Virtual private network connection maintenance method

Abstract

The invention discloses a virtual private network connection maintenance method, belongs to the technical field of network security, and aims to solve the problems that in the prior art, a VPN connection detection and recovery method is not fully considered, and rapid recovery and stability of connection cannot be effectively guaranteed. The method comprises the steps that a hotplug event script and a VPN connection maintenance script are newly added in an operating system, parameters are configured, and VPN connection is established; the hotplug event script receives the hotplug event and judges the type of the hotplug event; if the event is an up event of the VPN interface, executing a fault detection process, and if the event is a down event of the VPN interface, executing a fault recovery process; and when the hotplug event is triggered, the hotplug event script receives and processes the triggered event, so that the VPN connection can be comprehensively detected and quickly recovered in a multi-level manner, the connection is ensured to be stable and reliable, and the working efficiency and the network security of an enterprise are ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a method for maintaining a virtual private network connection. Background Art

[0002] With the popularization and development of 5G networks, the application scenarios of virtual private networks, or VPNs, in 5G networks are becoming more and more extensive, including remote office, smart city construction, smart factories, telemedicine and other fields that require enhanced data security and privacy. These fields require both high-speed, low-latency 5G networks and VPNs to ensure data security.

[0003] However, due to various reasons, VPN connections may be interrupted suddenly, causing significant inconvenience to users and potentially affecting the continuity of key businesses. When a VPN connection is detected to be interrupted, traditional VPN connection recovery methods require users to intervene manually to restore the VPN connection, which is time-consuming and technically demanding, causing business delays and increasing enterprise operating costs.

[0004] The "method and system for automatic connection of VPN network abnormality" disclosed in Chinese patent document CN110912759B includes: establishing a connection between a VPN client and a VPN server; detecting whether the VPN client obtains the IP address assigned to the client by the VPN server, and judging whether the VPN tunnel between the VPN client and the VPN server already exists; if yes, the VPN client is normally connected to the VPN server, otherwise, proceeding to the next step; delaying the set time and detecting again whether the VPN client obtains the IP address, and if the IP address is not detected for N consecutive times, the VPN client restarts; after restarting, re-detecting whether the VPN client obtains the IP address assigned to the client by the VPN server; until it is detected that the VPN client is normally connected to the VPN server. The above-mentioned VPN connection detection method does not comprehensively consider multiple aspects of VPN connection, and the detection method is relatively simple; the above-mentioned VPN connection recovery method only performs a simple reconnection attempt after the VPN connection is disconnected. Although it overcomes the deficiency of the traditional VPN connection recovery method that requires user intervention, the existing VPN connection recovery method cannot effectively guarantee the rapid recovery and stability of the VPN connection. Summary of the invention

[0005] The present invention overcomes the shortcomings of the prior art VPN connection detection method that does not comprehensively consider multiple aspects and the VPN connection recovery method that cannot effectively guarantee the rapid recovery and stability of the VPN connection, and provides a virtual private network connection maintenance method that can comprehensively detect VPN connections at multiple levels, can quickly restore VPN connections, ensure that VPN connections are stable and reliable, and further ensure the work efficiency and network security of the enterprise.

[0006] To achieve the above object, the present invention adopts the following technical solutions:

[0007] A method for maintaining a virtual private network connection comprises the following steps:

[0008] S1: Add hotplug event script and VPN connection maintenance script in the operating system, configure parameters, and establish VPN connection;

[0009] S2: the hotplug event script receives a hotplug event and determines the type of the hotplug event;

[0010] S3: If the hotplug event is a VPN interface up event, a fault detection process is executed; if the hotplug event is a VPN interface down event, a fault recovery process is executed;

[0011] S4: When the fault detection process triggers a VPN interface down event or the fault recovery process triggers a VPN interface up event, jump to step S2.

[0012] Hotplug refers to the hot-swap mechanism, which allows users to add or remove devices while the system is powered on. VPN refers to a virtual private network, which allows users to safely transmit data over an insecure network by creating protection through encryption. The automated incident response process based on the hotplug mechanism enables automatic detection and recovery when the VPN connection status changes, reducing the need for manual intervention.

[0013] Preferably, the hotplug event script can automatically execute the VPN connection maintenance script, which includes a detection script and a recovery script. The automation strategy implemented by the script makes the detection and recovery process flexible and programmable.

