Redundant network communication equipment for high-speed ship

Abstract

The invention provides a redundant network communication device for a high-speed ship, which belongs to the technical field of communication networks and comprises a redundant link aggregation module for interconnecting network switching devices through a preset number of optical fibers to form a stacking system and enabling an LACP (Link Aggregation Control Protocol) to bind the preset number of optical fibers into a logic aggregation channel; the double-rule terminal access module is used for configuring a network card for each user terminal based on the logic aggregation channel and the stacking system and respectively connecting the network card to the network switching equipment to obtain a double-rule access channel; the intelligent routing control module is used for generating a network topological graph based on the physical connection relationship between all the user terminals and the network switching equipment, and generating a static VLAN interface routing strategy based on the network topological graph; and the security protection execution module is used for implementing a security triple mechanism on the logic aggregation channel based on a static VLAN interface routing strategy. According to the invention, the network configuration can be automatically adjusted according to the link state and the network topology change, the bandwidth allocation is optimized, and the reliability and security of network communication are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of communication networks, and particularly to a redundant network communication device for high-speed ships. Background Art

[0002] With the increasing demand for communication in high-performance platforms such as high-speed ships, the demand for communication in high-performance network communication platforms is also increasing. Network communication devices are facing severe challenges in aspects such as data transmission stability, redundancy, and bandwidth management. Especially in special environments such as high-speed ships at sea, network communication devices are required to have high reliability, flexible redundancy mechanisms, and efficient bandwidth scheduling capabilities.

[0003] Currently, high-speed ship network communication devices usually adopt traditional network switching devices and redundant link aggregation technologies, such as the combination of fiber optic links and stacking systems. However, these traditional technical solutions have certain limitations. For example, existing link redundancy technologies often rely on simple link aggregation and load balancing mechanisms, and cannot respond to link and terminal state changes in real time and dynamically, which easily leads to waste of link bandwidth resources and occurrence of communication interruptions. Moreover, the security mechanisms of traditional devices are relatively weak, and they cannot make timely adjustments to maintain communication stability when encountering malicious attacks or accidental failures.

[0004] Therefore, the present invention provides a redundant network communication device for high-speed ships. Summary of the Invention

[0005] The present invention provides a redundant network communication device for high-speed ships. By improving existing redundant link aggregation, intelligent routing control, and security protection mechanisms, a redundant network communication device for high-speed ships is proposed, which not only provides efficient fiber optic link redundancy and flexible network topology adjustment mechanisms, but also has real-time monitoring and intelligent response capabilities, ensuring the stability and security of the system in complex environments. In particular, by introducing the LACP protocol and multi-level dynamic monitoring and response mechanisms, the present invention can automatically adjust network configurations, optimize bandwidth allocation, and improve the reliability and security of network communication according to link states and network topology changes.

[0006] The present invention provides a redundant network communication device for high-speed ships, including: A redundant link aggregation module: interconnecting network switching devices through a preset number of optical fibers to form a stacking system, and enabling the LACP protocol to bind the preset number of optical fibers into a logical aggregation channel; A dual-path terminal access module: based on the logical aggregation channel and the stacking system, configuring network cards for each user terminal and connecting them to the network switching device respectively to obtain dual-path access channels; Intelligent Routing Control Module: Generate a network topology map based on the physical connection relationships between all user terminals and network switching devices, and generate a static VLAN interface routing policy based on the network topology map. Security Protection Execution Module: Implement the security triple mechanism on the logical aggregation channel based on the static VLAN interface routing policy.

[0007] The present invention provides a high-speed ship redundant network communication device, further including: Real-time Monitoring Module: Collect and correlate and analyze the status data of the link aggregation layer, the status data of the terminal access layer, and the events of the security protection layer in real time. Intelligent Response Module: Determine abnormal data based on the correlation analysis result, match the abnormal data with the abnormal data of a preset type, and determine whether to trigger the control plane topology reconstruction based on the matching result.

[0008] Preferably, the redundant link aggregation module includes: Device Interconnection Unit: Interconnect network switching devices through a preset number of optical fibers, and enable a stacking protocol to generate a stacking system topology table. Optical Fiber Quality Detection Unit: Detect the connectivity status of all physical optical fibers based on the stacking system topology table, and perform baseline tests on the optical power and bit error rate of each optical fiber to obtain a baseline test result. Link Aggregation Protocol Unit: Determine the LACP priority of each optical fiber based on the baseline test result. Bandwidth Allocation Unit: When there is an optical fiber interruption in the independent optical fibers, allocate the bandwidth of the interrupted optical fiber to the remaining optical fibers according to the LACP priority in a preset ratio. Mapping Determination Unit: Determine the primary and secondary aggregation member ports based on the LACP priorities of all optical fibers, and generate an LACP port priority mapping table. Channel Aggregation Unit: Bind all optical fibers into a logical aggregation channel based on the LACP port priority mapping table, the bandwidth of all optical fibers, and a preset standard.

[0009] Preferably, the dual-homed terminal access module includes: Terminal Connection Unit: Deploy physical network cards for each user terminal to connect to the network switching device based on the stacking system topology table, and then generate a terminal-switch mapping table. Channel Configuration Unit: Allocate an aggregation channel ID to each network card based on the logical aggregation channel and the terminal-switch mapping table, and then update the user terminal configuration to a dual-homed access channel.

[0010] Preferably, the intelligent routing control module includes: Topology construction unit: Based on the terminal-switch mapping table and the stack system topology table, identify the physical connection relationships between all user terminals and network switching devices, and construct a network topology diagram that includes terminal nodes, switching nodes, and logical aggregation channels. Among them, the network topology diagram stores the connection status and channel attributes between nodes in the form of a three-dimensional matrix to generate a network topology relationship matrix; Mapping and parsing unit: Determine several terminal-switch groups based on the terminal-switch mapping table; Topology parsing unit: Based on the network topology relationship matrix, divide the security domain according to the preset network isolation standard, and assign an independent VLAN ID to each terminal-switch group; Policy generation unit: Obtain the bandwidth load data of the logical aggregation channel to determine the optimal routing path, and then generate a static VLAN interface routing policy.

[0011] Preferably, the security protection execution module includes: Policy matching unit: Based on the static VLAN interface routing policy, extract the VLAN ID and corresponding routing path of each terminal-switch group, and perform channel security level matching in combination with the LACP port priority mapping table to generate a VLAN-channel security binding table; Mechanism implementation unit: Based on the VLAN-channel security binding table, implement the security triple mechanism on the logical aggregation channel.

