after the terminal releases the IP, affecting subsequent terminals using that IP. However, using a temporary address for session configuration ensures that the service IP address range remains unaffected regardless of whether the configuration succeeds or fails.

[0060] The configuration host also generates a time-limited session token. The token structure includes an allocation timestamp, an expiration period (equal to the session timeout duration), a hash of the target terminal's MAC address, and the configuration host's signature. This token is used for two-way authentication in all subsequent in-session message exchanges.

[0061] Subsequently, the configuration host sends a session allocation message to the terminal. This message is still sent as a link-layer unicast frame—the destination MAC address is the terminal's MAC address, not an IP-layer unicast. The reason for still using link-layer communication at this point is that the terminal's IP address is still the factory default address, the same as other terminals. If the session allocation message were sent via the IP layer, there is no guarantee that the message would reach the correct terminal. The payload of the session allocation message includes: the allocated temporary address and subnet mask, the configuration host's communication address within the temporary address range, the session token, the session timeout duration, and encryption negotiation parameters.

[0062] Furthermore, in the implementation method that adopts security level priority arbitration, the session allocation message also carries the security level information of the terminal to be configured, so as to instruct the terminal to be configured to write the security level information into local non-volatile storage, and enable the terminal to be configured to calculate its waiting delay within the distributed time window based on the security level information when it re-enters the waiting state. Among them, the waiting delay corresponding to the security critical level is less than the waiting delay corresponding to the operation critical level, and the waiting delay corresponding to the operation critical level is less than the waiting delay corresponding to the general level.

[0063] This design, combined with the stochastic delay mechanism described in step S2, forms a two-layer evolutionary structure:

[0064] During the initial deployment phase of the terminal, since the terminal does not yet have local security level information, all terminals have the same latency weight, and the security level priority is only guaranteed by the arbitration on the configuration host side. Once the terminal completes the initial configuration process, the security level information is written to the terminal's local non-volatile storage along with the session allocation message.

[0065] In all subsequent restart or reconfiguration scenarios, a security level weighting coefficient is introduced into the calculation of the terminal's waiting latency. The specific calculation method is as follows: T delay =T min +R base ×W(S), where R base The base random value is calculated based on the low-order byte of the MAC address and the hardware random seed. W(S) is the weighting coefficient corresponding to the security level. For security critical levels, W takes a smaller value (e.g., 0.05) so that the delay is compressed to the lower limit T of the dispersed time window. min For extremely narrow ranges nearby, W is set to a moderate value (e.g., 0.4) for critical levels and 1.0 for general levels, i.e., using the full distributed time window.

[0066] Therefore, security-critical terminals will naturally emerge first within the dispersed time window, forming a two-layer protection with the priority arbitration on the configuration host side. Considering that the typical operating cycle of terminals in closed industrial networks is several to several decades, while the initial deployment only occurs once, the two-layer protection covers all restart, power outage recovery, and reconfiguration scenarios for most of the terminal's lifecycle.

[0067] After receiving the session allocation message, the terminal verifies the identity signature of the configuration host. If successful, it performs the following operations: switches the IP configuration of its own network interface from the factory default address to the temporary address specified by the configuration host; saves the session token; writes the received security level information to local non-volatile storage (if the session allocation message carried this information); and starts the session timeout timer. Subsequently, the terminal sends a session acknowledgment message to the configuration host. This message is sent in IP-layer unicast format—because the terminal now possesses the temporary address and knows the configuration host's communication address within the temporary address range, IP-layer communication can be established. The session acknowledgment message payload includes the temporary address allocated to the terminal (used by the configuration host to confirm successful address switching) and an echo of the session token.

[0068] In the aforementioned example, after receiving the session allocation message, the servo control terminal SN-RUDDER-001 switches its IP address from 192.168.0.254 to 169.254.1.1, writes the safety criticality level to its local EEPROM, and sends a session acknowledgment message to the configuration host using 169.254.1.1 as the source address. From this moment on, the terminal no longer holds the default IP address 192.168.0.254 that conflicts with other terminals, but instead has a temporary address 169.254.1.1 unique to this configuration session, establishing an independent IP-layer unicast communication channel with the configuration host.

