A network topology self-adaptive control-based intranet device remote access system and method

Abstract

This invention provides a remote access system and method for intranet devices based on network topology adaptive control. The system comprises a VPN server, a mapping database, and a reverse proxy server forming the basic architecture. The VPN server has a built-in virtual link state storage unit. When a device experiences a momentary disconnection due to network jitter, it temporarily refrains from broadcasting the offline status to the database, puts the corresponding dedicated fixed IP into a suspended state, and maintains the logical link through a shadow IP. If the device reconnects within a preset window, traffic forwarding is directly restored. The reverse proxy server has a built-in network status evaluation module that calculates a health score based on the frequency of device disconnections. If the score is below a threshold, the local routing cache duration is extended to reduce the frequency of invalid probes. Beneficial effects: It can buffer momentary network jitter, achieving a seamless transition of network topology changes to upper-layer services; it suppresses invalid probes and frequent data writes, effectively reducing resource consumption.

Description

Technical Field

[0001] This invention relates to the field of network communication technology, and specifically to a system and method for remote access to intranet devices based on network topology adaptive control. Background Technology

[0002] With the rapid development and large-scale implementation of the Industrial Internet, massive numbers of industrial edge devices are widely deployed in various local area network environments such as production plants and power grid sites. These devices encompass multiple core terminals, including programmable logic controllers (PLCs), frequency converters, smart meters, and data acquisition gateways, serving as the underlying support nodes for industrial production operations and on-site management. Traditional operation and maintenance (O&M) models rely on technical personnel to conduct on-site equipment debugging, fault diagnosis, and firmware upgrades. This approach suffers from drawbacks such as long response cycles, high labor costs, and difficulties in batch management, making it unsuitable for the O&M management needs of distributed industrial equipment. Against this backdrop, enabling remote access to internal network devices via the public network has become a rigid requirement for remote maintenance, fault diagnosis, and firmware upgrades in industrial scenarios. It is a core foundational support for improving industrial O&M efficiency and reducing operating costs.

[0003] Current mainstream remote access solutions for intranet devices mostly adopt a virtual private network tunnel-linked reverse proxy architecture. While this can meet basic access needs in a stable network environment, it has significant drawbacks under the complex communication conditions of industrial scenarios. Industrial sites often rely on 4G / 5G cellular networks or wireless microwave links for public network access. Signals are easily affected by physical environment, electromagnetic interference, base station switching, and other factors, causing devices to frequently experience network topology fluctuations of "instantaneous disconnection-redialing-connection recovery." In existing solutions, the device disconnection status is synchronized to the mapping database and reverse proxy nodes in real time, causing frequent writes and erases of routing tables and mapping data, generating a large number of invalid probe requests and data update operations, continuously consuming the system's core computing power and connection resources. At the same time, instantaneous disconnection directly interrupts upper-layer service access, leading to abnormal interruptions in remote operation and maintenance, severely reducing the stability of remote access services, and making it unsuitable for the harsh network operating environment of industrial sites. Summary of the Invention

[0004] To address the problems in the prior art, this invention provides a system and method for remote access to intranet devices based on network topology adaptive control.

[0005] The present invention provides a remote access system for intranet devices based on network topology adaptive control, including a VPN server, a mapping database and a reverse proxy server. The VPN server is used to establish a network layer tunnel with the intranet access device and allocate virtual IP addresses. The mapping database is connected to the VPN server and is used to store the mapping relationship between the intranet access device and the corresponding virtual IP address. The reverse proxy server is used to receive external access requests and forward them to the target intranet access device. The VPN server has a built-in virtual link state storage unit. When it detects that an internal network access device is momentarily disconnected due to network jitter, it will not broadcast the device's offline status to the mapping database, but will put the dedicated fixed IP corresponding to the internal network access device into a suspended state, and will perform virtual proxy answering through the shadow IP proxy answering mechanism configured by the virtual link state storage unit to maintain the logical link. If the intranet access device successfully reconnects within the preset sliding window time, traffic forwarding for that dedicated fixed IP address will be restored directly. The reverse proxy server has a built-in network status assessment and routing optimization module, which is used to calculate the network health score based on the historical disconnection frequency of the internal network access devices, and dynamically adjust the lifespan of the reverse proxy server's local route cache based on the network health score. When the network health score of an intranet access device is lower than a preset threshold, the lifespan of the corresponding local route cache of the device is extended proportionally to reduce the frequency of invalid probes to the VPN server.

