A multi-protocol fusion VPN communication method and system based on dynamic tunnel switching

Abstract

The application discloses a kind of multi-protocol fusion VPN communication method and system based on dynamic tunnel switching, it is related to computer network communication technical field, the method is by setting acquisition point in VPN entrance and export respectively, using time synchronization timer, data packet capture probe and protocol analysis tool, accurately collect control instruction time delay Delayctrl, control instruction packet loss rate Lossctrl, burst packet loss rate Burstloss And ordinary flow delay variance VarDelaydata, and introduce priority label in VPN protocol encapsulation layer, control instruction data stream is marked as first priority and is bound to fast switching tunnel, ordinary monitoring data stream is marked as second priority and is bound to conventional tunnel, the differentiated transmission guarantee of different types of flow is realized.This mode can ensure that key control instruction is not disturbed by ordinary flow in network fluctuation or tunnel switching process after optimization, significantly improve the real-time performance and transmission reliability of control instruction.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer network communication, in particular to a multi-protocol fusion VPN communication method and system based on dynamic tunnel switching. BACKGROUND

[0002] VPN technology belongs to the field of computer network communication, and is an important means for establishing an encrypted tunnel on a public network to ensure data transmission security and privacy. With the wide application of information technology in industrial internet, intelligent manufacturing and internet of things scenarios, VPN has not only taken on the traditional remote access function, but has gradually expanded to become a key infrastructure supporting real-time communication and remote monitoring of industrial control systems. In the intelligent factory environment, a large number of internet of things terminal devices, such as PLC controllers, sensors, actuators, etc., need to transmit control instructions and monitoring data through VPN tunnels, thereby putting forward higher requirements for VPN in terms of real-time performance and stability.

[0003] In the existing VPN communication mode, control instruction traffic and ordinary monitoring data traffic usually share the same tunnel and adopt a unified tunnel switching strategy. This "one-size-fits-all" approach has obvious shortcomings in the face of complex network fluctuations: when the VPN tunnel switches or is interrupted, all traffic is treated the same, resulting in high-priority control instructions being delayed or even lost along with ordinary data. In the context of an intelligent factory, control instructions are extremely sensitive to latency, and once packet loss or delay occurs during the switching process, it may cause device action errors or loss of synchronization, resulting in a decrease in system reliability. Existing VPN technology does not differentiate between different types of traffic and lacks mechanisms for priority labels and fast tunnel switching.

[0004] The above shortcomings mainly result from the fact that traditional VPN architecture design is biased towards ensuring uniform encrypted transmission security, while ignoring the differences in real-time performance and reliability between business flows. Once the network environment fluctuates, such as sudden packet loss, link latency anomalies or increased jitter, VPN treats all traffic the same when switching. This not only causes critical control instruction traffic and ordinary monitoring data traffic to suffer the same loss or delay during switching, but also may cause serious consequences in industrial scenarios, such as production line stoppage, robot action out of control, device safety protection triggering and other abnormal events. In the long term, this VPN switching method that lacks differentiated protection will significantly increase the complexity and risk of industrial system operation and maintenance, and cannot meet the needs of new-generation industrial internet for high-reliability, low-latency communication. SUMMARY

[0005] In view of the shortcomings of the prior art, the present application provides a multi-protocol fusion VPN communication method and system based on dynamic tunnel switching, which solves the problems mentioned in the background art.

[0006] To achieve the above object, the present application is implemented by the following technical solutions: comprising the following steps:

[0007] S1, setting collection points at the VPN entrance and exit, collecting communication data sets, and adding priority labels to different flows at the VPN protocol encapsulation layer to form differentiated channels of control instruction data flow and ordinary monitoring data flow, while performing data preprocessing operations to obtain a communication feature vector set;

[0008] S2, based on the communication feature vector set, calculating the control flow reliability score Qctrl, and according to the control flow reliability score Qctrl, classifying the tunnel running state, and based on the classification result, triggering a dynamic hierarchical protocol switching mechanism; and calculating the adjusted comprehensive score Qadj, and determining the tunnel switching mechanism according to the adjusted comprehensive score Qadj;

[0009] S3, when determining to execute tunnel switching, starting a tunnel redundancy checking mechanism, transmitting control instruction data flow through the main tunnel and standby tunnel in parallel, and executing a feedback mechanism after switching is completed.

[0010] Preferably, the S1 comprises S11;

[0011] S11, setting collection points at the VPN entrance and exit, and setting collection instructions, collection devices and collection tools for the collection points, and collecting communication data sets in real time;

[0012] The collection points include entrance collection points and exit collection points; wherein the entrance collection points are set at the VPN access end, and the exit collection points are set at the VPN exit end;

[0013] The collection instructions include control monitoring instructions and ordinary monitoring instructions;

[0014] The control monitoring instructions include time delay detection instructions, packet loss detection instructions and burst packet loss detection instructions;

[0015] The ordinary monitoring instructions include delay variance detection instructions;

[0016] The collection devices include time synchronization timers, data packet capture probes and protocol analysis tools;

[0017] The collection tools include Internet of Things data collection programs;

[0018] The communication data set includes control instruction time delay Delayctrl, control instruction packet loss rate Lossctrl, burst packet loss rate Burstloss and ordinary flow delay variance VarDelaydata.

[0019] Preferably, the S1 further comprises S12;

[0020] S12, the encapsulation layer at the VPN entrance analyzes and classifies all the data packets entering the VPN, which includes protocol identification, label generation and tunnel allocation;

[0021] The protocol identification distinguishes control instruction data stream from ordinary monitoring data stream by analyzing the data packet header field;

[0022] The label generation adds a first priority label to the control instruction data stream of the control instruction in the VPN encapsulation layer, and adds a second priority label to the ordinary monitoring data stream of the ordinary monitoring instruction; wherein the first priority label > the second priority label;

[0023] The tunnel allocation binds the traffic marked with the first priority label to the fast switching tunnel, and binds the traffic marked with the second priority label to the regular tunnel.