[0069] It should be noted that after entering the temporary session state, the terminal only establishes point-to-point unicast communication with the configuration host, does not respond to any broadcast messages (including new rounds of probe messages and silence commands), does not communicate with other terminals, and does not participate in service data forwarding. If the entire configuration process is not completed before the session timeout expires, the terminal automatically releases the temporary address, restores the network interface to the factory default IP address, rolls back to the sleep waiting state, recalculates the random delay, and waits for the next round of discovery. If the terminal has stored security level information locally, the delay calculation after rollback will use a security level weighting coefficient, and security-critical terminals will be prioritized in the next round.

[0070] After the configuration host receives the session confirmation message, it verifies that the token echoes correctly, marks the terminal as "configuring" in the mapping dictionary, and increments the active session count for that partition.

[0071] return Figure 1 In step S4, during the unicast communication session, the corresponding target network parameters are queried based on the received unique identifier and sent to the terminal to be configured for local writing, and the write confirmation information returned by the terminal to be configured for the writing result is received.

[0072] In this step, the host and terminal are configured to complete identity verification, parameter delivery and write confirmation through the established IP layer unicast communication channel.

[0073] In a closed industrial network, although the network is isolated from the outside, there is still a risk of terminal spoofing—malicious or misconfigured devices may send back a forged unique identifier in step S2 to obtain network parameters that do not belong to them.

[0074] Therefore, in a preferred embodiment, the configuration host performs identity verification before sending the target network parameters. Specifically, the mapping relationship also includes the public key corresponding to the unique identifier. Before querying the corresponding target network parameters based on the received unique identifier and sending them to the terminal to be configured for local writing, the method further includes: sending an identity challenge message to the terminal to be configured, the identity challenge message containing a random number and a session token; receiving an identity verification message sent back by the terminal to be configured after signing the random number, session token, and unique identifier based on a preset device key; verifying the legitimacy of the identity verification message based on the public key corresponding to the unique identifier pre-stored in the mapping relationship; if the legitimacy verification passes, querying the corresponding target network parameters based on the received unique identifier and sending them to the terminal to be configured for local writing; if the legitimacy verification fails, terminating the unicast communication session and reclaiming the temporary address. In low-security scenarios where identity verification is not required, the configuration host can also skip this step and directly proceed to parameter sending.

[0075] After successful identity verification (or in implementations where identity verification is not performed), the configuration host queries the mapping dictionary using the terminal's unique identifier as the key to retrieve the terminal's target IP address, subnet mask, default gateway, and optional extended parameter set. The configuration host assembles all parameters into a parameter delivery message and calculates an integrity checksum (e.g., HMAC-SHA256) on the entire parameter payload using the session key, appending the checksum to the payload before delivery. The session key can be generated from the random numbers exchanged between the parties during the identity verification phase using a key derivation function; if identity verification is not performed, it can be derived from the session token.

[0076] After receiving the parameter transmission message, the terminal first verifies the HMAC integrity checksum using the same session key. Upon successful verification, the terminal writes the parameters to local non-volatile storage (such as EEPROM or Flash configuration partition). After writing, the terminal reads back the written parameters from the non-volatile storage, comparing the read-back values ​​with the received values ​​field by field. The reason for introducing the read-back verification step is that physical conditions such as electromagnetic interference, extreme temperatures, and vibration in industrial environments may cause bit flips or incomplete writes during storage operations. Relying solely on the return status of the write operation is insufficient to guarantee that the data has actually been correctly written to disk.

[0077] If all fields match, the terminal calculates a digest value (e.g., SHA-256) of the complete content of the read-back parameters, encapsulates the digest value into a write confirmation message, and returns it to the configuration host. The configuration host independently calculates the SHA-256 digest value of the sent parameters and compares it with the digest value returned by the terminal. If the digests at both ends match, the write confirmation message verification is considered successful—meaning that the parameters sent by the configuration host are completely consistent with the parameters actually stored in the terminal's non-volatile storage. If any field does not match, the terminal returns a write failure message containing a failure field identifier. The configuration host terminates the terminal's session and reclaims the temporary address. The terminal automatically rolls back to a dormant waiting state and retryes in subsequent rounds.

