IPSec multi-tunnel quality probing and intelligent switching method

Abstract

The application discloses an IPSec multi-tunnel quality detection and intelligent switching method and relates to the technical field of communication network security. The method comprises the following steps: multi-tunnel management, tunnel quality detection, comprehensive evaluation and decision, anti-shock analysis and switching execution. Through multi-tunnel management and multi-dimensional quality detection, the application realizes comprehensive perception of time delay, jitter, packet loss rate and available bandwidth, accurately reflects real transmission quality of a tunnel, adopts a sliding window dynamic weight adjustment mechanism, makes the comprehensive score sensitively respond to network fluctuations, combines hysteresis comparison and anti-shock delay design, effectively filters transient jitter and avoids frequent mis-switching, and the smooth switching process guarantees that a TCP long connection is not interrupted through double sending and deduplication, supports fast hard switching in a fault scenario, supports load sharing according to quality when the tunnel quality is good, fully improves bandwidth resource utilization, and takes into account high reliability and transmission efficiency.

Description

Technical Field

[0001] This invention relates to the field of communication network security technology, specifically to a method for IPSec multi-tunnel quality detection and intelligent switching. Background Technology

[0002] In practical networking applications, to ensure connection reliability, multiple IPSec tunnels based on different communication resources are typically established between the local gateway and the peer gateway. Traditional tunnel management and switching mechanisms mainly rely on connectivity status for judgment, that is, switching to the backup tunnel is only triggered when the currently used tunnel fails and is interrupted. However, this approach has the following problems: First, the granularity of tunnel quality perception is insufficient. The existing mechanism uses tunnel connectivity as the sole criterion for judgment, which cannot detect situations where the tunnel is connected but the transmission quality has deteriorated, such as increased latency, increased packet loss rate, or decreased available bandwidth, causing business data to continue to be transmitted through the degraded tunnel.

[0003] Second, there is a lack of comprehensive detection and evaluation methods for multi-dimensional quality indicators. Traditional methods do not systematically collect and normalize indicators such as latency, jitter, packet loss rate, and available bandwidth, and lack a comprehensive quality scoring mechanism based on multiple indicators, making it difficult to fully reflect the true transmission status of the tunnel.

[0004] Third, the switching strategy is difficult to adapt to dynamic changes in the network. Because the evaluation weights are fixed, when a certain quality indicator fluctuates significantly, the scoring results cannot sensitively reflect the change, affecting the timeliness of the switching decision. At the same time, instantaneous fluctuations in network indicators may cause short-term changes in tunnel ranking. If switching is triggered directly based on this, it is easy to cause frequent changes in the primary tunnel, resulting in a decrease in transmission stability.

[0005] Fourth, during the switching process, if the encapsulation parameters are directly changed to perform a hard switch for cases where TCP long connection business data streams are already being carried, packet loss or out-of-order delivery may occur, leading to interruption of the upper-layer session.

[0006] Fifth, when there are multiple high-quality tunnels, traditional solutions typically maintain only one primary tunnel while leaving the others idle, failing to achieve balanced utilization of bandwidth resources across multiple tunnels. Summary of the Invention

[0007] To address the shortcomings of existing technologies, this invention provides a method for IPSec multi-tunnel quality detection and intelligent switching, which solves the problems mentioned in the background section.

[0008] To achieve the above objectives, the present invention provides the following technical solution: a method for IPSec multi-tunnel quality detection and intelligent handover, which is deployed on both the local and remote gateways, and includes the following steps: Step 1, Multi-tunnel Management: The multi-tunnel management module establishes and maintains multiple IPSec tunnels based on different communication resources between the local gateway and the peer gateway; The second step is tunnel quality detection: the quality detection module acquires multi-dimensional quality indicators for each tunnel in each preset detection cycle. The multi-dimensional quality indicators include latency indicators, packet loss rate indicators, jitter indicators, available bandwidth indicators, and connectivity indicators. The third step, comprehensive evaluation and decision-making: The comprehensive evaluation module normalizes the latency, jitter and available bandwidth indicators, dynamically adjusts the corresponding weights based on the fluctuation of each indicator within the sliding observation window, and calculates the comprehensive quality score of each connected tunnel; the decision-making module generates the primary tunnel and the target tunnel according to the score ranking, and generates the switching intention through hysteresis comparison logic. Step 4, Anti-vibration analysis: When selecting the primary tunnel based on the tunnel comprehensive quality score, the anti-vibration module applies a switching hysteresis to filter out short-term ranking changes caused by instantaneous fluctuations in network indicators and generates a formal switching instruction. Step 5: Switching Execution: The switching execution module migrates the business data stream from the original primary tunnel to the target tunnel according to the switching instruction.

[0009] Furthermore, after the local gateway is started, the multi-tunnel management module reads the set of tunnel parameters preset in the local configuration file, which contains the resource configuration information of each IPSec tunnel to be established. For each tunnel, the resource configuration information includes: the physical interface type used, the IP address or domain name of the peer gateway, the local IP address as the tunnel source, the source UDP port number, the destination UDP port number, the type of transport protocol to be used, and the encryption algorithm, authentication algorithm and key negotiation parameters required for security association. Based on the resource configuration information, the multi-tunnel management module negotiates with the peer gateway one by one using IKE to establish IPSec security associations. After successful negotiation, the multi-tunnel management module assigns a unique tunnel identifier i to each tunnel, where i = 1, 2, ..., n, and n is the total number of tunnels successfully established. At the same time, it creates a data structure corresponding to the tunnel in memory to record its basic attribute set, including: source address, destination address, source port, destination port, and the security association parameters generated by negotiation. Furthermore, when the network topology changes, the administrator, while the gateway is running, issues a tunnel addition command to the multi-tunnel management module. The tunnel addition command carries all the resource configuration information of the new tunnel. After receiving the tunnel addition command, the multi-tunnel management module immediately starts the negotiation process with the peer gateway. After the negotiation is successful, a new tunnel identifier is assigned to the tunnel, and the value of n is incremented by one. When an existing tunnel needs to be deleted, the administrator issues a tunnel deletion command, which includes the identifier of the target tunnel. After receiving the tunnel deletion command, the multi-tunnel management module sends a deletion notification to the peer gateway, releases the relevant security associations, reclaims the identifier of the tunnel, and decrements the value of n by one.