[0006] In a further improvement, the VPN server also has a built-in hash address allocation module. The hash address allocation module is used to perform one-way hash calculation based on the unique hardware serial number of the intranet access device during the system initialization phase, and map the calculation result to a unique dedicated fixed IP within the VPN virtual network segment. The IP resource allocation is completed in advance and the mapping relationship is synchronized to the mapping database for pre-storage.

[0007] The invention is further improved by including an automatic domain name generation module. The automatic domain name generation module has a built-in salted hash desensitization unit, which is used to read the hardware serial number of the intranet access device, convert it into an obfuscated string through salted hash conversion as a subdomain prefix, and concatenate it with a preset wildcard main domain name to generate a unique exclusive access domain name for each intranet access device.

[0008] In a further improvement, the reverse proxy server also has a built-in non-blocking state detection module. After receiving an external domain name access request and hitting the route, the reverse proxy server initiates a tunnel liveness query to the VPN server in a non-blocking manner through the non-blocking state detection module and the permanent internal control channel between the VPN server and the VPN server.

[0009] The present invention is further improved by using a set of independent TCP connection pools configured with a long connection keep-alive mechanism for the resident internal control channel; the non-blocking state detection module uses an event-driven mechanism to reuse the independent TCP connection pools for communication, and immediately releases the current working thread after initiating a tunnel liveness query, and triggers traffic forwarding operation after receiving the tunnel status callback returned by the VPN server.

[0010] This invention also discloses a method for remote access to intranet devices based on network topology adaptive control, comprising the following steps: Step S1: The intranet access device initiates a dial-up request to the VPN server, establishes a network layer tunnel and binds the corresponding dedicated fixed IP. The device access status and tunnel status timestamps are synchronized to the mapping database for storage. Step S2: The VPN server monitors the tunnel connection status of the intranet access device in real time. When it detects that the intranet access device is momentarily disconnected due to network jitter, it does not update the offline status of the device to the mapping database, puts the dedicated fixed IP corresponding to the device into a suspended state, and performs virtual proxy answering through the shadow IP proxy answering mechanism to maintain the logical link. If the intranet access device successfully reconnects within the preset sliding window time, the traffic forwarding of the dedicated fixed IP is directly restored. Step S3: The reverse proxy server counts the historical disconnection frequency of internal network access devices, calculates the network health score of the corresponding device, and dynamically adjusts the lifespan of the local routing cache based on the network health score. When the network health score of a device is lower than a preset threshold, the lifespan of the corresponding local routing cache of the device is extended proportionally to reduce invalid probe requests to the VPN server.

[0011] The invention is further improved by including a non-blocking access processing step: after receiving an external domain name access request and hitting the route, the reverse proxy server initiates a tunnel liveness query to the VPN server in a non-blocking manner through a resident internal control channel with the VPN server; if the tunnel is detected to be live, the external access request is forwarded to the target intranet access device; if the detection fails or the shadow IP proxy answering mechanism is triggered, the current external request is suspended or a customized prompt is returned.

[0012] The present invention is further improved by including a dedicated domain name generation step: reading the hardware serial number of the intranet access device, generating an obfuscated string as a subdomain prefix through salted hash conversion, and concatenating it with a preset wildcard main domain name to generate a unique dedicated access domain name for each intranet access device.

[0013] The present invention is further improved by including an initial IP pre-allocation step before step S1: During the system initialization phase, the unique hardware serial number of all intranet access devices is read, a one-way hash calculation is performed based on the hardware serial number to map the unique dedicated fixed IP within the VPN virtual network segment, and the mapping relationship between the hardware serial number and the dedicated fixed IP is pre-stored in the mapping database.

[0014] This invention is further improved by using the MurmurHash3 algorithm to perform one-way hash calculation on the hardware serial number, mapping the variable-length hardware serial number to a unique 32-bit dedicated fixed IP within the VPN virtual network segment. The mapping relationship remains fixed throughout the entire life cycle of the device.

[0015] Compared with existing technologies, the beneficial effects of this invention are as follows: This invention provides a remote access system and method for intranet devices based on network topology adaptive control, which solves the problem of network topology oscillation caused by high-frequency network jitter in industrial scenarios, avoids the ineffective consumption of core system resources, and ensures the continuity and stability of service access. The specific beneficial effects are as follows: 1. Topology-adaptive anti-surge mechanism, balancing business continuity and core resource protection. This invention maintains a brief logical link for momentarily disconnected devices through the shadow IP proxy mechanism of the virtual link state temporary storage unit, avoiding upper-layer service interruptions caused by real-time broadcasting of disconnection status, and achieving a seamless transition of network topology changes to the application layer. At the same time, combined with a dynamic routing cache optimization strategy based on network health, it actively extends the local cache lifespan of high-frequency disconnected devices, filtering out more than 90% of invalid probe requests caused by momentary jitter in weak networks, avoiding frequent writing and erasing of databases and routing tables, reducing the ineffective consumption of core system resources from the source, and achieving adaptive control of network topology.