[0014] Preferably, the parameters include a polling interval, a list of standby servers, and a ping address. The polling interval here refers to the time interval for periodically performing detection operations, and the ping address refers to the address that needs to be tested for connectivity. These parameters can be customized according to different network environments and user requirements.

[0015] Preferably, the hotplug event is issued by the operating system kernel when the VPN connection state changes, and the types of the hotplug event include the VPN interface up event and the VPN interface down event in step S3, the VPN interface up event is issued when the VPN connection is successfully established, and the VPN interface down event is issued when an abnormality occurs in the VPN connection. The event-driven control flow uses the hotplug mechanism to trigger the corresponding processing flow according to the change of the real-time network state, thereby ensuring the timeliness of the response.

[0016] Preferably, the fault detection process comprises the steps of:

[0017] S3.1a: Execute the detection script;

[0018] S3.2a: SIM card network registration status detection;

[0019] S3.3a: ping detection;

[0020] S3.4a: VPN process detection;

[0021] S3.5a: Routing status detection;

[0022] S3.6a: After the polling interval, jump to step S3.2a.

[0023] A comprehensive fault detection mechanism is adopted, which integrates multiple fault detection methods to more comprehensively evaluate the health status of VPN connections.

[0024] Preferably, when the VPN connection is abnormal in steps S3.2a-S3.5a, the detection script is stopped and the operating system kernel issues a VPN interface down event. Once any fault is detected in the above steps, a quick and timely automatic response can be made to facilitate the rapid execution of the next fault recovery process.

[0025] Preferably, step S3.2a determines whether the SIM card network injection status is normal by sending an AT command to the device, step S3.3a determines whether the current server is normal by performing a connectivity test on the peer IP of the VPN through a ping command, step S3.4a detects whether the VPN process is running normally in the background through a ps command, and step S3.5a detects whether the VPN routing status is normal through a route command. AT, ping, ps and route commands can be built-in commands of the operating system, or can be customized and implemented through programming. These fault detection methods are fast and efficient, and can comprehensively detect whether the VPN connection is normal.

[0026] Preferably, the fault recovery process comprises the steps of:

[0027] S3.1b: Execute the recovery script;

[0028] S3.2b: Obtain available candidate servers in the backup server list;

[0029] S3.3b: Perform a connectivity test on the standby server. If an abnormality occurs, jump to step S3.2b;

[0030] S3.4b: Try to establish a VPN connection. If the establishment fails, jump to step S3.2b.

[0031] By quickly and automatically transferring to an available alternative server, VPN connections can be quickly restored, significantly reducing service interruption time.

[0032] Preferably, the step S3.2b performs connectivity test on each backup server in the backup server list by polling the backup server list, thereby obtaining available backup servers. After a failure is detected, a predefined backup server list is automatically tried instead of a single reconnection attempt, thereby achieving fast and seamless failover and improving the success rate and speed of VPN connection recovery.

[0033] Preferably, after the VPN connection is successfully established in step S3.4b, the recovery script is stopped and the operating system kernel issues a VPN interface up event. Once the VPN connection is restored, a quick and timely automatic response can be made to facilitate the rapid execution of the next fault detection process.

[0034] Compared with the prior art, the present invention has the following beneficial effects: (1) The automated event response process based on the hotplug mechanism realizes automatic detection and recovery when the VPN connection status changes, reducing the need for manual intervention; (2) A comprehensive fault detection mechanism is adopted, which integrates multiple fault detection methods and can more comprehensively evaluate the health of the VPN connection; (3) After a fault is detected, a predefined list of backup servers is automatically tried instead of a single reconnection attempt, thereby achieving fast and seamless failover and improving the success rate and speed of VPN connection recovery; (4) The automated strategy implemented by the script makes the detection and recovery process flexible and programmable, which is convenient for customization according to different network environments and user needs; (5) The event-driven control flow uses the hotplug mechanism to trigger the corresponding processing flow according to the change of the real-time network status, ensuring the timeliness of the response; (6) By quickly and automatically transferring to the available backup server, the VPN connection can be quickly restored, significantly reducing the service interruption time; (7) The VPN connection is ensured to be stable and reliable, further ensuring the work efficiency and network security of the enterprise. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 It is a flow chart of the present invention. DETAILED DESCRIPTION

[0036] The technical solution of the present invention is further described in detail below through specific embodiments and in conjunction with the accompanying drawings.