[0010] Furthermore, the quality detection module operates in a fixed cycle T, where T is a preset value; the sequence number of the current detection cycle is denoted as k, where k = 1, 2, 3, ...; at the beginning of each current detection cycle k, the quality detection module starts an active detection thread, as follows: For all the currently established n tunnels, each tunnel i independently sends m probe messages, where m is a preset configuration item; The type of probe message is selected based on the transmission protocol carried by the tunnel: if the tunnel is based on UDP, a dedicated UDP probe packet is sent; if the tunnel is based on TCP, a dedicated TCP probe packet is sent. When sending probe messages, the quality detection module writes the current sending timestamp and message sequence number into the payload of each message. After receiving the probe message, the probe response module of the peer gateway immediately generates a response message, returning the original sending timestamp and sequence number intact. After receiving the response message, the local gateway matches the corresponding sending record according to the sequence number, subtracts the sending timestamp from the current receiving time, and calculates the round-trip delay value of this probe. The number of probe messages sent to tunnel i within the current detection period k is recorded as... The number of messages that successfully receive a response within the specified timeout period is recorded as follows: ,pass Calculate the number of messages for which no response was received. The round-trip delay values ​​for each successful message are recorded as follows: , ,..., ; pass Calculate the latency index ;pass Calculate the packet loss rate index ;pass Calculate the jitter index ; at the same time based on Define the connectivity index of tunnel i during the kth detection period. ;like If the value is greater than 0, then the connectivity index is determined. The value is 1; if =0, then determine the connectivity index. The value is 0.

[0011] Furthermore, for the passive detection portion of tunnel quality detection, the quality detection module mounts a statistical collection point at the plaintext side interface of the local gateway. This statistical collection point monitors the service data stream forwarded to the internal network after each tunnel is unblocked, and extracts the actual transmission rate from it. The actual transmission rate is obtained by dividing the cumulative number of bytes passed by the statistical collection point by the sampling time. The quality detection module subtracts the actual transmission rate from the theoretical maximum bandwidth of the tunnel, and uses the difference as the available bandwidth indicator. The value of ; At the end of the detection period k, the quality detection module will calculate the connectivity index. Latency indicators Packet loss rate indicator jitter index Available bandwidth indicators Encapsulate it as a quality metric record.

[0012] Furthermore, the normalization process involves the comprehensive evaluation module obtaining the preset maximum tolerable latency. Preset maximum tolerable jitter and the preset theoretical maximum bandwidth of the tunnel ;in, Determined based on the nominal rate of the physical interface used in the tunnel; pass , , Calculate the latency index respectively jitter index Available bandwidth indicators normalized value , , Among them, the packet loss rate indicator No normalization is performed.

[0013] Furthermore, the comprehensive evaluation module through Calculate the comprehensive quality score of tunnel i within the detection period k. In the formula, , , , These are the weights set for latency, packet loss rate, jitter, and available bandwidth metrics, respectively.

[0014] Furthermore, the dynamic adjustment methods for the weights of latency, packet loss rate, jitter, and available bandwidth metrics are as follows: In the comprehensive evaluation module, preset initial weights are configured for latency, packet loss rate, jitter, and available bandwidth metrics, and denoted as follows: , , , Furthermore, in the first detection period k=1 and when the sliding observation window is not filled, the preset initial weights are used.

[0015] The comprehensive evaluation module maintains a sliding observation window of length Q. For each connected tunnel, the comprehensive evaluation module stores the normalized values ​​of the latency index, jitter index, and packet loss rate index corresponding to its Q most recent sliding observation windows; during the detection period k, when the data in the sliding observation window is filled, the standard deviation of the latency index, packet loss rate index, and jitter index is calculated. If, within K consecutive detection cycles, the normalized values ​​of the latency index, jitter index, and packet loss rate index, respectively, are all less than the preset relative change threshold δ within the sliding observation window, it indicates that the fluctuations of the latency index, jitter index, and packet loss rate index have converged. At this point, comparison... , , The size of the value is used to extract the indicator category corresponding to the largest value, and at the same time, the preset adjustment step size ΔW=0.1 is extracted. When the indicator category corresponding to the largest value is a latency indicator, that is, when the latency indicator is the most volatile indicator, then... , , , Update weights , , , ; When the indicator category corresponding to the largest value is the packet loss rate indicator, that is, when the packet loss rate indicator is the most volatile indicator, then by... , , , Update weights , , , ; When the indicator category corresponding to the largest value is a jitter indicator, that is, a jitter indicator is an indicator with the most volatile fluctuations, then by... , , , Update weights , , , ; Furthermore, if a weight value is less than 0 during the deduction process, it is forcibly set to 0, and the shortfall is proportionally distributed from the remaining weights that are not the most volatile and whose current value is greater than 0, ensuring that the sum of the four is always 1. Furthermore, the comprehensive evaluation module assesses all... For tunnels with a score of 1, the overall quality score is calculated as follows: Sort the tunnels from highest to lowest quality, mark the tunnel with the highest overall quality score as the primary tunnel i (1), with an overall quality score of S (1), and mark the remaining tunnels as candidate tunnels i (h). Mark the tunnel with the second highest overall quality score as the target tunnel i (h1), with an overall quality score of S (h1). Wherein, if =0, then directly Set the value to 0.

[0016] Furthermore, the switching decision process of the decision module adopts hysteresis comparison: the decision module reads the pre-configured switching threshold Sth and hysteresis gap H; If S(1)≥S th If not, the switch will not be triggered, and the current cycle decision ends.

