Multi-protocol fusion VPN communication method and system based on dynamic tunnel switching

Abstract

The invention discloses a multi-protocol fusion VPN (Virtual Private Network) communication method and system based on dynamic tunnel switching, and relates to the technical field of computer network communication. According to the method, collection points are respectively arranged at an inlet and an outlet of a VPN, and a time synchronization timer, a data packet capture probe and a protocol analysis tool are utilized; the method comprises the following steps: accurately acquiring control instruction time delay Delay trl, control instruction packet loss rate Lossctrl, burst packet loss rate Burst and common flow delay variance VarDelay data, introducing a priority label into a VPN protocol encapsulation layer, marking a control instruction data flow as a first priority and binding the control instruction data flow to a rapid switching tunnel, marking a common monitoring data flow as a second priority and binding the common monitoring data flow to a conventional tunnel, and performing data transmission on the control instruction data flow and the common monitoring data flow; and differential transmission guarantee for different types of traffic is realized. After the method is optimized, it can be guaranteed that the key control instruction is not interfered by common flow in the network fluctuation or tunnel switching process, and the real-time performance and transmission reliability of the control instruction are remarkably improved.

Description

Technical Field

[0001] This invention relates to the field of computer network communication technology, specifically to a multi-protocol converged VPN communication method and system based on dynamic tunnel switching. Background Technology

[0002] Virtual Private Network (VPN) technology, belonging to the field of computer network communication, is an important means of establishing encrypted tunnels over public networks to ensure data transmission security and privacy. With the widespread application of information technology in industrial internet, smart manufacturing, and IoT scenarios, VPNs are no longer limited to traditional remote access functions but have gradually expanded into a critical infrastructure supporting real-time communication and remote monitoring of industrial control systems. In smart factory environments, numerous IoT terminal devices, such as PLC controllers, sensors, and actuators, need to transmit control commands and monitoring data through VPN tunnels, thus placing higher demands on the real-time performance and stability of VPNs.

[0003] In existing VPN communication methods, control command traffic and ordinary monitoring data traffic typically share the same tunnel and employ a uniform tunnel switching strategy. This "one-size-fits-all" approach has significant shortcomings when facing complex network fluctuations: when a VPN tunnel switches or is interrupted, all traffic is treated the same, causing high-priority control commands to be delayed or even lost along with ordinary data. Especially in smart factory scenarios, control commands are extremely sensitive to latency; packet loss or delay during switching can lead to equipment malfunctions or loss of synchronization, resulting in decreased system reliability. Existing VPN technologies do not differentiate between different types of traffic and lack priority labeling and mechanisms for rapid tunnel switching.

[0004] The aforementioned shortcomings primarily stem from the fact that traditional VPN architectures prioritize ensuring uniform encrypted transmission security, neglecting the differences in real-time performance and reliability between different business flows. When network conditions fluctuate, such as sudden packet loss, abnormal link latency, or increased jitter, the VPN treats all traffic equally during switching. This not only causes critical control command traffic and ordinary monitoring data traffic to suffer loss or delay during switching, but can also lead to serious consequences in industrial scenarios, such as production line shutdowns, robot malfunctions, and equipment safety protection triggering. In the long run, this VPN switching method, lacking differentiated protection, significantly increases the operational complexity and failure risks of industrial systems, failing to meet the high-reliability, low-latency communication requirements of the next generation of industrial IoT. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a multi-protocol converged VPN communication method and system based on dynamic tunnel switching, which solves the problems mentioned in the background art.

[0006] To achieve the above objectives, the present invention provides the following technical solution, comprising the following steps: S1. Set up collection points at the VPN inlet and outlet to collect communication datasets, and add priority labels to different traffic in the VPN protocol encapsulation layer to form differentiated channels for control command data streams and ordinary monitoring data streams. At the same time, perform data preprocessing operations to obtain communication feature vector sets. S2. Based on the communication feature vector set, calculate the control flow reliability score Qctrl, classify the tunnel operation status according to the control flow reliability score Qctrl, and trigger the dynamic graded protocol switching mechanism based on the classification results; calculate the adjusted comprehensive score Qadj, and determine the tunnel switching mechanism based on the adjusted comprehensive score Qadj. S3. When it is determined to perform tunnel switching, the tunnel redundancy verification mechanism is activated, the control command data stream is transmitted in parallel through the main tunnel and the backup tunnel, and the feedback mechanism is executed after the switching is completed.

[0007] Preferably, S1 includes S11; S11. Set up collection points at the VPN ingress and egress points, and set collection commands, collection devices and collection tools for the collection points to collect communication datasets in real time. The collection points include an entry collection point and an exit collection point; wherein: the entry collection point is set at the VPN access point, and the exit collection point is set at the VPN exit point; The acquisition commands include control monitoring commands and general monitoring commands; The control and monitoring commands include delay detection commands, packet loss detection commands, and sudden packet loss detection commands; The general monitoring instructions include delay variance detection instructions; The acquisition device includes a time synchronization timer, a data packet capture probe, and a protocol parsing tool; The data acquisition tool includes an Internet of Things (IoT) data acquisition program; The communication dataset includes control command delay Delayctrl, control command packet loss rate Lossctrl, burst packet loss rate Burstloss, and ordinary traffic delay variance VarDelaydata.

[0008] Preferably, S1 further includes S12; S12. At the encapsulation layer of the VPN entry point, all data packets entering the VPN are parsed and classified. The parsing and classification includes protocol identification, label generation, and tunnel allocation. The protocol identification distinguishes between control command data streams and ordinary monitoring data streams by parsing the data packet header fields. The tag generation is achieved by adding a first priority tag to the control instruction data stream of control instructions and a second priority tag to the ordinary monitoring data stream of ordinary monitoring instructions in the VPN encapsulation layer; wherein, the first priority tag > the second priority tag. The tunnel allocation binds traffic labeled with a first priority tag to a fast-switching tunnel and traffic labeled with a second priority tag to a regular tunnel.