[0012] Preferably, the real-time monitoring module includes: Link status collection unit: Based on the LACP port priority mapping table, poll and detect the optical power, bit error rate, and bandwidth occupancy data of each optical fiber in the logical aggregation channel, and compare with the baseline test results to determine the deviation degree, and generate a real-time link health score table; Terminal access status collection unit: Based on the terminal-switch mapping table, monitor the dual-homed access status of each user terminal network card, synchronously obtain the encryption policy execution log in the VLAN-channel security binding table, and integrate and generate a terminal security behavior matrix; Security event spatio-temporal correlation unit: Perform spatio-temporal matching on the link health score table, the terminal security behavior matrix, and the static VLAN interface routing policy of the intelligent routing control module, and then generate a security event alarm report.

[0013] Preferably, the preset types of abnormal data include: aggregated link abnormal data, terminal access abnormal data, and security event abnormal data.

[0014] Preferably, the link aggregation protocol unit includes: Determine the LACP priority of each optical fiber based on the baseline test results, where the baseline test results include the initial performance data of each optical fiber: Among them, are weight coefficients, respectively representing the influence weights of optical power, bit error rate, and stability, is the allowable deviation threshold of optical power; is the normalization scaling factor, is the basic priority, is the deviation of optical power from the nominal value, is the proportion of bit error rate, stability degradation value, is the average value of historical stability, is the preset standard stability, is the current optical power, is the preset optical power, is the current bit error rate, is the preset maximum allowable bit error rate.

[0015] Compared with the prior art, the beneficial effects of the present application are as follows: By improving the existing redundant link aggregation, intelligent routing control, and security protection mechanisms, a high-speed ship redundant network communication device is proposed, which not only provides efficient fiber optic link redundancy and a flexible network topology adjustment mechanism, but also has real-time monitoring and intelligent response capabilities to ensure the stability and security of the system in complex environments. In particular, by introducing the LACP protocol and a multi-level dynamic monitoring and response mechanism, the present invention can automatically adjust the network configuration, optimize the bandwidth allocation, and improve the reliability and security of network communication according to the link status and network topology changes. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following will briefly introduce the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings in the following description are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0017] Figure 1 is a schematic structural diagram of a high-speed ship redundant network communication device provided by an embodiment of the present invention; Figure 2 is a design example diagram of the application scenario of the redundant link aggregation module; Figure 3 is an example diagram of link anomaly analysis; Figure 4 Dual-track terminal access module application example diagram; Figure 5 is a normal state diagram of ring network protection; Figure 6It is a ring network protection switching status diagram. Detailed implementation manners

[0018] To make the objectives, technical solutions and advantages of the present invention clearer, the technical solutions in the present invention will be clearly and completely described below with reference to the accompanying drawings in the present invention. Apparently, the described embodiments are some but not all of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the embodiments in the present invention without creative efforts shall fall within the protection scope of the present invention.

[0019] Embodiment 1: The embodiment of the present invention provides a redundant network communication device for high-speed ships, as Figure 1 shown, including: Redundant link aggregation module: Interconnect network switching devices through a preset number of optical fibers to form a stacking system, and enable the LACP protocol to bind the preset number of optical fibers into a logical aggregation channel; Dual-homed terminal access module: Based on the logical aggregation channel and the stacking system, configure network cards for each user terminal and connect them to the network switching device respectively to obtain a dual-homed access channel; Intelligent routing control module: Generate a network topology diagram based on the physical connection relationship between all user terminals and the network switching device, and generate a static VLAN interface routing policy based on the network topology diagram; Security protection execution module: Implement a security triple mechanism on the logical aggregation channel based on the static VLAN interface routing policy.

[0020] In this embodiment, the redundant link aggregation module: Interconnect two Huawei CE6850-48S6Q-HI switches through 2 10G single-mode optical fibers (wavelength 1310nm, attenuation ≤ 0.4dB / km), and enable the VSF virtualization stacking protocol to form a single logical device; Deploy LACP dynamic aggregation based on the IEEE 802.3ad standard to bind physical links into a logical channel (total bandwidth 20Gbps), as Figure 2 shown: Application scenario design: Two network switching devices are interconnected through 2 optical fibers to form a stacking system; After the 2 optical fibers between the network switching devices are aggregated, the switching capacity between the network switching devices reaches 20G. If one optical fiber has a problem, it will not affect the communication between the network switching devices; Users access the two network switching devices through dual network cards in a dual-homed manner. When one of the links fails, it will not affect user communication; The two network switching devices are backup to each other. When one of the devices is abnormal, it will not affect user communication.

[0021] In this embodiment, the dual-standard terminal access module: the user terminal is equipped with an Intel X550-T2 dual-port 10G network card, which is directly connected to the GE1 / 0 / 1-24 ports of the two switches respectively; NIC Teaming technology is used to establish dual channels in active and standby mode, and the switching delay is <50ms (measured value).

[0022] In this embodiment, the intelligent routing control module: automatically discovers the topology through the LLDP protocol and generates a three-dimensional adjacency matrix (dimensions include: port ID, VLAN-ID, link quality indicator); divides independent routing domains for the command system (VLAN 10), fire control system (VLAN 20), etc., and configures static OSPF cost values.

[0023] In this embodiment, the security protection execution module implements the security triplet mechanism: [MAC binding table] + [IPsec encryption channel] + [RBAC permission policy]; and deploys Huawei USG6630 firewall at the aggregation layer to realize the linkage update of ACL rules and physical link status.

[0024] In this embodiment, the security triplet mechanism includes: (a) Identity Authentication: using X.509 certificates to bidirectionally authenticate the legitimacy of dual physical network cards; (b) Domain Segmentation: based on the port mapping table, VLAN communication boundaries are divided by function; (c) Ring network protection: real-time detection of the physical link status (first / second optical fiber on / off) of the logical aggregation channel through the ERPS protocol. ERPS (Ethernet Ring Protection Switching) is an Ethernet link layer loop breaking standard protocol, also known as G.8032. It absorbs the advantages of ring network protection technologies such as MSTP, optimizes the detection mechanism, and can achieve a convergence speed of milliseconds, which is much higher than MSTP; at the same time, it has good compatibility and can achieve interoperability. Figure 5 and Figure 6 There are normal and abnormal situations respectively. In the abnormal situation, a fault occurs, but the devices can still communicate with each other through the protection state. Ring network protection includes: configuring ring networking; configuring ERPS protocol, configuring RPL OWNER; configuring blocking interfaces; when a link fails, unblocking the port and switching the service to the protection state. The Ethernet ring network protection function is applied to the path protection of the access switch to realize the protection function of the path accessing the transmission network. When the working path fails, it can quickly switch to the protection path to ensure the normal communication between the access devices. The normal state of the ring network protection is as follows: Figure 5 As shown, the ring network protection switching status is as follows Figure 6 shown.