[0017] If S(1) < S th Further determine whether S(h1) > S(1) + H is satisfied. If satisfied, a switching intention is generated and submitted to the anti-vibration module. If not satisfied, no switching intention is generated and the current primary tunnel is maintained. Furthermore, the decision-making module determines the current switching mode to be adopted based on the comprehensive quality score of each tunnel, the preset switching threshold, and the load-sharing strategy, and generates the corresponding judgment result. If the connectivity index of the current primary tunnel =0, meaning the current tunnel is completely interrupted, the decision module immediately determines to enter the fault switching mode; at this time, the decision module selects the tunnel with the highest comprehensive quality score from the candidate tunnel i(h) as the target tunnel and generates a fault switching instruction; the fault switching instruction includes: the switching type corresponding to the fault switching mode, and the target tunnel identifier: i(h). If the current tunnel's overall quality score remains at T C If the time is below the preset quality degradation threshold, and there are other tunnels with scores higher than the threshold, the decision module determines to enter the quality switching mode. At this time, the decision module selects the tunnel with the highest overall quality score from candidate tunnel i(h) as the target tunnel and generates a quality switching instruction. The quality switching instruction includes: the switching type corresponding to the quality switching mode, and the target tunnel identifier: i(h). C The preset duration value; If the current tunnel does not have any severe degradation or interruption requiring immediate switching, and there are at least two candidate tunnels i(h) whose comprehensive quality scores both exceed the preset load-sharing activation threshold, and the absolute value of the difference between the highest and lowest comprehensive quality scores of these at least two candidate tunnels i(h) is less than the preset load-sharing balancing threshold, then the decision module determines to enter the load-sharing mode. At this time, the decision module includes all candidate tunnels i(h) whose comprehensive quality scores exceed the load-sharing activation threshold into the tunnel set V participating in load sharing, and generates a load-sharing instruction. The load-sharing instruction includes: the switching type corresponding to the load-sharing mode, the tunnel set V participating in load sharing, and the tunnel identifier i(h) of the corresponding tunnel. Furthermore, if no fault switching command, quality switching command, or load sharing command is generated, the decision module maintains the current tunnel state.

[0018] Furthermore, the anti-vibration module internally maintains a switching intention queue and a timer; when a switching intention is input, the anti-vibration module starts a timer with a duration of T. D The timer. T D The initial value is 30 seconds. The anti-vibration module simultaneously records the actual time taken for each tunnel from failure interruption to successful safe reconstruction. A sliding window of length 10 is used to record the time taken for the last ten reconstructions, and the arithmetic mean UP is calculated in real time. D Dynamically updated to 1.2×UP; During the timer period, the comprehensive evaluation module and the decision-making module continue to output the latest comprehensive quality score and switching intention according to the detection cycle; When the timer expires, the anti-oscillation module queries the comprehensive evaluation and decision module again for the latest S(1) and S(h1) states; if S(1) < S th If S(h1) > S(1) + H, then the quality degradation is determined to be a persistent state, and a formal switching instruction is sent to the switching execution module; if the condition is no longer met, then the switching intention is cancelled, the switching is not triggered, and the timer state is cleared.

[0019] Furthermore, the switching execution module receives the final formal switching instruction issued by the anti-vibration module. The formal switching instruction contains the switching type corresponding to the fault switching mode / quality switching mode / load sharing mode and the tunnel identifier of the target tunnel. The switching execution module first parses the switching type. When the instruction type is fault switching mode or quality switching mode, it checks whether there is a TCP long connection service data stream being transmitted through the primary tunnel. If there is no TCP long connection business data flow, a "hard switch" is performed directly: the encapsulation parameters of the data packets are updated to the security association and UDP header fields corresponding to the target tunnel, and all data packets are sent through the target tunnel; If there is a TCP long-connection business data stream, a smooth switching process will be initiated.

[0020] Furthermore, the smooth switching process is as follows: The switching execution module sends a handshake probe packet to the target tunnel peer gateway to verify the end-to-end reachability of the path; after confirming reachability, the switching execution module starts the dual-transmission mode; during the dual-transmission mode, for each service data packet to be sent, the switching execution module copies it into two copies, one copy is encapsulated and sent using the original primary tunnel parameters, and the other copy is encapsulated and sent using the target tunnel parameters. The receiving gateway's data merging module performs deduplication processing on the data packets received from the two tunnels; the IPSec encapsulation inner payload header of each data packet carries a globally incrementing sequence number inserted by the sending gateway. For data packets with the same globally incrementing sequence number, the receiving gateway only decapsulates the first arriving packet and forwards it to the internal network, while subsequent duplicate packets are directly discarded. The dual-transmission mode lasts for a preset transition time. After the transition time expires, the switching execution module stops sending data on the original primary tunnel, migrates all business data traffic to the target tunnel, and changes the status of the original primary tunnel to a candidate tunnel to continue participating in quality detection.

[0021] Furthermore, if the switching trigger is caused by the primary tunnel connectivity index becoming 0, the switching execution module does not need to wait for a complete detection cycle, but directly adopts the fault switching mode, skips the dual-transmission mode, and immediately switches the traffic to the target tunnel.

[0022] Furthermore, when the instruction type is load sharing mode, the switching execution module extracts the set of tunnels V participating in the load sharing and their corresponding tunnel identifiers i(h) from the load sharing instruction. When entering the load sharing mode, the current primary tunnel is included in the tunnel set V participating in the load sharing. The load sharing weight of the primary tunnel and each tunnel in the tunnel set V is determined according to the proportion of the current primary tunnel and the corresponding comprehensive quality score in its total comprehensive quality score. The switching execution module performs weighted allocation of all business data streams according to the tunnel identifier and load sharing weight in the new tunnel set V1.

[0023] Furthermore, the formula for calculating the weight sharing is as follows: In the formula, V1 represents the weighting weight of the j-th tunnel, and V1 is the new set of tunnels formed after the current primary tunnel is included in the set of tunnels participating in the weighting. Let j represent the overall quality score of the j-th candidate tunnel in the new tunnel set V1, where j is the identifier index of each tunnel in the new tunnel set V1, and includes the currently used primary tunnel, j∈i, and j≤i.