[0037] Example:

[0038] like Figure 1 The virtual private network connection maintenance method shown overcomes the shortcomings of the prior art VPN connection detection method that does not comprehensively consider multiple aspects, and the VPN connection recovery method that cannot effectively guarantee the rapid recovery and stability of the VPN connection. This embodiment applies the virtual private network connection maintenance method described to the OpenWRT system under the 5G network. 5G, the fifth generation mobile communication technology, is a new generation of broadband mobile communication technology with the characteristics of high speed, low latency and large connection. More and more scenarios include remote office, smart city construction, smart factories and telemedicine, which require strengthening data security and privacy. These fields require both the above-mentioned excellent characteristics of the 5G network and a virtual private network connection, namely a VPN connection, to ensure the security of data transmission. OpenWRT is an open source Linux operating system provided for embedded devices such as routers. The VPN services of many companies are usually deployed on the OpenWRT system.

[0039] A virtual private network connection maintenance method described in this embodiment first adds a hotplug event script and a VPN connection maintenance script in the operating system. Hotplug refers to a hot-swap mechanism that allows users to add or remove devices while the system is powered on. VPN refers to a virtual private network that creates protection through encryption to allow users to safely transmit data on an insecure network. The hotplug event script and the VPN connection maintenance script are written and created by relevant technical personnel in the operating system. The hotplug event script implements the corresponding operations that need to be performed after the operating system kernel issues a hotplug event, and can implement an automated event response process based on the hotplug mechanism; the VPN connection maintenance script includes a detection script and a recovery script, wherein the detection script implements a fault detection strategy for the VPN connection, and the recovery script implements a fault recovery strategy for the VPN connection. The hotplug event script can automatically execute the VPN connection maintenance script, i.e., the detection script and the recovery script. The advantage of the automated strategy implemented by the script is that the detection process and the recovery process can be made flexible, programmable and customizable.

[0040] Next, configure the parameters, which mainly include the polling interval, the backup server list, and the ping address. The polling interval generally refers to the time interval for regularly performing certain operations. The polling interval here specifically refers to the time interval for regularly performing VPN connection detection operations. In this embodiment, the polling interval is set to 5 seconds by default, and the user can modify it according to the actual situation. The smaller the polling interval is set, the more frequently the VPN connection detection operation is performed. If a VPN connection failure occurs, the VPN connection failure can be detected more promptly. However, at the same time, the disadvantage of a too small polling interval is that frequent detection operations will increase the network load and increase the consumption of system resources, affecting system performance; the larger the polling interval is set, the less obvious the impact of the detection operation on the network load and system resource consumption, but at the same time, the disadvantage of a too large polling interval is that the VPN connection detection operation is performed too infrequently. If a VPN connection failure occurs, it is very likely that the VPN connection failure cannot be detected in time. Therefore, the recommendation for setting the polling interval is that in scenarios where the stability of the VPN connection is extremely high, a smaller polling interval can be selected, and in scenarios where the network conditions are good and the immediacy requirement is not high, the polling interval can be appropriately increased to reduce resource consumption.

[0041] The backup server list refers to a list that stores the information of several backup VPN servers. It is an empty list by default and needs to be configured by the user in advance. The information of the backup VPN server includes the server IP address or domain name, port number, etc. When the primary VPN server connection fails, the VPN connection will be transferred to the available backup VPN server, so the configuration of the backup server list is quite critical. The more diverse the backup VPN servers in the backup server list, the less likely it is that the available backup VPN server cannot be found. However, excessive pursuit of diversity in backup VPN servers will increase the operating costs of the enterprise. A suitable backup server list can ensure the rapid recovery of the VPN connection. The ping address refers to the address that needs to be tested for connectivity. Similarly, the ping address is empty by default and needs to be configured by the user in advance. The ping address includes the IP address of the primary VPN server and the IP address of the backup VPN server. The ping address is needed in the connectivity test of the subsequent fault detection process and the fault recovery process. The correct ping address can ensure the smooth progress of the connectivity test. The above parameters, including the polling interval, the backup server list and the ping address, can be customized according to different network environments and user needs.