[0078] return Figure 1 In step S5, in response to the successful verification of the written confirmation information, the temporary address is reclaimed to the temporary address pool, and an activation command is sent to the terminal to be configured to instruct the terminal to release the temporary address and switch the network interface to enter the service running state according to the target network parameters.

[0079] In this step, after the configuration host confirms the successful writing of parameters, it sends an activation command to the terminal. The payload includes a session token and an activation confirmation random number. Upon receiving the command, the terminal performs the following operations in sequence: releases the temporary address, switches the network interface IP configuration to the target service IP address, subnet mask, and default gateway already written to non-volatile storage; and sends a configuration completion report to the configuration host using the new target service IP address as the source address. The payload includes the terminal device's unique identifier, the activated service IP address, and an echo of the activation confirmation random number. This configuration completion report also serves as the first legitimate data packet sent by the terminal using the target service IP address—allowing the configuration host to confirm that the terminal's address switch has actually been successful, rather than merely remaining at the parameter writing level. The terminal then enters the service operation state and begins normal service communication.

[0080] In the aforementioned ship engine room example, after receiving the activation command, the steering gear control terminal SN-RUDDER-001 releases the temporary address 169.254.1.1, switches the network interface to the target IP 10.1.1.11 / 24 and the gateway 10.1.1.1, and sends a configuration completion report to the configuration host with 10.1.1.11 as the source address. Thus, the terminal has undergone a complete address transition chain: factory default address 192.168.0.254 → temporary address 169.254.1.1 → target service address 10.1.1.11, all without manual intervention from engineers.

[0081] After receiving the configuration completion report, the configuration host verifies the correctness of the confirmation random number and performs the following cleanup operations: It reclaims the terminal's temporary address to the temporary address pool, allowing it to be reused by subsequent terminals; it updates the terminal's configuration status to "configured" in the mapping dictionary; and it decrements the active session count of the partition by one. The released slot is immediately available to the next waiting terminal—the next terminal in the waiting queue obtains the slot and proceeds to step S3 to begin the configuration process. This process is repeated until all terminals in the partition have completed configuration. If no configuration completion report is received within the specified time after the activation command is issued, the configuration host considers the activation to have failed, reclaims the temporary address, marks the terminal as "pending reconfiguration," and waits for it to automatically roll back to a dormant waiting state before rediscovering and configuring it in subsequent rounds.

[0082] It should be noted that after the terminal enters the service running state, it will no longer respond to configuration protocol probe messages and session allocation messages, unless it receives a forced reconfiguration command carrying a valid authentication token from the configuration host. Upon receiving a valid forced reconfiguration command, the terminal releases the current service IP, returns to the dormant waiting state, and restarts the complete configuration process from steps S1 to S5. At this time, the terminal's local non-volatile storage already retains the security level information, which will be used for security level weighted delay calculation after returning to the dormant waiting state.

[0083] After a terminal enters operational mode, the configuration host's management does not end. In closed industrial networks, events such as ship generator switching, mine power distribution cabinet tripping, and production line emergency shutdown followed by restoration can cause a momentary power outage and restoration of power to all devices in a physical partition. At this time, all terminals within the partition will simultaneously return to a dormant waiting state, potentially triggering batch discovery. This is a scenario similar to the initial deployment's batch power-on but more dangerous—during the initial deployment, maintenance personnel are present to monitor the configuration process, while unexpected power outages during operation are usually unattended, and safety-critical equipment needs to have the network restored as quickly as possible to ensure system security.

[0084] Therefore, in a preferred embodiment, the host is configured to periodically send heartbeat monitoring messages to terminals that have entered the service operation state within the current target partition, and receive heartbeat response messages from the terminals in response to the heartbeat monitoring messages. The payload of the heartbeat response message includes the terminal's current service IP, runtime, and self-test status code.