[0024] This technical solution also provides an IPSec multi-tunnel quality detection and intelligent handover system. This system implements an IPSec multi-tunnel quality detection and intelligent handover method. The system is deployed on both the local gateway and the peer gateway. The local gateway in this system includes: The multi-tunnel management module is used to establish and maintain multiple IPSec tunnels based on different communication resources with the peer gateway; The quality detection module is used to acquire multi-dimensional quality indicators for each tunnel within each preset detection cycle. These multi-dimensional quality indicators include latency, packet loss rate, jitter, available bandwidth, and connectivity status. The comprehensive evaluation module is used to normalize latency, jitter, and available bandwidth, dynamically adjust the weighting coefficients based on the fluctuation of each indicator within the sliding observation window, and calculate the comprehensive quality score for each connected tunnel. The decision module is used to generate switching instructions based on score ranking and hysteresis comparison logic; The anti-vibration module is used to filter out short-term ranking changes caused by instantaneous fluctuations in network indicators when selecting the primary tunnel based on the tunnel comprehensive quality score. The switching execution module is used to migrate business data streams from the original primary tunnel to the candidate tunnel according to the switching command; The peer gateway includes a probe response module and a data merging module, which are used to cooperate with the local gateway to complete probe and smooth handover.

[0025] This invention provides a method for IPSec multi-tunnel quality detection and intelligent handover. Compared with existing technologies, it has the following advantages: By actively probing and acquiring latency, packet loss rate, and jitter metrics, and combining this with passive detection to collect available bandwidth, while simultaneously determining connectivity status, the system can comprehensively reflect the real-time transmission quality of each IPSec tunnel from multiple dimensions, providing accurate data for subsequent switching decisions.

[0026] By calculating the standard deviation of each indicator within a sliding observation window, the degree of fluctuation is determined, and the weight of the indicator with the most drastic fluctuation is automatically increased, so that the overall quality score can be dynamically adjusted according to the changes in network status, avoiding the problem of inaccurate scoring under fixed weights in different network scenarios.

[0027] By setting a dynamically updatable timer duration through the anti-vibration module, the switching condition is required to be met after the timer expires before a formal switch is triggered. This avoids frequent switching caused by short-term ranking changes due to instantaneous fluctuations in network indicators, and ensures the stability of tunnel selection in the time dimension.

[0028] When the primary tunnel connectivity index becomes 0, the switching execution module does not need to wait for a complete detection cycle, but directly determines to enter the fault switching mode and immediately switches the traffic to the target tunnel, shortening the service interruption time caused by the complete interruption of the tunnel.

[0029] For scenarios involving TCP long-connection business data streams, seamless migration of data packets between the original primary tunnel and the target tunnel is achieved through dual-send mode and deduplication based on globally incrementing sequence numbers, avoiding packet loss or out-of-order delivery during the switching process.

[0030] When the comprehensive quality scores of multiple candidate tunnels all meet the load sharing activation conditions and the differences between them are less than the preset threshold, the decision module enters the load sharing mode, and the switching execution module allocates business data traffic according to the proportion of the comprehensive quality scores of each tunnel, so as to achieve balanced utilization of multiple tunnel resources. Attached Figure Description

[0031] Figure 1 This is a flowchart illustrating a method for IPSec multi-tunnel quality detection and intelligent switching according to the present invention.

[0032] Figure 2 This is a system block diagram of an IPSec multi-tunnel quality detection and intelligent switching system according to the present invention. Detailed Implementation

[0033] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0034] Please see Figure 1 and Figure 2 As shown, the embodiments of the present invention provide the following technical solutions: This solution is deployed on the gateway device implementing this solution and its peer gateway, and the gateway device implementing this solution is referred to as the local gateway. As an embodiment of the present invention: This invention relates to a method for IPSec multi-tunnel quality detection and intelligent handover. This method is based on an IPSec multi-tunnel quality detection and intelligent handover system, which is deployed on both the local and remote gateways. The local gateway in this system includes: The multi-tunnel management module is used to establish and maintain multiple IPSec tunnels based on different communication resources with the peer gateway; The quality detection module is used to acquire multi-dimensional quality indicators for each tunnel within each preset detection cycle. These multi-dimensional quality indicators include latency, packet loss rate, jitter, available bandwidth, and connectivity status. The comprehensive evaluation module is used to normalize latency, jitter, and available bandwidth, dynamically adjust the weighting coefficients based on the fluctuation of each indicator within the sliding observation window, and calculate the comprehensive quality score for each connected tunnel. The decision module is used to generate switching instructions based on score ranking and hysteresis comparison logic; The anti-vibration module is used to filter out short-term ranking changes caused by instantaneous fluctuations in network indicators when selecting the primary tunnel based on the tunnel comprehensive quality score. The switching execution module is used to migrate business data streams from the original primary tunnel to the candidate tunnel according to the switching command.

[0035] The peer gateway includes a probe response module and a data merging module, which are used to cooperate with the local gateway to complete probe and smooth handover.

[0036] The method includes the following steps: Step 1: Multi-tunnel management: The multi-tunnel management module is deployed on the local gateway and its peer gateway; After the multi-tunnel management module starts up on the local gateway, it reads the set of tunnel parameters preset in the local configuration file. This set contains the resource configuration information for each IPSec tunnel to be established.

[0037] For each tunnel, the resource configuration information includes: the physical interface type used, the IP address or domain name of the peer gateway, the local IP address as the tunnel source, the source UDP port number, the destination UDP port number, the type of transport protocol to be used, and the encryption algorithm, authentication algorithm, and key negotiation parameters required for security association.

[0038] The multi-tunnel management module negotiates with the peer gateway one by one based on the resource configuration information to establish IPSec security associations; After successful negotiation, the multi-tunnel management module assigns a unique tunnel identifier i to each tunnel, i = 1, 2, ..., n, where n is the total number of tunnels that have been successfully established.

[0039] At the same time, a data structure corresponding to the tunnel is created in memory to record its basic attribute set, including: source address, destination address, source port, destination port, and negotiated security association parameters.

[0040] When the network topology changes, the administrator issues a tunnel addition command to the multi-tunnel management module while the gateway is running; The tunnel addition command carries all resource configuration information for the new tunnel. After receiving a new tunnel instruction, the multi-tunnel management module immediately initiates a negotiation process with the peer gateway. Once the negotiation is successful, a new tunnel identifier is assigned to the tunnel, and the value of n is incremented by one.

[0041] When an existing tunnel needs to be deleted, the administrator issues a tunnel deletion command, which includes the identifier of the target tunnel. After receiving a tunnel deletion command, the multi-tunnel management module sends a deletion notification to the peer gateway, releases the relevant security associations, reclaims the tunnel's identifier, and decrements the value of n by one.