[0042] After completing the configuration of the above series of parameters, a VPN connection is established, more specifically, a connection with the main VPN server is established. After the VPN connection is successfully established, the hotplug event script will receive a hotplug event and determine the type of this hotplug event. The hotplug event is issued by the operating system kernel when the VPN connection state changes. The types of hotplug events include the VPN interface up event and the VPN interface down event. The VPN interface up event is issued when the VPN connection is successfully established, and the VPN interface down event is issued when an abnormality occurs in the VPN connection. The VPN interface here refers to the virtual network interface configured in the OpenWRT system for carrying the VPN connection, which is responsible for establishing an encrypted communication channel between the system and the remote VPN server. This event-driven control flow uses the hotplug mechanism to trigger the corresponding processing flow according to the change of the real-time network state, ensuring the timeliness of the response.

[0043] According to the type judgment, if the hotplug event is a VPN interface up event, that is, the VPN connection is successfully established, then the fault detection process is immediately executed. The fault detection process first executes the detection script in the VPN connection maintenance script, and then, according to the VPN connection fault detection strategy of the detection script, the SIM card network injection state detection is performed. The SIM card network injection state refers to whether the SIM card has been successfully registered with the mobile network. If the SIM card has been successfully registered, the device can use the operator network for communication, otherwise the device will not be able to connect to the network and thus cannot communicate normally. Whether the SIM card network injection state is normal is determined by sending an AT command to the device. The AT command is a series of standardized command sets for controlling modems or mobile devices. More specifically, in this embodiment, the AT+COPS? command can be sent to the device to query the current SIM card network injection state. If the SIM card network injection state detection finds that the current SIM card network injection state is abnormal, it may be due to signal problems or invalid SIM cards, etc., then the detection script is stopped, and the operating system kernel issues a VPN interface down event; if the SIM card network injection state detection finds that the current SIM card network injection state is normal, then the next ping detection is continued.

[0044] Ping is a network packet explorer and a program used to test network connections. It sends an ICMP echo request data packet to the target host and waits for the other party to return an echo reply. If the reply can be received and there is no packet loss, it means that the network is connected. Ping detection refers to connectivity testing, which is used to detect the network connectivity status with the current VPN server. The connectivity test of the VPN peer IP is performed through the ping command to determine whether the current server connection is normal. The ping command is one of the important commands for checking network connections and diagnosing network problems. It is used in conjunction with the VPN peer IP. The peer IP here refers to the IP address corresponding to the current VPN server in the ping address pre-configured by the user. If the ping detection finds that the network connectivity status with the current VPN server is abnormal, it may be due to reasons such as VPN server maintenance, then the detection script is stopped and the operating system kernel issues a VPN interface down event; if the ping detection finds that the network connectivity status with the current VPN server is normal, then the next VPN process detection continues.

[0045] In this embodiment, VPN process detection is performed in the OpenWRT system. In the OpenWRT system, VPN process refers to a background program related to VPN service, such as OpenVPN, which is used to encrypt and forward network traffic to ensure the privacy and security of data. Process detection uses tools or commands to detect whether a process is running. In this embodiment, the ps instruction is used to detect whether the VPN process is running normally in the background. The ps instruction is a command used in the OpenWRT system to obtain the status information of the process running on the current system. The ps instruction allows searching for a specific process. Taking the OpenVPN process as an example, if the relevant information of the OpenVPN process appears in the output of the ps instruction, it indicates that the OpenVPN process is running normally in the background. If the VPN process detection finds that the VPN process is not running normally in the background, then the detection script is stopped and the operating system kernel issues a VPN interface down event; if the VPN process detection finds that the VPN process is running normally in the background, then the next routing status detection continues.

[0046] In this embodiment, the routing status detection is performed in the OpenWRT system. The routing status refers to whether the path from the source address to the destination address of the data packet is established and works normally in the network, that is, whether there are valid routing entries to ensure the smooth communication. In the OpenWRT system, VPN routing status detection refers to checking whether the network path of the VPN connection is correctly configured by checking the VPN-related routing entries in the routing table, and detecting whether the data packets transmitted through the VPN can reach the destination normally. In this embodiment, the route instruction is used to detect whether the VPN routing status is normal. The routing table defines how network traffic is forwarded from one network interface to another, and the route instruction is a command for viewing and managing the system routing table. In the OpenWRT system, the route instruction can be used to check whether the VPN interface has the correct routing entry. If the VPN routing status is normal, it can be detected that the routing entry related to the VPN interface points to the correct gateway and target network.

