Network data transmission encryption system and method in industrial computer communication

Abstract

The invention relates to the technical field of network communication, in particular to a network data transmission encryption system and method in industrial computer communication. The method comprises the following steps of: periodically and synchronously acquiring physical space coordinates, motion vectors and network signal strength of a mobile terminal in a continuous movement process of the mobile terminal so as to screen out at least more than two potential wireless access point sets; selecting a first candidate network target and a second candidate network target from the potential wireless access point set to construct a dual-path handover plan; and when a preset signal strength switching condition is satisfied, establishing a temporary communication tunnel, completing authentication handshake with the first candidate network target or the second candidate network target, and establishing an end-to-end data transmission encryption link. Instantaneous security access under the dynamic network is realized through physical trajectory prediction and double-path pre-authorization, low-delay security switching and self-adaptive encryption of the industrial mobile equipment under the dynamic network are realized, and continuity of a production process and data security are guaranteed.

Description

Technical Field

[0001] The present invention relates to the technical field of network communications, and in particular to a network data transmission encryption system and method in industrial computer communications. Background Art

[0002] In smart factories and advanced production lines, devices such as automated guided vehicles (AGVs), collaborative robots, mobile workstations, and various temporarily connected smart tools frequently join and leave the network, causing the network topology to be in a state of constant flux. However, existing industrial network encryption technologies are primarily designed for relatively static network environments, with security architectures based on pre-configured, fixed network topologies and relatively stable communication relationships. These technologies perform one-time authentication and key distribution upon initial device access, and then use fixed encryption algorithms and security policies. In the dynamic environment of smart factories, this static encryption model cannot effectively cope with the frequently changing relationships between network nodes, leading to various security risks and efficiency issues. Furthermore, traditional authentication mechanisms are typically based on static identities and pre-set trust relationships, lacking support for dynamic trust assessment. In smart factory environments, the trust status of devices should be dynamically adjusted based on their location, behavior patterns, and network topology, rather than relying solely on initial authentication. Existing technologies are unable to assess the security status of mobile devices in real time, increasing the potential risk of unauthorized access, especially when devices move between different security domains. Summary of the Invention

[0003] Based on this, the present invention provides a network data transmission encryption system and method in industrial computer communication to solve at least one of the above technical problems.

[0004] To achieve the above object, a method for encrypting network data transmission in industrial computer communication includes the following steps: Step S1: While the mobile terminal is in continuous motion, its physical space coordinates, motion vector, and network signal strength are periodically and synchronously collected to generate a device spatiotemporal state; based on the device spatiotemporal state, its movement path is predicted, thereby screening at least two potential wireless access point sets; Step S2: Modifying the moving path based on the network signal strength in the device's spatiotemporal state, and selecting a first candidate network target and a second candidate network target from the set of potential wireless access points to construct a dual-path handover plan; determining a transient connection token including dual-path authentication based on the dual-path handover plan; Step S3: During the process of the mobile terminal continuously monitoring the network signal, when the preset signal strength switching condition is met, a transient connection token is broadcast to the candidate network target in the dual-path handover plan to establish a temporary communication tunnel; Step S4: Report the real-time location of the mobile terminal through the temporary communication tunnel to determine the dynamic encryption strategy; use the instant connection token to complete the authentication handshake with the first candidate network target or the second candidate network target, and establish an end-to-end data transmission encryption link based on the dynamic encryption strategy and the temporary communication tunnel.

[0005] The present invention also provides a network data transmission encryption system in industrial computer communication, which executes the network data transmission encryption method in industrial computer communication as described above. The network data transmission encryption system in industrial computer communication includes: The trajectory sensing module is used to periodically and synchronously collect the physical space coordinates, motion vectors, and network signal strength of the mobile terminal during its continuous movement to generate the device's spatiotemporal state; based on the device's spatiotemporal state, it predicts its movement path and thus selects at least two potential wireless access point sets; A dual-path planning module is configured to modify the mobile path based on the network signal strength in the device's spatiotemporal state, select a first candidate network target and a second candidate network target from a set of potential wireless access points, and construct a dual-path handover plan; and determine an instantaneous connection token including dual-path authentication based on the dual-path handover plan. The communication switching module is used to broadcast an instant connection token to the candidate network target in the dual-path handover plan to establish a temporary communication tunnel when the preset signal strength switching condition is met during the process of the mobile terminal continuously monitoring the network signal; The secure link establishment module is used to report the real-time location of the mobile terminal through a temporary communication tunnel to determine the dynamic encryption strategy; use the instant connection token to complete the authentication handshake with the first or second candidate network target, and establish an end-to-end data transmission encryption link based on the dynamic encryption strategy and the temporary communication tunnel.

[0006] The beneficial effects of the present invention are: On the one hand, by periodically and synchronously collecting the physical space coordinates, motion vectors and network signal strength of the mobile terminal to generate the device's spatiotemporal state, and based on this, predicting its movement path, the present invention can screen out candidate network targets in advance and construct a dual-path handover plan including the first and second candidate targets; further, by pre-generating an instantaneous connection token containing dual-path authentication information, the passive authentication request is converted into an active pre-authorization mode, fundamentally solving the connection delay and interruption problems caused by the complex key establishment process and the inability to adapt to frequent changes in network topology in traditional encryption methods, significantly improving the network access efficiency of mobile devices when roaming across regions, and ensuring the continuity of the production process and the real-time nature of data transmission.

[0007] Furthermore, by selecting a first and second candidate network target from a set of potential wireless access points and establishing a dual-path handover plan, the present invention provides a reliable redundancy mechanism for network switching. If a mobile terminal fails to establish a connection with the first candidate network target due to a sudden path change or signal interference, the handover process to the second candidate network target is immediately initiated. This design can easily cope with the rapidly changing network topology and unpredictable signals in industrial environments, significantly improving the success rate of network handovers and communication continuity, and effectively reducing the problem of secure connection interruptions (accumulated 5-15 minutes per shift) caused by single-path prediction failures.

[0008] On the other hand, the real-time location of the mobile terminal is reported through a temporary communication tunnel, and the dynamic encryption strategy is determined according to the risk level of the physical area where it is located. The present invention deeply binds the network security strategy with the physical space security domain of the factory; the present invention can intelligently adjust the encryption strength according to whether the equipment is in a high-risk core assembly area (using AES-256-GCM) or a low-risk storage area (using ChaCha20-Poly1305), which can ensure the highest security in the core area while reducing the encryption overhead for equipment in non-critical areas, thereby avoiding data transmission interruption and business stagnation caused by single-point switching failure in terms of security and communication efficiency, greatly improving communication reliability under complex working conditions and rapid changes in network topology, and ensuring the stable transmission of key industrial data. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] Figure 1 A schematic flow chart of the steps of the network data transmission encryption method in industrial computer communication of the present invention; The purpose, features and advantages of the present invention will be further described with reference to the accompanying drawings and in conjunction with the embodiments. DETAILED DESCRIPTION

[0010] The following is a clear and complete description of the technical method of the present invention in conjunction with the accompanying drawings. It is obvious that the embodiments described are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making any creative efforts are within the scope of protection of the present invention.

[0011] In addition, the accompanying drawings are merely schematic illustrations of the present invention and are not necessarily drawn to scale. Identical reference numerals in the figures denote identical or similar parts, and thus repetitive descriptions thereof will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities that do not necessarily correspond to physically or logically separate entities. These functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor and / or microcontroller approaches.