[0042] Step 2: Tunnel Quality Inspection The quality detection module operates in a fixed cycle T, where T is a preset value. Let k be the sequence number of the current detection period, where k = 1, 2, 3, ...; At the beginning of each current detection period k, the quality detection module starts the active detection thread as follows: For all the currently established n tunnels, each tunnel i independently sends m probe messages, where m is a preset configuration item; The type of probe message is selected based on the transmission protocol carried by the tunnel: If the tunnel is based on UDP transmission, then send a dedicated UDP probe packet; If the tunnel is based on TCP transmission, then a dedicated TCP probe packet is sent.

[0043] When sending probe messages, the quality probe module writes the current sending timestamp and message sequence number into the payload of each message; Upon receiving the probe message, the probe response module of the peer gateway immediately generates a response message, bringing back the original sending timestamp and sequence number as is. After receiving the response message, the local gateway matches the corresponding sending record according to the sequence number, and calculates the round-trip delay value of the probe by subtracting the sending timestamp from the current receiving time.

[0044] The number of probe messages sent to tunnel i within the current probe period k is denoted as . The number of messages that successfully receive a response within the specified timeout period is recorded as follows: ,pass Calculate the number of messages for which no response was received. ; The round-trip delay values ​​for each successful message are recorded as follows: , ,..., ; pass Calculate the latency index ;pass Calculate the packet loss rate index ;pass Calculate the jitter index ; at the same time based on Define the connectivity index of tunnel i during the kth detection period. ;like If the value is greater than 0, then the connectivity index is determined. The value is 1; if =0, then determine the connectivity index. The value is 0.

[0045] In the passive detection section, the quality detection module mounts statistical collection points at the plaintext side interface of the gateway; This statistical collection point monitors the business data flow forwarded to the internal network after each tunnel is unblocked, and extracts the actual transmission rate from it; The actual transmission rate is obtained by dividing the cumulative number of bytes passed by the statistical collection points by the sampling time; The quality detection module subtracts the actual transmission rate from the theoretical maximum bandwidth of the tunnel, and uses the difference as an indicator of available bandwidth. The value of ; At the end of the detection period k, the quality detection module will calculate the connectivity index. Latency indicators Packet loss rate indicator jitter index Available bandwidth indicators Encapsulate it as a quality metric record.

[0046] Step 3: Comprehensive Assessment and Decision-Making The comprehensive evaluation module receives the quality metric records generated in each detection cycle and performs normalization processing. Based on the normalization results, the comprehensive evaluation module calculates the comprehensive quality score as follows: The comprehensive evaluation module obtains the preset maximum tolerable latency. Preset maximum tolerable jitter and the preset theoretical maximum bandwidth of the tunnel ; in, Determined based on the nominal rate of the physical interface used in the tunnel. The value is 200 milliseconds. The value is 50 milliseconds; pass , , Calculate the latency index respectively jitter index Available bandwidth indicators normalized value , , ; Among them, the packet loss rate indicator The values ​​are dimensionless values ​​in the range [0,1] and are not normalized.

[0047] The comprehensive evaluation module passed Calculate the comprehensive quality score of tunnel i within the detection period k. In the formula, , , , These are the weights set for latency, packet loss rate, jitter, and available bandwidth metrics, respectively.

[0048] The overall quality score S is multiplied by 100 to obtain the percentage score.

[0049] Meanwhile, the comprehensive evaluation module adaptively adjusts the weights of latency, packet loss rate, jitter, and available bandwidth metrics as follows: Step S1: Configure the initial weights for latency, packet loss rate, jitter, and available bandwidth in the comprehensive evaluation module, and record them as follows: , , , Furthermore, in the first detection period k=1 and when the sliding observation window is not filled, the preset initial weights are used.

[0050] Step S2: The comprehensive evaluation module maintains a sliding observation window of length Q. For each connected tunnel, the comprehensive evaluation module stores the normalized values ​​of the latency index, jitter index, and packet loss rate corresponding to its most recent Q sliding observation windows. During the detection period k, after the sliding observation window is filled with data, the standard deviation of the time delay index is calculated using the following formula: , In the formula, This represents the average value of the latency index. The standard deviation of the latency index, q = 0, 1, 2, ..., Q-1; Calculate the standard deviation of the packet loss rate index according to the calculation logic of the standard deviation corresponding to the latency index. and the standard deviation of the jitter index .

[0051] Step S3: Within K consecutive detection cycles, when the standard deviations of the normalized values ​​of the latency index, jitter index, and packet loss rate index within the sliding observation window are all less than the preset relative change threshold δ, it indicates that the fluctuations of the latency index, jitter index, and packet loss rate index have converged. At this point, comparison... , , The size of the value is used to extract the indicator category corresponding to the largest value, and at the same time, the preset adjustment step size ΔW=0.1 is extracted. When the indicator category corresponding to the largest value is a latency indicator, that is, when the latency indicator is the most volatile indicator, then... , , , Update weights , , , ; When the indicator category corresponding to the largest value is the packet loss rate indicator, that is, when the packet loss rate indicator is the most volatile indicator, then by... , , , Update weights , , , ; When the indicator category corresponding to the largest value is a jitter indicator, that is, a jitter indicator is an indicator with the most volatile fluctuations, then by... , , , Update weights , , , ; If a weight value is less than 0 during the deduction process, it will be forcibly set to 0, and the shortfall will be proportionally distributed from the remaining weights that are not the most volatile and whose current value is greater than 0, to ensure that the sum of the four is always 1.

[0052] The comprehensive evaluation module covers all For tunnels with a score of 1, the overall quality score is calculated as follows: Sort from high to low, mark the tunnel with the highest comprehensive quality score as the primary tunnel i (1) with a comprehensive quality score of S (1), and mark the tunnels with the other scores as candidate tunnels i (h), and mark the tunnel with the second highest comprehensive quality score as target tunnel i (h1) with a comprehensive quality score of S (h1). Among them, if =0, then directly Set the value to 0.

[0053] The decision-making process of the decision module adopts hysteresis comparison: the decision module reads the pre-configured switching threshold Sth and hysteresis gap H, where the default value of the switching threshold Sth is 60 points and the default value of the hysteresis gap H is 5 points.