[0016] 2. Lock-free IP pre-allocation solves the bottleneck of high-concurrency access avalanche. This invention transforms traditional dynamic IP allocation into deterministic mathematical calculations based on hardware serial numbers through a hash address allocation module, reducing computational complexity to O(1). When a large number of devices access the network concurrently, the VPN server does not need to perform database IP retrieval and locking write operations, and can complete access verification in microseconds. This effectively solves the routing allocation table locking and access avalanche problems in the scenario of concurrent power restoration and power-on of industrial equipment clusters, and greatly improves the system response speed in the scenario of large-scale device access.

[0017] 3. Asynchronous non-blocking detection enhances the concurrent load capacity of public network gateways. This invention achieves asynchronous, non-blocking detection of device liveness status through an independent long-connection internal control channel and an event-driven mechanism. Once the reverse proxy worker thread initiates a detection request, it can release and process other requests without synchronously waiting for the detection result, thus completely avoiding thread blocking and connection resource exhaustion problems, and significantly improving the concurrent stress resistance and system stability of the public network gateway.

[0018] 4. Anonymized domain name generation ensures device identification security. This invention generates a unique access domain name by desensitizing the device hardware serial number through salt hashing. While ensuring a one-to-one mapping between the domain name and the device, it avoids directly exposing the original hardware identifier of the device to the public network environment, effectively improving the security of remote access and the device privacy protection capabilities. Attached Figure Description

[0019] To more clearly illustrate the solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0020] Figure 1 This is a schematic diagram of a remote access system for intranet devices based on network topology adaptive control according to the present invention. Figure 2 This is a flowchart of a method for remote access to intranet devices based on network topology adaptive control according to the present invention. Detailed Implementation

[0021] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs; the terminology used herein in the specification of the application is for the purpose of describing particular embodiments only and is not intended to limit the application; the terms “comprising” and “having” and any variations thereof in the specification, claims and foregoing description of the drawings are intended to cover non-exclusive inclusion.

[0022] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0023] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings.

[0024] like Figure 1 As shown, this invention provides a remote access system for intranet devices based on network topology adaptive control, including a VPN server, a mapping database, a reverse proxy server, and a domain name automatic generation module. The system is based on the core logic of "pre-allocation addressing + link temporary buffering + adaptive routing scheduling" to achieve network topology adaptive control, providing stable public network remote access capabilities for industrial edge devices deployed within a local area network.

[0025] The VPN server, dynamic mapping database, and reverse proxy server are deployed on a public network server.

[0026] The functions and collaborative relationships of each part are as follows: The VPN server is the core of the system's network layer tunnel management, with a built-in hash address allocation module and virtual link state storage unit. The hash address allocation module is responsible for pre-generating a dedicated fixed IP based on the device's hardware serial number during the system initialization phase, completing the pre-allocation of address resources. The virtual link state storage unit is responsible for maintaining the logical link through a shadow IP proxy mechanism configured in the virtual link state storage unit when the device experiences a momentary disconnection, thus achieving the underlying buffering of topology changes.

[0027] The shadow IP proxy mechanism refers to a buffer mechanism where, after a device momentarily disconnects, the VPN server generates a temporary virtual IP to handle upper-layer access requests. This does not reclaim the device's original dedicated fixed IP or update the offline status, and waits for the device to reconnect within a sliding window.

[0028] The mapping database and the VPN server are connected bidirectionally. On the one hand, it pre-stores the mapping relationship between hardware serial numbers and dedicated fixed IPs. On the other hand, it receives device access and status change events pushed by the VPN server and synchronously stores tunnel status timestamps, providing baseline data for routing queries and status verification across the entire link.

[0029] A reverse proxy server serves as the unified traffic entry point for external access requests, and it incorporates a non-blocking state detection module and a network status assessment and routing optimization module. The non-blocking state detection module asynchronously queries the VPN server for the device tunnel's liveness status; the network status assessment and routing optimization module calculates network health based on historical device disconnection data and dynamically adjusts the lifespan of the local routing cache.

[0030] After receiving an external domain name access request and hitting the route, the reverse proxy server initiates a tunnel liveness query to the VPN server in a non-blocking manner through the non-blocking state detection module via the resident internal control channel between the VPN server and the VPN server.