[0012] It should be understood that although the terms "first," "second," and the like may be used herein to describe various elements, these elements should not be limited by these terms. These terms are used solely to distinguish one element from another. For example, a first element may be referred to as a second element, and similarly, a second element may be referred to as a first element, without departing from the scope of the exemplary embodiments. The term "and / or" as used herein includes any and all combinations of one or more of the listed associated items.

[0013] To achieve this, please refer to Figure 1 The present invention provides a network data transmission encryption method in industrial computer communication, comprising the following steps: Step S1: While the mobile terminal is in continuous motion, its physical space coordinates, motion vector, and network signal strength are periodically and synchronously collected to generate a device spatiotemporal state; based on the device spatiotemporal state, its movement path is predicted, thereby screening at least two potential wireless access point sets; In this embodiment of the present invention, while a mobile terminal (such as an AGV) is in continuous motion, its multi-dimensional physical and network parameters are periodically and synchronously collected at a frequency of no less than 20Hz. The collected data includes: three-dimensional physical spatial coordinates provided by a UWB (ultra-wideband) positioning base station deployed within the factory; three-axis acceleration and angular velocity provided by the terminal's integrated IMU (inertial measurement unit), from which the instantaneous motion vector is calculated; and the received signal strength indicator (RSSI) of all surrounding wireless access points (APs) scanned by the terminal's wireless communication module. This heterogeneous data is timestamped and encapsulated into a structured device spatiotemporal status data packet.

[0014] In one implementation of this embodiment of the present invention, assume that at a certain time t = T0, the AGV's physical spatial coordinates are collected as (10.2m, 35.4m, 1.1m), its motion vector is 1.5m / s, its direction angle is 45°, and the received network signal strength is {AP-1: -55dBm, AP-2: -88dBm, AP-3: -90dBm, AP-4: -92dBm}. These data together constitute the device's spatiotemporal state at that moment. Based on this state, a movement path is predicted for the next three seconds, extending from (10.2, 35.4) to (13.4, 38.6). Comparing this predicted path with the pre-set factory AP coverage map reveals that the path will successively enter the signal range of AP-2 and AP-3 (within the -85dBm equipotential line). Therefore, {AP-2, AP-3} are selected as the potential wireless access point set.

[0015] Step S2: Modifying the moving path based on the network signal strength in the device's spatiotemporal state, and selecting a first candidate network target and a second candidate network target from the set of potential wireless access points to construct a dual-path handover plan; determining a transient connection token including dual-path authentication based on the dual-path handover plan; In this embodiment of the present invention, the continuous trend of RSSI values ​​in the device's spatiotemporal state is analyzed to correct for deviations in purely physical motion predictions. If the RSSI trend aligns with the predicted physical motion direction, the confidence of the predicted path is enhanced; if not, the prediction weight is appropriately reduced. Subsequently, the APs in the potential wireless access point set are evaluated and ranked based on the predicted path's trajectory intersection depth within their core signal coverage area (e.g., the -65dBm zone), the estimated signal gain gradient, and the AP's own load. The optimal and suboptimal APs are then selected as the first and second candidate network targets, forming a dual-path handover plan.

[0016] In one implementation of this embodiment of the present invention, analysis of the continuous spatiotemporal state of devices revealed that AP-2's RSSI value steadily increased from -88dBm to -80dBm, while AP-3's RSSI value fluctuated around -90dBm, confirming that the AGV was moving toward AP-2. Further calculations revealed that the predicted path length within AP-2's -65dBm core coverage area was 2.5 meters, while within AP-3's corresponding area it was only 0.8 meters. Therefore, AP-2 was selected as the first candidate network target, and AP-3 as the second candidate. These two targets were combined with the AGV IDs to form a dual-path handover plan: {AGV-ID: 007, Target 1: AP-2, Target 2: AP-3, Estimated Time 1: 2.8s}. Based on this plan, the central authentication server generated authentication key material for AP-2 and AP-3, encrypted and encapsulated it into a transient connection token containing dual-path authentication information, and pre-delivered it to the AGV.

[0017] Step S3: During the process of the mobile terminal continuously monitoring the network signal, when the preset signal strength switching condition is met, a transient connection token is broadcast to the candidate network target in the dual-path handover plan to establish a temporary communication tunnel; In this embodiment of the present invention, a mobile terminal carrying a transient connection token continuously monitors the signal strength of the currently connected AP (AP-1) and the first candidate network target (AP-2) in the dual-path handover plan at a high frequency (e.g., every 50 milliseconds). When the signal strength of the current AP decreases to a preset lower threshold while the signal strength of the target AP increases to a preset upper threshold, a handover condition is triggered. At this point, the terminal immediately broadcasts its transient connection token to the public channel of the first candidate network target, requesting a connection.

[0018] In one implementation of this embodiment, the preset handover condition is: the RSSI value of the current AP (AP-1) is less than -82dBm, and the RSSI value of the first candidate target (AP-2) is greater than -78dBm. At time t = T0 + 2.7s, the AGV detects that AP-1's signal strength is -83dBm and AP-2's signal strength is -77dBm, thus satisfying the handover condition. The AGV immediately extracts the portion of the transient connection token intended for AP-2 from the token and broadcasts it to AP-2. After receiving and verifying the token, AP-2 establishes a basic, temporary communication tunnel with the AGV without further communication with the central server.

[0019] Step S4: Report the real-time location of the mobile terminal through the temporary communication tunnel to determine the dynamic encryption strategy; use the instant connection token to complete the authentication handshake with the first candidate network target or the second candidate network target, and establish an end-to-end data transmission encryption link based on the dynamic encryption strategy and the temporary communication tunnel.

[0020] In this embodiment of the present invention, the moment a temporary communication tunnel is successfully established, the mobile terminal immediately reports its most accurate real-time UWB coordinates to the central server via the newly established link. Based on these coordinates, the server queries the risk level corresponding to the location module in a pre-set factory space security map and selects the appropriate encryption protocol accordingly, forming a dynamic encryption policy. Simultaneously, the terminal and the access point complete the final authentication handshake using the key material pre-installed in the transient connection token and apply the dynamic encryption policy to the tunnel, solidifying it into an end-to-end encrypted data transmission link with an appropriately secure level.

[0021] In one implementation of this embodiment, the AGV reports its real-time coordinates (14.5m, 39.0m) through a temporary communication tunnel established with AP-2. The central server queries the map and finds that the coordinates are located in the "Core Component Quality Inspection Area," which qualifies as a "High Communication Risk" zone. Therefore, it determines the dynamic encryption policy to be AES-256-GCM. The server immediately distributes this policy to the AGV and AP-2. Simultaneously, the AGV and AP-2 complete an authentication handshake based on a transient connection token. Subsequently, both parties jointly apply the AES-256-GCM policy, upgrading the temporary tunnel to a highly encrypted data transmission link. If AP-2 does not respond to the AGV's broadcast within a specified time (e.g., 500ms), the AGV automatically activates the second part of the backup plan and broadcasts the token to AP-3, repeating the process to ensure connection reliability.

