Computer module and computer-implemented method for data transmission

Abstract

The present invention relates to a computer module (1) and a computer implementation method for securely transmitting data from an external device (G) via a data transfer program (4) installed on a virtual machine (VM1) of the computer module (1).

Description

[Technical Field]

[0001] The present invention relates to a computer module and a computer implementation method for data transmission using the computer module.

[0002] A computer module, also known as a computer-on-module (COM), abbreviated as CoM, is used in embedded computing applications such as industrial equipment. A computer module includes a circuit board on which at least one processor unit, one main memory, and possibly a graphics processor and large-capacity memory are mounted. The computer module can be connected to a carrier board via a power connector to provide an external interface. [Previous Technology]

[0003] Such computer modules are increasingly being used in Internet of Things (IoT) environments, for example, to connect external devices to IT infrastructure, especially machines, sensors or other similar devices, so as to be able to process data from the devices or control the devices.

[0004] The problem with this type of application is that integrating external devices into the IT infrastructure usually causes IT security problems. On the one hand, this provides attackers with the possibility of accessing the devices from the outside, and on the other hand, the devices can also access data in the IT infrastructure without taking further measures. These situations should not usually happen. [Summary of the Invention]

[0005] In view of this, the object of the present invention is to provide a computer module that can securely and flexibly integrate external devices into an IT structure so as to enable data exchange with external devices.

[0006] The above objective can be achieved by using a computer module with the feature of independent request 1. The content of dependent request 10 is a computer implementation method for data transmission. The content of other dependent requests is various advantageous implementation methods.

[0007] From a first perspective, the present invention relates to a computer module. The computer module includes a circuit board having at least one processor unit and one main memory. The computer module has a virtual machine hypervisor installed. The virtual machine hypervisor provides at least two virtual machines. This means that the virtual machine hypervisor defines a virtual environment with multiple virtual machines based on physically available hardware, which serve as the basis for installing an operating system, regardless of the actual hardware present. In particular, the virtual machine hypervisor is designed to at least partially separate the hardware resources available to the virtual machines from each other to protect the resources of one virtual machine relative to the resources of another virtual machine. In particular, the virtual machine hypervisor can reserve a dedicated main memory area for each virtual machine. Furthermore, the virtual machine hypervisor can also reserve a common memory area that can be shared by multiple virtual machines.

[0008] The first virtual machine may connect to at least one external device to receive device information provided by that external device. Preferably, the first virtual machine should not be connected to an external data network, such as the Internet.

[0009] The first virtual machine has a data transfer program that can be configured to receive device data according to a first data format. For example, the data transfer program can receive various different data formats and adapt to the data formats provided by external devices through configuration. The term "data format" refers to a data protocol.

[0010] The data transfer program of the first virtual machine can be configured to extract device payload data from the received device data and store it in the main memory area allocated to the first virtual machine. In other words, it extracts device payload data from the received device data and stores this device payload data. This process is implemented in the data transfer program through a first connection configuration, which specifies which device payload data should be extracted and stored from the received device data.

[0011] The data transfer program of the first virtual machine can be configured to provide output data to the second virtual machine. The output data preferably has a configurable output data format.

[0012] According to a first variation, the first virtual machine provides output data in a second data format based on stored device payload data, which includes device payload data of external devices. The output data is transmitted from the first virtual machine to the second virtual machine via a virtual network, particularly a secure virtual network. According to another variation, the first virtual machine transmits and stores the device payload data stored in the main memory area allocated to the first virtual machine (VM1) to a storage unit accessible to both the first and second virtual machines. The second virtual machine can be configured to read from the storage unit and evaluate and / or further process the device payload data.

[0013] The technical advantage of the computer module lies in the fact that, through the functional cooperation of the virtual machine manager and the data transfer program, data transfer between the external device and the second virtual machine can be achieved using only the first virtual machine. It can extract the device payload data from the received device data, store and output it, without requiring direct transmission of the device data itself. This significantly improves data security because it avoids direct data access from the second virtual machine to the external device (and vice versa), and decompresses the device data to the level where the device payload data resides, preventing unnecessary transmission of other data.

[0014] According to one embodiment, the data transfer program of the first virtual machine does not directly transfer device payload data in a first data format to the output interface. Instead, it extracts the device payload data from the first data format, stores it in the main memory area allocated to the first virtual machine, and provides output data in a predefined output data format after rereading the device payload data from the main memory area. This process is also called data projection. If the first data format provided by the external device corresponds to a second data format that the output data should have, the extraction of device payload data, storage, and provision of output data from the device payload data are also performed.