[0031] The resident internal control channel is a set of independent TCP connection pools configured with a long connection keep-alive mechanism; the non-blocking state detection module uses an event-driven mechanism to reuse the independent TCP connection pools for communication. After initiating a tunnel liveness query, it immediately releases the current working thread and triggers traffic forwarding operation after receiving the tunnel status callback returned by the VPN server.

[0032] The domain name automatic generation module is responsible for reading the device hardware serial number, and after salting and hashing to de-identify it, generating a unique access domain name for each device, realizing a one-to-one mapping between device identifier and public network access address.

[0033] The collaborative workflow of each module is as follows: During the initialization phase, the VPN server pre-allocates IPs for all devices through the hash address allocation module and synchronizes them to the mapping database for persistent storage; During the device access phase, the VPN server verifies the device identity and establishes a tunnel, synchronizing the access status to the mapping database; During the external access phase, the reverse proxy server receives domain name requests, queries the mapping database or local cache to obtain the target IP, and forwards the traffic after confirming the tunnel status with the VPN server in a non-blocking manner; In network jitter scenarios, the VPN server's link buffering mechanism and the reverse proxy's cache optimization mechanism work together across layers to achieve adaptive suppression of topology turbulence.

[0034] The beneficial effects of this architecture are: by modular decomposition and cross-module collaboration, the IP allocation, tunnel management, traffic scheduling and state caching are decoupled, which not only ensures the independent optimization space of each link, but also realizes systematic topology adaptive control through the collaborative mechanism. Compared with the traditional integrated architecture, it is more suitable for the complex and harsh network environment of industrial scenarios.

[0035] like Figure 2 As shown, the present invention also provides a method for remote access to intranet devices based on network topology adaptive control. This method is used in the above-mentioned system. The steps of the method for remote access to intranet devices based on network topology adaptive control in this example are as follows: (1) Initialize IP pre-allocation steps The VPN server, dynamic mapping database, and reverse proxy server are deployed on a public network server. After the system is deployed, the VPN server reads the unique hardware serial number of all internal network access devices and maps the hardware serial number of each device to a unique dedicated fixed IP within the VPN virtual network segment using a one-way hash algorithm. The one-to-one mapping relationship between the hardware serial number and the dedicated fixed IP is pre-stored in the mapping database.

[0036] Functions and benefits: By moving the IP resource allocation process from the device access stage to the system initialization stage, and replacing the traditional dynamic retrieval and allocation with deterministic mathematical calculations, the database locking operation during device access is eliminated, thus avoiding the table locking and routing conflict problems in high-concurrency access scenarios from the root, and significantly improving the response efficiency when a large number of devices access at the same time.

[0037] (2) Secure access and status activation steps After the intranet access device is powered on, it automatically initiates a network layer dial-up request to the VPN server. The VPN server calculates the corresponding dedicated fixed IP based on the hardware serial number. After the verification is successful, a network layer tunnel is established, the forwarding permission of the corresponding IP is activated, and the device access event and tunnel status timestamp are synchronized to the mapping database for persistent storage.

[0038] Functions and benefits: Relying on pre-allocated fixed IPs, devices only need to perform hash calculations and identity verification when accessing the network. There is no need to perform IP resource retrieval and allocation operations. The access verification time is reduced to the microsecond level, which can support the concurrent access of tens of thousands of devices and is suitable for batch reconnection scenarios such as power grid restoration and base station fault recovery.

[0039] (3) Steps for generating a dedicated access domain name The domain name automatic generation module reads the hardware serial number of the intranet access device, and after salting and hashing to de-identify it, generates an obfuscated string as a subdomain prefix. This string is then concatenated with the pre-configured wildcard main domain name to generate a unique access domain name for each device.

[0040] Functions and benefits: Hash desensitization enables privacy protection of device hardware identifiers, preventing the original serial number from being directly exposed to the public network environment and reducing the risk of targeted attacks on the device; at the same time, the architecture based on wildcard domain names eliminates the need to configure DNS resolution for each device individually, significantly reducing domain name maintenance costs.

[0041] (4) Instantaneous disconnection topology buffering steps The VPN server monitors the tunnel connection status of each device in real time. When a device is detected to have a momentary disconnection due to network jitter, the server will not broadcast the device's offline status to the mapping database. Instead, it will put the corresponding dedicated fixed IP into a suspended state and activate the shadow IP proxy mechanism to perform virtual proxying to maintain the logical link. If the device successfully reconnects within the preset sliding window time, the traffic forwarding of the original dedicated fixed IP will be restored directly.