[0024] Preferably, the S1 further comprises S13;

[0025] S13, after analysis and classification, the data preprocessing operation is performed on the control instruction data stream of the first priority label before entering the fast switching tunnel;

[0026] The data preprocessing operation includes dimensionless processing of the communication data set, which uniformly maps different dimension parameters to the interval [0, 1] to eliminate the dimension difference;

[0027] The dimensionless processed communication data set is attached with a time stamp and a check code, and is transmitted to the VPN data processing platform through an independent special control channel;

[0028] In the VPN data processing platform, the control instruction delay Delayctrl and the control instruction packet loss rate Lossctrl of the first priority label are filtered by a sliding time window to eliminate sampling noise, and the burst loss rate Burstloss is extracted to identify abnormal packet loss mode, while the ordinary traffic delay variance VarDelaydata is standardized to optimize the deviation between different parameters, and the data preprocessing operation result is constructed as a communication feature vector set.

[0029] Preferably, the S2 comprises S21;

[0030] S21, based on the dimensionless processed communication feature vector set, the control instruction delay Delayctrl, the control instruction packet loss rate Lossctrl and the burst loss rate Burstloss are extracted, combined to construct a weighted formula, and the output control traffic reliability score Qctrl is calculated to quantitatively analyze the end-to-end transmission characteristics of the control traffic;

[0031] The control traffic reliability score Qctrl is calculated by the following algorithm formula:

[0032] .

[0033] Preferably, the S2 further comprises S22;

[0034] S22: Based on the control traffic reliability score Qctrl, the level of the tunnel running state is divided; the specific division is as follows:

[0035] When the control traffic reliability score Qctrl is greater than or equal to 0.8, it is divided into Level-0, and the existing tunnel running is maintained;

[0036] When 0.5 is less than the control traffic reliability score Qctrl, it is divided into Level-1, and a standby tunnel preheating mechanism is triggered to make the standby tunnel complete handshake and link detection in advance;

[0037] When the control traffic reliability score Qctrl is less than 0.5, it is divided into Level-2, and a dynamic hierarchical protocol switching mechanism is triggered.

[0038] Preferably, the S2 further comprises S23;

[0039] S23: When the tunnel running state is divided into Level-2, a dynamic hierarchical protocol switching mechanism is triggered, and the dynamic hierarchical protocol switching mechanism comprises a tunnel preheating mechanism, a redundancy checking mechanism, a dynamic hybrid protocol mechanism, and a jitter prevention mechanism;

[0040] Before executing the switching, the tunnel preheating mechanism is enabled to complete handshake and link detection in advance through the standby tunnel before the switching;

[0041] When executing the switching, the redundancy checking mechanism is enabled to transmit the control traffic marked with a first priority label in parallel through the main tunnel and the standby tunnel;

[0042] In the switching execution, the dynamic hybrid protocol mechanism is enabled to make the control traffic of the first priority label preferentially pass through the UDP type protocol, and the ordinary traffic of the second priority label pass through the TCP type protocol;

[0043] The jitter prevention mechanism is enabled to delay triggering if the score repeatedly fluctuates within a certain time window without immediately switching;

[0044] In the switching decision process, based on the control traffic reliability score Qctrl combined with the ordinary traffic delay variance VarDelaydata, an adjusted comprehensive score Qadj is calculated and output, and the control traffic reliability score Qctrl is adjusted again.

[0045] Preferably, S2 comprises S24;

[0046] S24, based on the output value of the adjusted comprehensive score Qadj, performs comparative evaluation to determine the tunnel switching mechanism. The specific comparative evaluation content is as follows:

[0047] When the adjusted comprehensive score Qadj is less than 0.6, the tunnel switching process is triggered immediately, and the redundancy verification mechanism and the dynamic hybrid protocol mechanism are enabled;

[0048] When the adjusted comprehensive score Qadj is greater than or equal to 0.6, the standby tunnel is kept in a preheating state, and the anti-shake mechanism is triggered to delay switching.

[0049] Preferably, S3 comprises S31;

[0050] S31, when the tunnel switching is performed and the tunnel redundancy verification mechanism is started, the control instruction flow marked with the first priority label is simultaneously encapsulated and transmitted in parallel in the main tunnel and the standby tunnel. The data packets of the parallel transmission are verified for integrity by time stamp comparison and verification code checking at the exit node. After the tunnel switching is completed, the communication feature vector set is re-collected, the new control flow reliability score Qctrl-new after switching is calculated, and compared with the control flow reliability score Qctrl before switching;

[0051] When the new control flow reliability score Qctrl-new is greater than the control flow reliability score Qctrl, it is determined that the tunnel switching optimization is successful, and the current switching strategy is maintained to continue running;

[0052] When the new control flow reliability score Qctrl-new is less than or equal to the control flow reliability score Qctrl, the rollback logic is triggered, the control flow of the first priority label is rolled back to the main tunnel before switching, and the cross-protocol camouflage strategy is enabled. The cross-protocol camouflage strategy camouflages the control flow as a normal data stream at the VPN encapsulation layer.

[0053] A multi-protocol fusion VPN communication system based on dynamic tunnel switching, comprising a communication detection module, a reliability analysis module and a switching strategy module;

[0054] The communication detection module sets collection points at the VPN entrance and exit, collects communication data sets, adds priority labels to different flows at the VPN protocol encapsulation layer, forms differentiated channels for control instruction data streams and normal monitoring data streams, and performs data preprocessing operations to obtain communication feature vector sets;

[0055] The reliability analysis module calculates the control traffic reliability score Qctrl based on the communication feature vector set, classifies the tunnel operation state according to the control traffic reliability score Qctrl, and triggers a dynamic hierarchical protocol switching mechanism based on the classification result; and calculates the adjusted comprehensive score Qadj, and determines the tunnel switching mechanism according to the adjusted comprehensive score Qadj;

[0056] The switching strategy module starts a tunnel redundancy checking mechanism when it is determined to perform tunnel switching, simultaneously transmits control instruction data streams through the main tunnel and the standby tunnel in parallel, and executes a feedback mechanism after switching is completed.

[0057] The application provides a multi-protocol fusion VPN communication method and system based on dynamic tunnel switching.