[0085] For offline detection of a single terminal, if a terminal fails to send a heartbeat response message for a preset number of consecutive times (typically 3 times), the configuration host marks its status in the mapping dictionary as "awaiting reconfiguration" and marks the terminal's target service IP as "temporarily unassignable" for one protection period—to prevent IP conflicts with the replacement device when the terminal recovers from only a brief communication interruption. If the heartbeat resumes within the protection period, the marking is removed; if it still does not recover after the protection period, it is determined to be permanently offline, the IP protection marking is removed, and the mapping dictionary is allowed to reassign the IP to the replacement device.

[0086] For partition-level batch offline detection, when it is detected that more than a preset proportion (typically 50%) of terminals in the current target partition have not sent back heartbeat response messages within a preset time window, a batch power outage event is determined to have occurred in the current target partition. In response to the batch power outage event, protective operations are performed in advance before the terminals in the current target partition resend response messages: the concurrent session limit is reduced to a preset conservative value, the upper limit of the dispersion time window is increased, and the sending period of probe messages is extended to reduce the probe frequency.

[0087] The effect of this design is that when power to the partition is restored and all terminals simultaneously re-enter a sleep waiting state, the configuration host has already entered a protective posture in advance, rather than passively triggering the adaptive flow control in step S2 only after a large number of terminal responses flood in. This protective preparation reduces the peak intensity and duration of the broadcast storm from the source.

[0088] The following example of a ship's engine room fully illustrates the collaborative working process of each mechanism in a batch power outage recovery scenario:

[0089] Assuming all eight terminals in the engine room partition have been configured and are in operational mode, the configuration host periodically sends heartbeat monitoring messages to them. At this time, the ship performs a generator paralleling switchover, resulting in a brief power outage in the engine room power distribution circuit, which is restored after approximately 5 seconds. Within about 3 seconds of the power outage, the configuration host detects that 7 out of the 8 terminals simultaneously lose their heartbeat response, exceeding a preset threshold of 50%, and determines that a batch power outage event has occurred in the engine room partition. The configuration host immediately performs protective measures: reducing the concurrent session limit to a conservative value of 2, increasing the upper limit of the dispersion time window to 60 seconds, and extending the detection transmission cycle. Power is restored approximately 2 seconds later, and the 7 terminals simultaneously re-power on and enter a sleep waiting state. Since all 7 terminals have previously completed their initial configuration, their local non-volatile storage already retains security level information. Two safety-critical servo control terminals, with their weighted delay windows compressed into an extremely narrow range of approximately 0.5 to 2 seconds, entered the listening-ready phase and responded after about 1 second. The delays of the three general-level environmental sensors, however, were spread across a wider window of 0.5 to 60 seconds. The configuration host received responses from the two servo control terminals first. After confirming their safety-criticality level using the mapping dictionary, it prioritized allocating sessions to these two terminals in a conservative mode with only two slots available. The servo control terminals completed reconfiguration through steps S3 to S5, rejoining the network with their service IPs, ensuring navigational safety. Subsequently, as monitoring indicators returned to normal levels, the configuration host gradually restored the concurrent session limits and detection frequencies, sequentially completing the reconfiguration of the remaining terminals.

[0090] In this scenario, the security level weighted delay in step S2 allows security-critical terminals to surface first in the time domain, the security level priority arbitration in step S3 ensures that they are the first to obtain a quota, the adaptive flow control in step S2 prevents congestion caused by seven terminals responding simultaneously through conservative concurrency limits and expanded distribution windows, and the heartbeat monitoring and batch power outage prediction in step S5 enable the configuration host to enter a protective posture before the terminals have been restored to power.

[0091] Furthermore, once all mapping dictionary entries for a partition have entered the "configured" state, the configuration host can transfer the concurrent session quotas released by that partition to the next partition to be configured, and shorten the probe packet sending cycle of the next partition to be configured, thereby achieving a cascading effect of "completing one partition and accelerating the next partition" and improving the overall configuration efficiency of the entire network.

[0092] In summary, the identity mapping-based Ethernet terminal zero-contact automatic configuration method proposed in this application achieves the following through the complete process of steps S1 to S5:

[0093] First, under the constraints of no standard DHCP service, no external network connection, and terminals holding a unified default IP address without carrying any deployment customization information, the system bypasses IP conflicts through link layer detection and response, and isolates configuration traffic and service traffic through temporary addresses. This achieves fully automated and accurate configuration of terminal network parameters, eliminating the workload and error risk of manual configuration on a per-unit basis.