[0047] The AT, ping, ps and route instructions used for SIM card network status detection, ping detection, VPN process detection and routing status detection in the fault detection process of this embodiment can be built-in instructions in the OpenWRT operating system, or customized by programming to meet other requirements. These fault detection method instructions are fast and efficient, and can also comprehensively detect whether the VPN connection is normal at multiple levels.

[0048] If the above-mentioned routing status detection finds that the VPN routing status is abnormal, and detects that the routing entry related to the VPN interface does not point to the correct gateway and target network, then the detection script is stopped, and the operating system kernel issues a VPN interface down event; if the above-mentioned routing status detection finds that the VPN routing status is normal, and detects that the routing entry related to the VPN interface points to the correct gateway and target network, then after the polling interval configured in the previous parameter configuration link, jump to the SIM card network injection status detection, that is, continue to perform the above-mentioned series of VPN connection detection operations, including SIM card network injection status detection, ping detection, VPN process detection and routing status detection. It can be seen that the VPN connection fault detection strategy in the detection script constitutes a loop, and the time interval between ending a loop and preparing to enter the next loop is the polling interval configured in the previous parameter configuration link. Once the VPN connection is found to be abnormal in any detection process within a certain round of loops, the loop will be immediately jumped out and the detection script will be stopped, so that the hotplug event script can immediately respond to the VPN interface down event issued by the operating system kernel. In other words, once the above-mentioned fault detection strategy detects any kind of fault, it can automatically respond quickly and timely, so as to quickly execute the next fault recovery process. The comprehensive fault detection mechanism adopted integrates multiple fault detection methods to more comprehensively evaluate the health status of VPN connections.

[0049] According to the type judgment, if the hotplug event is a VPN interface down event, that is, the VPN connection fails, then the fault recovery process is executed immediately. The fault recovery process first executes the recovery script in the VPN connection maintenance script, and then, according to the VPN connection fault recovery strategy of the recovery script, obtains the available alternative servers in the backup server list. The backup server list has been pre-configured, and the backup server list now stores the information of several backup VPN servers, including server IP addresses or domain names, port numbers, etc. By polling the backup server list, a ping test, i.e., a connectivity test, is performed on each backup server in the backup server list to obtain available alternative servers. After a fault is detected, a predefined backup server list is automatically tried instead of a single reconnection attempt, thereby achieving fast and seamless failover and improving the success rate and speed of VPN connection recovery.

[0050] The ping detection in the fault recovery process is similar to the ping detection in the fault detection process. The ping detection in the current fault recovery process is also used in combination with the peer IP of the VPN. The peer IP here refers to the IP address corresponding to the current backup VPN server in the ping address pre-configured by the user. In the process of polling the backup server list, if a backup VPN server is found to have a normal network connection status with it after ping detection, then this available backup VPN server will be used as a backup server; if the entire polling process of the backup server list is completed, but the network connection status with all the backup VPN servers in the backup server list is abnormal after ping detection, in this relatively rare case, the backup server list will be immediately polled twice. If after the three polling processes are completed, it is still found that the network connection status with all the backup VPN servers in the backup server list is abnormal, then the recovery script under the OpenWRT system will immediately notify the user through email, SMS or network push service that no available backup VPN server can be found in the backup server list as a backup server.

[0051] If an available alternative server is successfully obtained, then proceed to the next server connectivity test. The purpose of pinging the current alternative server again, i.e., the connectivity test, is to further confirm the availability of the alternative server obtained in the previous step. If the path is found to be abnormal, that is, the current alternative server is found to be abnormal in its network connectivity after pinging the test, indicating that the current alternative server is not available at this time, then jump to the first step in the recovery script, that is, to re-acquire the available alternative servers in the backup server list. If the path is found to be normal, that is, the current alternative server is found to be normal in its network connectivity after pinging the test, indicating that the current alternative server is still available at this time, then jump to the next step, that is, to try to establish a VPN connection.

[0052] After determining the alternative server, try to establish a VPN connection. If the VPN connection fails to be established, then jump to the first step in the recovery script, that is, to re-acquire the available alternative servers in the backup server list; if the VPN connection is successfully established, then the recovery script will be stopped immediately, so that the hotplug event script can immediately respond to the VPN interface up event issued by the operating system kernel. In other words, once the above-mentioned fault recovery strategy restores the VPN connection, it can automatically respond quickly and in a timely manner, so as to quickly execute the next fault detection process. The above-mentioned fault recovery process can quickly restore the VPN connection by quickly and automatically transferring to the available alternative server, which significantly reduces the service interruption time.