[0058] (1) The method sets acquisition points at the VPN inlet and outlet, respectively, uses a time synchronization timer, a data packet capture probe and a protocol analysis tool to accurately collect control instruction delay Delayctrl, control instruction packet loss rate Lossctrl, burst packet loss rate Burstloss and ordinary traffic delay variance VarDelaydata, introduces a priority label in the VPN protocol encapsulation layer, marks the control instruction data stream as the first priority and binds it to the fast switching tunnel, marks the ordinary monitoring data stream as the second priority and binds it to the regular tunnel, and realizes differentiated transmission protection of different types of traffic. After optimization, this method can ensure that critical control instructions are not disturbed by ordinary traffic during network fluctuations or tunnel switching, significantly improving the real-time performance and transmission reliability of control instructions.

[0059] (2) The method constructs a control traffic reliability score Qctrl formula based on the collected communication feature vector set, classifies the score results, realizes dynamic perception of the tunnel operation state, triggers the standby tunnel preheating mechanism in advance when the score result enters the early warning level to shorten the switching delay, and further calculates the adjusted comprehensive score Qadj when the score result enters the high-risk level to introduce the ordinary traffic delay variance VarDelaydata for secondary correction of the control traffic reliability. After optimization, this mechanism can avoid excessive switching or misjudgment caused by relying only on control instruction indicators, ensure the accuracy and stability of switching decisions, and improve the adaptability of VPN in complex industrial environments.

[0060] (3) The method starts the tunnel redundancy checking mechanism when it is determined to perform tunnel switching, and transmits the control instruction data stream of the first priority label through the main tunnel and the standby tunnel in parallel, performs integrity verification through the time stamp and the check code at the exit node, and ensures zero loss in the switching process. After the switching is completed, the new control flow reliability score Qctrl-new after the switching is calculated, and compared with the control flow reliability score Qctrl before the switching, to realize feedback evaluation of the switching effect. When the switching result is not ideal, the control flow is returned to the main tunnel through the trigger rollback logic, and the cross-protocol camouflage strategy is enabled to camouflage the control flow as a normal data stream at the encapsulation layer, to ensure continuous transmission in the rollback process. The optimization mechanism can ensure the safety and robustness of the whole process of tunnel switching, and further improve the continuity and stability of communication in the industrial control scene. BRIEF DESCRIPTION OF DRAWINGS

[0061] Figure 1 A step schematic diagram of a multi-protocol fusion VPN communication method based on dynamic tunnel switching is provided.

[0062] Figure 2 A module block diagram of a multi-protocol fusion VPN communication system based on dynamic tunnel switching is provided.

[0063] Figure 3 A data acquisition point arrangement schematic diagram is provided. DETAILED DESCRIPTION

[0064] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0065] Embodiment 1, please refer to Figure 1 The present application provides a multi-protocol fusion VPN communication method based on dynamic tunnel switching. To achieve the above purpose, the present application is implemented through the following technical solutions: comprising the following steps:

[0066] S1, setting acquisition points at the VPN entrance and exit, collecting communication data sets, and adding priority labels to different flows at the VPN protocol encapsulation layer to form differentiated channels of control instruction data streams and normal monitoring data streams, and performing data preprocessing operations to obtain a communication feature vector set;

[0067] S2, based on the communication feature vector set, the control traffic reliability score Qctrl is calculated, and the tunnel operation state is classified according to the control traffic reliability score Qctrl, and based on the classification result, a dynamic classification protocol switching mechanism is triggered; and the adjusted comprehensive score Qadj is calculated, and the tunnel switching mechanism is determined according to the adjusted comprehensive score Qadj;

[0068] S3, when it is determined to execute tunnel switching, a tunnel redundancy checking mechanism is started, the control instruction data stream is transmitted through the main tunnel and the standby tunnel in parallel, and a feedback mechanism is executed after the switching is completed.

[0069] In this embodiment, the method sets collection points at the VPN entry and exit, collects communication data sets in real time, and adds priority labels to different flows in the encapsulation layer of the VPN protocol, thereby forming differentiated channels for control instruction data flow and ordinary monitoring data flow. Such a design is because in a tunnel communication environment, if all data is transmitted in the same channel, once a burst congestion or delay occurs, it may cause the delay or even loss of control instruction data flow, thereby directly affecting the stability of the VPN tunnel. Through the setting of differentiated channels, the control instruction data flow can be ensured to obtain higher priority scheduling and transmission, thereby ensuring that the key control flow still has higher timeliness and reliability in a complex network environment. In step S2, the control flow reliability score Qctrl is calculated based on the extracted communication feature vector set, and the tunnel running state is classified according to the control flow reliability score Qctrl. Such classification can realize hierarchical monitoring and quantitative analysis of the tunnel running state, and can realize real-time monitoring of the tunnel in normal, mild abnormal or serious abnormal running state. If there is no level division, the system can only judge the tunnel condition with a fixed threshold, which is easy to cause early or late switching problems, resulting in unnecessary resource consumption or communication interruption. Through the dynamic grading method, the grading switching mechanism of the protocol can be triggered, and the adjusted comprehensive score Qadj is calculated, so that the tunnel switching mechanism is more in line with the actual running state, thereby avoiding misjudgment and excessive switching problems. In step S3, when it is determined to perform tunnel switching, the tunnel redundancy verification mechanism is started, the control instruction data flow is transmitted through the main tunnel and the standby tunnel in parallel, and the feedback mechanism is executed after the switching is completed. Such a mechanism is because in the tunnel switching process, if only a single path is relied on, it is easy to cause instantaneous interruption of instruction transmission, resulting in loss of key control information, and further causing switching failure. Through parallel redundant transmission, even if the main tunnel is interrupted at the switching moment, the standby tunnel can still carry the control instruction, ensuring that the control plane information is not interrupted, and physically improving the continuity and reliability of instruction transmission. The feedback mechanism further ensures that the state of the new tunnel after switching can be confirmed in time, avoiding secondary switching caused by unstable tunnels. In summary, the implementation process combines the differentiated channel design, the level division based on the control flow reliability score Qctrl, the dynamic switching mechanism, and the tunnel redundancy verification mechanism, which not only guarantees the high-priority transmission of key control instructions, but also realizes the fine monitoring and dynamic adjustment of the tunnel running state, and finally effectively improves the stability, reliability and real-time performance of the VPN tunnel switching, avoids the tunnel interruption problem caused by the delay or loss of control flow, and improves the fault tolerance and service continuity of the overall network.