[0042] Functions and benefits: By using the buffering mechanism of shadow IP proxy, the instantaneous network jitter in industrial scenarios is decoupled from upper-layer business access, avoiding business access interruptions caused by short-term signal interruptions, and realizing a seamless transition of network layer topology changes to the application layer; at the same time, offline status broadcasting is temporarily suspended, avoiding frequent data erasure and writing to the mapping database due to high-frequency disconnections, and reducing database resource consumption.

[0043] (5) Adaptive route caching optimization steps The reverse proxy server continuously monitors the historical disconnection frequency of each internal network access device and calculates the network health score of the corresponding device. When the network health score of a device is lower than a preset threshold, the device's lifespan in the reverse proxy's local routing cache is extended proportionally to reduce invalid probe requests to the VPN server.

[0044] Functions and benefits: Based on the actual network quality of the devices, the caching strategy is adjusted accordingly. The cache period is actively extended for devices with high frequency jitter in weak networks. This can block most of the repeated probe requests caused by instantaneous jitter, suppress the impact of invalid traffic on the core system from the access entry side, and achieve adaptive suppression of network topology fluctuations.

[0045] (6) Non-blocking remote access processing steps External users initiate access requests through a dedicated access domain name. After the request reaches the reverse proxy server, it resolves and extracts the device identifier, queries the local routing cache or mapping database to obtain the target IP. After the route is matched, the reverse proxy initiates a tunnel liveness query in a non-blocking manner through a resident internal control channel with the VPN server. After initiating the query, it immediately releases the current worker thread to process other requests. After receiving the callback response that the tunnel is live, the access request is then forwarded to the target internal network device.

[0046] Functions and benefits: By adopting an event-driven, non-blocking probe mode, the blocking problem of worker threads caused by traditional synchronous probes is completely avoided. It will not cause the proxy server thread pool to run out when the underlying VPN tunnel response is delayed, thus significantly improving the concurrent carrying capacity and system stability of the reverse proxy.

[0047] This embodiment takes the remote operation and maintenance scenario of factory equipment in an industrial IoT enterprise as an example to further illustrate the role and beneficial effects of each technical feature, and provides a detailed description of the system deployment and operation process: Scenario Setup: This deployment covers 200 industrial intranet data acquisition gateway devices, each with a globally unique hardware serial number pre-installed (e.g., SN202600123). On the public network side, a VPN server cluster, a dynamic mapping database, and a reverse proxy server cluster are deployed. The wildcard DNS main domain is configured as *.iot-factory.com, the VPN virtual address range is 10.20.0.0 / 16, the preset instantaneous disconnection sliding window time is 5 seconds, the default route cache lifespan is 5 seconds, and the network health threshold is 60 points.

[0048] Implementation steps and corresponding effects: 1. Static hash pre-allocation phase.

[0049] During system initialization and deployment, the built-in hash address allocation module of the VPN server reads the hardware serial numbers of all 200 gateways in batches. It then performs a one-way irreversible hash calculation on each serial number using the MurmurHash3 algorithm, mapping the variable-length string serial number to a unique 32-bit dedicated fixed IP address within the 10.20.0.0 / 16 network segment. For example, serial number SN202600123 is mapped to 10.20.0.15 after calculation, and serial number SN202600124 is mapped to 10.20.0.16. All mapping relationships remain fixed throughout the device's lifespan. After the calculation is complete, the hash address allocation module batch synchronizes all "hardware serial number-dedicated fixed IP" mapping relationships to the dynamic mapping database for pre-storage.

[0050] Functions and Benefits: The MurmurHash3 algorithm ensures high-speed hash calculation and low collision rate, reducing the computational complexity of IP allocation to O(1). In the pre-allocation mode, IP resources are allocated in one go during the initialization phase. When devices connect, there is no need to perform operations such as idle IP retrieval and database locking, thus eliminating the table locking bottleneck of traditional dynamic IP allocation from an architectural perspective. When encountering scenarios such as regional power grid restoration or base station failure recovery, and 200 gateways simultaneously initiate concurrent reconnection, the VPN server only needs to complete the hash calculation in memory to complete IP verification. The access time for a single device can reach the microsecond level, completely avoiding the problems of concurrent access avalanche and routing configuration conflicts. 2. Lock-free access and virtual state buffering phase.

[0051] After the gateway device is powered on, it automatically initiates a VPN dial-up request to the VPN server, carrying its own hardware serial number in the request. After receiving the request, the VPN server calculates the dedicated fixed IP corresponding to the serial number (such as 10.20.0.15) in real time through the hash address allocation module. After verifying the identity, it directly establishes a network layer tunnel, activates the traffic forwarding permission of the IP, and pushes the "device access, tunnel activation" event and timestamp to the dynamic mapping database to update the status.