[0094] Second, by identifying network-side partitions and conducting partition polling for targeted discovery, the discovery scope is limited to a single partition, avoiding the overlap of responses across partitions. By independently maintaining monitoring indicators for each partition and dynamically adjusting three control parameters—concurrent session limit, probe sending cycle, and upper limit of the dispersed time window—a linked negative feedback control loop is formed, which can automatically converge to a stable configuration throughput rhythm when facing batch power-on scenarios of various scales.

[0095] Third, by configuring a two-tiered evolutionary structure of security level priority arbitration (effective upon first deployment) for host-side mapping dictionary drivers and security level weighted delay (effective throughout the entire lifecycle after initial configuration), we ensure that security-critical terminals can obtain configuration services first in any scenario, thus meeting the rigid requirements of industrial security for the network readiness time of critical equipment.

[0096] Fourth, by monitoring the heartbeat of business operation and predicting batch power outages in different areas, the scope of the configuration protocol is expanded from "the end after configuration" to cover the entire life cycle of the terminal. This enables the system to provide early protection against foreseeable batch reconfiguration events and to be in a protective posture rather than a passive response the moment power is restored.

[0097] Exemplary system:

[0098] Figure 2The illustration depicts a contactless automatic configuration system for Ethernet terminals based on identity mapping according to an embodiment of this application. The system is applied to a configuration host in a closed Ethernet environment, which also includes multiple terminals to be configured with pre-set unified default IP addresses. The configuration host stores a mapping relationship between the unique identifier of each terminal to be configured and target network parameters. The system includes: a probe broadcast module for broadcasting probe messages to the terminals to be configured at the link layer; an acknowledgment receiving module for receiving acknowledgment messages carrying the unique identifiers sent back by the terminals to be configured from the link layer in unicast frames within a dispersed time window after the probe messages are sent; and a session allocation module for determining which terminals to be configured will receive session slots based on the currently allowed concurrent session limit, from a temporary address segment independent of the service address range. The address pool allocates temporary addresses to the terminals to be configured that have obtained session slots, and sends session allocation messages carrying temporary addresses to them at the link layer to instruct them to switch their network interfaces from the default IP address to the temporary address and establish a unicast communication session; the parameter distribution module is used to query the corresponding target network parameters based on the received unique identifier in the unicast communication session and distribute them to the terminals to be configured for local writing, and receive the write confirmation information returned by the terminals to be configured for the write results; the activation control module is used to reclaim the temporary address to the temporary address pool in response to the successful verification of the write confirmation information, and send an activation command to the terminals to be configured to instruct them to release the temporary address and switch the network interface to enter the service running state according to the target network parameters.

[0099] In one example, the probe broadcast module broadcasts probe messages to the terminal to be configured at the link layer, including: determining the physical reachability range of the probe messages as the current target partition according to a preset partition polling strategy; and broadcasting probe messages to the current target partition in a targeted manner through at least one network-side control method among physical interface targeted sending, virtual LAN VLAN targeted sending, and switch port group targeted sending, so that only the terminal to be configured in the current target partition receives the probe messages at any given time.

[0100] In one example, the mapping relationship also includes the security level information of each terminal to be configured. The security level information includes security critical level, operation critical level and general level. The session allocation module determines the terminal to be configured to obtain a session quota based on the current allowed concurrent session limit, including: determining whether the number of terminals to be configured that send back response messages in the current target partition exceeds the concurrent session limit. If so, it queries the corresponding security level information based on the received unique identifier and determines the terminal to be configured to obtain a session quota in the order of security critical level taking precedence over operation critical level and operation critical level taking precedence over general level.

[0101] In one example, the session allocation message also carries the security level information of the terminal to be configured, instructing the terminal to write the security level information to local non-volatile storage, and enabling the terminal to calculate its waiting delay within the distributed time window based on the security level information when it re-enters the configuration state. The waiting delay corresponding to the security critical level is less than the waiting delay corresponding to the operation critical level, and the waiting delay corresponding to the operation critical level is less than the waiting delay corresponding to the general level.