[0070] Embodiment 2, please refer to Figure 1 and Figure 3 , specifically: S1 includes S11;

[0071] S11, setting collection points at the VPN entry and exit, and setting collection instructions, collection devices and collection tools for the collection points, and collecting communication data sets in real time;

[0072] The collection points include entry collection points and exit collection points; the entry collection points are set at the VPN access end for detecting the original traffic state before entering the VPN, and the exit collection points are set at the VPN exit end for detecting the traffic state after transmission through the VPN;

[0073] The collection instructions include control monitoring instructions and ordinary monitoring instructions;

[0074] The control monitoring instructions include time delay detection instructions, packet loss detection instructions and burst packet loss detection instructions;

[0075] The ordinary monitoring instructions include delay variance detection instructions;

[0076] The collection devices include time synchronization timers, data packet capture probes and protocol analysis tools;

[0077] The collection tools include Internet of Things data collection programs for recording and uploading sampling results;

[0078] The communication data sets include control instruction time delay Delayctrl, control instruction packet loss rate Lossctrl, burst packet loss rate Burstloss and ordinary traffic delay variance VarDelaydata;

[0079] The collection method includes setting collection points at the entry and exit of the VPN tunnel, respectively, and using time synchronization timers to ensure that the clocks of the two collection points are consistent to provide accurate time reference; through data packet capture probes, all data packets entering and leaving the VPN tunnel are obtained in real time, and then combined with the protocol analysis tools, the messages are deeply analyzed to distinguish control instructions and ordinary monitoring instructions; on this basis, the control instruction time delay Delayctrl is obtained by recording the time stamps of the same message at the entry collection point and the exit collection point and calculating the difference; the control instruction packet loss rate Lossctrl is obtained by comparing the number of messages sent at the entry with the number of messages received at the exit; the burst packet loss rate Burstloss is obtained by counting the proportion of the number of continuously lost messages in the total number of messages within a preset time window; the ordinary traffic delay variance VarDelaydata is obtained by calculating the variance of the delay of ordinary messages within a time window, which is used to reflect the delay fluctuation of the background traffic; the collected parameters are periodically uploaded to the VPN data processing platform after being attached with a uniform time stamp and a check code by the Internet of Things data collection program, as input data for subsequent reliability scoring and dynamic tunnel switching evaluation;

[0080] Note: Control instructions are the smallest data units, usually generated by industrial control systems (such as PLC, DCS, robot controller, etc.), specific commands for driving actuators or triggering device behavior; Characteristics: Strong real-time: for example, "motor start", "valve close" must be transmitted within milliseconds; Low fault tolerance: once lost or delayed, it may cause device out of control or action failure; Small data volume: generally short messages or instruction sets; Example: a PLC sends a "write register 0x01 = 1" command message, or a robot controller issues a "joint angle + 2°" instruction;

[0081] Control flow is a collection of data streams composed of a large number of control instruction messages, forming a continuous communication flow in network transmission; Characteristics: composed of multiple control instructions: for example, a robot will continuously send / receive motion trajectory control instructions when running, these instructions form a continuous data stream; Overall requirement of stability and reliability: not only requires that a single instruction not be lost, but also requires that the entire communication flow be continuous and uninterrupted during network switching; Wide range of applications: including industrial control flow, vehicle networking control flow, remote medical device instruction flow, etc.; Example: in an intelligent factory, a robot controller continuously sends 1000 action control instruction messages within 10 seconds, which are represented as a "control flow" at the transmission level;

[0082] Normal flow: state monitoring data such as temperature sensor, current sensor, pressure sensor uploaded timing monitoring data; Log and diagnostic data device operation log, fault diagnosis message, debugging record, etc.; Statistical and batch data such as energy consumption data collected within a period of time, production statistics, etc., for background analysis; These data have low real-time requirements and usually allow for seconds or even minutes of delay, and can tolerate a certain packet loss rate.

[0083] S1 also includes S12;

[0084] S12, the encapsulation layer at the VPN entrance analyzes and classifies all data packets entering the VPN, including protocol identification, label generation, and tunnel allocation;

[0085] Protocol identification distinguishes control instruction data streams from ordinary monitoring data streams by analyzing packet header fields;

[0086] Label generation adds a first priority label to the control instruction data stream of control instructions in the VPN encapsulation layer, and adds a second priority label to the ordinary monitoring data stream of ordinary monitoring instructions; Wherein, the first priority label > the second priority label;

[0087] Tunnel allocation binds the flow marked with the first priority label to the fast switching tunnel, and binds the flow marked with the second priority label to the regular tunnel, thereby realizing differentiated protection.

[0088] S1 further comprises S13;

[0089] S13, after parsing and classification, the control instruction data stream of the first priority label performs data preprocessing operation before entering the fast switching tunnel;

[0090] The data preprocessing operation includes dimensionless processing of the communication data set, which uniformly maps different dimension parameters to the interval [0, 1] to eliminate the dimension difference;

[0091] The dimensionless processed communication data set is attached with a time stamp and a check code, and is transmitted to the VPN data processing platform through an independent special control channel to ensure the integrity and synchronization of the parameter transmission process;

[0092] In the VPN data processing platform, the control instruction delay Delayctrl and the control instruction packet loss rate Lossctrl of the first priority label are filtered by a sliding time window to eliminate sampling noise, and the continuity feature is extracted based on the burst packet loss rate Burstloss to identify abnormal packet loss mode, at the same time, the ordinary flow delay variance VarDelaydata is standardized to optimize the deviation between different parameters, and the data preprocessing operation result is constructed as a communication feature vector set as the input of subsequent reliability score calculation;

[0093] The ordinary data stream of the second priority label does not perform the above preprocessing, and only participates in the auxiliary evaluation in the tunnel switching process as background data to reduce the calculation overhead and improve the real-time performance of the control instruction data stream.