[0025] In this embodiment, a dynamic priority adjustment LACP protocol implementation mechanism is adopted, which is different from the standard 802.3ad protocol. Its special algorithm will detect the optical power attenuation rate of the optical fiber (with an accuracy of ±0.1dBm) and the burst change gradient of the bit error rate in real time. By normalizing the processing, the dynamic weight value of each optical fiber is calculated (the battle damage environment correction coefficient β = 1.2 is introduced in the formula). When it is detected that the instantaneous optical power fluctuation of a certain optical fiber exceeds the threshold of the standard GJB-2242, the priority of this link will be automatically reduced within 3ms, and the port mapping table will be synchronously updated through the stacking system to ensure that critical service traffic (such as the command and control system) is only allocated to healthy links. Test data shows that this mechanism can improve the availability of the aggregation channel in the battle damage environment from 78% of the traditional scheme to 99.6%.

[0026] In this embodiment, the dual-homed access of the dual-regulated terminal access module adopts a protocol to achieve "zero-sensing switching". The key technology lies in the fast fault detection algorithm implanted in the network card driver layer. This algorithm triggers the activation instruction of the standby channel pre-installed in the FPGA chip by monitoring the disappearance time of the physical layer carrier signal (the threshold is set to 4.7μs, which is more sensitive than the 16μs of the standard Ethernet) and the number of burst CRC error packets (when 5 consecutive frames are abnormal, it is determined to be invalid). When the primary link is interrupted, the standby link will force the switch by writing a specific control word (0x55AA) to the network card register. The entire process generates a delay of only 1.2μs (measured value), which is far lower than the upper limit of 50μs required by the combat system.

[0027] In this embodiment, during the generation of the network topology diagram of the intelligent routing control module, a three-dimensional space matrix coding technology is adopted, and non-standard parameters such as the physical coordinates (X, Y, Z) of each switching node, the port polarization state characteristics (S parameters), and the carrier phase noise value are incorporated into the routing decision factors. When generating the static VLAN policy, the system will preferentially select the path with the best electromagnetic compatibility (such as avoiding the section where the co-frequency interference exceeds -85dBm), and solidify 16 groups of preset routing rules through the hardware TCAM table. This design shortens the routing convergence time in this environment from 2.3s of the conventional OSPF protocol to 38ms.

[0028] In this embodiment, for the encryption policy dynamic binding technology of the security triple mechanism of the security protection execution module, the ACL rules of each VLAN interface will be automatically downgraded with the optical power degradation rate of the aggregation channel: when it is detected that the optical signal-to-noise ratio (OSNR) of the optical fiber drops by 5dB due to strong electromagnetic interference, the system will immediately switch the IPsec encryption mode from AES-GCM-256 to the lightweight Speck-128 / 256 algorithm, and regenerate the key material through the TRNG module (compliant with the GJB-7361 standard) pre-installed in the switching chip. The actual measurement shows that this mechanism can resist the EMP attack of 200kV / m on the premise of maintaining communication continuity.

[0029] Beneficial effects of the above technical solution: By improving the existing redundant link aggregation, intelligent routing control, and security protection mechanisms, a redundant network communication device for high-speed ships is proposed, which not only provides efficient optical fiber link redundancy and a flexible network topology adjustment mechanism, but also has real-time monitoring and intelligent response capabilities, ensuring the stability and security of the system in complex environments. In particular, by introducing the LACP protocol and a multi-level dynamic monitoring and response mechanism, the present invention can automatically adjust the network configuration, optimize bandwidth allocation, and improve the reliability and security of network communication according to link status and network topology changes.

[0030] Embodiment 2: The embodiment of the present invention provides a redundant network communication device for high-speed ships, further comprising: Real-time monitoring module: Real-time collect and associatively analyze the status data of the link aggregation layer, the status data of the terminal access layer, and the security protection layer events; Intelligent response module: Determine abnormal data based on the associative analysis results, match the abnormal data with preset types of abnormal data, and determine whether to trigger the control plane topology reconstruction based on the matching results.

[0031] In this embodiment, the intelligent response module further includes: intelligent classification of abnormal data based on the security event alarm report: Aggregate link anomaly recognition unit: Based on the real-time link health score table, identify link anomaly patterns such as sudden drop in optical power, bit error rate exceeding the threshold, or bandwidth allocation imbalance, and mark them as the first type of abnormal data; Terminal access anomaly recognition unit: According to the terminal security behavior matrix, detect terminal illegal VLAN hopping, high-frequency switching of primary and backup channels, or MAC address forgery behavior, and mark them as the second type of abnormal data; Security event correlation unit: Spatially and temporally correlate the first type of abnormal data with the second type of abnormal data, and determine the attack path in combination with the VLAN-channel security binding table to generate the third type of abnormal data (coordinated attack event).

[0032] In this embodiment, the real-time monitoring module uses multi-dimensional composite probe technology to achieve millisecond-level global perception. A micro grating array (spacing ≤ 2μm) is implanted in the link aggregation layer to capture optical fiber microbend strain signals in real time, and the polarization mode dispersion (PMD) matrix is hard-analyzed by an FPGA; the terminal access layer intercepts the NIC TCAM table entry change event through a customized ASIC chip, and synchronously monitors the MAC layer retransmission rate and the physical layer clock jitter (RMS value); the security protection layer embeds a dedicated coprocessor in the switching chip to deeply decompose the sequence number hopping mode of the IPsec ESP payload. The three types of data are aggregated to the on-board data fusion unit through an RS-485 bus (transmission rate ≥ 20Mbps), and an improved DBSCAN algorithm is used for spatio-temporal alignment (time drift compensation accuracy ± 50ns) to form a dynamic situation map containing 17-dimensional feature vectors.

[0033] Beneficial effects of the above technical solution: By collecting and analyzing data of the link aggregation layer, terminal access layer, and security protection layer through the real-time monitoring module, the network status can be evaluated in real time. The intelligent response module automatically identifies abnormal data based on the analysis results, matches it with the preset abnormal types, and decides whether to trigger network topology reconstruction. This mechanism improves the stability and adaptability of the network, ensures quick response in case of failures, optimizes network resource allocation, and enhances communication reliability.