[0054] If S(1)≥S th If not, the switch will not be triggered, and the current cycle decision will end; If S(1) < S th Further determine whether S(h1) > S(1) + H is satisfied. If satisfied, a switching intention is generated and submitted to the anti-vibration module. If not satisfied, no switching intention is generated and the current primary tunnel is maintained.

[0055] As a second embodiment of the present invention: In its specific implementation, compared to Embodiment 1, the technical solution of this embodiment differs only in that it further includes a fourth step: anti-vibration analysis. The anti-vibration module internally maintains a switching intention queue and a timer; When the input indicates a change of intention, the anti-vibration module starts a timer with a duration of T. D The timer. T D The initial value is 30 seconds, and the anti-vibration module also records the actual time taken for each tunnel to go from a fault interruption to a successful safe association reconstruction.

[0056] A sliding window of length 10 is used to record the time taken for the last ten reconstructions, and their arithmetic mean UP is calculated in real time. The time is then set to T. D Dynamically updated to 1.2×UP.

[0057] During the timer period, the comprehensive evaluation module and the decision-making module continue to output the latest comprehensive quality score and switching intention according to the detection cycle.

[0058] When the timer expires, the anti-vibration module queries the comprehensive evaluation and decision module again for the latest S(1) and S(h1) status; If at this point S(1) < S th If S(h1) > S(1) + H, then the quality degradation is determined to be a persistent state, and a formal switching instruction is sent to the switching execution module; If the conditions are no longer met, the handover intention is cancelled, the handover is not triggered, and the timer state is cleared to avoid frequent handovers due to momentary network jitter.

[0059] When a new switching intention arrives, if the timer is running, the target tunnels of the new and old intentions are compared. If the targets are the same, the new intention is ignored; if the targets are different, the current timer is canceled and the timer is restarted with the latest intention.

[0060] As an embodiment of the present invention: In its specific implementation, compared to Embodiment 1 and Embodiment 2, the technical solution of this embodiment is to combine the solutions of Embodiment 1 and Embodiment 2. The only difference between the technical solution of this embodiment and Embodiment 1 and Embodiment 2 is that this embodiment also includes a fifth step: switching execution. The decision-making module determines the current switching mode based on the comprehensive quality score of each tunnel, the preset switching threshold, and the load-sharing strategy, and generates the corresponding judgment result.

[0061] If the connectivity index of the current primary tunnel =0, meaning the current tunnel is completely interrupted, the decision module immediately determines to enter the fault switching mode; at this time, the decision module selects the tunnel with the highest comprehensive quality score from the candidate tunnel i(h) as the target tunnel and generates a fault switching instruction; The fault switching instruction includes: the switching type corresponding to the fault switching mode and the target tunnel identifier: i (h).

[0062] If the current tunnel's overall quality score remains at T C If the time is lower than the preset quality degradation threshold, and there are other tunnels with scores higher than the quality degradation threshold, the decision module determines to enter the quality switching mode. At this time, the decision module selects the tunnel with the highest comprehensive quality score from the candidate tunnel i(h) as the target tunnel and generates a quality switching command. The quality switching command includes: the switching type corresponding to the quality switching mode, and the target tunnel identifier: i(h); T C The preset duration value, where T C The value is 3 seconds, and the quality degradation threshold is 60 minutes.

[0063] If the current tunnel does not have any severe degradation or interruption that requires immediate switching, and there are at least two candidate tunnels i(h) whose comprehensive quality scores both exceed the preset load sharing activation threshold, and the absolute value of the difference between the highest and lowest comprehensive quality scores of the at least two candidate tunnels i(h) is less than the preset load balancing threshold, then the decision module determines to enter the load sharing mode. At this time, the decision module includes all candidate tunnels i(h) whose comprehensive quality scores exceed the load sharing activation threshold into the set V of tunnels participating in load sharing, and generates a load sharing instruction. The load sharing instruction includes: the switching type corresponding to the load sharing mode, the set of tunnels V participating in the sharing, and the tunnel identifier i(h) of the corresponding tunnel. The threshold for enabling load sharing is set at 70 points, and the threshold for load sharing balancing is set at 15 points.

[0064] If no fault switching command, quality switching command, or load sharing command is generated, the decision module maintains the current tunnel state.

[0065] The decision module sends the generated fault switching command, quality switching command, or load sharing command to the switching execution module.

[0066] The switching execution module receives the final formal switching instruction issued by the anti-vibration module. The formal switching instruction contains the switching type corresponding to the fault switching mode / quality switching mode / load sharing mode and the tunnel identifier of the target tunnel. The switching execution module first parses the switching type and then performs the corresponding tunnel operation accordingly. When the instruction type is fault switching mode or quality switching mode, check whether there is a TCP long connection service data stream currently being transmitted through the primary tunnel; If there is no TCP long-connection business data flow, a "hard switch" is performed directly: the encapsulation parameters of the data packets are updated to the security association and UDP header fields corresponding to the target tunnel, and all data packets are sent through the target tunnel.

[0067] If there is a TCP long-connection service data stream, a smooth switchover process will be initiated, as follows: The switching execution module sends a handshake probe packet to the target tunnel peer gateway to verify the end-to-end reachability of the path; after confirming reachability, the switching execution module starts dual-send mode. During dual-transmission mode, for each business data packet to be sent, the switching execution module copies it into two copies: one copy is encapsulated and sent using the original master tunnel parameters, and the other copy is encapsulated and sent using the target tunnel parameters.

[0068] The data merging module of the receiving gateway performs deduplication processing on the data packets received from the two tunnels.

[0069] Each data packet's IPSec encapsulation inner payload header carries a globally incrementing sequence number inserted by the sending gateway. For data packets with the same globally incrementing sequence number, the receiving gateway only decapsulates the first arriving packet and forwards it to the internal network; subsequent duplicate packets are discarded.

[0070] Before the sending gateway performs IPSec encapsulation, a custom probe / sequence number extension header is inserted between the IP header and the transport layer header of the original inner IP data packet. This extension header contains a globally incrementing sequence number. Then, standard IPSec tunnel mode encapsulation is performed. The ESP encryption range does not include the outer IP header of this extension header, but includes the extension header itself. After decryption, the peer gateway extracts the sequence number from the extension header for deduplication and restores the original IP data packet before forwarding it to the internal network.