[0094] In this embodiment, by setting collection points at the VPN entry and exit at the same time, and using a time synchronization timer to ensure clock consistency, the accurate time collection of the same message at different locations is realized. The purpose of this design is to avoid the distortion of time delay calculation caused by the clock drift of the collection point, especially in the industrial control scene with millisecond-level requirements. If the clocks are not synchronized, it will directly cause the misjudgment of the control instruction time delay Delayctrl, and ultimately affect the decision of tunnel switching. Through high-precision synchronous timing, the transmission performance of the physical link can be truly reflected, and the accuracy of data measurement is ensured. In S12, a priority label mechanism is introduced at the VPN encapsulation layer, and the control instruction data stream is bound to the fast switching tunnel, while the ordinary monitoring data stream is bound to the regular tunnel. The design of this differentiated channel is because the loss or delay of control instructions may lead to serious consequences such as "valve not closed in time", while the delay of ordinary monitoring data such as temperature curve can be tolerated. Through the priority label binding mechanism, it can ensure that critical control data is still preferentially forwarded when there is a burst of traffic competition, and physically improves the survival probability of control instructions under congestion conditions. In S13, the control instruction data stream is dimensionless and sliding time window filtering, the purpose is to eliminate the interference of different parameter dimensions and short-time sampling noise. For example, if the control instruction packet loss rate Lossctrl is directly added to the ordinary traffic delay variance VarDelaydata, due to the large difference in numerical interval and dimension, it will cause one of the indicators to be amplified or submerged, and finally deviate from the true evaluation. Through dimensionless mapping and filtering, not only the comparability between parameters is guaranteed, but also the abnormal recognition ability of burst packet loss rate Burstloss is enhanced. In a real sense, this is a noise reduction and equalization processing of the original data, so that the input communication feature vector set can objectively reflect the tunnel running state. Overall, this implementation process realizes high-precision measurement, priority protection and data optimization of control instructions through the link design of "collection point clock synchronization + priority differentiated label + dimensionless preprocessing", so that the VPN tunnel can make judgments based on more real and cleaner parameter inputs during the dynamic switching process. This not only effectively avoids the misjudgment caused by data collection distortion, traffic competition or parameter imbalance, but also improves the accuracy and real-time of tunnel switching, and further enhances the stability and security of VPN in high-reliability scenarios such as industrial control, Internet of Vehicles and remote medical treatment.

[0095] Embodiment 3, please refer to Figure 1 , specifically: S2 includes S21;

[0096] S21, based on the dimensionless processed communication feature vector set, extracting control instruction delay Delayctrl, control instruction packet loss rate Lossctrl and burst packet loss rate Burstloss, combining to construct a weighted formula, calculating the output control traffic reliability score Qctrl, quantitatively analyzing the end-to-end transmission characteristics of the control traffic;

[0097] The control traffic reliability score Qctrl is calculated by the following algorithm formula:

[0098] ;

[0099] The formula is based on: control traffic reliability evaluation usually refers to the QoS (Quality of Service) index system in the queuing theory and communication quality evaluation model; common QoS indicators include: delay (Delay), packet loss rate (Packet Loss Rate), jitter (Jitter), bandwidth utilization, etc.; in the formula, three indicators of control instruction delay Delayctrl, control instruction packet loss rate Lossctrl and burst packet loss rate Burstloss are selected to construct a weighted formula for calculating the comprehensive reliability score; the formula introduces burst packet loss rate Burstloss and adds it together with packet loss rate Lossctrl to reflect the combined risk of "average packet loss" and "continuous packet loss" in communication;

[0100] Dimension consistency: the communication data set is processed dimensionless in the data preprocessing operation, so the control instruction delay Delayctrl, the control instruction packet loss rate Lossctrl and the burst packet loss rate Burstloss are all dimensionless parameters, and the dimensions are reasonable;

[0101] Derivation process: the formula of the application adopts the reciprocal form of the denominator: when the control instruction delay Delayctrl increases, the control traffic reliability score Qctrl decreases significantly, which reflects the characteristics of the sensitivity of industrial control to delay; through the (1+Lossctrl+Burstloss) term, the average packet loss and the burst packet loss are coupled, and the negative effect of continuous packet loss is amplified; the score interval of Qctrl∈(0,1] is obtained, and the larger the value is, the higher the transmission reliability is.

[0102] S2 also includes S22;

[0103] S22: based on the control traffic reliability score Qctrl, the level division of the tunnel running state is performed; the specific division is as follows:

[0104] When the control traffic reliability score Qctrl is greater than or equal to 0.8, it is divided into Level-0, and the existing tunnel operation is maintained;

[0105] When 0.5≤control flow reliability score Qctrl<0.8, it is classified as Level-1, triggering a standby tunnel preheating mechanism to make the standby tunnel establish handshake and link detection in advance;

[0106] When control flow reliability score Qctrl<0.5, it is classified as Level-2, triggering a dynamic hierarchical protocol switching mechanism.

[0107] S2 also includes S23;

[0108] S23: When the tunnel running state is classified as Level-2, a dynamic hierarchical protocol switching mechanism is triggered, which includes a tunnel preheating mechanism, a redundancy checking mechanism, a dynamic hybrid protocol mechanism, and a jitter prevention mechanism;

[0109] Before performing switching, the tunnel preheating mechanism is enabled to complete handshake and link detection in advance through the standby tunnel before switching, thereby reducing switching delay;

[0110] During switching, the redundancy checking mechanism is enabled to ensure zero loss by transmitting control flow marked with a first priority label in parallel through the main tunnel and the standby tunnel;

[0111] During switching, the dynamic hybrid protocol mechanism is enabled to realize differentiated transmission guarantee by preferentially transmitting control flow of the first priority label through UDP-type protocol and transmitting ordinary flow of the second priority label through TCP-type protocol;

[0112] The jitter prevention mechanism avoids frequent jitter by not immediately switching but delaying triggering if the score repeatedly fluctuates within a certain time window;