[0015] According to one embodiment, the storage unit is an external storage unit that can be coupled to a computer module via a data connection, such as an external mass storage device. Alternatively, the storage unit is a main memory area that can be shared by the first and second virtual machines and is provided by a virtual machine administrator.

[0016] According to one embodiment, a main memory sub-region allocated to the main memory region of the first virtual machine is reserved exclusively for a data transfer program, and only the data transfer program can access this main memory sub-region. This can further improve the security of data transfer because other programs processed by the first virtual machine cannot modify the temporary device payload data.

[0017] According to one embodiment, a data transfer program can be configured to transfer control data from a second virtual machine to an external device via a first virtual machine, wherein the second virtual machine transfers the first control data to the first virtual machine via a virtual network. The data transfer program can be configured to decompress the control data contained in the first control data and store the decompressed control data in a main memory area allocated to the first virtual machine. Then, the stored control data is read from the main memory area allocated to the first virtual machine and integrated into second control data having a data format readable by the external device. Finally, the second control data is transferred to the external device. This allows control of the external device through the second virtual machine with lower security risks because the control data is not directly transferred from the second virtual machine to the external device.

[0018] According to another embodiment, a data transfer program can be configured to transfer control data from a second virtual machine to an external device via a first virtual machine. This is done by the second virtual machine storing the control data contained in the first control data in a storage unit accessible to both the first and second virtual machines. Furthermore, the data transfer program can be configured to read the control data from the storage unit and store the read control data in the main storage area allocated to the first virtual machine. Additionally, the data transfer program can be configured to then read the stored control data from the main storage area allocated to the first virtual machine, integrate it into second control data having a data format readable by the external device, and then transfer the second control data to the external device. This allows control of the external device via the second virtual machine with lower security risks, because the control data is not directly transferred from the second virtual machine to the external device.

[0019] According to one embodiment, the storage unit is an external storage unit that can be coupled to a computer module via a data connection. Alternatively, the storage unit is a main memory area that can be shared by a first and a second virtual machine.

[0020] According to one embodiment, the virtual machine hypervisor is a bare-metal virtual machine hypervisor, also known as a type I virtual machine hypervisor. Unlike type II virtual machine hypervisors, the technical advantage of using a type I bare-metal virtual machine hypervisor is that it allows for hardware control without relying on the host system. In addition to improved performance, this also benefits the overall system security, as it eliminates potential harm to the system caused by the host operating system.

[0021] According to one embodiment, a virtual machine hypervisor can be configured to provide device payload data as output data to a second virtual machine according to an output data format when a data transfer program stores device payload data in a storage unit accessible by the first and second virtual machines, and trigger the second virtual machine to read the device payload data stored in the storage unit based on an event. This allows the second virtual machine to query the device payload data based on an event without looping through the query, as long as the data transfer program of the first virtual machine has written the device payload data to the storage unit.

[0022] From a second perspective, the present invention also proposes a computer implementation method for data transmission using a computer module. The computer module includes a circuit board having at least one processor unit and a main memory, wherein the computer module has a virtual machine manager installed. The virtual machine manager provides at least two virtual machines. This method includes the following steps: - A first virtual machine coupled to an external device and having a data transfer program receives device data according to a first data format provided by the external device; - The data transfer program extracts device payload data from the received device data; - The decompressed device payload data is stored in a main memory area allocated to the first virtual machine; - The data transfer program of the first virtual machine provides output data in a predefined output data format, wherein: ● The first virtual machine provides output data according to a second data format based on the stored device payload data, the device payload data including the device payload data of the external device, and the output data is transmitted from the first virtual machine to a second virtual machine via a virtual network; or ● The first virtual machine transmits and stores the device payload data stored in the main memory area allocated to the first virtual machine to a storage unit accessible to both the first and second virtual machines, and the second virtual machine reads the device payload data from the storage unit; - The second virtual machine evaluates and / or further processes the device payload data.

[0023] The technical advantage of this method is that the cooperation between the virtual machine manager and the data transfer program can greatly improve data security because it avoids direct data access from the second virtual machine to the external device (and vice versa), and decompresses the device data to the level where the device payload data is located to prevent unnecessary transmission of other data.

[0024] According to one embodiment of this method, the data transfer program of the first virtual machine does not directly transfer device data in the first data format to the output interface. Instead, it extracts and stores device payload data from the first data format, and after rereading the device payload data from the storage unit, provides output data in a predefined output data format. This further improves the security of the data transfer method.

[0025] According to one embodiment of this method, a main memory sub-region allocated to the main memory region of the first virtual machine is specifically reserved for the data transfer program, and only the data transfer program can access this main memory sub-region. This can further improve the security of data transfer because other programs processed by the first virtual machine cannot modify the temporarily stored device payload data.