[0009] Preferably, S1 further includes S13; S13. After parsing and classification, the control instruction data stream of the first priority label performs data preprocessing operations before entering the fast switching tunnel; The data preprocessing operation includes performing dimensionless processing on the communication dataset, mapping different dimensional parameters to the [0,1] interval to eliminate dimensional differences; The dimensionless communication dataset is appended with a timestamp and a checksum and then transmitted to the VPN data processing platform via a dedicated control channel. In the VPN data processing platform, sliding time window filtering is performed on the control command delay Delayctrl and control command packet loss rate Lossctrl of the first priority label to eliminate sampling noise. Continuous feature extraction is performed based on the burst packet loss rate Burstloss to identify abnormal packet loss patterns. At the same time, the ordinary traffic delay variance VarDelaydata is standardized to optimize the deviation between different parameters, and the data preprocessing results are constructed into a communication feature vector set.

[0010] Preferably, S2 includes S21; S21. Based on the dimensionless processing of the communication feature vector set, extract the control command delay Delayctrl, control command packet loss rate Lossctrl, and burst packet loss rate Burstloss, combine them to construct a weighted formula, calculate and output the control traffic reliability score Qctrl, and quantitatively analyze the end-to-end transmission characteristics of the control traffic. The control flow reliability score Qctrl is calculated and output using the following algorithm formula: .

[0011] Preferably, S2 further includes S22; S22: Based on the control flow reliability score Qctrl, the tunnel operation status is classified into levels; the specific classification is as follows: When the control flow reliability score Qctrl ≥ 0.8, it is classified as Level-0, and the existing tunnel operation is maintained; When 0.5 ≤ control flow reliability score Qctrl < 0.8, it is classified as Level-1, triggering the backup tunnel preheating mechanism to enable the backup tunnel to establish handshake and link detection in advance; When the control flow reliability score Qctrl < 0.5, it is classified as Level-2, triggering the dynamic tiered protocol switching mechanism.

[0012] Preferably, S2 further includes S23; S23: When the tunnel operation status is classified as Level-2, a dynamic hierarchical protocol switching mechanism is triggered. The dynamic hierarchical protocol switching mechanism includes a tunnel preheating mechanism, a redundancy verification mechanism, a dynamic hybrid protocol mechanism, and a jitter prevention mechanism. Before the handover is performed, a tunnel preheating mechanism is enabled so that the backup tunnel can complete the handshake and link detection in advance. During the handover, a redundancy check mechanism is enabled by transmitting control traffic marked with the first priority tag in parallel in the primary tunnel and the backup tunnel. During the switching process, the dynamic hybrid protocol mechanism is enabled by prioritizing UDP protocols for control traffic of the first priority label and TCP protocols for ordinary traffic of the second priority label. The anti-shake mechanism delays the switching process if the score fluctuates repeatedly within a certain time window. During the switching decision process, the control flow reliability score Qctrl is calculated and adjusted based on the ordinary flow delay variance VarDelaydata, and the control flow reliability score Qctrl is adjusted a second time.

[0013] Preferably, S2 includes S24; S24. Based on the output value of the adjusted comprehensive score Qadj, a comparative evaluation is conducted to determine the tunnel handover mechanism; the specific comparative evaluation content is as follows: When the adjusted comprehensive score Qadj is less than 0.6, the tunnel switching process is immediately triggered, and the redundancy check mechanism and dynamic hybrid protocol mechanism are enabled. When the adjusted comprehensive score Qadj is greater than or equal to 0.6, the backup tunnel is kept in preheating state, and the anti-shake mechanism is triggered, delaying the switchover.

[0014] Preferably, S3 includes S31; S31. When tunnel switching is performed and tunnel redundancy verification mechanism is started, control command traffic marked with the first priority label is simultaneously encapsulated and transmitted in parallel in the main tunnel and backup tunnel. The data packets transmitted in parallel are verified for integrity at the exit node by comparing timestamps and checking codes. After tunnel switching is completed, the communication feature vector set is re-collected, the new control traffic reliability score Qctrl-new after switching is calculated, and compared with the control traffic reliability score Qctrl before switching. When the new control flow reliability score Qctrl-new is greater than the control flow reliability score Qctrl, the tunnel handover optimization is deemed successful, and the current handover strategy is maintained and continues to run. When the new control traffic reliability score Qctrl-new is less than or equal to the control traffic reliability score Qctrl, a fallback logic is triggered, which rolls back the control traffic with the first priority label to the main tunnel before the switchover. At the same time, a cross-protocol masquerading policy is enabled, which disguises the control traffic as a normal data stream at the VPN encapsulation layer.

[0015] A multi-protocol converged VPN communication system based on dynamic tunnel switching includes a communication detection module, a reliability analysis module, and a switching strategy module; The communication detection module collects communication datasets by setting up collection points at VPN ingress and egress points, and adds priority labels to different traffic at the VPN protocol encapsulation layer to form differentiated channels for control command data streams and ordinary monitoring data streams. At the same time, it performs data preprocessing operations to obtain communication feature vector sets. The reliability analysis module calculates the control flow reliability score Qctrl based on the communication feature vector set, classifies the tunnel operation status according to the control flow reliability score Qctrl, and triggers a dynamic graded protocol switching mechanism based on the classification results; it also calculates the adjusted comprehensive score Qadj and determines the tunnel switching mechanism based on the adjusted comprehensive score Qadj. The switching strategy module activates a tunnel redundancy verification mechanism when determining to perform a tunnel switch, transmits control command data streams in parallel through both the main tunnel and the backup tunnel, and executes a feedback mechanism after the switch is completed.

