Background
The edge gateway is concerned when being widely applied to novel information technologies such as cloud computing, big data, artificial intelligence and the internet of things, and can be universally understood to be used for computing at the edge of a network by means of various network node devices, including data analysis, application deployment and the like. With the continuous development of the internet of things, the practical application problems of network bandwidth, data delay, security and the like cause the edge gateway to be quickly approved and focused.
The edge gateway is a product highly integrating the technology of an OT layer and an IT layer in the field of industrial internet, wherein the edge calculation is different from the traditional field data analysis and processing method and is different from the cloud calculation and big data analysis in the consumption internet, and the edge gateway has special advantages and values. The edge gateway effectively solves the problems that a user pays more and more attention to sensitive data protection, the real-time data processing efficiency is low, and the cloud, edge and end effectively cooperate and the like in the falling process of the industrial internet.
The edge gateway mainly provides services of collecting, processing, storing, analyzing, transmitting and the like for information of an industrial field. As a link for connecting field equipment and a data storage platform, on one hand, the edge gateway needs to collect, convert a communication protocol and transmit a data packet for a large amount of static information and real-time dynamic information in an industrial field heterogeneous network; on the other hand, the core services such as data processing, integration, analysis, decision making, sharing and utilization are more focused.
The edge intelligent gateway needs to support not only multiple industrial protocols but also TCP/IP protocols. Due to the fact that data packet transmission formats corresponding to different communication protocols are different, application requirements of large-scale and high-speed safe transmission and information processing of a support platform can be met only by achieving heterogeneous network conversion.
The edge intelligent gateway needs to provide data push services for the field devices and the support platform, including data acquisition and interaction. The field device continuously generates real-time data, and after receiving the data, the edge intelligent gateway performs preprocessing, calculation and analysis, and then sends the data to the support platform, so that the data are served for platform applications such as big data, AI (artificial intelligence) calculation, cloud simulation and the like. On the contrary, the edge intelligent gateway can also be connected with and support an industrial internet platform to carry out reverse control on the field device.
The field devices frequently upload large amounts of data, including normal data, invalid data, and urgent data. Part of the data does not need to be uploaded to the supporting platform for storage and analysis, and the other part of the data needs to be processed and fed back in time. The edge intelligent gateway provides calculation and intelligent online analysis services of local data, preprocessing calculation services such as filtering and aggregation of the data and the like, aggregates complementary or redundant information in space and time, and then sends the processed effective data to the support platform. For field devices with huge data quantity, the preprocessing calculation service can reduce the problems of large network transmission pressure, waste of storage space and the like caused by uploading of a large amount of data.
1. In the prior art, the expansibility of the edge gateway is poor, and only common industrial hardware communication ports such as RS232, USB, CAN and the like are covered. Only supports a wired communication mode; the communication module and the storage module can not be expanded without reserving an expansion interface; edge computing is not supported, and edge side AI application cannot be supported; and the industrial design is relatively poor, the structure is complex, and the performances such as sealing, dust prevention, heat dissipation and earthquake resistance are relatively weak.
2. In the prior art, an edge gateway adopts an open source operating system in the aspect of operating systems, so that the safety guarantee performance is poor; in the aspect of application functions, built-in industrial software resources are deficient, and various cloud-edge cooperative applications such as cloud services, cloud configuration and remote updating are not supported. Meanwhile, the current gateway only supports data acquisition and data transmission, can not manage the edge intelligent gateway through an edge intelligent service platform, and download, deployment and state monitoring of light application, and does not support 5G, and the gateway security is poor.
Disclosure of Invention
Aiming at the defects of the prior art, the invention provides a highly integrated edge intelligent gateway based on cloud edge cooperation, so as to solve the problems in the background technology.
In order to achieve the purpose, the invention provides the following technical scheme: a highly integrated edge intelligent gateway based on cloud edge coordination comprises a technical architecture unit, a service architecture unit, a deployment architecture unit and a safety protection architecture unit;
the technical architecture unit comprises a connection layer, a data layer, an application layer, a communication layer, a link layer and an edge-cloud coordination layer;
the business architecture unit comprises a running environment component, an equipment interaction component, a data service component, a network connection component, a safety protection component and an intelligent application;
the deployment architecture unit comprises system deployment, containerized deployment, mirror image production, warehouse, container and edge intelligent service platform deployment;
the safety protection architecture unit comprises a kernel layer, a system layer and an application protection layer.