[0034] Embodiment 3: The embodiment of the present invention provides a redundant network communication device for high-speed ships. The redundant link aggregation module includes: Device interconnection unit: Interconnects network switching devices through a preset number of optical fibers, and enables a stacking protocol to generate a stacking system topology table; Optical fiber quality detection unit: Detects the connection status of all physical optical fibers based on the stacking system topology table, and performs baseline tests on the optical power and bit error rate of each optical fiber to obtain baseline test results; Link aggregation protocol unit: Determines the LACP priority of each optical fiber based on the baseline test results; Bandwidth allocation unit: When there is an optical fiber interruption in the independent optical fibers, allocates the bandwidth of the interrupted optical fiber to the remaining optical fibers according to the LACP priority in a preset ratio; Mapping determination unit: Determines the primary and standby aggregation member ports based on the LACP priorities of all optical fibers, and generates an LACP port priority mapping table; Channel aggregation unit: Binds all optical fibers into a logical aggregation channel based on the LACP port priority mapping table, the bandwidth of all optical fibers, and a preset standard.

[0035] In this embodiment, when there is an optical fiber interruption in the independent optical fibers, link anomaly analysis is performed, such as Figure 3If there is a problem with one of the links in the aggregation group of the switching device shown, it will only cause the bandwidth between the switching devices to change from 20G to 10G. Since the 10G switching bandwidth is already sufficient, it will not affect the communication between the network switching devices. If the link for dual-homed access by the user fails, it will automatically switch to the other link without affecting user communication; allocating the bandwidth of the interrupted optical fiber to the remaining optical fibers according to the LACP priority in a preset ratio includes: when the system detects an interruption of an independent optical fiber (determined by a sudden drop in optical power exceeding 10dB or a sudden increase in the OTDR reflection peak), the dynamic bandwidth reallocation engine immediately starts the LACP state machine (extended based on the IEEE 802.3ad protocol). First, it freezes the transmission of LACP PDUs on the faulty port, and then recalculates the member port priorities according to a preset tactical-level weight matrix (including 6 parameters such as the remaining life of the optical fiber and the current bit error rate). The allocation process uses a strongly real-time sliding window algorithm and completes the bandwidth migration within 3 LACP heartbeat cycles (about 900ms): ① The original bandwidth of the interrupted optical fiber is divided according to the preset ratio in the combat plan (such as 90% to the primary optical fiber and 10% to the standby); ② Lossless switching is achieved by modifying the traffic shaping register of the switch chip (with an accuracy of 4Kbps for each queue); ③ Synchronously update the BFD session parameters in the control plane to ensure that the end-to-end delay fluctuation does not exceed 50μs.

[0036] In this embodiment, the stacking protocol is a control protocol that allows multiple physical switches to be logically virtualized into a single device. It usually adopts a private message interaction mechanism (such as Huawei's CSS and Cisco's StackWise). In the high-speed ship scenario, it is optimized into a multi-ring topology protocol and uses 128-bit encrypted Hello messages (with a 5ms cycle) to synchronize the MAC table entries and forwarding table entries of the member switches. The stacking system topology table is a matrix database that records the optical fiber connection relationships between switches in real time, including optical path fingerprints (such as wavelength allocation mode, polarization state signature) and device role identifiers (master control / standby control / member). It checks the topology consistency every 200ms through the SHA-3 algorithm to ensure that nanosecond-level synchronization accuracy can still be maintained in a strong vibration environment, supporting subsequent bandwidth allocation decisions.

[0037] In this embodiment, detecting the optical fiber connection status based on the stacked topology table includes: The detection process adopts a dual-mode flaw detection mechanism: ① In the optical layer, a tunable laser light source (step accuracy 0.01 nm) is used to inject test light, and the backscattering intensity of each fiber core is detected through an APD array to establish an attenuation-distance curve (identifying micro-bend points); ② In the electrical layer, a BERT module is implanted in the SerDes unit of the switching chip to send a PRBS31 pseudo-random code to test the bit error rate (BER≤1E-12 is qualified). The system will compare the current test results with the combat readiness baseline library (including the optical power threshold table under different sea conditions). When the time delay jitter of a certain optical fiber exceeds the baseline value by ±15%, it is marked as the "sub-healthy" state and triggers the LACP priority downgrade to ensure that critical services automatically avoid degraded links.

[0038] In this embodiment, the determination of the LACP primary and standby ports and the generation of the priority mapping table. The selection of the primary and standby ports adopts an enhanced greedy algorithm, comprehensively evaluating three indicators: the LACP priority (0-65535) of the optical fiber, the real-time available bandwidth (granularity of 50 Mbps), and the historical failure rate (weighting factor 0.3). The optimal solution calculation is completed within 80 μs through the FPGA hardware sorting engine. The generated LACP port priority mapping table is an encrypted binary structure, including port role identification bits (primary / standby / hot standby), bandwidth weight factors (Q22.10 fixed-point number format), and failover markers (4-bit CRC check). This table is sent to each line card through the PCIe Gen4 x8 channel for the data plane hardware to look up the table, ensuring that the update of the flow table entries does not affect the established TCP sessions.

[0039] In this embodiment, the binding process of the logical aggregation channel follows the G.8032 enhanced Ethernet ring standard: ① Time-slot bandwidth allocation - The physical bandwidth of each optical fiber is divided into 8 ns time slots, and the time slot occupancy ratio of each member port is dynamically adjusted according to the priority mapping table (for example, the primary optical fiber occupies 60% of the time slots alone); ② Anti-interference aggregation coding - Add a 16-byte frame header at the MAC layer, embedding the RS(255,239) forward error correction code and the frequency hopping pattern indicator. Finally, the aggregation channel has cross-layer self-healing capabilities: when it is detected that the CRC error suddenly increases due to electromagnetic interference, it can switch to the standby 128-bit AES-GCM encryption channel within 1 ms to maintain the integrity of the data link.

[0040] Beneficial effects of the above technical solution: The high-speed ship redundant network communication device is made highly efficient and stable through the redundant link aggregation module. First, a stacking system topology table is generated through the stacking protocol to ensure the connectivity status and quality of the optical fibers. The optical fiber quality detection unit ensures the reliability of the link through baseline tests of optical power and bit error rate. The link aggregation protocol unit determines the LACP priority based on the test results and allocates bandwidth according to the priority when the optical fiber is interrupted, optimizing the use of network bandwidth. Finally, through LACP port priority mapping, all optical fibers are bound into a logical aggregation channel, improving network redundancy and bandwidth efficiency and enhancing communication stability.