[0113] During switching determination, based on control flow reliability score Qctrl and ordinary flow delay variance VarDelaydata, an output adjusted comprehensive score Qadj is calculated to make a secondary adjustment to control flow reliability score Qctrl, and the specific calculation formula is: Qadj=Qctrl-β·VarDelaydata; in the formula, β represents an empirical adjustment coefficient, which is dimensionless, and its range is 0.001-0.05;

[0114] Formula derivation logic: In actual networks, the control traffic reliability score Qctrl mainly reflects the transmission reliability of control traffic, but if there is a large range of fluctuations in the network (for example, the background traffic delay is severely jittered), relying only on the control traffic reliability score Qctrl will lead to "misjudgment" or "excessive switching"; therefore, the formula introduces the ordinary traffic delay variance VarDelaydata based on the control traffic reliability score Qctrl, and controls the weight of the ordinary traffic delay variance VarDelaydata through an empirical adjustment coefficient β, to form an adjusted comprehensive score Qadj, wherein the ordinary traffic delay variance VarDelaydata is the ordinary traffic delay variance, used to describe the fluctuation of the background traffic, and β is a preset empirical adjustment coefficient, used to dynamically balance the influence of control traffic and ordinary traffic, thereby improving the accuracy of tunnel switching decision;

[0115] Control traffic reliability score Qctrl: Calculate the preliminary reliability score of control traffic, used to judge the tunnel state level;

[0116] Adjusted comprehensive score Qadj: When the control traffic reliability score Qctrl is determined to be high risk (Level-2), the ordinary traffic delay variance is introduced for secondary adjustment to avoid unnecessary switching triggered by single indicator fluctuation.

[0117] S2 includes S24;

[0118] S24, based on the output value of the adjusted comprehensive score Qadj, performs comparative evaluation to determine the tunnel switching mechanism; the specific comparative evaluation content is as follows:

[0119] When the adjusted comprehensive score Qadj is less than 0.6, the tunnel switching process is immediately triggered, and the redundancy verification mechanism and the dynamic hybrid protocol mechanism are enabled;

[0120] When the adjusted comprehensive score Qadj is greater than or equal to 0.6, the standby tunnel preheating state is maintained, and the anti-jitter mechanism is triggered to delay switching;

[0121] The significance of selecting 0.6: If it is too high (such as 0.8), it will lead to frequent switching, even if the network fluctuation is not large, it will also switch, causing link shock; if it is too low (such as 0.3), it may delay the protection of critical control traffic, causing control command loss or delay exceeding the standard; 0.6 is an empirical threshold that balances switching sensitivity and switching stability in actual industrial VPN network environment.

[0122] In this embodiment, in S21, the end-to-end transmission characteristics of the control traffic can be quantified by combining the control instruction delay Delayctrl, the control instruction packet loss rate Lossctrl, and the burst packet loss rate Burstloss to construct the control traffic reliability score Qctrl. This scoring method is necessary because relying on a single indicator can be biased. For example, only looking at the average packet loss rate can be low, but there can be continuous packet loss in a short time, which can still cause all control packets to fail. After introducing the coupling term of the burst packet loss rate Burstloss, the composite risk of "average packet loss + continuous packet loss" can be truly reflected, and the score is closer to the real communication state; in S22, grading is performed based on the control traffic reliability score Qctrl, and the purpose is to directly map the abstract score to an executable action. For example, setting Qctrl≥0.8 as Level-0 is to avoid blind switching when the network fluctuates slightly and to ensure stable operation of the tunnel; when Qctrl is lower than 0.5 to trigger Level-2, it is immediately switched, which is to prevent the loss of millisecond-level control instructions such as "joint angle + 2°" of an industrial robot from causing serious deviation. The physical meaning of the grading mechanism is that different levels correspond to different tunnel processing strategies to ensure that switching is neither delayed nor redundant; in S23, a dynamic grading protocol switching mechanism is introduced to make the tunnel switching process more refined and robust. For example, the standby tunnel preheating mechanism avoids handshake delay during switching; the redundancy checking mechanism ensures zero loss during switching; the dynamic hybrid protocol mechanism makes critical control traffic go through UDP to ensure timeliness, and ordinary traffic goes through TCP to ensure reliability; and the anti-jitter mechanism avoids frequent fluctuations of Qctrl near the critical value, causing repeated switching of the link. The physical meaning of this design is to provide differentiated protection paths for different traffic to make the switching fast and stable; in S24, the adjusted comprehensive score Qadj is introduced, and Qctrl is modified again in combination with the ordinary traffic delay variance VarDelaydata, in order to avoid "misjudgment" caused by the over-sensitivity of a single control traffic indicator. For example, when the background network traffic fluctuates greatly, the control traffic reliability score Qctrl can temporarily decrease, and if switching is triggered immediately, unnecessary tunnel oscillation will occur. By introducing VarDelaydata and setting an empirical threshold of 0.6, the sensitivity and stability of switching can be balanced to ensure that switching is performed only in a truly high-risk situation; in summary, the implementation of S2 realizes precise triggering and stable execution of tunnel switching through the construction of the reliability score Qctrl, multi-level operation state division, a dynamic grading switching mechanism, and comprehensive score Qadj modification. This design not only ensures the immediate protection of control traffic in the case of burst packet loss or high delay, but also avoids frequent switching caused by misjudgment, thereby improving the continuity and reliability of the VPN tunnel in high real-time scenarios such as industrial control and vehicle networking.

[0123] For example 4, please refer to Figure 1 Specifically, S3 includes S31;

[0124] S31, when performing tunnel switching and starting tunnel redundancy checking mechanism, the control instruction flow marked with the first priority label is simultaneously encapsulated and transmitted in parallel through the main tunnel and the standby tunnel, and the data packets transmitted in parallel are verified for integrity by time stamp comparison and checking code checking at the exit node; after the tunnel switching is completed, the communication feature vector set is re-acquired, the new control flow reliability score Qctrl-new after switching is calculated, and compared with the control flow reliability score Qctrl before switching;

[0125] When the new control flow reliability score Qctrl-new is greater than the control flow reliability score Qctrl, it is determined that the tunnel switching optimization is successful, and the current switching strategy is maintained to continue running;

[0126] When the new control flow reliability score Qctrl-new is less than or equal to the control flow reliability score Qctrl, the rollback logic is triggered, the control flow of the first priority label is rolled back to the main tunnel before switching, and the cross-protocol camouflage strategy is enabled, which camouflages the control flow as a normal data stream at the VPN encapsulation layer to avoid the interruption risk caused by excessive switching, thereby ensuring the continuous transmission of the control flow during the tunnel rollback process.