Further optimizing the technical scheme, the connection layer in the technical architecture unit is used for communicating with bottom layer equipment, including communication protocols including MODBUS TCP, MODBUS RTU, S7, Profinet and OPC UA; the data layer is used for storing and processing equipment data, system data and calculation data, interacting with the equipment, storing data and commands in a distributed mode and processing the instructions in real time.
Further optimizing the technical scheme, the application layer in the technical architecture unit is used for providing the intelligent data analysis and calculation functions of the edge, providing the basic data calculation functions of a calculation rule engine, a real-time algorithm model and time early warning for the edge intelligent gateway, and providing an operating environment for the user-defined data calculation service.
Further optimizing the technical scheme, a communication layer in the technical architecture unit is used for establishing, processing and maintaining the relationship between the edge intelligent gateway and cloud computing, the application in the cloud platform performs interaction between computing tasks and computing results through the communication layer and the edge intelligent gateway, other layers in the edge intelligent gateway collect data for the layer and issue the data to service functions executed on the layer, and the service functions at least comprise MQTT, HTTP, HTTPS, MODBUS SERVER and SNMP.
Further optimizing the technical scheme, the link layer in the technical architecture unit supports a 5G link; the edge-cloud cooperative layer issues and deploys function calculation, stream data analysis, event management, mechanism/training models and other applications to edge nodes in a container mode through an edge end service management system, and the edge nodes upload processing results and data to a cloud platform for further analysis and management after performing primary processing on the data through various components.
The technical scheme is further optimized, the service architecture unit supports operating environments of Docker, node. js, Python and Tensflow, and is internally provided with an equipment interaction module supporting industrial communication protocols of Modbus, OPCUA and S7, a data pool module supporting data storage and distribution services and a network connection module supporting communication protocols of HTTPS and MQTT, a visual programming tool, a calculation formula editing row, time management and gateway management applications are provided, data interaction and sharing are performed among the modules through API interfaces, and part of the API interfaces are open to the outside to provide basic services for the edge applications of the Internet of things.
Further optimizing the technical scheme, the system deployment in the deployment architecture unit is used for packaging all files related to the edge intelligent gateway function into compressed files, deploying the compressed files in the gateway through a deployment script one-key, copying the lib files and the executable binary files to the specified working directory, and then setting the self-starting function of the program.
Further optimizing the technical scheme, the edge intelligent service platform in the deployment architecture unit deploys edge service products for uniformly managing edge intelligent network nodes on the cloud platform, the edge side application full-life-cycle management consistent with the container cloud products is constructed based on a container technology, an open interface is provided, and the edge side bears cloud platform application deployment, gateway default application and third-party application.
Further optimizing the technical scheme, the kernel layer in the safety protection architecture unit is used for providing safety increase for the kernel and safety management of network messages; the system layer is responsible for providing basic security services and security support for applications; the application protection layer is used for providing system applications to complete management of system configuration and identity authentication and providing a safe communication component for business applications.
Further optimizing the technical scheme, the safety protection architecture unit is used for realizing safety protection functions of inner core layer safety, network protection, safety audit, integrity detection, system upgrade and application management.
Compared with the prior art, the invention provides a highly integrated edge intelligent gateway based on cloud edge cooperation, which has the following beneficial effects:
1. this high integrated edge intelligent gateway based on cloud limit is cooperative through setting up technical framework unit, realizes cloud limit cooperative function based on KubeEdge technique, and user's accessible edge intelligent service platform manages edge intelligent gateway to and the download, the deployment and the state monitoring of lightweight application.
2. This highly integrated edge intelligent gateway based on cloud limit is in coordination through setting up safety protection constitutional unit, provides multiple safety guarantee ability in the edge side: supporting multi-user management of the system, and using a strong user password strategy; TLS encryption is adopted for data communication, and a high-strength encryption algorithm is adopted for data encryption storage and transmission; the network port, connection and service are protected through the firewall; and providing an audit log interface, saving the audit log and managing the audit log.
Detailed Description
The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
The embodiment is as follows:
a highly integrated edge intelligent gateway based on cloud edge cooperation comprises a technical architecture unit, a service architecture unit, a deployment architecture unit and a safety protection architecture unit.
The technical architecture unit comprises a connection layer, a data layer, an application layer, a communication layer, a link layer and an edge-cloud coordination layer.