[0041] Embodiment 4: The embodiment of the present invention provides a high-speed ship redundant network communication device, a dual-track terminal access module, including: Terminal connection unit: Based on the stacking system topology table, physical network cards are deployed for each user terminal to be respectively connected to the network switching device, thereby generating a terminal-switch mapping table; Channel configuration unit: Based on the logical aggregation channel and the terminal-switch mapping table, an aggregation channel ID is assigned to each network card, and then the configuration of the user terminal is updated to a dual-track access channel.

[0042] In this embodiment, deploying physical network cards for each user terminal based on the stacking system topology table and respectively connecting them to the network switching device to generate a terminal-switch mapping table means configuring physical network cards for each user terminal through the stacking system topology table of the network switching device. The stacking system topology table shows the connection structure between network switching devices and helps determine which specific switch port each user terminal (such as a computer, communication device, etc.) should be connected to. Through this topology table, the system can automatically configure physical network cards for user terminals to ensure that each terminal can access the network through the correct switch port. The generated terminal-switch mapping table records the mapping relationship between each user terminal and its corresponding switch port, providing basic data for subsequent network management and optimization.

[0043] In this embodiment, based on the logical aggregation channel and the terminal-switch mapping table, an aggregation channel ID is assigned to each network card, and then the configuration of the user terminal is updated to an access channel. In this process, the logical aggregation channel refers to the logical combination of multiple optical fiber channels formed through redundant link aggregation, and the terminal-switch mapping table records the relationship between each user terminal and the switch port. Based on this data, the system will assign an aggregation channel ID to the physical network card of each terminal, and this ID represents the channel through which the user terminal accesses through redundant link aggregation. After the channel ID is assigned, the system will update the configuration of the user terminal to enable data transmission through the specified aggregation channel, thereby achieving network redundancy, optimized bandwidth allocation, and efficient data communication. This process improves the reliability, bandwidth utilization rate, and load balancing ability of the network.

[0044] In this embodiment, an example of the application of the dual-homed terminal access module is as follows Figure 4 As shown: When an abnormality occurs in one of the network switching devices, since users are dual-homed to the network switching devices, all users will automatically switch to the link of the other network switching device, without affecting the user network communication.

[0045] Advantages of the above technical solution: The access management of the high-speed ship network communication device is optimized through the terminal access module. The terminal connection unit automatically deploys physical network cards for each user terminal based on the stacking system topology table and connects them to the appropriate network switching device, generating a terminal-switch mapping table. The channel configuration unit assigns an aggregated channel ID to each network card according to the logical aggregated channel and the mapping table, and updates the user terminal configuration to the access channel. This method improves the bandwidth utilization rate of the network, simplifies the terminal access process, and improves the network stability and reliability.

[0046] Embodiment 5: The embodiment of the present invention provides a high-speed ship redundant network communication device, an intelligent routing control module, including: Topology construction unit: Based on the terminal-switch mapping table and the stacking system topology table, identify the physical connection relationships between all user terminals and network switching devices, and construct a network topology diagram including terminal nodes, switching nodes, and logical aggregated channels. Among them, the network topology diagram stores the connection status and channel attributes between nodes in the form of a three-dimensional matrix, generating a network topology relationship matrix; Mapping analysis unit: Determine a number of terminal-switch groups based on the terminal-switch mapping table; Topology analysis unit: Based on the network topology relationship matrix, divide the security domain according to the preset network isolation standard, and assign an independent VLAN ID to each terminal-switch group; Policy generation unit: Obtain the bandwidth load data of the logical aggregated channel to determine the optimal routing path, and then generate a static VLAN interface routing policy.

[0047] In this embodiment, based on the terminal-switch mapping table and the stack system topology table, the physical connection relationships between all user terminals and network switching devices are identified, and a network topology graph including terminal nodes, switching nodes, and logical aggregation channels is constructed. Among them, the network topology graph stores the connection status between nodes and the channel attributes in the form of a three-dimensional matrix, generating a network topology relationship matrix. It is to use the terminal-switch mapping table and the stack system topology table to identify the physical connection relationships between all user terminals and network switching devices, and construct a network topology graph through these data. The graph includes terminal nodes (user terminals), switching nodes (network switches), and logical aggregation channels (multiple optical fibers aggregated into one logical channel). The network topology graph is stored in the form of a three-dimensional matrix, recording the connection status between nodes and the attributes of each channel (such as bandwidth, status, etc.). In this way, the system can clearly present the overall architecture of the network and provide an efficient way to analyze and optimize the network topology, generating a network topology relationship matrix for subsequent network optimization and routing decisions.

[0048] In this embodiment, several terminal-switch groups are determined based on the terminal-switch mapping table. By analyzing the terminal-switch mapping table, it is determined which terminals are connected to which switch ports, thus forming multiple "terminal-switch groups". Each group represents the physical connection relationship between a user terminal and its corresponding network switch port. The purpose of this process is to classify each user terminal in the network according to its connection relationship with the switch, providing basic information for subsequent network management, resource allocation, and routing policy generation.

[0049] In this embodiment, based on the network topology relationship matrix, security domains are divided according to a preset network isolation standard, and an independent VLAN ID is assigned to each terminal-switch group. Based on the previously generated network topology relationship matrix, the system divides the network into multiple security domains (VLANs, virtual local area networks) according to preset network isolation standards (such as security requirements, performance requirements, etc.). Each "terminal-switch group" will be assigned an independent VLAN ID to ensure traffic isolation and data security between different terminal groups. The assignment of VLAN IDs helps improve network security, prevent unauthorized access, and optimize the use of network resources.

[0050] In this embodiment, the bandwidth load data of the logical aggregation channel is obtained to determine the optimal routing path, and then a static VLAN interface routing policy is generated. In this process, the bandwidth load data of the logical aggregation channel is collected, that is, the real-time bandwidth utilization of each aggregation channel. Based on these data, the system will calculate the optimal routing path to ensure that data traffic can pass through the network in the most efficient way. The generated static VLAN interface routing policy will be set according to these optimal paths to ensure the balanced distribution of network traffic, improve data transmission efficiency and network stability. This routing policy optimizes the resource usage of the network, reduces latency, and enhances network performance.