[0127] In this embodiment, when tunnel switching is performed in S31, the tunnel redundancy check mechanism is enabled, and the control instruction traffic marked with the first priority label is transmitted in parallel through the main tunnel and the standby tunnel. The purpose of this mode is to avoid the "black screen period" that occurs during switching. In the millisecond-level industrial control instruction scenario, even a single loss can cause the actuator to malfunction. By comparing the timestamps at the exit node and the check code, it can be ensured that the two transmission results are completely consistent, and the control instruction is guaranteed to be zero-loss during switching. After switching is completed, the communication feature vector set is re-acquired and a new control traffic reliability score Qctrl-new is calculated, which is compared with the control traffic reliability score Qctrl before switching to verify the effectiveness of the switching in real time. If the score improves after switching, it means that the new tunnel is indeed better, and the switching strategy is maintained. If the score decreases, the rollback logic is triggered to avoid more serious communication quality degradation caused by false switching. The purpose of this design is to quantify the switching effect and avoid "blind switching" to ensure that the decision-making process is verifiable and reversible. The cross-protocol camouflage strategy is introduced in the rollback logic, which makes the control traffic be disguised as ordinary data flow at the VPN encapsulation layer. This design is aimed at the risk scenario after switching fails. If it is directly rolled back, tunnel oscillation or short-term interruption may occur. By using the camouflage method, the control traffic can still obtain a continuous transmission channel during the rollback process, which is equivalent to providing "stealth protection" for the control traffic in a physical sense, avoiding sudden service interruption.

[0128] Embodiment 5, please refer to Figure 1 and Figure 2 A multi-protocol fusion VPN communication system based on dynamic tunnel switching includes a communication detection module, a reliability analysis module, and a switching strategy module.

[0129] The communication detection module acquires communication data sets by setting acquisition points at the VPN entrance and exit, adds priority labels to different traffic at the VPN protocol encapsulation layer to form differentiated channels for control instruction data flow and ordinary monitoring data flow, and performs data preprocessing operations to obtain a communication feature vector set.

[0130] The reliability analysis module calculates the control traffic reliability score Qctrl based on the communication feature vector set, classifies the tunnel operation state according to the control traffic reliability score Qctrl, triggers the dynamic hierarchical protocol switching mechanism based on the classification result, and calculates the adjusted comprehensive score Qadj to determine the tunnel switching mechanism.

[0131] The switching strategy module starts the tunnel redundancy check mechanism when tunnel switching is determined to be performed, transmits the control instruction data flow in parallel through the main tunnel and the standby tunnel, and executes the feedback mechanism after switching is completed.

[0132] While embodiments of the application have been shown and described, it is to be understood that the embodiments described are merely exemplary of the principles and application of the present application. Numerous modifications and changes can be made by those skilled in the art without departing from the spirit and scope of the application.

Claims

1. A multi-protocol converged VPN communication method based on dynamic tunnel switching, characterized in that: Includes the following steps: S1. Set up collection points at the VPN inlet and outlet to collect communication datasets, and add priority labels to different traffic in the VPN protocol encapsulation layer to form differentiated channels for control command data streams and ordinary monitoring data streams. At the same time, perform data preprocessing operations to obtain communication feature vector sets. S2. Based on the communication feature vector set, calculate the control flow reliability score Qctrl, classify the tunnel operation status according to the control flow reliability score Qctrl, and trigger the dynamic graded protocol switching mechanism based on the classification results; calculate the adjusted comprehensive score Qadj, and determine the tunnel switching mechanism based on the adjusted comprehensive score Qadj. The adjusted comprehensive score Qadj is calculated by combining the control flow reliability score Qctrl with the ordinary flow delay variance VarDelaydata. The dynamic hierarchical protocol switching mechanism includes a tunnel preheating mechanism, a redundancy verification mechanism, a dynamic hybrid protocol mechanism, and a jitter prevention mechanism. Before the handover is performed, a tunnel preheating mechanism is enabled. Before the handover, the backup tunnel completes the handshake and link detection in advance. During the handover, the redundancy check mechanism is enabled to transmit control traffic marked with the first priority label in parallel in the primary tunnel and the backup tunnel. During the switching process, a dynamic hybrid protocol mechanism is enabled to prioritize UDP protocols for control traffic of the first priority label and TCP protocols for ordinary traffic of the second priority label. The anti-shake mechanism delays the switching process if the score fluctuates repeatedly within a certain time window. S2 includes S24; S24. Based on the output value of the adjusted comprehensive score Qadj, a comparative evaluation is conducted to determine the tunnel handover mechanism; the specific comparative evaluation content is as follows: When the adjusted comprehensive score Qadj is less than 0.6, the tunnel switching process is immediately triggered, and the redundancy check mechanism and dynamic hybrid protocol mechanism are enabled. When the adjusted comprehensive score Qadj is greater than or equal to 0.6, the backup tunnel is kept in preheating state and the anti-shake mechanism is triggered, delaying the switchover. S3. When it is determined to perform tunnel switching, the tunnel redundancy verification mechanism is activated, the control command data stream is transmitted in parallel through the main tunnel and the backup tunnel, and the feedback mechanism is executed after the switching is completed.