Further, as shown in fig. 1, the connection layer (i.e., the connection pool in fig. 1) clearly divides the functions and services in the north direction (the edge smart gateway interacts with the cloud platform) and the south direction (the edge smart gateway interacts with the device) inside the edge smart gateway. The layer is mainly used for communicating with bottom layer equipment and mainly comprises communication protocols such as MODBUS TCP, MODBUS RTU, S7, Profinet, OPC UA and the like.
Further, the data layer (i.e., the data pool in fig. 1) is mainly responsible for storing and processing device data, system data, and calculation data. And is responsible for interacting with the device, is an edge connector that interacts with the device. Meanwhile, data and commands are stored in a distributed mode, and the commands are processed in real time.
Further, the application layer (i.e., the application pool in fig. 1) includes a plurality of data computing service functions, providing intelligent data analysis and computing functions at the edge. The layer not only provides basic data calculation functions such as a calculation rule engine, a real-time algorithm model and time early warning for the edge intelligent gateway, but also can provide an operating environment for user-defined data calculation service.
Further, a communication layer (i.e., a communication pool in fig. 1) is used to establish, process, and maintain a relationship between the edge intelligent gateway and cloud computing, an application in the cloud platform performs interaction between a computing task and a computing result with the edge intelligent gateway through the communication layer, and other layers in the edge intelligent gateway collect data for the layer and issue the data to a service function executed at the layer. These service functions include at least: MQTT, HTTP, HTTPS, MODBUS SERVER, SNMP.
The link layer in the technical architecture unit supports a 5G link, and the 5G link has the characteristics of low delay, high reliability, support of massive connection and large broadband and high speed. With the 5G scale deployment, the network transmission delay, the bandwidth and the connection density are all improved by orders of magnitude, and a basic guarantee is provided for end-edge-cloud cooperation; 5G provides a good network foundation for the landing and development of the edge computing industry.
In the edge-cloud coordination layer in the technical architecture unit, function calculation, stream data analysis, event management, a mechanism/training model and other applications are distributed and deployed to edge nodes in a container mode through an edge service management system, and the edge nodes upload processing results and data to a cloud platform for further analysis and management after performing primary processing on the data through various components.
The business architecture unit comprises a running environment component, an equipment interaction component, a data service component, a network connection component, a safety protection component and an intelligent application.
Furthermore, on one hand, the edge intelligent gateway acquires a large amount of static information and real-time dynamic information in a sensor network, converts a communication protocol and transmits a data packet; on the other hand, the core services such as data processing, integration, analysis, decision making, sharing and utilization are more focused. As shown in fig. 2, the edge intelligent gateway supports operating environments such as Docker, node. js, Python, and TensorFlow, and is provided with a device interaction module supporting industrial communication protocols such as Modbus, opua, and S7, a data pool module supporting data storage and distribution services, and a network connection module supporting communication protocols such as HTTPS and MQTT, and provides applications such as a visual programming tool, a calculation formula editing queue, time management, and gateway management. And data interaction and sharing are carried out among the modules through API interfaces, and part of the API interfaces are open to the outside, so that basic service is provided for the edge application of the Internet of things.
The edge intelligent gateway overall service mainly comprises the following parts:
1) the system supports 26 communication protocols such as an industrial bus protocol, a remote service protocol, a hardware port protocol, a wireless communication protocol, a data transmission protocol and the like. Industrial bus protocols such as ModbusRTU, ModbusTCP, S7, and OPCUA; the remote service protocol comprises SSH, FTP, Tel-net and VPN; the hardware port communication protocols comprise RS232, RS485, RS422, USB and LAN; wireless communication protocols comprise WIFI, GPRS, 4G, NB-IOT and WIA; HTTP, HTTPCM0TT, TCP, UDP, IPv4, IPV6.
2) The method supports a cloud-edge collaborative mode, the cloud platform carries out full-life-cycle management (creation, configuration, unloading, updating and monitoring) on the gateway and the application, carries out gateway configuration, edge-side data processing strategy arrangement and model training through the cloud platform, and then issues configuration information, models, applications and the like to the edge intelligent gateway for updating and execution.
3) The method provides various general operation models, supports the local real-time processing logic of the editing tool arrangement data of the visual rule engine, has various high-level programming language analysis and operation environments such as C \ C + +, Go, Python and the like, and supports higher-level application data analysis of local data.