[0022] Preferably, in step S1, while the mobile terminal is in continuous motion, periodically and synchronously collecting its physical space coordinates, motion vector, and network signal strength to generate the device's spatiotemporal state includes: The ultra-wideband positioning base station deployed in the factory collects the physical coordinates of the mobile terminal at a frequency of 10Hz to obtain the instantaneous spatial coordinates; The inertial measurement unit integrated in the mobile terminal is used to obtain its three-axis acceleration and calculate the instantaneous motion vector based on the instantaneous spatial coordinates; Based on the instantaneous motion vector, the instantaneous spatial coordinates within 0.5 seconds are forward-propagated and verified to correct the positioning error and obtain high-confidence trajectory points. Continuously collect at least 10 received signal strength indicator values ​​received by the mobile terminal from the current wireless access point in the past 1 second to obtain an RSSI raw sequence; The RSSI raw sequence, high-confidence trajectory points, and instantaneous motion vectors are encapsulated as the device's spatiotemporal state.

[0023] In this embodiment of the present invention, a UWB tag is mounted on top of a mobile terminal (such as an AGV), and UWB positioning base stations are evenly distributed across the factory ceiling. A central positioning server sends positioning requests to all base stations at a fixed interval of 100 milliseconds (10Hz). The base stations calculate the real-time 3D physical coordinates of the AGV by measuring the time difference of arrival (TDOA) of the UWB tag's signals.

[0024] In one implementation of an embodiment of the present invention, it is assumed that at time t=1.0s, the central positioning server determines the physical coordinates of the AGV as (10.21m, 35.43m, 1.10m) through collaborative calculation of four UWB base stations. This coordinate data is marked as the instantaneous spatial coordinates at that moment.

[0025] In this embodiment of the present invention, the IMU integrated within the AGV continuously outputs its three-axis acceleration and angular velocity data at a higher frequency (e.g., 100 Hz). The IMU data closest to the timestamp of the instantaneous spatial coordinate is extracted. Simultaneously, by performing a differential operation on two consecutive instantaneous spatial coordinates, the average speed and direction of the AGV within 100 milliseconds can be calculated.

[0026] In one implementation of an embodiment of the present invention, it is assumed that the instantaneous spatial coordinates at t = 1.0s (10.21, 35.43, 1.10) and the coordinates at t = 0.9s (10.10, 35.32, 1.10) are obtained. By calculation, the displacement within this time interval is approximately 0.156 meters, the direction angle is approximately 45 degrees, and the velocity is therefore 1.56 m / s. Combined with the acceleration data provided by the IMU (for example, x-axis acceleration ax = 0.1 m / s²), the instantaneous motion vector at this moment is formed: {speed: 1.56 m / s, direction: 45°, acceleration: (0.1, 0.05, 0.0) m / s²}.

[0027] In this embodiment of the present invention, the instantaneous spatial coordinates for the past 0.5 seconds (i.e., five acquisition cycles) are cached. Starting from the coordinate point 0.4 seconds ago, forward propagation (i.e., position dead reckoning) is performed using the four consecutive instantaneous motion vectors thereafter to obtain a theoretical current position. This theoretical position is then compared with the most recently acquired instantaneous spatial coordinates. If the deviation between the two is less than a preset threshold (e.g., 10 cm), the most recent instantaneous spatial coordinates are considered credible. If the deviation is excessive, a weighted correction is applied to the theoretical position. The resulting, verified and corrected coordinate point is recorded as a high-credibility trajectory point.

[0028] In another implementation of an embodiment of the present invention, it is assumed that the instantaneous motion vector at t=0.5s predicts that the coordinates at t=0.6s should be (10.36, 35.58, 1.10). The actual instantaneous spatial coordinates captured by UWB at t=0.6s are (10.38, 35.60, 1.10). The Euclidean distance between the two is less than the preset threshold of 10cm, and the verification passes. The system will use a weighted average (for example, the predicted value weight is 0.3, the actual value weight is 0.7) to calculate the final corrected coordinates (10.374, 35.594, 1.10). This verified and corrected coordinate point is marked as a high-confidence trajectory point. If the distance exceeds the threshold, the system will temporarily discard the UWB reading and continue to use the motion vector prediction value as the high-confidence trajectory point to ensure the continuity of the trajectory.

[0029] In this embodiment of the present invention, the AGV's wireless communication module continuously scans and records the RSSI value of the AP it is currently connected to (e.g., AP-1) at approximately 100ms intervals. The system maintains a sliding queue with a time window of 1 second to store the most recent RSSI readings.

[0030] It should be noted that at least 10 samples are collected to enable trend analysis (such as slope calculation) to more accurately determine the changing trend of signal strength and avoid misjudgment caused by single signal jitter.

[0031] In one implementation of this embodiment, at time t = 1.0s, the high-confidence trajectory points (10.21, 35.43, 1.10), the instantaneous motion vector {speed: 1.56m / s, ...}, and the original RSSI sequence of 10 RSSI values ​​{-55dBm, ...}, along with the device ID and timestamp, are combined into a complete data packet. This data packet is the final device spatiotemporal state used for subsequent decision-making.

[0032] Preferably, in step S1, predicting the movement path of the device based on its spatiotemporal state, thereby screening out at least two or more potential wireless access point sets includes: Calculate the standard deviation of the instantaneous motion vector in the device's spatiotemporal state within the last 1 second, and record this standard deviation as the device's motion stability; Determine whether the device's motion stability is greater than a preset threshold of 0.1 m / s. If so, generate a maneuvering status code. Identify the mobile terminal's movement path within the next 2 seconds based on the maneuvering state code and the high-confidence trajectory points and instantaneous motion vectors in the device's spatiotemporal state, and use this as the predicted displacement path. The predicted displacement paths are spatially overlaid and compared based on a preset plant-wide AP signal strength spatial topology map. Access points whose trajectories will fall within the -75dBm signal equipotential line are selected to form a set of potential wireless access points. The preset plant-wide AP signal strength spatial topology map is annotated with the physical locations of each wireless access point in the factory and the -75dBm signal equipotential coverage circle.

[0033] In this embodiment of the present invention, the velocity components of all instantaneous motion vectors within the past second (for example, the most recent 10 sampling points) are extracted from a continuous stream of device spatiotemporal state data. This set of velocity data is then statistically analyzed to determine its standard deviation. This standard deviation is used to quantitatively assess the smoothness of the mobile terminal's recent motion.

[0034] In one implementation of this embodiment, 10 AGV speed readings were taken over the past second: {1.50, 1.51, 1.49, 1.50, 1.52, 1.50, 1.51, 1.48, 1.50, 1.49} m / s. The standard deviation of this data set was calculated to be approximately 0.011 m / s. This value is recorded as the device's motion stability at that moment. A smaller standard deviation indicates that the device is moving smoothly at a constant or near-constant speed.

[0035] In one implementation of this invention, assume the currently calculated device motion stability is 0.011 m / s, which is less than the preset threshold of 0.1 m / s. Therefore, the AGV is determined to be in a stable driving state, no maneuvering state code is generated, and a linear model is used for path prediction. This linear model is a simple geometric extrapolation method based on the assumption of uniform linear motion. Its purpose is to quickly estimate the device's future position within a short period of time while consuming minimal computing resources.

[0036] The specific implementation of this linear model is as follows: Parameter definition and acquisition: current position : Get from the latest high-confidence trajectory point and record it as coordinates ; Current speed : Get the speed from the latest instantaneous motion vector; current direction :Get the direction angle from the latest instantaneous motion vector, which is the angle between the velocity vector and the positive direction of the X-axis of the factory coordinate system; prediction time window : This is a preset parameter used to define the predicted future duration. In the present invention, this value is set to 2 seconds.