[0051] In this embodiment, calculating the optimal routing path includes: First, collect the counter data of the logical aggregation channel (such as ifHCInOctets and ifHCOutOctets) every 250ms through the SNMP protocol, and obtain the real-time throughput of each channel in combination with the OpenFlow port statistics extension (`OFPST_PORT_STATS`) of the SDN controller. Then use the EWMA (Exponentially Weighted Moving Average) algorithm to smooth the instantaneous fluctuations and calculate the bandwidth utilization rate of each aggregation channel (obtained as a percentage according to `(actual traffic / theoretical bandwidth) × 100%`). Subsequently, the routing engine runs the improved Dijkstra algorithm, introduces the bandwidth utilization rate as a dynamic weight factor when calculating the shortest path (for example, the link weight with a utilization rate above 80% is automatically multiplied by 1.5), and combines the preset QoS policy (such as VoIP traffic is forced to avoid links with a utilization rate > 70%). Finally, generate a static VLAN routing entry (including the next-hop port, Cost value, and traffic shaping parameters), and send it to the switch hardware forwarding table through the NETCONF protocol to achieve load balancing and low-latency transmission.

[0052] The beneficial effects of the above technical solution: Optimize the routing management of the high-speed ship redundant network communication equipment through the intelligent routing control module. The topology construction unit constructs a network topology diagram including terminal nodes, switching nodes, and logical aggregation channels by identifying the connection relationship between terminals and switching devices, and generates a network topology relationship matrix. The mapping resolution unit and the topology resolution unit determine the terminal-switching unit and divide the security domain according to the mapping table and the topology matrix. The policy generation unit determines the optimal routing path based on the bandwidth load data and generates a static VLAN interface routing policy, which improves network performance, reliability, and security, and ensures efficient and secure data transmission.

[0053] Embodiment 6: An embodiment of the present invention provides a high-speed ship redundant network communication device, a security protection execution module, including: Policy matching unit: Based on the static VLAN interface routing policy, extract the VLAN ID and corresponding routing path of each terminal-switch group, and combine with the LACP port priority mapping table to perform channel security level matching, generating a VLAN-channel security binding table; Mechanism implementation unit: Based on the VLAN-channel security binding table, implement the security triple mechanism on the logical aggregation channel.

[0054] In this embodiment, based on the static VLAN interface routing policy, extracting the VLAN ID and corresponding routing path of each terminal-switch group includes: Automatically discovering the switch ports connected by terminal devices through the LLDP protocol, and assigning VLAN IDs to each terminal according to the preset VLAN policy library (including port-VLAN matching rules, such as based on MAC OUI or 802.1X authentication results); Subsequently, query the static routing table, extract the outgoing port, next-hop IP and path cost corresponding to this VLAN ID (based on OSPF cost or administrator manual weight), generate a routing tuple of the terminal-switch group (format: <terminal IP, switch port, VLAN ID, next-hop, path cost>), and finally write the tuple into the flow table of the switch through the Open vSwitch database (OVSDB) protocol, and at the same time set ACL rules to limit cross-VLAN access permissions to achieve policy-based routing; In this embodiment, the security level matching includes: Forcing high-security-level VLANs to be bound to the main logical aggregation channel (AGG1), and dynamically allocating medium and low-security-level VLANs (such as the monitoring system VLAN 201) to the backup channel (AGG2).

[0055] In this embodiment, implementing the security triple mechanism on the logical aggregation channel: Adopting triple encryption (SM4 + IPSec + quantum key distribution) for the main channel AGG1, enabling dual encryption (SM4 + IPSec) for the backup channel AGG2, and dynamically adjusting the encryption level according to the link status data of the real-time monitoring module (such as when the packet loss rate of the AGG2 channel > 5%, upgrading to triple encryption).

[0056] Beneficial effects of the above technical solutions: Enhance the security of the redundant network communication equipment of high-speed boats through the security protection execution module. The policy matching unit generates a VLAN-channel security binding table for each terminal-switch group according to the static VLAN interface routing policy and the LACP port priority mapping table to ensure that the security level of the channel matches the routing policy. The mechanism implementation unit implements the security triple mechanism on the logical aggregation channel based on this binding table, further strengthening the security and protection capabilities of data transmission, effectively improving the network security, and preventing potential security risks.

[0057] Example 7: An embodiment of the present invention provides a redundant network communication device for high-speed ships. The real-time monitoring module includes: Link status acquisition unit: Poll and detect the optical power, bit error rate, and bandwidth occupancy ratio data of each optical fiber in the logical aggregation channel based on the LACP port priority mapping table, compare with the baseline test results to determine the deviation degree, and generate a real-time link health score table; Terminal access status acquisition unit: Based on the terminal-switch mapping table, monitor the dual-homed access status of each user terminal network card, synchronously obtain the encryption policy execution logs in the VLAN-channel security binding table, and integrate and generate a terminal security behavior matrix; Security event spatio-temporal correlation unit: Perform spatio-temporal matching on the link health score table, the terminal security behavior matrix, and the static VLAN interface routing policy of the intelligent routing control module, and then generate a security event warning report.

[0058] In this embodiment, the link status acquisition unit polls the optical fiber parameters in the logical aggregation channel at intervals of 2 seconds through the LACP protocol priority table (such as port priority 0-65535) (the optical power is obtained through the optoelectronic sensor of the SFP-DD module, and the bit error rate is statistically based on the CRC error count), compares with the pre-established baseline data (such as the standard optical power range of -8dBm to +2dBm, and the bit error rate threshold of 1E-12), calculates the dynamic deviation degree (formula: |real-time value - baseline median| / baseline allowable fluctuation range × 100%), and finally generates a link health score graded from 0 to 100 (such as a score <60 triggers a warning). The score table includes the port ID, health score, and abnormal parameter type.

[0059] In this embodiment, the terminal access status acquisition unit includes: Scanning the terminal-switch mapping table (recording the terminal MAC, connection port, and dual-network card binding status), verifying the terminal compliance in combination with the VLAN-security binding table (such as the key rotation record of the AES-256 encryption policy), analyzing the terminal traffic behavior through NetFlow / sFlow logs (such as access attempts to unbound VLANs), generating a terminal security behavior matrix (dimensions include: access authentication result, encryption compliance, traffic anomaly index), and storing the matrix data in JSON format and associating the terminal IP with the switch port identifier.

[0060] In this embodiment, the spatio-temporal correlation unit for security events includes: The correlation engine aligns the link health score table, the terminal behavior matrix, and the static VLAN routing policy (such as VLANs with path cost > 50 or unmatched encryption policies) based on timestamps, and uses a sliding time window (such as 5 minutes) to detect spatio-temporal anomalies (for example, when the optical power of a certain VLAN path drops suddenly by 10 dBm, unencrypted traffic appears in the terminal matrix during the same period), generates a security alert report (including event ID, associated device list, risk level, and handling suggestions), and pushes it to the operation and maintenance platform in real time through WebHook, triggering an automated script to isolate the abnormal port or switch to the backup channel.