[0016] This invention provides a multi-protocol converged VPN communication method and system based on dynamic tunnel switching. It has the following beneficial effects: (1) This method sets up collection points at the VPN ingress and egress points respectively, and uses time synchronization timers, packet capture probes, and protocol parsing tools to accurately collect control command delay (Delayctrl), control command packet loss rate (Lossctrl), burst packet loss rate (Burstloss), and ordinary traffic delay variance (VarDelaydata). Priority labels are introduced into the VPN protocol encapsulation layer, marking the control command data stream as the first priority and binding it to the fast switching tunnel, while marking the ordinary monitoring data stream as the second priority and binding it to the regular tunnel, thus achieving differentiated transmission protection for different types of traffic. This optimized approach ensures that critical control commands are not interfered with by ordinary traffic during network fluctuations or tunnel switching, significantly improving the real-time performance and transmission reliability of control commands.

[0017] (2) This method constructs a control flow reliability scoring formula Qctrl based on the collected communication feature vector set, and classifies the levels based on the scoring results to achieve dynamic perception of the tunnel operation status. When the scoring result enters the early warning level, the backup tunnel preheating mechanism is triggered in advance to shorten the switching delay; when the scoring result enters the high-risk level, the adjusted comprehensive score Qadj is further calculated to introduce the ordinary flow delay variance VarDelaydata to perform secondary correction on the control flow reliability. After optimization, this mechanism can avoid excessive switching or misjudgment caused by relying solely on control command indicators, ensuring the accuracy and stability of switching decisions, thereby improving the adaptability of VPN in complex industrial environments.

[0018] (3) This method activates a tunnel redundancy check mechanism when determining to perform tunnel switching, transmitting the control command data stream with the first priority tag simultaneously through the main tunnel and the backup tunnel. Integrity verification is performed at the exit node using timestamps and checksums, ensuring zero data loss during the switching process. After the switching is complete, the reliability score Qctrl-new of the new control traffic is recalculated and compared with the reliability score Qctrl before the switching, providing feedback and evaluation of the switching effect. When the switching result is unsatisfactory, a fallback logic is triggered to roll back the control traffic to the main tunnel, and a cross-protocol masquerading strategy is enabled to disguise the control traffic as a normal data stream at the encapsulation layer, ensuring continuous transmission during the fallback process. This optimization mechanism ensures the security and robustness of the entire tunnel switching process, further improving the continuity and stability of communication in industrial control scenarios. Attached Figure Description

[0019] Figure 1 This is a schematic diagram illustrating the steps of a multi-protocol fusion VPN communication method based on dynamic tunnel switching according to the present invention; Figure 2This is a block diagram of a multi-protocol converged VPN communication system based on dynamic tunnel switching according to the present invention. Figure 3 A schematic diagram showing the layout of data collection points. Detailed Implementation

[0020] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] Example 1, please refer to Figure 1 This invention provides a multi-protocol converged VPN communication method based on dynamic tunnel switching. To achieve the above objectives, this invention employs the following technical solution, comprising the following steps: S1. Set up collection points at the VPN inlet and outlet to collect communication datasets, and add priority labels to different traffic in the VPN protocol encapsulation layer to form differentiated channels for control command data streams and ordinary monitoring data streams. At the same time, perform data preprocessing operations to obtain communication feature vector sets. S2. Based on the communication feature vector set, calculate the control flow reliability score Qctrl, classify the tunnel operation status according to the control flow reliability score Qctrl, and trigger the dynamic graded protocol switching mechanism based on the classification results; calculate the adjusted comprehensive score Qadj, and determine the tunnel switching mechanism based on the adjusted comprehensive score Qadj. S3. When it is determined to perform tunnel switching, the tunnel redundancy verification mechanism is activated, the control command data stream is transmitted in parallel through the main tunnel and the backup tunnel, and the feedback mechanism is executed after the switching is completed.

[0022] In this embodiment, the method sets up collection points at the VPN ingress and egress points to collect communication datasets in real time. Priority tags are added to different traffic flows within the VPN protocol's encapsulation layer, creating differentiated channels for control command data flows and ordinary monitoring data flows. This design is necessary because in a tunnel communication environment, if all data is transmitted within the same channel, sudden congestion or delays can lead to delays or even loss of control command data flows, directly impacting the stability of the VPN tunnel. By setting differentiated channels, control command data flows can be scheduled and transmitted with higher priority, physically ensuring that critical control traffic maintains higher timeliness and reliability even in complex network environments. In step S2, a control traffic reliability score Qctrl is calculated based on the extracted communication feature vector set, and the tunnel's operating status is classified according to the control traffic reliability score Qctrl. This classification enables hierarchical monitoring and quantitative analysis of the tunnel's operating status, allowing real-time monitoring of whether the tunnel is in a normal, slightly abnormal, or severely abnormal state. Without this classification, the system can only judge the tunnel's condition using fixed thresholds, which can easily lead to premature or delayed switching, resulting in unnecessary resource consumption or communication interruptions. By dynamically ranking the tunnels, a tiered switching mechanism can be triggered, and an adjusted comprehensive score Qadj can be calculated to ensure that the tunnel switching mechanism better reflects the actual operating conditions, thereby avoiding misjudgments and over-switching. In step S3, when it is determined to perform a tunnel switch, a tunnel redundancy verification mechanism is activated, transmitting control command data streams in parallel through both the primary and backup tunnels, and executing a feedback mechanism after the switch is completed. This mechanism is necessary because during tunnel switching, relying solely on a single path can easily lead to momentary interruptions in command transmission, resulting in the loss of critical control information and subsequent switch failure. Parallel redundant transmission ensures that even if the primary tunnel is interrupted during the switch, the backup tunnel can still carry control commands, ensuring uninterrupted control plane information and physically improving the continuity and reliability of command transmission. The feedback mechanism further ensures that the new tunnel status after the switch can be confirmed in a timely manner, avoiding secondary switches caused by tunnel instability. In summary, this implementation process, through the combination of differentiated channel design, a level classification and dynamic switching mechanism based on the control traffic reliability score Qctrl, and a tunnel redundancy verification mechanism, not only ensures the high-priority transmission of critical control commands but also achieves refined monitoring and dynamic adjustment of tunnel operation status. Ultimately, it effectively improves the stability, reliability, and real-time performance of VPN tunnel switching, avoids tunnel interruption problems caused by control traffic delays or loss, and enhances the overall network's fault tolerance and service continuity.