[0037] Predicted displacement calculation: The system first decomposes the velocity vector into components on the X and Y axes: X-axis velocity component: ; Y-axis velocity component: ; Then, calculate the Internal, X-axis and Y-axis displacement: X-axis displacement ; Y-axis displacement ; Calculation of future position points: Add the calculated displacement to the current position coordinates to get the predicted future position point : Predicted position X coordinate ; Predicted position Y coordinate ; Generate predicted displacement path: Finally, the current position point and predicted future position points Connect them to form a straight line segment, which is the predicted displacement path of the final output.

[0038] In another implementation of this embodiment, assume that the AGV is turning and its velocity readings are {1.5, 1.4, 1.2, 1.0, 0.8, ...} m / s. The calculated device motion stability is 0.25 m / s, which is greater than the 0.1 m / s threshold. At this point, a maneuver status code (e.g., 0x01) is generated. This status code informs subsequent steps that a nonlinear prediction model that considers acceleration should be used, as described above for the linear model implementation.

[0039] In this embodiment of the present invention, a pre-drawn digital factory map is loaded. This map precisely marks the physical coordinates of each wireless access point (AP). A theoretical -75dBm signal strength contour (usually simplified as a circle or ellipse) is drawn around each AP, known as the "AP weak signal coverage circle." The predicted displacement path generated in the previous step is used as a geometric line segment and intersected with all "AP weak signal coverage circles" on this map.

[0040] In one implementation of this embodiment of the present invention, for example, the predicted displacement path segment [(10.21, 35.43), (12.42, 37.64)] is overlaid with the plant-wide AP coverage map. Calculation results show that this path segment intersects with the -75dBm coverage circles of both AP-2 and AP-3. Therefore, AP-2 and AP-3 are selected.

[0041] It's important to note that -75dBm is generally considered the edge signal strength for a reliable Wi-Fi connection. Choosing this value as the screening threshold ensures that the selected APs are potential targets that can provide effective service. Ultimately, the identifiers of the two selected access points, {AP-2, AP-3}, form the set of potential wireless access points.

[0042] Preferably, identifying the movement path of the mobile terminal within the next 2 seconds based on the maneuvering state code and the high-confidence trajectory points and instantaneous motion vector in the device's spatiotemporal state includes: The signal strength trend slope is obtained by calculating the change slope of the RSSI raw sequence in the device's spatiotemporal state within the most recent 500ms time window. Analyze the positive and negative signs of the signal strength trend slope to identify whether the mobile terminal is approaching or moving away from the wireless access point, thereby obtaining the relative movement trend of the device; Cross-verify the Doppler shift in the communication signal based on the relative movement trend of the device. If the two directions are consistent, construct a verified direction vector based on the maneuver status code; The predicted landing coordinates of the mobile terminal after the 2-second prediction time window are deduced based on the verified direction vector and the instantaneous motion vector in the device's spatiotemporal state; The predicted displacement path is obtained by linear interpolation based on the predicted landing point coordinates and the high-confidence trajectory points in the device's spatiotemporal state.

[0043] In this embodiment, the latest RSSI raw sequence is extracted from the device's spatiotemporal state, focusing only on data points within the most recent 500ms time window. Linear regression analysis is applied to these data points to calculate the slope of a best-fit line, which quantitatively reflects the recent trend in signal strength.

[0044] Specifically, the slope The calculation adopts the least square method, and its mathematical expression is: ; in: is the number of samples in the 500ms time window; It is The acquisition timestamp of each sample (relative to the start of the window); It is RSSI value of each sample (unit: dBm).

[0045] In the embodiment of the present invention, it is only necessary to determine the signal strength trend slope calculated in the previous step A positive slope indicates that the signal strength is increasing, which means that the mobile terminal is approaching the signal source (wireless access point); a negative slope indicates that the signal is weakening, which means that it is moving away.

[0046] In one implementation of the present invention, for example, because the calculated signal strength trend slope is +19.0 dBm / s, a positive number, the mobile terminal is determined to be approaching AP-2. This determination result is recorded as the device's relative movement trend, with the data format being {Trend: Approaching, Target AP: AP-2}.

[0047] In the embodiment of the present invention, in order to improve the reliability of direction determination, the Doppler shift of the physical layer is introduced as a cross-validation method. The wireless communication module of the mobile terminal measures the carrier frequency offset of the received signal, that is, the Doppler shift Theoretically, when the terminal is close to the signal source, a positive frequency shift will occur (the frequency becomes higher); when it is far away, a negative frequency shift will occur. Compare the sign of with the relative movement trend of the device obtained in the previous step.

[0048] Specifically, the following judgment is made: If the relative movement trend of the device is "approaching" and >0, or trending to "far away" and <0, the direction indication is determined to be consistent and the verification is passed. After the verification is passed, the current instantaneous motion vector is considered to be highly reliable and is directly adopted as the verified direction vector.

[0049] In one implementation of the embodiment of the present invention, it is assumed that the relative movement of the device is "close" and the Doppler frequency shift measured by the wireless communication module is =+50Hz. Since the physical effect of "approaching" is a positive frequency shift, the two directions indicate the same, and cross-validation succeeds. Therefore, the instantaneous motion vector in the current device's spatiotemporal state is confirmed as the verified direction vector. If the device's relative motion trend indicates "approaching," but the estimated Doppler frequency shift is -40Hz (indicating "moving away"), a discrepancy occurs. In this case, the direction verification is considered a failure, and a verified direction vector will not be generated. An alarm will be triggered, or a more conservative prediction strategy will be adopted, such as shortening the prediction time window.

[0050] It should be noted that the Doppler shift measurement value can be provided by the baseband processor of the communication chip without the need for additional hardware.

[0051] In the embodiment of the present invention, since the maneuvering state code has been generated before, indicating that the device is in a non-uniform motion state, a quadratic kinematic model considering acceleration is used for prediction.

[0052] Specifically, the predicted landing coordinates The calculation formula is: ; in: is the predicted future position vector ; is the current position vector, taken from a high-confidence trajectory point in the device's spatiotemporal state ; is the current velocity vector, taken from The corresponding verified direction vector; is the current acceleration vector, which is taken from the value calculated by the IMU in the device's spatiotemporal state ; It is the prediction time window, which is preset to 2.0 seconds.

[0053] It should be noted that the preset 2-second time window is a comprehensive trade-off based on the typical speed of AGVs in the factory (0-2m / s) and the preparation time required for network switching (approximately 1-3 seconds). It can provide sufficient lead time without causing excessive error amplification due to excessive prediction time.

[0054] In this embodiment of the present invention, linear interpolation refers to directly connecting the predicted starting and ending points to form a straight line path representing the net displacement. A high-confidence trajectory point in the device's spatiotemporal state is used as the starting point of the path, and the predicted landing point coordinates calculated in the previous step are used as the ending point of the path.

[0055] In one implementation of the embodiment of the present invention, the starting point (15.0, 40.0) m and the end point (17.0, 41.8) m are connected to form a straight line segment. This line segment represents the net displacement direction and distance in the next 2 seconds, and is finally determined as the predicted displacement path.