[0052] When a gateway within the factory experiences a 2-second momentary signal interruption due to cellular base station switching, the VPN server's virtual link state temporary storage unit immediately detects the tunnel disconnection. At this time, it temporarily refrains from broadcasting the device's offline status to the dynamic mapping database, nor does it reclaim the 10.20.0.15 IP resource. Instead, it puts the IP into a suspended state and simultaneously activates the corresponding shadow IP proxy mechanism to perform virtual proxying, maintaining the logical link at the routing layer. Three seconds later, the gateway reconnects via a new base station. After verifying the hardware serial number, the VPN server directly aligns the 10.20.0.15 IP resource and resumes real traffic forwarding.

[0053] Functions and Benefits: Shadow IP proxy provides a buffer window for momentary disconnections. For the extremely high incidence of second-level instantaneous jitter in industrial scenarios, it eliminates the need to trigger a full-link state update process. After device reconnection, the original fixed IP is directly reused without the need for address reallocation and route updates, achieving complete insensitivity of network topology changes to upper-layer services. Simultaneously, suspending offline status broadcasting avoids frequent CRUD operations on the mapping database due to high-frequency disconnections, significantly reducing database write pressure and resource consumption. If the device disconnection exceeds a 5-second sliding window without reconnection, the VPN server then officially updates the device status to offline and synchronizes it to the database, balancing jitter buffering and status accuracy.

[0054] 3. Generation of de-identified domain names and non-blocking access phase.

[0055] The domain name generation module reads the hardware serial number of each gateway, obfuscates the original serial number using a salted MD5 hash algorithm, and generates a 32-bit fixed-length string as a subdomain prefix. This string is then concatenated with the wildcard main domain to generate a unique access domain. For example, the serial number SN202600123 corresponds to the unique domain name a1b2c3d4.iot-factory.com. This domain name corresponds one-to-one with the device and cannot be reverse-resolved to retrieve the original hardware serial number.

[0056] External operations personnel initiate an HTTP access request by entering the dedicated domain name on the public network. After DNS resolution, the request reaches the reverse proxy server. The reverse proxy server resolves the subdomain prefix, matches the corresponding device identifier, and queries its local routing cache, finding the target IP as 10.20.0.15. At this point, the non-blocking state detection module of the reverse proxy server sends a tunnel liveness probe packet to the VPN server through a persistent internal control channel (a set of independent connection pools configured with TCP long-lived connections). After sending, it immediately releases the worker thread currently processing the request, allowing it to handle access requests from other users. When the VPN server returns a "tunnel active" status response, the reverse proxy triggers traffic forwarding through an event callback mechanism, seamlessly forwarding the user request to the target intranet gateway.

[0057] Functions and Benefits: Salted hash domain name generation achieves public network desensitization of device identifiers, effectively preventing targeted attacks based on device serial numbers and improving the security of remote access; the independent internal control connection pool is physically isolated from the business access channel, avoiding the consumption of business bandwidth by probe traffic. The non-blocking probe mode completely changes the traditional synchronous waiting processing logic. Worker threads do not need to block and wait for probe results, increasing the concurrent access capacity of a single reverse proxy server by more than 3 times. Even if the VPN server experiences response delays due to network fluctuations, it will not lead to the exhaustion of the reverse proxy thread pool or service avalanche, significantly improving the stability of the public network gateway.

[0058] 4. Health assessment and adaptive anti-surge phase.

[0059] The reverse proxy server's network status assessment and routing optimization module continuously collects disconnection and reconnection data from all devices, calculating a network health score with a one-hour statistical window. The initial health score is 100 points, and 3 points are deducted for each disconnection and reconnection. During operation, a gateway deployed at the edge of the factory experienced severe signal obstruction, resulting in 22 disconnections and reconnections within one hour, causing its network health score to drop to 34 points, below the preset threshold of 60 points. The system then triggered a routing cache optimization rule, proportionally extending the local routing cache lifetime of this device from the default 5 seconds to 60 seconds.

[0060] For the next 60 seconds, for all repeated access requests to this device's domain name, the reverse proxy server directly reads the locally cached routing information and status, and no longer sends real-time probe requests to the VPN server. Combined with the VPN server's shadow IP proxy mechanism, the gateway's high-frequency transient jitter is completely intercepted at the system level and will not be transmitted to the database or core business logic.