[0071] The dual-transmission mode lasts for a preset transition time, with a default value of 2 seconds. After the transition time expires, the switching execution module stops sending data on the original primary tunnel, migrates all business data traffic to the target tunnel, and changes the status of the original primary tunnel to a candidate tunnel to continue participating in quality detection.

[0072] If the switching trigger is caused by the primary tunnel connectivity index becoming 0, the switching execution module does not need to wait for a full detection cycle, but directly adopts the fault switching mode, skips the dual-transmission mode, and immediately switches the traffic to the target tunnel.

[0073] When the instruction type is load sharing mode, the switching execution module extracts the set of tunnels V participating in the load sharing and their corresponding tunnel identifiers i (h) from the load sharing instruction. When entering the load sharing mode, the current primary tunnel is included in the set V of tunnels participating in the load sharing, and the load sharing weight of the primary tunnel and each tunnel in the set V of tunnels participating in the load sharing is determined according to the proportion of the current primary tunnel and the corresponding comprehensive quality score of each tunnel in its total comprehensive quality score. The formula for calculating the weight sharing is as follows: In the formula, V1 represents the weighting weight of the j-th tunnel, and V1 is the new set of tunnels formed after the current primary tunnel is included in the set of tunnels participating in the weighting. This represents the comprehensive quality score of the j-th candidate tunnel in the new tunnel set V1, where j is the identifier index of each tunnel in the new tunnel set V1, and includes the currently used primary tunnel, j∈i, and j≤i; The switching execution module performs weighted allocation of all service data streams based on the tunnel identifiers and load-sharing weights in the new tunnel set V1. This weighted allocation is implemented using a weighted round-robin scheduler. Within the same security policy context, when each data packet is sent, the weighted round-robin scheduler selects a tunnel for encapsulation and transmission based on the weight ratio of each tunnel, achieving load balancing among multiple tunnels. The weighted round-robin scheduler is a well-known existing technology and will not be elaborated upon further.

[0074] As an embodiment of the present invention: In specific implementation, compared with Embodiment 1, Embodiment 2 and Embodiment 3, the technical solution of this embodiment is to combine the solutions of Embodiment 1, Embodiment 2 and Embodiment 3.

[0075] Furthermore, any content not described in detail in this specification is existing technology known to those skilled in the art.

[0076] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0077] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

[0078] The various embodiments of this application have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or improvement of the technology in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A method for IPSec multi-tunnel quality detection and intelligent handover, deployed at the local gateway and the peer gateway, characterized in that, Includes the following steps: Multi-tunnel management: Establish and maintain multiple IPSec tunnels based on different communication resources between the local gateway and the peer gateway; Tunnel quality detection: Acquire multi-dimensional quality indicators for each tunnel within each preset detection cycle. These multi-dimensional quality indicators include latency, packet loss rate, jitter, available bandwidth, and connectivity. Comprehensive assessment and decision-making: The latency, jitter and available bandwidth indicators are normalized, and the corresponding weights are dynamically adjusted based on the fluctuation of each indicator within the sliding observation window to calculate the comprehensive quality score of each connected tunnel. The primary and target tunnels are generated based on the score ranking, and switching intentions are generated through hysteresis comparison logic. Anti-vibration analysis: When selecting the primary tunnel based on the tunnel comprehensive quality score, a switching hysteresis is applied to filter out short-term ranking changes caused by instantaneous fluctuations in network indicators and generate formal switching instructions. Switchover execution: Based on the switching instruction, the service data flow is migrated from the original primary tunnel to the target tunnel, or the service data flow is distributed to multiple tunnels according to weight to achieve load sharing when the load sharing conditions are met.

2. The method for IPSec multi-tunnel quality detection and intelligent switching according to claim 1, characterized in that, Multi-tunnel management includes: reading the preset tunnel parameter set in the local configuration file, which contains the resource configuration information of each IPSec tunnel to be established, including the physical interface type, the IP address or domain name of the peer gateway, the local IP address as the tunnel source, the source UDP port number, the destination UDP port number, the proposed transport protocol type, and the encryption algorithm, authentication algorithm, and key negotiation parameters required for security association; based on the resource configuration information, performing IKE negotiation with the peer gateway one by one to establish IPSec security association, and assigning a unique tunnel identifier i to each tunnel, i=1, 2, ..., n, where n is the total number of tunnels currently successfully established, while recording the basic attribute set of the tunnel.

3. The method for IPSec multi-tunnel quality detection and intelligent switching according to claim 2, characterized in that, Tunnel quality detection runs in a fixed cycle T; the current detection cycle number is recorded as k; at the beginning of each current detection cycle k, for all n established tunnels, each tunnel i independently sends m detection messages, where m is a preset configuration item; The detection message type is selected according to the transmission protocol carried by the tunnel; When sending probe messages, the current sending timestamp and message sequence number are written into the payload of each message; After receiving the probe message, the peer gateway generates a response message and sends back the original sending timestamp and sequence number as is. After receiving the response message, the local gateway matches the corresponding sending record according to the sequence number, subtracts the sending timestamp from the current receiving time, and calculates the round-trip delay value of this probe. The number of probe messages sent to tunnel i within the current probe period k is denoted as . The number of messages that successfully receive a response within the specified timeout period is recorded as follows: And based on that, determine the number of messages for which no response was received. The round-trip delay values ​​for each successful message are recorded as follows: , ,..., ; pass Calculate the latency index ;pass Calculate the packet loss rate index ;pass Calculate the jitter index ; at the same time based on Define the connectivity index of tunnel i during the kth detection period. ; like If the value is greater than 0, then the connectivity index is determined. The value is 1; if =0, then determine the connectivity index The value is 0.

4. The method for IPSec multi-tunnel quality detection and intelligent switching according to claim 3, characterized in that, Tunnel quality detection also includes a passive detection component. Statistical data collection points are mounted on the plaintext side interface of the local gateway to monitor the service data flow forwarded to the internal network after each tunnel is unblocked. The actual transmission rate is extracted from this data flow. The quality detection module subtracts the actual transmission rate from the theoretical maximum bandwidth of the tunnel, and uses the difference as the available bandwidth indicator. The value of ; At the end of the detection period k, the calculated connectivity index will be... Latency indicators Packet loss rate indicator jitter index and available bandwidth metrics obtained through passive detection. Encapsulate it as a quality metric record.