[0056] Preferably, in step S2, the moving path is modified according to the network signal strength in the spatiotemporal state of the device, and a first candidate network target and a second candidate network target are selected from the potential wireless access point set to construct a dual-path handover plan, including: For each wireless access point in the potential wireless access point set, the spatial intersection length of its core signal coverage area and the predicted displacement path is calculated to obtain the trajectory intersection depth. The core signal coverage area is the area within the wireless access point where the signal strength is better than -55dBm. Arrange all wireless access points in the potential wireless access point set in descending order according to the trajectory intersection depth to form a preferred AP ranking; Search the preset plant-wide AP signal strength spatial topology map and identify the best wireless access point in the preferred AP ranking as the first candidate network target; After determining the first candidate target, the second best wireless access point in the preferred AP ranking is retrieved and identified again and recorded as the second candidate network target; The identifiers of the first candidate network target and the second candidate network target are combined with the ID of the mobile terminal, and a timestamp is added to form a dual-path handover plan.

[0057] In an embodiment of the present invention, the core signal coverage area is extracted for each AP in the potential wireless access point set from the preset plant-wide AP signal strength spatial topology map. This core area is defined as a circular area where the signal strength can theoretically be stably maintained above -55dBm. Then, the predicted displacement path (a straight line segment) generated in the previous step is geometrically intersected with these circular areas to calculate the length of the path segment inside each circle. It should be noted that -55dBm is a typical signal strength value that can provide high-quality, high-throughput Wi-Fi services. Specifically, the intersection length The calculation involves the intersection of a line and a circle in analytic geometry. A circle with a center and radius r, and a line from point and The calculation process of the defined line segment includes determining whether the line segment intersects the circle, solving the intersection point, and finally calculating the partial length of the line segment within the circle. This length is quantified into a new parameter, recorded as the trajectory intersection depth.

[0058] In one implementation of the embodiment of the present invention, it is assumed that the set of potential wireless access points is {AP-2, AP-3}. The core signal coverage area of ​​AP-2 is a circle with a center of (18.0, 42.0) and a radius of 10 meters. The core area of ​​AP-3 is a circle with a center of (22.0, 45.0) and a radius of 8 meters. The predicted displacement path is a line segment connecting points (17.0, 41.8) and (19.5, 43.0). Through geometric calculation: the intersection length of this path segment with the core area of ​​AP-2 is 2.8 meters; the intersection length of this path segment with the core area of ​​AP-3 is 1.1 meters; these two calculated length values ​​are the trajectory intersection depths of AP-2 and AP-3, respectively.

[0059] In one implementation of this embodiment of the present invention, calculations show that the trajectory intersection depth of AP-2 (2.8 meters) is greater than the trajectory intersection depth of AP-3 (1.1 meters). Therefore, the set {AP-2, AP-3...} is sorted in descending order, resulting in an ordered list: [AP-2, AP-3...]. This list represents the preferred AP ranking.

[0060] In the embodiment of the present invention, an element is directly taken from the top of the preferred AP ranking list, that is, the AP ranked first. This AP is considered to be the best switching option under the current predicted path.

[0061] In one implementation of the embodiment of the present invention, the system takes the first element AP-2 from the preferred AP ranking [AP-2, AP-3...], and then the system formally identifies AP-2 as the first candidate network target in the internal state.

[0062] In an implementation manner of the embodiment of the present invention, the second element AP-3 is taken out from the preferred AP ranking [AP-2, AP-3], and then the system formally identifies AP-3 as the second candidate network target.

[0063] In one implementation of this embodiment of the present invention, the mobile terminal ID (e.g., AGV-007), the first candidate network target (AP-2), the second candidate network target (AP-3), and the current system timestamp (e.g., 1678886405.123) are combined to generate the following data structure: {Plan ID: PRE-001, Timestamp: 1678886405.123, Terminal ID: AGV-007, Target 1: AP-2, Target 2: AP-3}, resulting in a dual-path handover plan.

[0064] Preferably, in step S2, determining the instantaneous connection token including the dual-path authentication according to the dual-path handover plan includes: According to the first candidate network target and the second candidate network target in the dual-path handover plan, immediately initiate a collaborative authentication request to the central server to obtain the first collaborative session ID and the second collaborative session ID; Generate a first temporary key pair according to the first collaborative session ID, and send one public key of the first temporary key pair to the first candidate network target and the other public key to the mobile terminal, which are recorded as the first session seed; Generate a second temporary key pair based on the second collaborative session ID, and send one public key of the second temporary key pair to the second candidate network target and the other public key to the mobile terminal, which are recorded as the second session seed; The mobile terminal performs a SHA-256 hash digest calculation using its own device certificate and the received first session seed and second session seed, respectively, to obtain a first pre-trust and a second pre-trust; Based on the estimated time of entering the wireless access point in the dual-path handover plan plus a 2-second security window, an absolute expiration timestamp is calculated to form a token expiration tag. The first pre-token, the second pre-token and the token time-limit tag are constructed into an instantaneous connection token dedicated to the mobile terminal.

[0065] In one implementation of this embodiment of the present invention, after receiving the plan, the central authentication server generates an identifier, SessID_A = 'A7B3-C9D1-E4F2-10AB', for the potential connection between AGV-007 and AP-2. This is the first collaborative session ID. Simultaneously, it generates SessID_B = 'F6A9-8B2E-5C1D-77FF' for the potential connection between AGV-007 and AP-3. This is the second collaborative session ID.

[0066] In this embodiment of the present invention, the central authentication server uses its built-in cryptographic library to generate a temporary, short-lived public-private key pair for the first collaborative session ID based on elliptic curve cryptography (ECC). The server then pushes the public key portion of this key pair to both communicating parties via an internal secure channel (e.g., an established IPsec tunnel).

[0067] Specifically, the server generates a key pair (PrivKey_A, PubKey_A) for SessionID_A. It then sends the public key PubKey_A directly to AP-2 via the internal wired network. It then sends the same public key PubKey_A to AGV-007 via AP-1, to which AGV-007 is currently connected. This public key PubKey_A sent to the AGV is recorded as the first session seed.

[0068] It's important to note that the public key is the one being sent, so even if it's eavesdropped on during transmission, it won't leak critical information. The private key, PrivKey_A, is securely stored by the central authentication server or, in some architectures, can be sent directly to the AP. It's never sent to mobile devices.

[0069] In one implementation of this embodiment, the server sends the public key, PubKey_B, to AP-3 via the internal network. It then distributes the same public key, PubKey_B, to AGV-007 via AP-1. This public key, PubKey_B, distributed to the AGV is recorded as the second session seed. The AGV now holds two different session seeds (public keys) for communicating with AP-2 and AP-3.

[0070] In this embodiment of the present invention, after receiving the session seed, the mobile terminal performs a local hash calculation to generate a credential that verifies its identity and is bound to the session. It concatenates its device certificate (an X.509 certificate issued by the root CA containing its identity and public key) with the session seed and then calculates the resulting hash value.

[0071] Specifically, the calculation process is as follows: ; ; in, and are the calculated hash digest values; It is the standard SHA-256 hash function; It is the binary content of the device certificate of AGV-007; and are the first session seed and the second session seed received respectively; || represents a binary concatenation operation.

[0072] In one implementation of the embodiment of the present invention, the AGV performs the above calculation, and the obtained 256-bit hash value H_A is recorded as the first pre-trust, and the hash value H_B is recorded as the second pre-trust.

[0073] In one implementation of the embodiment of the present invention, it is assumed that the estimated switching time (estimated time to enter the first candidate target) in the dual-path handover plan is 2.8s. The current system time is The default security window is 2.0s. The calculation is: ; This calculated absolute future timestamp +4.8s, which is recorded as the token validity label.