[0061] Beneficial effects of the above technical solution: The monitoring ability of the redundant network communication equipment of high-speed ships is improved through the real-time monitoring module. The link status acquisition unit regularly detects the optical power, bit error rate, and bandwidth occupancy ratio of the optical fiber link, and generates a real-time link health score table to help monitor the link health. The terminal access status acquisition unit monitors the terminal access status and integrates security behavior data to generate a terminal security behavior matrix. The spatio-temporal correlation unit for security events matches the link health data, terminal security behavior, and routing policy to generate a security event alert report, thereby realizing real-time security monitoring and anomaly warning of the network, and improving the stability and security of the system.

[0062] Embodiment 8: The embodiment of the present invention provides a redundant network communication device for high-speed ships, and preset types of abnormal data, including: aggregated link abnormal data, terminal access abnormal data, and security event abnormal data.

[0063] Beneficial effects of the above technical solution: The fault detection and warning ability of the redundant network communication equipment of high-speed ships is improved through preset types of abnormal data. The aggregated link abnormal data monitors the change of the link state, the terminal access abnormal data monitors the terminal access problem, and the security event abnormal data focuses on network security events. By collecting and analyzing these data in real time, the system can quickly identify potential faults and security risks, and take measures in time to ensure the stable and secure operation of the network, thereby improving the reliability of the equipment and the protection ability of the network.

[0064] Embodiment 9: The embodiment of the present invention provides a redundant network communication device for high-speed ships, and the link aggregation protocol unit includes: Determine the LACP priority of each optical fiber based on the baseline test results, where the baseline test results include the initial performance data of each optical fiber: Among them, are weight coefficients, respectively representing the influence weights of optical power, bit error rate, and stability, is the allowable deviation threshold of optical power; is the normalization scaling factor, is the basic priority, is the optical power deviation from the nominal value, is the proportion of bit error rate, is the stability degradation value, is the average value of historical stability, is the preset standard stability, is the current optical power, is the preset optical power, is the current bit error rate, is the preset maximum allowable bit error rate.

[0065] In this embodiment, the initial performance data includes: current optical power, current bit error rate, and historical stability.

[0066] In this embodiment, is the weight coefficient (default values are 0.5, 0.3, and 0.2 respectively) used to control the influence of optical power, bit error rate, and stability. The sum of the three should be 1; it reflects the influence degree of different indicators on the reliability of the optical fiber: Optical power: directly affects the signal transmission intensity and is the most direct indicator for judging the physical state of the optical fiber, with the highest weight (50%). Bit error rate: reflects the stability of signal transmission but may be affected by instantaneous interference (such as electromagnetic pulses), with the second highest weight (30%). Historical stability: reflects the long-term reliability of the optical fiber but is an indirect indicator (it may mask sudden failures), with the lowest weight (20%). Supported by industry standards and experimental data, IEEE 802.3 (Ethernet physical layer standard): The contribution rate of optical power deviation to link failure is about 1.67 times that of the bit error rate, α / β≈0.5 / 0.3≈1.67, which is consistent with the failure statistics of common optical modules. ITU-T G.977 (Optical fiber network performance baseline): It is recommended that in the dynamic routing algorithm, the sum of the weights of real-time performance indicators (optical power, bit error rate) is not less than 80%, and the weight of historical data does not exceed 20%. For the robustness requirements of actual deployment, high-speed ships may face strong electromagnetic interference or physical vibration. The instantaneous fluctuation of optical power (dominated by α) can more quickly reflect link anomalies than the long-term bit error rate (dominated by β), preventing misjudgment: If the weight of the bit error rate is too high (such as β>0.5), the priority may oscillate frequently due to instantaneous noise; while if the historical stability is too high (such as γ>0.3), the response to sudden failures will be delayed.

[0067] In this embodiment, the typical value of the allowable deviation threshold of optical power is ±3 dBm. Technical basis for the default value of ±3dBm: Optical module industry standards (ITU-T G.957 / G.977): The allowable optical power fluctuation range of typical SFP / SFP+ optical modules is ±3 dBm (for example, at a nominal value of -18 dBm, the compliance range is -15 dBm~-21 dBm); exceeding this range is regarded as severe degradation (which may damage optical devices); In this embodiment, It is used to calculate the penalty term for the degradation of the link stability. Here, S represents the actual measured average value of the historical stability (for example, the link availability rate in the past 30 days. If S = 0.98, it means 98% availability); S1 represents the preset standard stability (if S1 = 0.95, it means the expected minimum allowable availability rate is 95%); the numerator (1 - S) represents the degree of actual deviation from perfect stability. If S = 1 (historical 100% stability), 1 - S = 0 → no penalty, and the link is optimal; if S = 0.9 (historical 90% stability), 1 - S = 0.1 → there is a 10% instability penalty. The denominator S1 is used to normalize to the standard stability. By comparing the actual penalty (1 - S) with the preset standard S1, the relative degradation ratio is obtained: if S < S1 (the actual is worse than the standard), → the penalty value is amplified; if S ≥ S1 (the actual reaches or exceeds the standard), → usually set to zero (no penalty is counted).

[0068] In this embodiment, the default value of the normalization scaling factor is 10000, which is used to map the calculation result to the actual LACP priority range. The determination basis of the default value 10000: According to the IEEE 802.1AX standard, the LACP priority is a 16-bit unsigned integer (0 - 65535), and it is necessary to avoid the overflow of the calculation result. The theoretical maximum value of the weighted sum in the formula (assuming that all indicators degrade to the limit) (α + β + γ = 1). If directly multiplied by 65535, it may cause the priority to be too concentrated in the high numerical range (such as all the priorities of the degraded links are 65535), losing the discrimination. The scaling factor K = 10000 ensures the result of the weighted sum. Combining with BasePriority = 32768, the final priority range is 32768 - 42768, realizing the conflict-free coexistence of dynamic priority and static configuration; In this embodiment, the default value of the base priority is 32768, which is used for the benchmark configuration of different ports. The reason for setting the default value 32768: The LACP priority space is divided as follows: Static priority (manually configured): Usually use 0 - 32767 (the lower half of the 16-bit value); Dynamic priority (generated by the algorithm): Occupies 32768 - 65535 (the upper half), to avoid conflicts with static configurations. Protocol compatibility: RFC 7431 (BGP Link Aggregation Optimization) recommends that the dynamic priority should be higher than the static configuration. 32768 is the identification value of the highest bit (1000000000000000) in binary.