[0026] According to one embodiment of this method, a data transfer program transmits control data from a second virtual machine to an external device via a first virtual machine. This is done by the second virtual machine transmitting the first control data to the first virtual machine via a virtual network. The data transfer program performs the following steps: - Extracting control data contained in the first control data and storing the extracted control data in a main memory area allocated to the first virtual machine; - Reading the stored control data from the main memory area allocated to the first virtual machine and integrating it into second control data having a data format readable by the external device; - Transmitting the second control data to the external device.

[0027] This allows for the control of external devices with very high security standards.

[0028] According to another embodiment of the method, the data transfer program transmits control data from a second virtual machine to an external device via a first virtual machine. This is achieved by the second virtual machine storing the control data contained in the first control data in a storage unit accessible to both the first and second virtual machines. For this purpose, the data transfer program is configured to: - read control data from the storage unit and store the read control data in the main storage area allocated to the first virtual machine; - read the stored control data from the main storage area allocated to the first virtual machine and integrate it into second control data having a data format readable by the external device; - transmit the second control data to the external device.

[0029] This can further improve the safety standards for controlling external devices.

[0030] According to another embodiment of this method, when the data transfer program stores device payload data in storage units accessible to the first and second virtual machines, the virtual machine hypervisor provides the device payload data as output data to the second virtual machine and triggers the second virtual machine to read the device payload data stored in the storage unit based on an event. Therefore, there is no need to periodically query the memory; instead, the virtual machine hypervisor notifies the second virtual machine to read the device payload data based on an event.

[0031] In this invention, a "computer module" refers to a computer board that can be connected to a carrier board via a standardized electrical connector. In addition to having at least one processor and one main memory, the computer board may also have a graphics processor and / or large-capacity memory. Such a computer module is often abbreviated as CoM, where CoM stands for Computer-on-Module.

[0032] The embodiments and figures described below are descriptions of further improvements, advantages, and possible applications of the present invention. In principle, all features described and / or graphically displayed are within the scope of the present invention, whether appearing alone or in any combination, and regardless of their combination in the claims or references cited. The contents of the claims are also part of this specification.

[0033] The following description uses several embodiments and accompanying drawings to provide a more detailed explanation of this specification. The drawings show:

Implementation Method

[0038] Figure 1 shows an example and general schematic diagram of computer module 1. Computer module 1 is coupled to an external device G to receive device data from the external device G. For example, the external device G may be a machine, a sensor, or other data generation unit. Computer module 1 includes at least one processor unit 2 and a main memory 3.

[0039] A virtual machine hypervisor is installed on computer module 1, which is capable of running multiple client operating systems simultaneously on computer module 1. The virtual machine hypervisor allows a virtual environment to be defined on available hardware resources, which can serve as the basis for installing operating systems and other applications.

[0040] In the embodiment of FIG1, two virtual machines VM1 and VM2 are formed on computer module 1, and hardware resources are allocated to them through a virtual machine management program. The special processor unit 2 may have multiple processor cores, so different processor cores can be allocated to virtual machines VM1 and VM2. Of course, more than two virtual machines can also be implemented on computer module 1 through a virtual machine management program.

[0041] The hypervisor can segment the main memory 3, where the first region 3.1 of the main memory 3 is allocated to virtual machine VM1, and the second region 3.2 of the main memory 3 is allocated to virtual machine VM2. Main memory regions 3.1 and 3.2 can be used individually by their respective virtual machines VM1 and VM2; that is, they can only be read or written by their respective virtual machines. Furthermore, a shared main memory region 3.3 (also called "shared memory") is formed within main memory region 3, which can be read and / or written by multiple virtual machines VM1 and VM2.

[0042] The computer module 1 can be configured to ensure that the external device G can securely exchange data between the first virtual machine VM1 and the application running on the second virtual machine VM2. To ensure this secure data exchange, the first virtual machine VM1 has a data transfer program 4 installed. A main memory sub-region of a main memory region 3.1 of the main memory (that is, the main memory reserved specifically for the first virtual machine VM1) is allocated to the data transfer program 4. Therefore, only the data transfer program 4 can use this main memory sub-region, that is, read and write to it.

[0043] The data transmission program 4 can receive device data from the external device G, which is provided according to a first data format. For example, the first data format may be analog or digital signals, OPC UA protocol, REST protocol, MQTT protocol, PLC protocol, ModBus protocol, IOLink protocol or other similar protocols.

[0044] In addition, the data transfer program 4 can also retrieve the device payload data (such as measurement values, machine information, etc.) contained in the received device data. In particular, this means that regardless of the data format provided by the external device G, the data transfer program 4 will decompress the device payload data to make it a usable universal data format.