[0074] In one implementation of the embodiment of the present invention, the AGV encapsulates the first pre-token (a 256-bit hash value), the second pre-token (another 256-bit hash value), and the token expiration tag (a 64-bit Unix timestamp) in a predetermined format.

[0075] In another implementation of the embodiment of the present invention, the generation and construction of the instant connection token further includes: Generate a monotonically increasing sequence number based on the first pre-token and the second pre-token with the central server, which together constitute the core data of the session; Perform an asymmetric encryption operation on the core data of the session using the public key of the target access point to form an asymmetric encryption block; The estimated entry time of the first candidate network target and the second candidate network target in the dual-path handover plan is added with a fixed delay window of 2 seconds to obtain the absolute failure time; The final encapsulation structure of the instant connection token is the target access point ID plaintext header, the asymmetric encryption block, and the absolute expiration time, forming a three-part token structure.

[0076] Preferably, step S3 includes the following steps: Step S31: The mobile terminal, while carrying the instantaneous connection token, continuously monitors the signal strength of the currently connected wireless access point and the signal strength of the target wireless access point in the dual-path handover plan at intervals of 50 ms to obtain a real-time signal strength pair; Step S32: Correlate the target wireless access point identifier in the instant connection token according to the real-time signal strength to obtain a pending connection group including the handover source, target, and credentials; Step S33: Determine whether the signal strength of the currently connected wireless access point in the pending connection group is less than -82dBm, and whether the signal strength of the target wireless access point in the dual-path handover plan is greater than -78dBm; if so, determine that the handover condition is met and generate a handover execution instruction; if not, continue to monitor the network status of the mobile terminal; Step S34: according to the handover execution instruction, the mobile terminal immediately broadcasts an instant connection token to the public channel of the wireless access point in the dual-path handover plan to form a temporary communication tunnel.

[0077] In this embodiment of the present invention, upon receiving a transient connection token, the wireless communication module of a mobile terminal (such as an AGV) enters a high-frequency monitoring state. It not only continues to monitor the signal strength of the currently connected AP (source AP) but also, based on information in the dual-path handover plan, specifically listens for beacon frames from the first and second candidate network target APs to obtain their real-time signal strengths. This monitoring interval is set to 50 milliseconds.

[0078] It should be noted that 50ms is a well-balanced interval. It is short enough to allow signal evaluation every 10cm when the AGV moves at a high speed of 2m / s, thus ensuring the timeliness of switching decisions. In one implementation of this embodiment, an AGV is currently connected to AP-1. The dual-path handover plan specifies AP-2 (the first candidate) and AP-3 (the second candidate). At a specific monitoring time, the AGV receives signal strength readings of: AP-1: -81dBm, AP-2: -79dBm, and AP-3: -88dBm.

[0079] In one implementation of this embodiment of the present invention, the real-time signal strength pair (-81dBm, -79dBm) is logically bound to AGV-007's instantaneous connection token. This token includes the first pre-token prepared for AP-2 and the second pre-token prepared for AP-3. The resulting pending connection group can be described as: {Source AP: AP-1, Target AP: AP-2, Source Signal: -81dBm, Target Signal: -79dBm, Credentials: [First Pre-token]}.

[0080] In one implementation of the present invention, in the next 50ms monitoring period, the signal strength in the pending connection group becomes {source signal: -83dBm, target signal: -77dBm}. The system makes a judgment: S_source(-83dBm)<T_lower(-82dBm)--> Condition is met; S_target(-77dBm)>T_upper(-78dBm)-->Condition is met; Since both conditions are met simultaneously, the system determines that the switching condition has been met and immediately generates an internal switching execution instruction, where S_source is the signal strength of the currently connected AP; S_target is the signal strength of the first candidate target AP; T_lower is the lower limit threshold of the source AP signal strength, preset to -82dBm; T_upper is the upper limit threshold of the target AP signal strength, preset to -78dBm.

[0081] In another implementation of the embodiment of the present invention, if the signal strength is {source signal: -81dBm, target signal: -79dBm}, both conditions are not met, the system will continue to monitor and will not generate instructions.

[0082] In one implementation of this embodiment of the present invention, upon receiving a handover instruction, the wireless communication protocol stack of the AGV's mobile terminal immediately executes the handover operation. It temporarily stops sending data to the source AP and switches the wireless network card to the operating channel of the first candidate network target (AP-C). The terminal then constructs a specific management frame (for example, a modified authentication request frame or a customized action frame) with a transient connection token as the payload. This frame is sent to AP-C's public channel, effectively broadcasting it. Upon receiving this frame, AP-2 parses the token content and locally verifies its validity (e.g., timeliness, integrity, etc.). Because the token is pre-signed by a central server, AP-2 trusts its content and eliminates the need for server communication. It directly uses the key material implicit in the token to complete a handshake with the AGV, rapidly establishing a basic, encrypted communication link within 100-300 milliseconds.

[0083] Preferably, in step S4, reporting the real-time location of the mobile terminal through the temporary communication tunnel to determine the dynamic encryption strategy includes: After the temporary secure tunnel is established, the mobile terminal immediately reports its real-time location coordinates through the tunnel; The central server receives the real-time location coordinates and determines the risk level of the real-time location coordinates based on the preset factory risk communication area; the risk levels include high communication risk and low communication risk; If the communication risk is high, the AES-256-GCM encryption standard is selected. If the communication risk is low, the ChaCha20-Poly1305 encryption standard is selected. The central server then sends instructions to both communicating parties to obtain a dynamic encryption strategy.

[0084] In one implementation of the embodiment of the present invention, within the first 50 milliseconds after the temporary safety tunnel is established, AGV-007 reads the output of its UWB module and obtains the coordinates (17.02m, 41.85m, 1.10m).

[0085] Specifically, the factory's pre-defined risk communication zones are pre-defined by safety engineers. They divide the entire factory into two- or three-dimensional polygonal areas, each assigned a risk level. For example, warehouses storing core materials, precision assembly workstations, and quality inspection areas are designated "high communication risk," while public corridors and general material storage areas are designated "low communication risk." This map is digitally stored in a server database, with each area consisting of a sequence of vertex coordinates and a risk level label.

[0086] In one implementation of an embodiment of the present invention, the server receives the real-time location coordinates (17.02, 41.85) reported by AGV-007. The server executes a "point inside a polygon" geometric judgment algorithm to match the coordinates with all areas in the risk map. The calculation results show that the point falls within the polygon marked as "core component quality inspection area", and the preset risk level of this area is "high communication risk". Therefore, the server determines the risk level for this query as "high".

[0087] In another implementation of the embodiment of the present invention, if the coordinates reported by the AGV are located in a public corridor, the matched area risk level is "low communication risk".

[0088] In this embodiment of the present invention, a security policy mapping table exists within the central server. This table rigidly associates different risk levels with specific encryption standards. This selection is based on a trade-off between security strength and computational overhead. AES-256-GCM is an industry-recognized symmetric encryption algorithm with extremely high security strength, suitable for high-risk scenarios. ChaCha20-Poly1305, on the other hand, is an encryption algorithm that offers higher computational efficiency while maintaining sufficient security, especially on CPUs without hardware acceleration. It is suitable for low-risk scenarios that are more sensitive to energy consumption and latency.