4) The system has multiple safety guarantee functions, supports multi-system user management, and uses a strong user password strategy; TLS encryption is adopted for data communication, and network ports, connection and service are subjected to safety protection through a firewall; and providing an audit log interface, saving the audit log and managing the audit log.
The deployment architecture unit comprises system deployment, containerized deployment, mirror image production, warehouse, container and edge intelligent service platform deployment.
Further, the deployment architecture unit includes the following details:
1. system deployment
All files related to the edge intelligent gateway function software are packaged into a compressed file, the compressed file is deployed in the gateway through a deployment script one-key, the lib file and the executable binary file are mainly copied to a specified working directory, and then the self-starting function of the program is set.
2. Containerized deployment
The container deployment technology mainly aims to realize application deployment by running a container, and the container runs based on mirror images. The project and the dependency package (basic image) are made into a project image with a starting instruction, then a container is created in the server, and the image is operated in the container, so that the project deployment is realized. The server is the host machine of the container, and the docker container and the host machine are isolated from each other.
3. Mirror image production
The docker image is an application package constructed by using a Dockerfile script and building an application and a dependent package of the application, and usually carries a start command of the application. These commands are executed at the start of the container, i.e. the application is started at the start of the container. The creation of the image needs to be created by configuring a Dockerfile script and then executing a Dockerbiuld command.
4. Storage house
The manufactured docker mirror image is pushed to a docker warehouse through a push command, and then the docker mirror image can be pulled down through the push command in any place where the docker command can be used.
5. Container with a lid
A container is a sandbox independent of a host (server), and may be understood as a box with a special structure, which automatically executes some instructions mirrored from itself when created, thereby implementing the running of the application. The main purpose of the container is to provide the running space and environment for the image and to execute the instructions of the image.
6. Edge intelligent service platform deployment
In the aspect of application deployment, in this embodiment, an edge service product for uniformly managing edge intelligent gateway nodes is built on a space cloud network cloud platform, edge side application full-life-cycle management consistent with a container cloud product is built based on a container technology, an open interface is provided, and cloud platform application deployment, gateway default application and third-party application are borne on an edge side. Function calculation, stream data analysis, event management, mechanism/training models and other applications can be issued and deployed to edge nodes in a container mode through an edge intelligent service platform, and the edge nodes perform primary processing on data through various components and upload processing results and data to a cloud platform for further analysis and management.
The safety protection architecture unit comprises a kernel layer, a system layer and an application protection layer.
Further, the safety protection framework unit adopts an autonomous controllable safety operation system, and provides multiple safety guarantee capabilities at the edge side: supporting multi-user management of the system, and using a strong user password strategy; TLS encryption is adopted for data communication, and a high-strength encryption algorithm is adopted for data encryption storage and transmission; the network port, connection and service are protected through the firewall; and providing an audit log interface, saving the audit log and managing the audit log. The kernel layer mainly comprises the security increase of the kernel and the security management of the network message; the system layer is responsible for providing some basic security services and security support for applications; the application protection layer is mainly used for managing system configuration and identity authentication by system application and providing a safe communication component for service application.
The edge intelligent gateway safety function design based on three layers is used for realizing the following functions:
1. the inner nuclear layer is safe:
the safety of the kernel layer is realized mainly through the integrity verification of the kernel module and the protection of the process memory.
2. Network protection:
and the firewall supports the security policy configuration according to the source IP address, the source port, the target IP address and the target port of the IP message. Black and white list security mechanisms are supported.
The system supports various forms of VPNs, mainly including IPsec VPNs and SSL VPNs.
3. Security audit
And (3) regularly collecting safety logs of various devices and applications, storing and analyzing the safety logs, discovering violation, override and abnormal behaviors of the applications, predicting and alarming violation operations and tracing afterwards.
4. Integrity detection
And the integrity detection module is mainly used for providing periodic integrity detection for the operating system and providing periodic integrity detection for the application.
5. System upgrade
And the system upgrading module is mainly responsible for verifying the integrity of the upgrading packet and upgrading the system.
6. Application management
Application management includes application package management and rights management. The application package management module is mainly responsible for installation of the application and carries out integrity verification on the application package in the application installation process; the application authority management module is used, and applications in the gateway are divided into system applications and three-party applications, wherein the system applications can modify the security configuration of the terminal, and the three-party applications do not have the authority. And the application authority management module is mainly responsible for the authority management of the three-prevention application.