[0061] Functions and Benefits: Health assessment based on historical disconnection data enables quantitative control of network quality, while differentiated caching strategies provide targeted protection for devices with weak networks. Through a two-layer collaborative mechanism of "VPN-side link caching + proxy-side cache extension," the system can filter out over 90% of instantaneous blind spot jitter in industrial wireless networks, reducing invalid probes and status update operations at the source, preventing core system resources from being consumed by invalid traffic, achieving true network topology adaptive control, and ensuring the resource robustness of the entire network operation and maintenance system.

[0062] As can be seen from the above, this invention provides a remote access system and method for intranet devices based on network topology adaptive control, which solves the problem of network topology oscillation caused by high-frequency network jitter in industrial scenarios, avoids the ineffective consumption of core system resources, and ensures the continuity and stability of service access. The specific beneficial effects are as follows: 1. Topology-adaptive anti-surge mechanism, balancing business continuity and core resource protection. This invention maintains a brief logical link for momentarily disconnected devices through the shadow IP proxy mechanism of the virtual link state temporary storage unit, avoiding upper-layer service interruptions caused by real-time broadcasting of disconnection status, and achieving a seamless transition of network topology changes to the application layer. At the same time, combined with a dynamic routing cache optimization strategy based on network health, it actively extends the local cache lifespan of high-frequency disconnected devices, filtering out more than 90% of invalid probe requests caused by momentary jitter in weak networks, avoiding frequent writing and erasing of databases and routing tables, reducing the ineffective consumption of core system resources from the source, and achieving adaptive control of network topology.

[0063] 2. Lock-free IP pre-allocation solves the bottleneck of high-concurrency access avalanche. This invention transforms traditional dynamic IP allocation into deterministic mathematical calculations based on hardware serial numbers through a hash address allocation module, reducing computational complexity to O(1). When a large number of devices access the network concurrently, the VPN server does not need to perform database IP retrieval and locking write operations, and can complete access verification in microseconds. This effectively solves the routing allocation table locking and access avalanche problems in the scenario of concurrent power restoration and power-on of industrial equipment clusters, and greatly improves the system response speed in the scenario of large-scale device access.

[0064] 3. Asynchronous non-blocking detection enhances the concurrent load capacity of public network gateways. This invention achieves asynchronous, non-blocking detection of device liveness status through an independent long-connection internal control channel and an event-driven mechanism. Once the reverse proxy worker thread initiates a detection request, it can release and process other requests without synchronously waiting for the detection result, thus completely avoiding thread blocking and connection resource exhaustion problems, and significantly improving the concurrent stress resistance and system stability of the public network gateway.

[0065] 4. Anonymized domain name generation ensures device identification security. This invention generates a unique access domain name by desensitizing the device hardware serial number through salt hashing. While ensuring a one-to-one mapping between the domain name and the device, it avoids directly exposing the original hardware identifier of the device to the public network environment, effectively improving the security of remote access and the device privacy protection capabilities.

[0066] The specific embodiments described above are preferred embodiments of the present invention and are not intended to limit the specific scope of the present invention. The scope of the present invention includes, but is not limited to, these specific embodiments. All equivalent changes made in accordance with the present invention are within the protection scope of the present invention.

Claims

1. A remote access system for intranet devices based on network topology adaptive control, characterized in that, It includes a VPN server, a mapping database, and a reverse proxy server. The VPN server is used to establish a network layer tunnel with the intranet access device and allocate virtual IP addresses. The mapping database is connected to the VPN server and is used to store the mapping relationship between the intranet access device and the corresponding virtual IP address. The reverse proxy server is used to receive external access requests and forward them to the target intranet access device. The VPN server has a built-in virtual link state temporary storage unit, which is used to detect when an intranet access device experiences a momentary disconnection due to network jitter. When this occurs, the device will not broadcast its offline status to the mapping database, but will put the dedicated fixed IP address corresponding to the intranet access device into a suspended state. The virtual IP proxy mechanism configured by the virtual link state temporary storage unit will be used to perform virtual proxying to maintain the logical link. If the intranet access device successfully reconnects within the preset sliding window time, traffic forwarding for that dedicated fixed IP address will be restored directly. The reverse proxy server has a built-in network status assessment and routing optimization module, which is used to calculate the network health score based on the historical disconnection frequency of the intranet access devices, and dynamically adjust the lifespan of the local routing cache of the reverse proxy server based on the network health score. When the network health score of an intranet access device is lower than a preset threshold, the lifespan of the corresponding local route cache of the device is extended proportionally to reduce the frequency of invalid probes to the VPN server.