[0089] Preferably, in step S4, completing the authentication handshake with the first or second candidate network target using the transient connection token, and establishing an end-to-end data transmission encrypted link according to the dynamic encryption policy and the temporary communication tunnel includes: triggering a first handover request within a 2-second validity period of a first preceding token in the instantaneous connection token; After receiving the first pre-authentication through the temporary communication tunnel, the first candidate network target in the dual-path handover plan immediately performs a local verification on the first pre-authentication, and returns a first authentication confirmation if it passes. After receiving the first authentication confirmation, the mobile terminal applies the dynamic encryption policy to establish a data transmission encryption link for the temporary communication tunnel and determines that the connection status is normal; When the 2-second validity period of the first preceding token in the instantaneous connection token expires, if the first authentication confirmation is not received, it is determined that the first path switching has failed, and a switching failure flag is generated; After the handover failure mark is generated, a handover procedure to a second candidate network target in the dual-path handover plan is triggered, and a second handover request including a second pre-token in the instant connection token is issued; After receiving the second handover request, the second candidate network target locally verifies the second pre-authentication and returns a second authentication confirmation if it passes. After receiving the second authentication confirmation, the mobile terminal applies the dynamic encryption strategy to establish a data transmission encryption link for the temporary communication tunnel, and determines that the connection status is normal in standby mode.

[0090] In one implementation of this embodiment of the present invention, the AGV meets the handover conditions and generates a handover execution instruction. It immediately starts a 2-second countdown and broadcasts a handover request, including the first pre-authentication, to AP-2, the first candidate network target in the dual-path handover plan. This action is referred to as the first handover request.

[0091] In one implementation of this embodiment, AP-2 receives the first pre-authentication token broadcast by the AGV. It performs a verification process and also checks the token expiration tag in the transient connection token to ensure that the current time does not exceed the expiration timestamp. If all checks pass, AP-2 determines the verification is successful and immediately returns a confirmation message to the AGV. This message serves as the first authentication confirmation.

[0092] In one implementation of this embodiment, the AGV receives the first authentication confirmation from AP-2 80 milliseconds after issuing its request. Almost simultaneously, it also receives a dynamic encryption policy from the central server specifying the use of AES-256-GCM. The AGV immediately enables the AES-256-GCM cipher suite in its protocol stack, negotiates with AP-2 (which also received the same policy instructions), generates a session key, and applies it to the temporary communication tunnel.

[0093] In one implementation of this embodiment, assume that the AGV fails to receive the first authentication confirmation due to AP-2's instantaneous high load or severe channel interference. At this point, the AGV's internal 2-second timer expires, triggering an interrupt. The program immediately determines that the handoff to AP-2 has failed and generates an internal handoff failure flag.

[0094] In one implementation of this embodiment of the present invention, after the handover failure flag is generated, the AGV immediately starts a new 2-second timer and extracts the second pre-token H_B prepared for AP-3 from the transient connection token. It encapsulates H_B in a new handover request and broadcasts it to AP-3's public channel. This action is called the second handover request.

[0095] In one implementation of this embodiment of the present invention, the AGV receives the second authentication confirmation 120ms after issuing the second handover request. It also applies the dynamic encryption policy issued by the central server (typically, the server issues it to the backup path simultaneously with the primary path, or immediately after the primary path fails), negotiates with AP-3, and establishes a link encrypted using AES-256-GCM. The AGV then updates its internal state, declaring the connection with AP-3 to be in a normal backup state. Even if the primary path fails, data transmission can be quickly restored via the backup path, ensuring service continuity.

[0096] The present invention is therefore intended to be illustrative and non-restrictive in all respects, with the scope of the invention being defined by the appended claims rather than the foregoing description, and all changes that come within the meaning and range of equivalents of the application documents are intended to be embraced therein.

[0097] The foregoing description is intended only to provide specific embodiments of the present invention, which will enable those skilled in the art to understand and implement the present invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention is not intended to be limited to the embodiments shown herein, but is to be construed in the widest possible manner consistent with the principles and novel features disclosed herein.

Claims

1. A network data transmission encryption method in industrial computer communication, characterized in that: The following steps are involved: Step S1: While the mobile terminal is in continuous motion, its physical space coordinates, motion vector, and network signal strength are periodically and synchronously collected to generate a device spatiotemporal state; based on the device spatiotemporal state, its movement path is predicted, thereby screening at least two potential wireless access point sets; Step S2: Modifying the moving path based on the network signal strength in the device's spatiotemporal state, and selecting a first candidate network target and a second candidate network target from the set of potential wireless access points to construct a dual-path handover plan; determining a transient connection token including dual-path authentication based on the dual-path handover plan; Step S3: During the process of the mobile terminal continuously monitoring the network signal, when the preset signal strength switching condition is met, a transient connection token is broadcast to the candidate network target in the dual-path handover plan to establish a temporary communication tunnel; Step S4: reporting the real-time location of the mobile terminal through the temporary communication tunnel to determine the dynamic encryption strategy; The instant connection token is used to complete the authentication handshake with the first candidate network target or the second candidate network target, and an end-to-end data transmission encryption link is established according to the dynamic encryption strategy and the temporary communication tunnel.

2. The network data transmission encryption method in industrial computer communication according to claim 1 is characterized in that: In step S1, while the mobile terminal is in continuous motion, periodic synchronous collection of its physical space coordinates, motion vector, and network signal strength to generate the device's spatiotemporal state includes: The ultra-wideband positioning base station deployed in the factory collects the physical coordinates of the mobile terminal at a frequency of 10Hz to obtain the instantaneous spatial coordinates; The inertial measurement unit integrated in the mobile terminal is used to obtain its three-axis acceleration and calculate the instantaneous motion vector based on the instantaneous spatial coordinates; Based on the instantaneous motion vector, the instantaneous spatial coordinates within 0.5 seconds are forward-propagated and verified to correct the positioning error and obtain high-confidence trajectory points. Continuously collect at least 10 received signal strength indicator values ​​received by the mobile terminal from the current wireless access point in the past 1 second to obtain an RSSI raw sequence; The RSSI raw sequence, high-confidence trajectory points, and instantaneous motion vectors are encapsulated as the device's spatiotemporal state.

3. The network data transmission encryption method in industrial computer communication according to claim 1, characterized in that: In step S1, the movement path of the device is predicted based on its spatiotemporal state, thereby screening out at least two potential wireless access point sets including: Calculate the standard deviation of the instantaneous motion vector in the device's spatiotemporal state within the last 1 second, and record this standard deviation as the device's motion stability; Determine whether the device's motion stability is greater than a preset threshold of 0.1 m / s. If so, generate a maneuvering status code. Identify the mobile terminal's movement path within the next 2 seconds based on the maneuvering state code and the high-confidence trajectory points and instantaneous motion vectors in the device's spatiotemporal state, and use this as the predicted displacement path. The predicted displacement paths are spatially overlaid and compared based on a preset plant-wide AP signal strength spatial topology map. Access points whose trajectories will fall within the -75dBm signal equipotential line are selected to form a set of potential wireless access points. The preset plant-wide AP signal strength spatial topology map is annotated with the physical locations of each wireless access point in the factory and the -75dBm signal equipotential coverage circle.