[0102] In one example, the probe message carries the upper limit of the distributed time window. The system functions also include: maintaining monitoring indicators for the current target partition, including the number of response messages received per unit time, the number of detected link collision events, and the number of session timeout rollbacks; adjusting the concurrent session limit, the probe message sending period, and the upper limit of the distributed time window according to the monitoring indicators: when the number of response messages exceeds a preset first threshold, or the number of link collision events exceeds a preset second threshold, reducing the concurrent session limit, extending the probe message sending period, and increasing the upper limit of the distributed time window; when the number of session timeout rollbacks exceeds a preset third threshold, stopping the broadcast of probe messages to the current target partition and broadcasting a silence command to instruct the terminals to be configured in the current target partition to reset the waiting delay and increase the upper limit of the distributed time window; after waiting for a preset cooling period, rebroadcasting probe messages to the current target partition with a preset minimum concurrent session limit.

[0103] In one example, the system functionality also includes: periodically sending heartbeat monitoring messages to terminals that have entered the service operation state within the current target partition, and receiving heartbeat response messages sent back by the terminals in response to the heartbeat monitoring messages; when it is detected that more than a preset proportion of terminals within the current target partition have not sent back heartbeat response messages within a preset time window, it is determined that a batch power outage event has occurred in the current target partition; in response to the batch power outage event, before the terminals within the current target partition resend the response messages, the concurrent session limit is reduced to a preset conservative value, the upper limit of the dispersed time window is increased, and the sending period of the probe messages is extended to reduce the probe frequency.

[0104] In one example, the mapping relationship also includes the public key corresponding to the unique identifier; before querying the corresponding target network parameters based on the received unique identifier and sending them to the terminal to be configured for local writing, the process also includes: sending an identity challenge message to the terminal to be configured, the identity challenge message containing a random number and a session token; receiving an identity verification message sent back by the terminal to be configured after signing the random number, session token, and unique identifier based on a preset device key; verifying the legitimacy of the identity verification message based on the public key corresponding to the unique identifier pre-stored in the mapping relationship; if the legitimacy verification passes, then querying the corresponding target network parameters based on the received unique identifier and sending them to the terminal to be configured for local writing; if the legitimacy verification fails, then terminating the unicast communication session and reclaiming the temporary address.

[0105] Exemplary electronic device:

[0106] Figure 3 A block diagram of an electronic device according to an embodiment of this application is illustrated.

[0107] like Figure 3 As shown, the electronic device includes one or more processors and memory.

[0108] A processor can be a central processing unit (CPU) or other form of processing unit with data processing and / or instruction execution capabilities, and can control other components in an electronic device to perform desired functions.

[0109] The memory may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. Volatile memory may include, for example, random access memory (RAM) and / or cache memory. Non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc.

[0110] In one example, the electronic device may also include input devices and output devices, which are interconnected via a bus system and / or other forms of connection mechanism (not shown).

[0111] Of course, for the sake of simplicity, Figure 3 Only some of the components of the electronic device relevant to this application are shown in this illustration; components such as buses, input / output interfaces, etc., are omitted. In addition, the electronic device may include any other suitable components depending on the specific application.

[0112] Exemplary computer-readable media:

[0113] Embodiments of this application may also be computer-readable storage media storing computer program instructions thereon, which, when executed by a processor, cause the processor to perform the steps described in the "Exemplary Methods" section above according to the various embodiments of this application.

[0114] Computer-readable storage media may take the form of any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may, for example, include, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatuses, or devices, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: electrical connections having one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0115] The basic principles of this application have been described above with reference to specific embodiments. However, it should be noted that the advantages, benefits, and effects mentioned in this application are merely examples and not limitations, and should not be considered as essential features of each embodiment of this application. Furthermore, the specific details disclosed above are for illustrative and facilitative purposes only, and are not limitations. These details do not restrict the application from being implemented using the specific details described above.