Based on the highly integrated edge intelligent gateway based on cloud edge collaboration, when the edge intelligent gateway is applied, platform users can comprise equipment production enterprises, equipment service enterprises, developers, enterprise units of various industries and the like. The intelligent manufacturing transformation upgrading enterprise and the intelligent manufacturing system integration service provider in different industries can be oriented, advanced products and services are provided through the edge intelligent gateway to carry out field intelligent transformation, and an integral solution is provided for users by combining the industrial internet platform cloud service and the edge side service. Meanwhile, the method actively responds to the national and local government policy guidance, does not have the complex information system construction capacity based on new generation information technologies such as cloud computing, big data, artificial intelligence and the like, and needs to realize wide medium and small enterprises on the cloud of the enterprises urgently. The cloud-up of enterprises is realized by applying edge intelligent gateway access equipment, products and the like, and the production management efficiency of the enterprises is improved.
Compared with the prior art, the invention has the following advantages:
1. the problem of poor interface is solved, common industrial hardware communication ports such as RS232, USB and CAN are covered, and wired and wireless communication modes are supported; an expansion interface is reserved, and the communication module and the storage module can be expanded; the compact industrial design of the whole machine, simple structure, and excellent sealing, dust-proof, heat dissipation and anti-seismic performance.
2. The problem of an operating system is solved, an independently controllable safe operating system is adopted, and multiple safety guarantee capabilities are provided on the edge side: supporting multi-user management of the system, and using a strong user password strategy; TLS encryption is adopted for data communication, and a high-strength encryption algorithm is adopted for data encryption storage and transmission; the network port, connection and service are protected through the firewall; and providing an audit log interface, saving the audit log and managing the audit log.
3. The problem of small number of application functions is solved, a smart main program is preinstalled to be used as an edge intelligent gateway, access is flexible, equipment can be connected at the lower part, and a cloud platform can be connected at the upper part; the software application pre-installation aerospace cloud network company INDIS edge platform can be used as an edge server to build a private cloud environment, pre-install mainstream industrial application software, interact with an aerospace cloud network application store, expand cloud application, embed rich industrial software resources and support various cloud edge cooperative applications such as cloud service, cloud configuration, remote updating and the like; providing a workshop-level solution for an enterprise: and the closed loop of the workshop-level application can be realized at the edge side.
4. By integrating the 5G module on the edge intelligent gateway, low-delay and high-reliability wireless data acquisition with equipment is realized for the lower part, and ultra-fast and high-capacity data cooperation with a cloud platform is realized for the upper part.
5. The problem of cloud edge collaborative integration is solved, a cloud edge collaborative function is achieved based on a KubeEdge technology, and a user can manage an edge intelligent gateway through an edge intelligent service platform and download, deploy and state monitoring of light application.
6. The problem of Docker containerization technology integration is solved, and the Docker technology is used for realizing containerization packaging of the edge intelligent gateway functional components, so that the functional components are independently cut, configured, operated and updated.
The invention has the beneficial effects that:
1. this high integrated edge intelligent gateway based on cloud limit is cooperative through setting up technical framework unit, realizes cloud limit cooperative function based on KubeEdge technique, and user's accessible edge intelligent service platform manages edge intelligent gateway to and the download, the deployment and the state monitoring of lightweight application.
2. This highly integrated edge intelligent gateway based on cloud limit is in coordination through setting up safety protection constitutional unit, provides multiple safety guarantee ability in the edge side: supporting multi-user management of the system, and using a strong user password strategy; TLS encryption is adopted for data communication, and a high-strength encryption algorithm is adopted for data encryption storage and transmission; the network port, connection and service are protected through the firewall; and providing an audit log interface, saving the audit log and managing the audit log.
In the description herein, references to the description of the term "one embodiment," "some embodiments," "an example," "a specific example," or "some examples," etc., mean that a particular feature, structure, material, or characteristic described in connection with the embodiment or example is included in at least one embodiment or example of the invention. In this specification, the schematic representations of the terms used above are not necessarily intended to refer to the same embodiment or example. Furthermore, the particular features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples. Furthermore, various embodiments or examples and features of different embodiments or examples described in this specification can be combined and combined by one skilled in the art without contradiction.
Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that changes, modifications, substitutions and alterations can be made in these embodiments without departing from the principles and spirit of the invention, the scope of which is defined in the appended claims and their equivalents.