[0023] Example 2, please refer to Figure 1 and Figure 3 Specifically: S1 includes S11; S11. Set up collection points at the VPN ingress and egress points, and set collection commands, collection devices and collection tools for the collection points to collect communication datasets in real time. The collection points include ingress collection points and egress collection points; wherein: the ingress collection point is set at the VPN access end to detect the original traffic status before entering the VPN, and the egress collection point is set at the VPN egress end to detect the traffic status after passing through the VPN. Data acquisition commands include control monitoring commands and general monitoring commands; Control and monitoring commands include delay detection commands, packet loss detection commands, and sudden packet loss detection commands; Common monitoring instructions include delay variance detection instructions; The acquisition equipment includes a time synchronization timer, a packet capture probe, and a protocol parsing tool; The data acquisition tools include IoT data acquisition programs used to record and upload sampling results; The communication dataset includes control command delay Delayctrl, control command packet loss rate Lossctrl, burst packet loss rate Burstloss, and ordinary traffic delay variance VarDelaydata; The data collection methods include setting up collection points at the entrance and exit of the VPN tunnel, and using a time synchronization timer to ensure that the clocks of the two collection points are consistent to provide an accurate time reference; acquiring all data packets entering and leaving the VPN tunnel in real time using a packet capture probe, and then using a protocol parsing tool to perform in-depth analysis of the packets to distinguish between control commands and ordinary monitoring commands; based on this, the control command delay Delayctrl is obtained by recording the timestamps of the same packet at the entrance and exit collection points and calculating the difference; the control command packet loss rate Lossctrl is obtained by comparing the number of packets sent at the entrance and the number of packets received at the exit; the burst packet loss rate Burstloss is obtained by statistically analyzing the proportion of consecutively lost packets to the total number of packets within a preset time window; and the ordinary traffic delay variance VarDelaydata is obtained by calculating the variance of the ordinary packet delay within a time window, which is used to reflect the delay fluctuation of background traffic. The above parameters are periodically uploaded to the VPN data processing platform after being appended with a unified timestamp and checksum by the IoT data acquisition program, and serve as input data for subsequent reliability scoring and dynamic tunnel switching evaluation. It should be noted that control commands are the smallest units of data, typically generated by industrial control systems (such as PLCs, DCSs, robot controllers, etc.). They are specific commands used to drive actuator actions or trigger equipment behavior. Characteristics include: high real-time performance (e.g., "motor start" or "valve close" must be transmitted within milliseconds); low fault tolerance (loss or delay can cause equipment malfunction or failure); and small data volume (generally short messages or instruction sets). Examples include a PLC sending a command message to "write register 0x01=1", or a robot controller issuing a command to "joint angle +2°". Control flow is a collection of data streams consisting of a large number of control command messages, forming a continuous communication stream in network transmission. Its characteristics include: it consists of multiple control commands; for example, a robot continuously sends / receives motion trajectory control commands during operation, forming a continuous data stream; it requires overall stability and reliability; not only must individual commands not be lost, but the entire communication stream must also remain uninterrupted during network switching; and it has a wide range of applications, including industrial control flow, vehicle network control flow, and remote medical device command flow. For example, in a smart factory, a robot controller might continuously send 1000 motion control command messages within 10 seconds; these messages represent a "control flow" at the transmission layer. Ordinary traffic: Status monitoring data such as timed monitoring data uploaded by temperature sensors, current sensors, and pressure sensors; logs and diagnostic data such as equipment operation logs, fault diagnosis messages, and debugging records; statistics and batch data such as energy consumption data and production statistics collected over a period of time for background analysis; these data do not have high real-time requirements, usually allow for delays of seconds or even minutes, and can tolerate a certain packet loss rate.

[0024] S1 also includes S12; S12. At the encapsulation layer of the VPN entry point, all data packets entering the VPN are parsed and classified. Parsing and classification include protocol identification, label generation, and tunnel allocation. Protocol identification distinguishes control command data streams from ordinary monitoring data streams by parsing data packet header fields. Tag generation involves adding a first-priority tag to the control command data stream of control commands and a second-priority tag to the ordinary monitoring data stream of ordinary monitoring commands within the VPN encapsulation layer; wherein, the first-priority tag > the second-priority tag. Tunnel allocation provides differentiated protection by binding traffic labeled with the first priority tag to the fast switching tunnel and traffic labeled with the second priority tag to the regular tunnel.

[0025] S1 also includes S13; S13. After parsing and classification, the control instruction data stream of the first priority label performs data preprocessing operations before entering the fast switching tunnel; Data preprocessing operations include dimensionless processing of the communication dataset, mapping different dimensional parameters to the [0,1] interval to eliminate dimensional differences; The dimensionless communication dataset is appended with a timestamp and a checksum, and then transmitted to the VPN data processing platform through a dedicated control channel to ensure the integrity and synchronization of the parameter transmission process. In the VPN data processing platform, sliding time window filtering is performed on the control command delay Delayctrl and control command packet loss rate Lossctrl of the first priority label to eliminate sampling noise. Continuous feature extraction is performed based on the burst packet loss rate Burstloss to identify abnormal packet loss patterns. At the same time, the ordinary traffic delay variance VarDelaydata is standardized to optimize the deviation between different parameters. The data preprocessing results are then used to construct a communication feature vector set as input for subsequent reliability score calculation. The ordinary data stream of the second priority label does not undergo the above preprocessing and is only used as background data to assist in the evaluation during tunnel switching, so as to reduce computational overhead and improve the real-time guarantee of control command data stream.