[0116] The block diagrams of devices, apparatuses, devices, and systems involved in this application are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As those skilled in the art will recognize, these devices, apparatuses, devices, and systems can be connected, arranged, and configured in any manner. Words such as “comprising,” “including,” “having,” etc., are open-ended terms meaning “including but not limited to,” and are used interchangeably with them. The terms “or” and “and” as used herein refer to the terms “and / or,” and are used interchangeably with them unless the context clearly indicates otherwise. The term “such as” as used herein refers to the phrase “such as but not limited to,” and is used interchangeably with it.

[0117] It should also be noted that in the apparatus, equipment, and methods of this application, the components or steps can be disassembled and / or recombined. These disassemblies and / or recombinations should be considered as equivalent solutions of this application.

[0118] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use this application. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein can be applied to other aspects without departing from the scope of this application. Therefore, this application is not intended to be limited to the aspects shown herein, but rather to be accorded the widest scope consistent with the principles and novel features disclosed herein.

[0119] The above description has been given for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of this application to the forms disclosed herein. Although numerous exemplary aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations thereof.

Claims

1. A zero-contact automatic configuration method for Ethernet terminals based on identity mapping, applied to a configuration host in a closed Ethernet environment, wherein the environment further includes multiple terminals to be configured with pre-set unified default IP addresses, and the configuration host pre-stores a mapping relationship between the unique identifier of each terminal to be configured and target network parameters, characterized in that, The method includes: Broadcast probe messages to the terminal to be configured at the link layer; The terminal to be configured receives a response message carrying its unique identifier, sent back from the link layer as a unicast frame within a dispersed time window after the probe message is sent. Based on the current allowed concurrent session limit, determine the terminal to be configured to obtain a session quota, allocate a temporary address to the terminal to be configured to obtain a session quota from a temporary address pool that is independent of the service address range, and send a session allocation message carrying the temporary address to it at the link layer to instruct it to switch the network interface from the default IP address to the temporary address and establish a unicast communication session. In the unicast communication session, the corresponding target network parameters are queried based on the received unique identifier and sent to the terminal to be configured for local writing, and the write confirmation information returned by the terminal to be configured for the writing result is received. In response to the successful verification of the written confirmation information, the temporary address is reclaimed to the temporary address pool, and an activation command is sent to the terminal to be configured to instruct the terminal to release the temporary address and switch the network interface to enter the service running state according to the target network parameters.

2. The Ethernet terminal zero-contact automatic configuration method based on identity mapping according to claim 1, characterized in that, The step of broadcasting probe messages to the terminal to be configured at the link layer includes: According to the preset partition polling strategy, the physical reachability range of the probe packets is sequentially determined as the current target partition; The probe message is broadcast to the current target partition via at least one network-side control method, namely, physical interface-directed transmission, virtual LAN VLAN-directed transmission, and switch port group-directed transmission, so that only the terminal to be configured in the current target partition receives the probe message at any given time.

3. The Ethernet terminal zero-contact automatic configuration method based on identity mapping according to claim 2, characterized in that: The mapping relationship also includes the security level information of each terminal to be configured, which includes security critical level, operation critical level and general level; The terminal to be configured, which is determined based on the currently allowed concurrent session limit, includes: Determine whether the number of terminals to be configured that send back the response message in the current target partition exceeds the concurrent session limit. If so, query the corresponding security level information based on the received unique identifier, and determine the terminals to be configured that will obtain session slots in the order that the security critical level takes precedence over the operation critical level, and the operation critical level takes precedence over the general level.

4. The Ethernet terminal zero-contact automatic configuration method based on identity mapping according to claim 3, characterized in that: The session allocation message also carries the security level information of the terminal to be configured, instructing the terminal to be configured to write the security level information into local non-volatile storage, and enabling the terminal to be configured to calculate its waiting delay within the dispersed time window based on the security level information when it re-enters the configuration state. The waiting delay corresponding to the safety critical level is less than the waiting delay corresponding to the operation critical level, and the waiting delay corresponding to the operation critical level is less than the waiting delay corresponding to the general level.