2. The multi-protocol converged VPN communication method based on dynamic tunnel switching according to claim 1, characterized in that: S1 includes S11; S11. Set up collection points at the VPN ingress and egress points, and set collection commands, collection devices and collection tools for the collection points to collect communication datasets in real time. The collection points include an entry collection point and an exit collection point; wherein: the entry collection point is set at the VPN access point, and the exit collection point is set at the VPN exit point; The acquisition commands include control monitoring commands and general monitoring commands; The control and monitoring commands include delay detection commands, packet loss detection commands, and sudden packet loss detection commands; The general monitoring instructions include delay variance detection instructions; The acquisition device includes a time synchronization timer, a data packet capture probe, and a protocol parsing tool; The data acquisition tool includes an Internet of Things (IoT) data acquisition program; The communication dataset includes control command delay Delayctrl, control command packet loss rate Lossctrl, burst packet loss rate Burstloss, and ordinary traffic delay variance VarDelaydata.

3. The multi-protocol converged VPN communication method based on dynamic tunnel switching according to claim 2, characterized in that: S1 further includes S12; S12. At the encapsulation layer of the VPN entry point, all data packets entering the VPN are parsed and classified. The parsing and classification includes protocol identification, label generation, and tunnel allocation. The protocol identification distinguishes between control command data streams and ordinary monitoring data streams by parsing the data packet header fields. The tag generation is achieved by adding a first priority tag to the control instruction data stream of control instructions and a second priority tag to the ordinary monitoring data stream of ordinary monitoring instructions in the VPN encapsulation layer; wherein, the first priority tag > the second priority tag. The tunnel allocation binds traffic labeled with a first priority tag to a fast-switching tunnel and traffic labeled with a second priority tag to a regular tunnel.

4. The multi-protocol converged VPN communication method based on dynamic tunnel switching according to claim 3, characterized in that: S1 also includes S13; S13. After parsing and classification, the control instruction data stream of the first priority label performs data preprocessing operations before entering the fast switching tunnel; The data preprocessing operation includes performing dimensionless processing on the communication dataset, mapping different dimensional parameters to the [0,1] interval to eliminate dimensional differences; The dimensionless communication dataset is appended with a timestamp and a checksum and then transmitted to the VPN data processing platform via a dedicated control channel. In the VPN data processing platform, sliding time window filtering is performed on the control command delay Delayctrl and control command packet loss rate Lossctrl of the first priority label to eliminate sampling noise. Continuous feature extraction is performed based on the burst packet loss rate Burstloss to identify abnormal packet loss patterns. At the same time, the ordinary traffic delay variance VarDelaydata is standardized to optimize the deviation between different parameters, and the data preprocessing results are constructed into a communication feature vector set.

5. The multi-protocol converged VPN communication method based on dynamic tunnel switching according to claim 4, characterized in that: S2 includes S21; S21. Based on the dimensionless processing of the communication feature vector set, extract the control command delay Delayctrl, control command packet loss rate Lossctrl, and burst packet loss rate Burstloss, combine them to construct a weighted formula, calculate and output the control traffic reliability score Qctrl, and quantitatively analyze the end-to-end transmission characteristics of the control traffic. The control flow reliability score Qctrl is calculated and output using the following algorithm formula: 。 6. The multi-protocol converged VPN communication method based on dynamic tunnel switching according to claim 1, characterized in that: S2 further includes S22; S22: Based on the control flow reliability score Qctrl, the tunnel operation status is classified into levels; the specific classification is as follows: When the control flow reliability score Qctrl ≥ 0.8, it is classified as Level-0, and the existing tunnel operation is maintained; When 0.5 ≤ control flow reliability score Qctrl < 0.8, it is classified as Level-1, triggering the backup tunnel preheating mechanism to enable the backup tunnel to establish handshake and link detection in advance; When the control flow reliability score Qctrl < 0.5, it is classified as Level-2, triggering the dynamic tiered protocol switching mechanism.

7. The multi-protocol converged VPN communication method based on dynamic tunnel switching according to claim 6, characterized in that: S2 also includes S23; S23: When the tunnel operation status is classified as Level-2, the dynamic hierarchical protocol switching mechanism is triggered. During the switching process, the control flow reliability score Qctrl is adjusted a second time based on the ordinary flow delay variance VarDelaydata to obtain the adjusted comprehensive score Qadj.

8. The multi-protocol converged VPN communication method based on dynamic tunnel switching according to claim 7, characterized in that: S3 includes S31; S31. When tunnel switching is performed and tunnel redundancy verification mechanism is started, control command traffic marked with the first priority label is simultaneously encapsulated and transmitted in parallel in the main tunnel and backup tunnel. The data packets transmitted in parallel are verified for integrity at the exit node by comparing timestamps and checking codes. After tunnel switching is completed, the communication feature vector set is re-collected, the new control traffic reliability score Qctrl-new after switching is calculated, and compared with the control traffic reliability score Qctrl before switching. When the new control flow reliability score Qctrl-new is greater than the control flow reliability score Qctrl, the tunnel handover optimization is deemed successful, and the current handover strategy is maintained and continues to run. When the new control traffic reliability score Qctrl-new is less than or equal to the control traffic reliability score Qctrl, a fallback logic is triggered, which rolls back the control traffic with the first priority label to the main tunnel before the switchover. At the same time, a cross-protocol masquerading policy is enabled, which disguises the control traffic as a normal data stream at the VPN encapsulation layer.

9. A multi-protocol converged VPN communication system based on dynamic tunnel switching, applied to the multi-protocol converged VPN communication method based on dynamic tunnel switching as described in any one of claims 1-8, characterized in that: It includes a communication detection module, a reliability analysis module, and a handover strategy module; The communication detection module collects communication datasets by setting up collection points at VPN ingress and egress points, and adds priority labels to different traffic at the VPN protocol encapsulation layer to form differentiated channels for control command data streams and ordinary monitoring data streams. At the same time, it performs data preprocessing operations to obtain communication feature vector sets. The reliability analysis module calculates the control flow reliability score Qctrl based on the communication feature vector set, classifies the tunnel operation status according to the control flow reliability score Qctrl, and triggers a dynamic graded protocol switching mechanism based on the classification results; it also calculates the adjusted comprehensive score Qadj and determines the tunnel switching mechanism based on the adjusted comprehensive score Qadj. The switching strategy module activates a tunnel redundancy verification mechanism when determining to perform a tunnel switch, transmits control command data streams in parallel through both the main tunnel and the backup tunnel, and executes a feedback mechanism after the switch is completed.

Images