[0026] In this embodiment, by setting up collection points at both the VPN ingress and egress points and using a time synchronization timer to ensure clock consistency, accurate time synchronization of the same message at different locations is achieved. This design aims to avoid distortion in delay calculations due to clock drift at the collection points, especially in industrial control scenarios with millisecond-level requirements. If the clocks are not synchronized, it will directly cause misjudgments of the control command delay (Delayctrl), ultimately affecting tunnel switching decisions. High-precision synchronized timing accurately reflects the transmission performance of the physical link, ensuring the accuracy of data measurements. In S12, a priority labeling mechanism is introduced at the VPN encapsulation layer, binding the control command data stream to the fast-switching tunnel, while binding the ordinary monitoring data stream to the regular tunnel. This differentiated channel design is because the loss or delay of control commands can lead to serious consequences such as "valves not closing in time," while delays in ordinary monitoring data such as temperature curves are tolerable. The priority labeling mechanism ensures that critical control data is still prioritized for forwarding during sudden traffic contention, physically increasing the survival probability of control commands under congestion conditions. In S13, dimensionless processing and sliding time window filtering are performed on the control command data stream to eliminate interference from different parameter dimensions and short-term sampling noise. For example, if the control command packet loss rate Lossctrl is directly superimposed with the ordinary traffic delay variance VarDelaydata, the large differences in numerical range and dimensions can amplify or overwhelm a certain indicator, ultimately deviating from the true evaluation. Dimensionless mapping and filtering not only ensure the comparability between parameters but also enhance the anomaly identification capability of the burst packet loss rate (Burstloss). In a practical sense, this is noise reduction and equalization processing of the raw data, enabling the input communication feature vector set to objectively reflect the tunnel's operating status. Overall, this implementation process, through the link design of "collection point clock synchronization + priority differentiation label + dimensionless preprocessing," achieves high-precision measurement, priority protection, and data optimization of control commands, enabling the VPN tunnel to make judgments based on more realistic and cleaner parameter inputs during dynamic switching. This not only effectively avoids misjudgments caused by data acquisition distortion, traffic competition, or parameter imbalance, but also improves the accuracy and real-time performance of tunnel switching, thereby enhancing the stability and security of VPN in high-reliability scenarios such as industrial control, vehicle networking, and telemedicine.

[0027] Example 3, please refer to Figure 1 Specifically: S2 includes S21; S21. Based on the dimensionless processing of the communication feature vector set, extract the control command delay Delayctrl, control command packet loss rate Lossctrl, and burst packet loss rate Burstloss, combine them to construct a weighted formula, calculate and output the control traffic reliability score Qctrl, and quantitatively analyze the end-to-end transmission characteristics of the control traffic. The flow control reliability score Qctrl is calculated and output using the following algorithm formula: ; The formula is based on the QoS (Quality of Service) metric system in queuing theory and communication quality evaluation models, which is typically used for reliability assessment of control flow. Common QoS metrics include delay, packet loss rate, jitter, and bandwidth utilization. In this formula, three metrics are selected: control command delay (Delayctrl), control command packet loss rate (Lossctrl), and burst packet loss rate (Burstloss). A weighted formula is constructed to calculate the overall reliability score. This formula introduces burst packet loss rate and sums it with the packet loss rate (Lossctrl) to reflect the combined risk of "average packet loss" and "continuous packet loss" in communication. Dimensional consistency explanation: The communication dataset is processed in a dimensionless manner during data preprocessing. Therefore, the control command delay Delayctrl, control command packet loss rate Lossctrl, and burst packet loss rate Burstloss are all dimensionless parameters, and the dimensions are reasonable. Derivation process: The formula in this application adopts the reciprocal form of the denominator: when the control command delay Delayctrl increases, the control flow reliability score Qctrl decreases significantly, reflecting the characteristic of industrial control being sensitive to delay; through the (1+Lossctrl+Burstloss) term, the average packet loss and burst packet loss are coupled, amplifying the negative impact of continuous packet loss; thus, the score range of Qctrl∈(0,1] is obtained, and the larger the value, the higher the transmission reliability.

[0028] S2 also includes S22; S22: Based on the control flow reliability score Qctrl, the tunnel operation status is classified into levels; the specific classification is as follows: When the control flow reliability score Qctrl ≥ 0.8, it is classified as Level-0, and the existing tunnel operation is maintained; When 0.5 ≤ control flow reliability score Qctrl < 0.8, it is classified as Level-1, triggering the backup tunnel preheating mechanism to enable the backup tunnel to establish handshake and link detection in advance; When the control flow reliability score Qctrl < 0.5, it is classified as Level-2, triggering the dynamic tiered protocol switching mechanism.

[0029] S2 also includes S23; S23: When the tunnel operation status is classified as Level-2, the dynamic hierarchical protocol switching mechanism is triggered. The dynamic hierarchical protocol switching mechanism includes tunnel preheating mechanism, redundancy verification mechanism, dynamic hybrid protocol mechanism and anti-jitter mechanism. Before the handover is performed, a tunnel preheating mechanism is enabled to reduce handover latency by having the backup tunnel complete handshake and link detection in advance. During the handover, a redundancy check mechanism is enabled to ensure zero loss by transmitting control traffic marked with the first priority tag in parallel in the primary and backup tunnels. During the switching process, a dynamic hybrid protocol mechanism is enabled to prioritize control traffic of the first priority label to use UDP-type protocols, while ordinary traffic of the second priority label uses TCP-type protocols, thereby achieving differentiated transmission guarantees. The anti-shake mechanism avoids frequent shaking by delaying the trigger if the score fluctuates repeatedly within a certain time window, instead of switching immediately. During the switching decision process, based on the control flow reliability score Qctrl and the ordinary flow delay variance VarDelaydata, the adjusted comprehensive score Qadj is calculated and output. The control flow reliability score Qctrl is then adjusted a second time. The specific calculation formula is: Qadj=Qctrl-β·VarDelaydata; where β represents the empirical adjustment coefficient, which is dimensionless and ranges from 0.001 to 0.05. Formula Derivation Logic: In actual networks, the control traffic reliability score Qctrl mainly reflects the transmission reliability of control traffic. However, if there are large fluctuations in the network (e.g., severe jitter in background traffic delay), relying solely on the control traffic reliability score Qctrl can lead to "misjudgment" or "over-switching". Therefore, this formula introduces the ordinary traffic delay variance VarDelaydata on the basis of the control traffic reliability score Qctrl, and controls its weight through an empirical adjustment coefficient β to form an adjusted comprehensive score Qadj. Here, the ordinary traffic delay variance VarDelaydata is the ordinary traffic delay variance used to describe the fluctuation of background traffic, and β is a preset empirical adjustment coefficient used to dynamically balance the influence of control traffic and ordinary traffic, thereby improving the accuracy of tunnel handover decisions. Control flow reliability score Qctrl: Calculates a preliminary reliability score for the control flow, used to determine the tunnel condition level; Adjusted comprehensive score Qadj: When the control traffic reliability score Qctrl is judged to be high risk (Level-2), the ordinary traffic delay variance is introduced for secondary adjustment to avoid unnecessary switching triggered by fluctuations in a single indicator.