5. The Ethernet terminal zero-contact automatic configuration method based on identity mapping according to claim 2, characterized in that: The detection message carries the upper limit of the dispersed time window; The method further includes: The current target partition maintains monitoring indicators, which include the number of response packets received per unit time, the number of detected link conflict events, and the number of session timeout rollbacks. Adjust the concurrent session limit, the probe message sending period, and the upper limit of the distributed time window based on the monitoring indicators: When the number of response messages exceeds a preset first threshold, or the number of link conflict events exceeds a preset second threshold, the concurrent session limit is reduced, the sending period of the probe messages is extended, and the upper limit of the distributed time window is increased. When the number of session timeout rollbacks exceeds a preset third threshold, broadcasting the probe packets to the current target partition stops, and a silence command is broadcast to instruct the terminals to be configured in the current target partition to reset their waiting delay and increase the upper limit of the dispersed time window; and After waiting for a preset cooling period, the probe message is rebroadcast to the current target partition at a preset minimum concurrent session limit.

6. The Ethernet terminal zero-contact automatic configuration method based on identity mapping according to claim 5, characterized in that, The method further includes: Periodically send heartbeat monitoring messages to terminals that have entered the service operation state within the current target partition, and receive heartbeat response messages sent back by the terminals in response to the heartbeat monitoring messages; When it is detected that more than a preset proportion of terminals in the current target partition have not sent back the heartbeat response message within a preset time window, it is determined that a batch power outage event has occurred in the current target partition. In response to the batch power outage event, before the terminals in the current target partition resend the response message, the concurrent session limit is reduced to a preset conservative value, the upper limit of the distributed time window is increased, and the sending period of the probe message is extended to reduce the probe frequency.

7. The Ethernet terminal zero-contact automatic configuration method based on identity mapping according to claim 1, characterized in that: The mapping relationship also includes the public key corresponding to the unique identifier; Before querying the corresponding target network parameters based on the received unique identifier and sending them to the terminal to be configured for local writing, the method further includes: Send an identity challenge message to the terminal to be configured, the identity challenge message containing a random number and a session token; Receive the identity verification message sent back by the terminal to be configured after signing the random number, the session token and the unique identifier based on the preset device key; Based on the public key pre-stored in the mapping relationship corresponding to the unique identifier, the legitimacy of the identity verification message is verified; If the legality verification passes, the process of querying the corresponding target network parameters based on the received unique identifier is executed and sent to the terminal to be configured for local writing. If the validity verification fails, the unicast communication session is terminated and the temporary address is reclaimed.

8. A zero-contact automatic configuration system for Ethernet terminals based on identity mapping, applied to a configuration host in a closed Ethernet environment, wherein the environment also includes multiple terminals to be configured with pre-set unified default IP addresses, and the configuration host pre-stores a mapping relationship between the unique identifier of each terminal to be configured and target network parameters, characterized in that, The system includes: The probe broadcast module is used to broadcast probe messages to the terminal to be configured at the link layer; The response receiving module is used to receive the response message carrying its unique identifier sent back by the terminal to be configured from the link layer in unicast frames within a dispersed time window after the probe message is sent. The session allocation module is used to determine the terminal to be configured to obtain a session quota based on the current allowed concurrent session limit, allocate a temporary address to the terminal to be configured to obtain a session quota from a temporary address pool that is independent of the service address range, and send a session allocation message carrying the temporary address to the terminal at the link layer to instruct it to switch the network interface from the default IP address to the temporary address and establish a unicast communication session. The parameter delivery module is used to query the corresponding target network parameters based on the received unique identifier in the unicast communication session and deliver them to the terminal to be configured for local writing, and to receive the write confirmation information returned by the terminal to be configured for the writing result. The activation control module is used to, in response to the successful verification of the written confirmation information, reclaim the temporary address to the temporary address pool, and send an activation instruction to the terminal to be configured, so as to instruct the terminal to be configured to release the temporary address and switch the network interface to enter the service running state according to the target network parameters.

9. An electronic device comprising a memory and a processor, characterized in that: The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions, which, when executed by the processor, implement the identity mapping-based Ethernet terminal zero-contact automatic configuration method as described in any one of claims 1 to 7.

10. A computer-readable storage medium having computer-executable instructions stored thereon, characterized in that: When the computer-executable instructions are executed by the processor, they implement the identity mapping-based Ethernet terminal zero-contact automatic configuration method as described in any one of claims 1 to 7.

Images