[0053] When the fault detection process triggers a VPN interface down event, or the fault recovery process triggers a VPN interface up event, the hotplug event script will receive the hotplug event triggered by the above process, determine the type of the received hotplug event and continue to execute its next process. Specifically, when the fault detection process triggers a VPN interface down event, the hotplug event script receives the hotplug event, determines its type and finds that it is a VPN interface down event, and then executes the fault recovery process; when the fault recovery process triggers a VPN interface up event, the hotplug event script receives the hotplug event, determines its type and finds that it is a VPN interface up event, and then executes the fault detection process. This automated event response process based on the hotplug mechanism realizes automatic detection and recovery when the VPN connection status changes, reduces the need for manual intervention, and at the same time ensures that the VPN connection is stable and reliable, further ensuring the work efficiency and network security of the enterprise.

[0054] This embodiment applies the virtual private network connection maintenance method to the OpenWRT system under the 5G network. In fact, the virtual private network connection maintenance method can also be applied to other network environments and other types of operating systems.

[0055] The embodiments described above are only preferred solutions of the present invention and are not intended to limit the present invention in any form. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or make equivalent substitutions for some of the technical features therein. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the invention should be included in the protection scope of the present invention.

Claims

1. A method for maintaining a virtual private network connection, characterized in that: The following steps are involved: S1: Add hotplug event script and VPN connection maintenance script in the operating system, configure parameters, and establish VPN connection; S2: the hotplug event script receives a hotplug event and determines the type of the hotplug event; S3: If the hotplug event is a VPN interface up event, a fault detection process is executed; if the hotplug event is a VPN interface down event, a fault recovery process is executed; S4: When the fault detection process triggers a VPN interface down event or the fault recovery process triggers a VPN interface up event, jump to step S2.

2. A virtual private network connection maintenance method according to claim 1, characterized in that: The hotplug event script can automatically execute the VPN connection maintenance script, which includes a detection script and a recovery script.

3. A virtual private network connection maintenance method according to claim 2, characterized in that: The parameters include the polling interval and a list of alternate servers and ping addresses.

4. A virtual private network connection maintenance method according to claim 1, 2 or 3, characterized in that: The hotplug event is issued by the operating system kernel when the VPN connection state changes. The types of the hotplug event include the VPN interface up event and the VPN interface down event in step S3. The VPN interface up event is issued when the VPN connection is successfully established, and the VPN interface down event is issued when an abnormality occurs in the VPN connection.

5. A virtual private network connection maintenance method according to claim 3, characterized in that: The fault detection process includes the following steps: S3.1a: Execute the detection script; S3.2a: SIM card network registration status detection; S3.3a: ping detection; S3.4a: VPN process detection; S3.5a: Routing status detection; S3.6a: After the polling interval, jump to step S3.2a.

6. A virtual private network connection maintenance method according to claim 5, characterized in that: When the steps S3.2a-S3.5a find that the VPN connection is abnormal, the detection script is stopped and the operating system kernel issues a VPN interface down event.

7. A virtual private network connection maintenance method according to claim 5 or 6, characterized in that: The step S3.2a determines whether the SIM card network injection status is normal by sending an AT command to the device, the step S3.3a determines whether the current server is normal by performing a connectivity test on the VPN's peer IP through a ping command, the step S3.4a detects whether the VPN process is running normally in the background through a ps command, and the step S3.5a detects whether the VPN routing status is normal through a route command.

8. A virtual private network connection maintenance method according to claim 3, characterized in that: The fault recovery process includes the following steps: S3.1b: Execute the recovery script; S3.2b: Obtain available candidate servers in the backup server list; S3.3b: Perform a connectivity test on the standby server. If an abnormality occurs, jump to step S3.2b; S3.4b: Try to establish a VPN connection. If the establishment fails, jump to step S3.2b.

9. A virtual private network connection maintenance method according to claim 8, characterized in that: The step S3.2b performs a connectivity test on each standby server in the standby server list by polling the standby server list, thereby obtaining available candidate servers.

10. A virtual private network connection maintenance method according to claim 8 or 9, characterized in that: After the VPN connection is successfully established in step S3.4b, the recovery script is stopped and the operating system kernel issues a VPN interface up event.

Images