2. The intranet device remote access system based on network topology adaptive control according to claim 1, characterized in that: The VPN server also has a built-in hash address allocation module. During the system initialization phase, the hash address allocation module performs a one-way hash calculation based on the unique hardware serial number of the intranet access device, maps the calculation result to a unique dedicated fixed IP within the VPN virtual network segment, pre-allocates IP resources, and synchronizes the mapping relationship to the mapping database for pre-storage.

3. The intranet device remote access system based on network topology adaptive control according to claim 1, characterized in that: It also includes an automatic domain name generation module, which has a built-in salted hash desensitization unit for reading the hardware serial number of the intranet access device, converting it with salted hash to generate an obfuscated string as a subdomain prefix, and concatenating it with a preset wildcard main domain name to generate a unique exclusive access domain name for each intranet access device.

4. The intranet device remote access system based on network topology adaptive control according to claim 1, characterized in that: The reverse proxy server also has a built-in non-blocking state detection module; after receiving an external domain name access request and hitting the route, the reverse proxy server initiates a tunnel liveness query to the VPN server in a non-blocking manner through the non-blocking state detection module and the permanent internal control channel between the VPN server and the VPN server.

5. The intranet device remote access system based on network topology adaptive control according to claim 4, characterized in that: The resident internal control channel is a set of independent TCP connection pools configured with a long connection keep-alive mechanism; the non-blocking state detection module uses an event-driven mechanism to reuse the independent TCP connection pools for communication, and immediately releases the current working thread after initiating a tunnel liveness query, and triggers traffic forwarding operation after receiving the tunnel status callback returned by the VPN server.

6. The method for remote access to intranet devices based on network topology adaptive control according to claim 1, implemented based on the intranet device remote access system based on network topology adaptive control according to any one of claims 1-5, characterized in that: Includes the following steps: Step S1: The intranet access device initiates a dial-up request to the VPN server, establishes a network layer tunnel and binds the corresponding dedicated fixed IP. The device access status and tunnel status timestamps are synchronized to the mapping database for storage. Step S2: The VPN server monitors the tunnel connection status of the intranet access device in real time. When it detects that the intranet access device is momentarily disconnected due to network jitter, it does not update the offline status of the device to the mapping database, puts the dedicated fixed IP corresponding to the device into a suspended state, and performs virtual proxy answering through the shadow IP proxy answering mechanism to maintain the logical link. If the intranet access device successfully reconnects within the preset sliding window time, the traffic forwarding of the dedicated fixed IP is directly restored. Step S3: The reverse proxy server counts the historical disconnection frequency of internal network access devices, calculates the network health score of the corresponding device, and dynamically adjusts the lifespan of the local routing cache based on the network health score. When the network health score of a device is lower than a preset threshold, the lifespan of the corresponding local routing cache of the device is extended proportionally to reduce invalid probe requests to the VPN server.

7. The method for remote access to intranet devices based on network topology adaptive control according to claim 6, characterized in that: It also includes a non-blocking access processing step: after the reverse proxy server receives an external domain name access request and hits the route, it initiates a tunnel liveness query to the VPN server in a non-blocking manner through the resident internal control channel between the VPN server and the VPN server. If the tunnel is detected to be alive, external access requests will be forwarded to the target intranet access device; If the probe fails or the shadow IP proxy response mechanism is triggered, the current external request will be suspended or a customized prompt will be returned.

8. The method for remote access to intranet devices based on network topology adaptive control according to claim 6, characterized in that: It also includes a dedicated domain name generation step: reading the hardware serial number of the intranet access device, generating an obfuscated string as a subdomain prefix through salted hash conversion, and concatenating it with a preset wildcard main domain name to generate a unique dedicated access domain name for each intranet access device.

9. The method for remote access to intranet devices based on network topology adaptive control according to claim 6, characterized in that: Before step S1, there is also an initial IP pre-allocation step: during the system initialization phase, the unique hardware serial number of all intranet access devices is read, a one-way hash calculation is performed based on the hardware serial number to map the unique dedicated fixed IP within the VPN virtual network segment, and the mapping relationship between the hardware serial number and the dedicated fixed IP is pre-stored in the mapping database.

10. The method for remote access to intranet devices based on network topology adaptive control according to claim 9, characterized in that: The MurmurHash3 algorithm is used to perform one-way hash calculation on the hardware serial number, mapping the variable-length hardware serial number to a unique 32-bit dedicated fixed IP within the VPN virtual network segment. This mapping relationship remains fixed throughout the entire life cycle of the device.

Images