4. The network data transmission encryption method in industrial computer communication according to claim 3 is characterized in that: Identifying the mobile terminal's movement path within the next 2 seconds based on the maneuvering status code and the high-confidence trajectory points and instantaneous motion vectors in the device's spatiotemporal state includes: The signal strength trend slope is obtained by calculating the change slope of the RSSI raw sequence in the device's spatiotemporal state within the most recent 500ms time window. Analyze the positive and negative signs of the signal strength trend slope to identify whether the mobile terminal is approaching or moving away from the wireless access point, thereby obtaining the relative movement trend of the device; Cross-verify the Doppler shift in the communication signal based on the relative movement trend of the device. If the two directions are consistent, construct a verified direction vector based on the maneuver status code; The predicted landing coordinates of the mobile terminal after the 2-second prediction time window are deduced based on the verified direction vector and the instantaneous motion vector in the device's spatiotemporal state; The predicted displacement path is obtained by linear interpolation based on the predicted landing point coordinates and the high-confidence trajectory points in the device's spatiotemporal state.

5. The network data transmission encryption method in industrial computer communication according to claim 3, characterized in that: In step S2, the mobile path is modified according to the network signal strength in the device's spatiotemporal state, and a first candidate network target and a second candidate network target are selected from the potential wireless access point set to construct a dual-path handover plan, including: For each wireless access point in the potential wireless access point set, the spatial intersection length of its core signal coverage area and the predicted displacement path is calculated to obtain the trajectory intersection depth. The core signal coverage area is the area within the wireless access point where the signal strength is better than -55dBm. Arrange all wireless access points in the potential wireless access point set in descending order according to the trajectory intersection depth to form a preferred AP ranking; Search the preset plant-wide AP signal strength spatial topology map and identify the best wireless access point in the preferred AP ranking as the first candidate network target; After determining the first candidate target, the second best wireless access point in the preferred AP ranking is retrieved and identified again and recorded as the second candidate network target; The identifiers of the first candidate network target and the second candidate network target are combined with the ID of the mobile terminal, and a timestamp is added to form a dual-path handover plan.

6. The network data transmission encryption method in industrial computer communication according to claim 1, characterized in that: In step S2, the instantaneous connection token including the dual-path authentication is determined according to the dual-path handover plan, including: According to the first candidate network target and the second candidate network target in the dual-path handover plan, immediately initiate a collaborative authentication request to the central server to obtain the first collaborative session ID and the second collaborative session ID; Generate a first temporary key pair according to the first collaborative session ID, and send one public key of the first temporary key pair to the first candidate network target and the other public key to the mobile terminal, which are recorded as the first session seed; Generate a second temporary key pair based on the second collaborative session ID, and send one public key of the second temporary key pair to the second candidate network target and the other public key to the mobile terminal, which are recorded as the second session seed; The mobile terminal performs a SHA-256 hash digest calculation using its own device certificate and the received first session seed and second session seed, respectively, to obtain a first pre-trust and a second pre-trust; Based on the estimated time of entering the wireless access point in the dual-path handover plan plus a 2-second security window, an absolute expiration timestamp is calculated to form a token expiration tag. The first pre-token, the second pre-token and the token time-limit tag are constructed into an instantaneous connection token dedicated to the mobile terminal.

7. The network data transmission encryption method in industrial computer communication according to claim 1, characterized in that: Step S3 includes the following steps: Step S31: The mobile terminal, while carrying the instantaneous connection token, continuously monitors the signal strength of the currently connected wireless access point and the signal strength of the target wireless access point in the dual-path handover plan at intervals of 50 ms to obtain a real-time signal strength pair; Step S32: Correlate the target wireless access point identifier in the instant connection token according to the real-time signal strength to obtain a pending connection group including the handover source, target, and credentials; Step S33: Determine whether the signal strength of the currently connected wireless access point in the pending connection group is less than -82dBm, and whether the signal strength of the target wireless access point in the dual-path handover plan is greater than -78dBm; if so, determine that the handover condition is met and generate a handover execution instruction; if not, continue to monitor the network status of the mobile terminal; Step S34: according to the handover execution instruction, the mobile terminal immediately broadcasts an instant connection token to the public channel of the wireless access point in the dual-path handover plan to form a temporary communication tunnel.

8. The network data transmission encryption method in industrial computer communication according to claim 1, characterized in that: Reporting the real-time location of the mobile terminal through the temporary communication tunnel in step S4 to determine the dynamic encryption strategy includes: After the temporary secure tunnel is established, the mobile terminal immediately reports its real-time location coordinates through the tunnel; The central server receives the real-time location coordinates and determines the risk level of the real-time location coordinates based on the preset factory risk communication area; the risk levels include high communication risk and low communication risk; If the communication risk is high, the AES-256-GCM encryption standard is selected. If the communication risk is low, the ChaCha20-Poly1305 encryption standard is selected. The central server then sends instructions to both communicating parties to obtain a dynamic encryption strategy.

9. The network data transmission encryption method in industrial computer communication according to claim 1, characterized in that: In step S4, using the transient connection token to complete the authentication handshake with the first or second candidate network target, and establishing an end-to-end data transmission encryption link according to the dynamic encryption strategy and the temporary communication tunnel includes: triggering a first handover request within a 2-second validity period of a first preceding token in the instantaneous connection token; After receiving the first pre-authentication through the temporary communication tunnel, the first candidate network target in the dual-path handover plan immediately performs a local verification on the first pre-authentication, and returns a first authentication confirmation if it passes. After receiving the first authentication confirmation, the mobile terminal applies the dynamic encryption policy to establish a data transmission encryption link for the temporary communication tunnel and determines that the connection status is normal; When the 2-second validity period of the first preceding token in the instantaneous connection token expires, if the first authentication confirmation is not received, it is determined that the first path switching has failed, and a switching failure flag is generated; After the handover failure mark is generated, a handover procedure to a second candidate network target in the dual-path handover plan is triggered, and a second handover request including a second pre-token in the instant connection token is issued; After receiving the second handover request, the second candidate network target locally verifies the second pre-authentication and returns a second authentication confirmation if it passes. After receiving the second authentication confirmation, the mobile terminal applies the dynamic encryption strategy to establish a data transmission encryption link for the temporary communication tunnel, and determines that the connection status is normal in standby mode.

10. A network data transmission encryption system in industrial computer communication, characterized in that: For executing the network data transmission encryption method in industrial computer communication according to claim 1, the network data transmission encryption system in industrial computer communication comprises: The trajectory sensing module is used to periodically and synchronously collect the physical space coordinates, motion vectors, and network signal strength of the mobile terminal during its continuous movement to generate the device's spatiotemporal state; based on the device's spatiotemporal state, it predicts its movement path and thus selects at least two potential wireless access point sets; A dual-path planning module is configured to modify the mobile path based on the network signal strength in the device's spatiotemporal state, select a first candidate network target and a second candidate network target from a set of potential wireless access points, and construct a dual-path handover plan; and determine an instantaneous connection token including dual-path authentication based on the dual-path handover plan. The communication switching module is used to broadcast an instant connection token to the candidate network target in the dual-path handover plan to establish a temporary communication tunnel when the preset signal strength switching condition is met during the process of the mobile terminal continuously monitoring the network signal; The secure link establishment module is used to report the real-time location of the mobile terminal through a temporary communication tunnel to determine the dynamic encryption strategy; use the instant connection token to complete the authentication handshake with the first or second candidate network target, and establish an end-to-end data transmission encryption link based on the dynamic encryption strategy and the temporary communication tunnel.

Images