[0069] Beneficial effects of the above technical solution: Optimize the optical fiber link management of the redundant network communication equipment of high-speed ships through the link aggregation protocol unit. Based on the baseline test results, the LACP priority of each optical fiber is determined by comprehensively considering performance data such as optical power, bit error rate, and stability. The weight coefficient is used to adjust the influence of each performance factor to ensure the dynamic adjustment of the priority, optimize the stability and reliability of the link, effectively improve the fault tolerance ability of the link, and ensure the efficient and stable operation of the network.

[0070] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments or equivalently replace some of the technical features; and these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A redundant network communication device for a high-speed ship, characterized in that, including: Redundant Link Aggregation Module: Interconnect network switching devices through a preset number of optical fibers to form a stacking system, and enable the LACP protocol to bind the preset number of optical fibers into a logical aggregation channel; Dual-Homed Terminal Access Module: Based on the logical aggregation channel and the stacking system, configure network cards for each user terminal and connect them to the network switching device respectively to obtain a dual-homed access channel; Intelligent Routing Control Module: Generate a network topology diagram based on the physical connection relationship between all user terminals and the network switching device, and generate a static VLAN interface routing policy based on the network topology diagram; Security Protection Execution Module: Implement the security triple mechanism on the logical aggregation channel based on the static VLAN interface routing policy.

2. The redundant network communication device for a high-speed ship according to claim 1, characterized in that, It also includes: Real-Time Monitoring Module: Real-time collect and correlatively analyze the status data of the link aggregation layer, the status data of the terminal access layer, and the events of the security protection layer; Intelligent Response Module: Determine abnormal data based on the correlative analysis result, match the abnormal data with the preset types of abnormal data, and determine whether to trigger the control plane topology reconstruction based on the matching result.

3. The redundant network communication device for a high-speed ship according to claim 1, wherein, The redundant link aggregation module includes: Device Interconnection Unit: Interconnect network switching devices through a preset number of optical fibers and enable the stacking protocol to generate a stacking system topology table; Optical Fiber Quality Detection Unit: Detect the connectivity status of all physical optical fibers based on the stacking system topology table, and perform baseline tests on the optical power and bit error rate of each optical fiber to obtain the baseline test results; Link Aggregation Protocol Unit: Determine the LACP priority of each optical fiber based on the baseline test results; Bandwidth Allocation Unit: When there is a fiber interruption in the independent optical fibers, allocate the bandwidth of the interrupted fiber to the remaining fibers according to the preset ratio according to the LACP priority; Mapping Determination Unit: Determine the primary and standby aggregation member ports based on the LACP priorities of all optical fibers, and generate an LACP port priority mapping table; Channel Aggregation Unit: Bind all optical fibers into a logical aggregation channel based on the LACP port priority mapping table, the bandwidth of all optical fibers, and the preset standard.

4. The redundant network communication device for a high-speed ship according to claim 3, wherein, The dual-homed terminal access module includes: Terminal Connection Unit: Deploy physical network cards for each user terminal based on the stacking system topology table and connect them to the network switching device respectively, and then generate a terminal-switch mapping table; Channel Configuration Unit: Allocate an aggregation channel ID to each network card based on the logical aggregation channel and the terminal-switch mapping table, and then update the user terminal configuration to a dual-homed access channel.

5. The redundant network communication device for a high-speed ship according to claim 4, characterized in that, The intelligent routing control module includes: Topology Construction Unit: Based on the terminal-switch mapping table and the stacking system topology table, identify the physical connection relationship between all user terminals and the network switching device, and construct a network topology diagram including terminal nodes, switching nodes, and logical aggregation channels, where the network topology diagram stores the connection status and channel attributes between nodes in the form of a three-dimensional matrix, and generate a network topology relationship matrix; Mapping Resolution Unit: Determine several terminal-switch groups based on the terminal-switch mapping table; Topology Resolution Unit: Divide the security domain according to the preset network isolation standard based on the network topology relationship matrix, and allocate an independent VLAN ID to each terminal-switch group; Policy Generation Unit: Obtain the bandwidth load data of the logical aggregation channel to determine the optimal routing path, and then generate a static VLAN interface routing policy.

6. The redundant network communication device for a high-speed ship according to claim 5, characterized in that, Security Protection Execution Module, including: Policy Matching Unit: Based on the static VLAN interface routing policy, extract the VLAN ID and corresponding routing path of each terminal-switch group, combine with the LACP port priority mapping table for channel security level matching, and generate a VLAN-channel security binding table; Mechanism Implementation Unit: Based on the VLAN-channel security binding table, implement the security triple mechanism on the logical aggregation channel.

7. The redundant network communication device for a high-speed ship according to claim 2, characterized in that Real-time Monitoring Module, including: Link Status Acquisition Unit: Based on the LACP port priority mapping table, poll and detect the optical power, bit error rate, and bandwidth occupancy data of each optical fiber in the logical aggregation channel, compare with the baseline test results to determine the deviation degree, and generate a real-time link health score table; Terminal Access Status Acquisition Unit: Based on the terminal-switch mapping table, monitor the dual-homed access status of each user terminal network card, synchronously obtain the encryption policy execution log in the VLAN-channel security binding table, and integrate to generate a terminal security behavior matrix; Security Event Spatiotemporal Association Unit: Perform spatiotemporal matching on the link health score table, terminal security behavior matrix, and the static VLAN interface routing policy of the intelligent routing control module, and then generate a security event alarm report.

8. A redundant network communication device for a high-speed ship according to claim 2, characterized in that, Abnormal data of preset types, including: aggregated link abnormal data, terminal access abnormal data, and security event abnormal data.

9. The redundant network communication device for a high-speed ship according to claim 3, characterized in that Link Aggregation Protocol Unit, including: Determine the LACP priority of each optical fiber based on the baseline test results, where the baseline test results include the initial performance data of each optical fiber: Among them, is the LACP priority of the optical fiber, is the weight coefficient, respectively representing the influence weights of optical power, bit error rate, and stability, is the allowable deviation threshold of optical power; is the normalization scaling factor, is the basic priority, is the deviation of optical power from the nominal value, is the proportion of bit error rate, is the degradation value of stability, is the average value of historical stability, is the preset standard stability, is the current optical power, is the preset optical power, is the current bit error rate, is the preset maximum allowable bit error rate.

Images