5. The method for IPSec multi-tunnel quality detection and intelligent switching according to claim 4, characterized in that, The normalization process is as follows: The preset maximum tolerable latency, maximum tolerable jitter, and theoretical maximum tunnel bandwidth are obtained. For latency, the smaller of the quotient (the current value divided by the maximum tolerable latency) and 1 is used as the normalized value. For jitter, the minimum of the quotient (the current value divided by the maximum tolerable jitter) and 1 is used as the normalized value. For available bandwidth, the smaller of the quotient (the current value divided by the theoretical maximum tunnel bandwidth) and 1 is used as the normalized value. Packet loss rate is not normalized. pass Calculate the comprehensive quality score of tunnel i within the detection period k. In the formula, , , , These are the weights set for latency, packet loss rate, jitter, and available bandwidth metrics, respectively. , , These are the normalized values ​​of latency, jitter, and available bandwidth, respectively. This is a packet loss rate metric.

6. The method for IPSec multi-tunnel quality detection and intelligent switching according to claim 5, characterized in that, The weights are dynamically adjusted as follows: In the first detection period k=1 and before the sliding observation window is filled, the preset initial weights are used; Within a sliding observation window of length Q, normalized values ​​of the corresponding latency, jitter, and packet loss rate are extracted. Once the sliding observation window is filled with data, calculate the standard deviation of the latency, packet loss rate, and jitter metrics. If, within K consecutive detection cycles, the normalized values ​​of the delay index, jitter index, and packet loss rate index, respectively, are all less than the preset relative change thresholds within the sliding observation window, then the comparison... , , The magnitude of the value is determined by identifying the category corresponding to the maximum value among the standard deviations of the normalized values ​​of latency, packet loss rate, and jitter. The weight corresponding to this category is then increased by a preset adjustment step. The remaining three weights are each reduced. ; If any weight is less than zero after deduction, it is set to zero, and the insufficient deduction amount is proportionally distributed among the remaining weights that are currently greater than zero, except for the weight corresponding to the maximum value indicator, so that the sum of the four weights is always 1.

7. The method for IPSec multi-tunnel quality detection and intelligent switching according to claim 6, characterized in that, All Tunnels with a score of 1 are rated based on their overall quality. Sort the tunnels from highest to lowest quality and mark the tunnel with the highest overall quality score as the primary tunnel i(1), with an overall quality score of S(1). Mark the tunnel with the second highest overall quality score as the target tunnel i(h1), with an overall quality score of S(h1). Read the pre-configured switching threshold Sth and hysteresis gap H. If S(1) ≥ S th If S(1) < S, then no switching will be triggered; th If the condition is met, determine whether S(h1) > S(1) + H. If it is met, generate a switching intention; otherwise, do not generate a switching intention.

8. The method for IPSec multi-tunnel quality detection and intelligent switching according to claim 1, characterized in that, Anti-vibration analysis includes: when a switching intention is received, initiating a timer with a duration of T. D The timer, comprehensive evaluation and decision-making steps continue to output the latest comprehensive quality score and switching intention according to the detection cycle; When the timer expires, re-query the latest S(1) and S(h1) states; if S(1) < S... th If S(h1) > S(1) + H, then send a formal switching instruction; otherwise, cancel the switching intention, do not trigger the switching, and clear the timer state. The handover execution includes: parsing the handover type and target tunnel identifier in the formal handover instruction; when the instruction type is fault handover mode or quality handover mode, and there is TCP long-connection service data flow, a smooth handover process is initiated: first, the end-to-end reachability of the target tunnel path is verified; then, dual-transmission mode is enabled, and each service data packet to be sent is copied twice and encapsulated and sent through the original primary tunnel and the target tunnel respectively; the sending gateway inserts a globally incrementing sequence number into each data packet, and the receiving gateway performs deduplication using the globally incrementing sequence number carried in the data packet; after the dual-transmission mode continues for a preset transition time, transmission on the original primary tunnel is stopped, all service data traffic is migrated to the target tunnel, and the original primary tunnel is changed to the target tunnel to continue participating in quality detection; if the connectivity index of the original primary tunnel becomes 0, causing a handover, the fault handover mode is directly adopted, the dual-transmission mode is skipped, and the traffic is immediately switched to the target tunnel.

9. The method for IPSec multi-tunnel quality detection and intelligent switching according to claim 8, characterized in that, When the instruction type is load sharing mode, extract the set of tunnels V participating in the sharing and their corresponding tunnel identifiers i(h) from the load sharing instruction. When entering the load sharing mode, the current primary tunnel is included in the set of tunnels V participating in the load sharing, thus forming a new tunnel set V1; the load sharing weight of each tunnel in the primary tunnel and the set of tunnels V participating in the load sharing is determined according to the proportion of the current primary tunnel and the corresponding comprehensive quality score of each tunnel in its total comprehensive quality score. All business data streams are weighted and allocated based on the tunnel identifiers and load-sharing weights in the new tunnel set V1.

10. An IPSec multi-tunnel quality detection and intelligent handover system, the system being used to execute the IPSec multi-tunnel quality detection and intelligent handover method according to any one of claims 1-9, characterized in that, The system includes: The multi-tunnel management module is used to establish and maintain multiple IPSec tunnels based on different communication resources with the peer gateway; The quality detection module is used to acquire multi-dimensional quality indicators for each tunnel within each preset detection cycle; The comprehensive evaluation module is used to normalize latency, jitter, and available bandwidth, dynamically adjust the weight coefficients based on the fluctuation of each indicator within the sliding observation window, and calculate the comprehensive quality score of each connected tunnel. The decision module is used to generate switching instructions based on score ranking and hysteresis comparison logic; The anti-vibration module is used to filter out short-term ranking changes caused by instantaneous fluctuations in network indicators when selecting the primary tunnel based on the tunnel comprehensive quality score. The switching execution module is used to migrate business data streams from the original primary tunnel to the target tunnel according to the switching command.

Images