[0030] S2 includes S24; S24. Based on the output value of the adjusted comprehensive score Qadj, a comparative evaluation is conducted to determine the tunnel handover mechanism; the specific comparative evaluation content is as follows: When the adjusted comprehensive score Qadj is less than 0.6, the tunnel switching process is immediately triggered, and the redundancy check mechanism and dynamic hybrid protocol mechanism are enabled. When the adjusted comprehensive score Qadj is greater than or equal to 0.6, the backup tunnel is kept in preheating state and the anti-shake mechanism is triggered, delaying the switchover. The significance of choosing 0.6: If it is too high (such as 0.8), it will cause frequent handovers, even if the network fluctuations are not significant, resulting in link oscillations; if it is too low (such as 0.3), it may delay the protection of critical control traffic, causing control commands to be lost or latency to exceed the standard; 0.6 is an empirical threshold for balancing handover sensitivity and handover stability in actual industrial VPN network environments.

[0031] In this embodiment, in S21, a control traffic reliability score Qctrl is constructed by combining the control command delay (Delayctrl), control command packet loss rate (Lossctrl), and burst packet loss rate (Burstloss). This allows for the quantification of the end-to-end transmission characteristics of control traffic. This scoring method is necessary because relying on a single indicator can lead to bias. For example, the average packet loss rate may appear low, but consecutive packet losses within a short period can still cause all control messages to fail. Introducing the burst packet loss rate (Burstloss) as a coupling term accurately reflects the combined risk of "average packet loss + consecutive packet loss," ensuring the score more closely reflects the actual communication state. In S22, the control traffic reliability score Qctrl is used for hierarchical classification to directly map the abstract score to executable actions. For example, setting Qctrl ≥ 0.8 as Level-0 avoids blind switching during minor network fluctuations, ensuring stable tunnel operation. When Qctrl falls below 0.5, Level-2 is triggered for immediate switching, preventing serious deviations caused by the loss of millisecond-level control commands such as "joint angle + 2°" in industrial robots. The physical meaning of the hierarchical mechanism is that different levels correspond to different tunnel processing strategies, ensuring that the handover is neither delayed nor redundant. In S23, the introduction of a dynamic hierarchical protocol handover mechanism makes the tunnel handover process more refined and robust. For example, the backup tunnel preheating mechanism avoids handshake delays during handover; the redundancy check mechanism ensures zero loss during handover; the dynamic hybrid protocol mechanism ensures that critical control traffic uses UDP to ensure timeliness, while ordinary traffic uses TCP to ensure reliability; and the debouncing mechanism avoids frequent fluctuations of Qctrl near the critical value, causing repeated link switching. The physical meaning of this design is to provide differentiated protection paths for different traffic, making the handover both fast and stable. In S24, the adjusted comprehensive score Qadj is introduced, and Qctrl is further corrected by combining it with the ordinary traffic delay variance VarDelaydata to avoid the single control traffic indicator being too sensitive and causing "misjudgment". For example, when the network background traffic fluctuates greatly, the control traffic reliability score Qctrl may drop briefly. If a handover is triggered immediately, it will cause unnecessary tunnel oscillation. By introducing VarDelaydata and setting an empirical threshold of 0.6, the sensitivity and stability of switching can be balanced, ensuring that switching only occurs under truly high-risk conditions. In summary, the S2 implementation achieves precise triggering and stable execution of tunnel switching through the construction of a reliability score Qctrl, multi-level operational state division, dynamic hierarchical switching mechanism, and comprehensive score Qadj correction. This design not only guarantees immediate protection of control traffic in the event of sudden packet loss or high latency but also avoids frequent switching caused by misjudgments, thereby improving the continuity and reliability of VPN tunnels in high real-time scenarios such as industrial control and vehicle networking.

[0032] Example 4, please refer to Figure 1 Specifically: S3 includes S31; S31. When tunnel switching is performed and tunnel redundancy verification mechanism is started, control command traffic marked with the first priority label is encapsulated simultaneously and transmitted in parallel in the main tunnel and backup tunnel. The data packets transmitted in parallel are verified for integrity at the exit node by comparing timestamps and checking codes. After the tunnel switching is completed, the communication feature vector set is re-collected, the new control traffic reliability score Qctrl-new after the switching is calculated, and compared with the control traffic reliability score Qctrl before the switching. When the new control flow reliability score Qctrl-new is greater than the control flow reliability score Qctrl, the tunnel handover optimization is deemed successful, and the current handover strategy is maintained and continues to run. When the new control traffic reliability score Qctrl-new is less than or equal to the control traffic reliability score Qctrl, the fallback logic is triggered, and the control traffic with the first priority label is fallback to the main tunnel before the handover. At the same time, the cross-protocol masquerading policy is enabled. The cross-protocol masquerading policy disguises the control traffic as a normal data stream at the VPN encapsulation layer to avoid the risk of interruption caused by excessive handover, thereby ensuring the continuous transmission of control traffic during the tunnel fallback process.

[0033] In this embodiment, in S31, when performing tunnel switching, a tunnel redundancy verification mechanism is enabled, and control command traffic marked with the first priority label is transmitted in parallel through both the main tunnel and the backup tunnel. This approach aims to avoid the "black screen period" that occurs during switching, because in millisecond-level industrial control command scenarios, even a single loss can lead to actuator malfunctions. By comparing the timestamps of the exit nodes and verifying the checksums, the consistency of the two transmission results can be guaranteed, physically ensuring zero loss of control commands during switching. After switching, a new communication feature vector set is collected, and a new control traffic reliability score Qctrl-new is calculated and compared with the previous control traffic reliability score Qctrl to verify the effectiveness of the switching in real time. If the score improves after switching, it indicates that the new tunnel is indeed superior, and the switching strategy is maintained; if the score decreases, a fallback logic is triggered to avoid more severe communication quality degradation due to erroneous switching. This design aims to quantify the switching effect, avoid "blind switching," and ensure that the decision-making process is verifiable and reversible. A cross-protocol masquerading strategy is introduced in the fallback logic, so that control traffic is disguised as ordinary data streams at the VPN encapsulation layer. This design addresses the risk scenario following a failed handover. If the handover is rolled back directly, tunnel oscillations or short-term interruptions may occur. By employing camouflage techniques, the control traffic can still maintain a continuous transmission channel during the rollback process, effectively providing "stealth protection" for the control traffic in a physical sense and preventing sudden service interruptions.

[0034] Example 5, please refer to Figure 1 and Figure 2 A multi-protocol converged VPN communication system based on dynamic tunnel switching includes a communication detection module, a reliability analysis module, and a switching strategy module; The communication detection module collects communication datasets by setting up collection points at the VPN ingress and egress points, and adds priority labels to different traffic at the VPN protocol encapsulation layer to form differentiated channels for control command data streams and ordinary monitoring data streams. At the same time, it performs data preprocessing operations to obtain communication feature vector sets. The reliability analysis module calculates the control flow reliability score Qctrl based on the communication feature vector set, classifies the tunnel operation status according to the control flow reliability score Qctrl, and triggers the dynamic graded protocol switching mechanism based on the classification results; it also calculates the adjusted comprehensive score Qadj and determines the tunnel switching mechanism based on the adjusted comprehensive score Qadj. The switching strategy module activates a tunnel redundancy check mechanism when determining to perform a tunnel switch, transmits control command data streams in parallel through both the primary and backup tunnels, and executes a feedback mechanism after the switch is completed.

[0035] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention.

Claims

1. A multi-protocol converged VPN communication method based on dynamic tunnel switching, characterized in that: Includes the following steps: S1. Set up collection points at the VPN inlet and outlet to collect communication datasets, and add priority labels to different traffic in the VPN protocol encapsulation layer to form differentiated channels for control command data streams and ordinary monitoring data streams. At the same time, perform data preprocessing operations to obtain communication feature vector sets. S2. Based on the communication feature vector set, calculate the control flow reliability score Qctrl, classify the tunnel operation status according to the control flow reliability score Qctrl, and trigger the dynamic graded protocol switching mechanism based on the classification results; calculate the adjusted comprehensive score Qadj, and determine the tunnel switching mechanism based on the adjusted comprehensive score Qadj. S3. When it is determined to perform tunnel switching, the tunnel redundancy verification mechanism is activated, the control command data stream is transmitted in parallel through the main tunnel and the backup tunnel, and the feedback mechanism is executed after the switching is completed.

2. The multi-protocol converged VPN communication method based on dynamic tunnel switching according to claim 1, characterized in that: S1 includes S11; S11. Set up collection points at the VPN ingress and egress points, and set collection commands, collection devices and collection tools for the collection points to collect communication datasets in real time. The collection points include an entry collection point and an exit collection point; wherein: the entry collection point is set at the VPN access point, and the exit collection point is set at the VPN exit point; The acquisition commands include control monitoring commands and general monitoring commands; The control and monitoring commands include delay detection commands, packet loss detection commands, and sudden packet loss detection commands; The general monitoring instructions include delay variance detection instructions; The acquisition device includes a time synchronization timer, a data packet capture probe, and a protocol parsing tool; The data acquisition tool includes an Internet of Things (IoT) data acquisition program; The communication dataset includes control command delay Delayctrl, control command packet loss rate Lossctrl, burst packet loss rate Burstloss, and ordinary traffic delay variance VarDelaydata.

3. The multi-protocol converged VPN communication method based on dynamic tunnel switching according to claim 2, characterized in that: S1 further includes S12; S12. At the encapsulation layer of the VPN entry point, all data packets entering the VPN are parsed and classified. The parsing and classification includes protocol identification, label generation, and tunnel allocation. The protocol identification distinguishes between control command data streams and ordinary monitoring data streams by parsing the data packet header fields. The tag generation is achieved by adding a first priority tag to the control instruction data stream of control instructions and a second priority tag to the ordinary monitoring data stream of ordinary monitoring instructions in the VPN encapsulation layer; wherein, the first priority tag > the second priority tag. The tunnel allocation binds traffic labeled with a first priority tag to a fast-switching tunnel and traffic labeled with a second priority tag to a regular tunnel.

4. The multi-protocol converged VPN communication method based on dynamic tunnel switching according to claim 3, characterized in that: S1 also includes S13; S13. After parsing and classification, the control instruction data stream of the first priority label performs data preprocessing operations before entering the fast switching tunnel; The data preprocessing operation includes performing dimensionless processing on the communication dataset, mapping different dimensional parameters to the [0,1] interval to eliminate dimensional differences; The dimensionless communication dataset is appended with a timestamp and a checksum and then transmitted to the VPN data processing platform via a dedicated control channel. In the VPN data processing platform, sliding time window filtering is performed on the control command delay Delayctrl and control command packet loss rate Lossctrl of the first priority label to eliminate sampling noise. Continuous feature extraction is performed based on the burst packet loss rate Burstloss to identify abnormal packet loss patterns. At the same time, the ordinary traffic delay variance VarDelaydata is standardized to optimize the deviation between different parameters, and the data preprocessing results are constructed into a communication feature vector set.

5. The multi-protocol converged VPN communication method based on dynamic tunnel switching according to claim 4, characterized in that: S2 includes S21; S21. Based on the dimensionless processing of the communication feature vector set, extract the control command delay Delayctrl, control command packet loss rate Lossctrl, and burst packet loss rate Burstloss, combine them to construct a weighted formula, calculate and output the control traffic reliability score Qctrl, and quantitatively analyze the end-to-end transmission characteristics of the control traffic. The control flow reliability score Qctrl is calculated and output using the following algorithm formula: 。 6. The multi-protocol converged VPN communication method based on dynamic tunnel switching according to claim 1, characterized in that: S2 further includes S22; S22: Based on the control flow reliability score Qctrl, the tunnel operation status is classified into levels; the specific classification is as follows: When the control flow reliability score Qctrl ≥ 0.8, it is classified as Level-0, and the existing tunnel operation is maintained; When 0.5 ≤ control flow reliability score Qctrl < 0.8, it is classified as Level-1, triggering the backup tunnel preheating mechanism to enable the backup tunnel to establish handshake and link detection in advance; When the control flow reliability score Qctrl < 0.5, it is classified as Level-2, triggering the dynamic tiered protocol switching mechanism.

7. The multi-protocol converged VPN communication method based on dynamic tunnel switching according to claim 6, characterized in that: S2 also includes S23; S23: When the tunnel operation status is classified as Level-2, a dynamic hierarchical protocol switching mechanism is triggered. The dynamic hierarchical protocol switching mechanism includes a tunnel preheating mechanism, a redundancy verification mechanism, a dynamic hybrid protocol mechanism, and a jitter prevention mechanism. Before the handover is performed, a tunnel preheating mechanism is enabled. Before the handover, the backup tunnel completes the handshake and link detection in advance. During the handover, the redundancy check mechanism is enabled to transmit control traffic marked with the first priority label in parallel in the primary tunnel and the backup tunnel. During the switching process, a dynamic hybrid protocol mechanism is enabled to prioritize UDP protocols for control traffic of the first priority label and TCP protocols for ordinary traffic of the second priority label. The anti-shake mechanism delays the switching process if the score fluctuates repeatedly within a certain time window. During the switching decision process, the control flow reliability score Qctrl is calculated and adjusted based on the ordinary flow delay variance VarDelaydata, and the control flow reliability score Qctrl is adjusted a second time.

8. The multi-protocol converged VPN communication method based on dynamic tunnel switching according to claim 6, characterized in that: S2 includes S24; S24. Based on the output value of the adjusted comprehensive score Qadj, a comparative evaluation is conducted to determine the tunnel handover mechanism; the specific comparative evaluation content is as follows: When the adjusted comprehensive score Qadj is less than 0.6, the tunnel switching process is immediately triggered, and the redundancy check mechanism and dynamic hybrid protocol mechanism are enabled. When the adjusted comprehensive score Qadj is greater than or equal to 0.6, the backup tunnel is kept in preheating state, and the anti-shake mechanism is triggered, delaying the switchover.

9. A multi-protocol converged VPN communication method based on dynamic tunnel switching according to claim 8, characterized in that: S3 includes S31; S31. When tunnel switching is performed and tunnel redundancy verification mechanism is started, control command traffic marked with the first priority label is simultaneously encapsulated and transmitted in parallel in the main tunnel and backup tunnel. The data packets transmitted in parallel are verified for integrity at the exit node by comparing timestamps and checking codes. After tunnel switching is completed, the communication feature vector set is re-collected, the new control traffic reliability score Qctrl-new after switching is calculated, and compared with the control traffic reliability score Qctrl before switching. When the new control flow reliability score Qctrl-new is greater than the control flow reliability score Qctrl, the tunnel handover optimization is deemed successful, and the current handover strategy is maintained and continues to run. When the new control traffic reliability score Qctrl-new is less than or equal to the control traffic reliability score Qctrl, a fallback logic is triggered, which rolls back the control traffic with the first priority label to the main tunnel before the switchover. At the same time, a cross-protocol masquerading policy is enabled, which disguises the control traffic as a normal data stream at the VPN encapsulation layer.

10. A multi-protocol converged VPN communication system based on dynamic tunnel switching, applied to the multi-protocol converged VPN communication method based on dynamic tunnel switching as described in any one of claims 1-9, characterized in that: It includes a communication detection module, a reliability analysis module, and a handover strategy module; The communication detection module collects communication datasets by setting up collection points at VPN ingress and egress points, and adds priority labels to different traffic at the VPN protocol encapsulation layer to form differentiated channels for control command data streams and ordinary monitoring data streams. At the same time, it performs data preprocessing operations to obtain communication feature vector sets. The reliability analysis module calculates the control flow reliability score Qctrl based on the communication feature vector set, classifies the tunnel operation status according to the control flow reliability score Qctrl, and triggers a dynamic graded protocol switching mechanism based on the classification results; it also calculates the adjusted comprehensive score Qadj and determines the tunnel switching mechanism based on the adjusted comprehensive score Qadj. The switching strategy module activates a tunnel redundancy verification mechanism when determining to perform a tunnel switch, transmits control command data streams in parallel through both the main tunnel and the backup tunnel, and executes a feedback mechanism after the switch is completed.

Images