[0045] After the data transfer program 4 extracts the device payload data, it stores the device payload data in the main memory area 3.1 allocated to the first virtual machine VM1, specifically in the main memory sub-area 3.1.1 dedicated to the use of the data transfer program 4. It should be noted that the second virtual machine VM2 does not have access to the main memory area 3.1, especially the main memory sub-area 3.1.1 dedicated to the use of the data transfer program 4.

[0046] Furthermore, the data transfer program 4 can be configured to provide output data containing device payload data previously stored in main memory region 3.1 at an output interface of the first virtual machine VM1. The data transfer program 4 can provide the device payload data in a freely configurable manner in the desired output data format, for example, by integrating it into a second data format, such as the OPC UA protocol or the MQTT protocol. Alternatively, the data transfer program 4 can also store the device payload data in a storage unit, a database, or a cloud platform.

[0047] Configurable data transfer can be achieved through data transfer program 4 by performing a first connection configuration process on device data provided by external device G to extract device payload data and store it in a main memory sub-area specifically used by data transfer program 4. Through a second connection configuration, output data can be generated from the stored device payload data, and this output data is output by the first virtual machine VM1.

[0048] To provide output data for the second virtual machine VM2, the output data in the embodiment of FIG1 is stored in a storage unit accessible to both the first virtual machine VM1 and the second virtual machine VM2. That is, the data transfer program 4 is configured to read the initial device payload data stored in the main memory sub-region 3.1.1 specifically allocated to the data transfer program 4 and transfer it to the storage unit for storage. In this embodiment, the storage unit is the main memory region 3.3 that can be shared by both virtual machines VM1 and VM2. Alternatively, the storage unit can be a storage unit independent of the main memory 3, such as the mass storage of the computer module 1, or an external storage unit (database, storage device, etc.) connected to the computer module 1.

[0049] The second virtual machine VM2 can access the storage unit, especially the main memory area 3.3 which can be used by the two virtual machines VM1 and VM2, in order to receive device payload data.

[0050] Through the hypervisor and the data transfer program 4 installed on the first virtual machine VM1, device data cannot be directly transferred from the external device G to an application running on the second virtual machine VM2, even if the application can directly process the data format provided by the external device G. The data transfer program 4 always performs data projection, that is, extracts device payload data from the first data format through the first connection configuration, temporarily stores the device payload data in the main memory sub-region 3.1.1 dedicated to the use of the data transfer program 4, and outputs the device payload data through the second connection configuration. Therefore, the first virtual machine VM1 with the data transfer program 4 constitutes a security barrier to ensure protection from external attacks.

[0051] Figure 2 shows a second embodiment of the computer module 1. The following description only describes the differences between this computer module 1 and the embodiment of Figure 1. Apart from these differences, the foregoing explanation also applies to the embodiment of Figure 2.

[0052] The main difference between the embodiment in Figure 2 and the embodiment in Figure 1 is that the data exchange between the virtual machines VM1 and VM2 is not carried out by storing the device payload data in a storage unit that can be accessed by both virtual machines VM1 and VM2, but by exchanging data through a network connection.

[0053] The first virtual machine VM1 and the second virtual machine VM2 are coupled to each other through a virtual network VN, specifically through a secure virtual network VN. Therefore, there is a direct data connection between the virtual machines VM1 and VM2. Through this data connection, the virtual machines VM1 and VM2 can communicate with each other, so there is no need to temporarily store data in a storage unit that can be accessed by both virtual machines VM1 and VM2.

[0054] To ensure secure data exchange between the external device G and the virtual machine VM2, the first virtual machine VM1 still has a data transfer program 4. A main memory sub-region 3.1.1 of a main memory region 3.1 of the main memory (that is, the main memory reserved specifically for the first virtual machine VM1) is allocated to the data transfer program 4. Therefore, only the data transfer program 4 can use this main memory sub-region 3.1.1, that is, read and write to it.

[0055] Data transfer program 4 is also configured to receive device data provided according to the first data format from external device G. In addition, data transfer program 4 may also be configured to extract device payload data contained in the received device data, and after extraction, store the device payload data in the main memory area 3.1 allocated to the first virtual machine VM1, specifically in the main memory sub-area 3.1.1 dedicated to the use of data transfer program 4.

[0056] Based on the stored device payload data, the data transfer program 4 can generate output data in a second data format and provide this output data to an output interface of the first virtual machine VM1. The second data format may be the same as or different from the first data format of the device data provided by the external device G.

[0057] The output data provided by the data transfer program 4 of the first virtual machine VM1 can be freely configured to be provided in the desired output data format and integrated into a second data format, such as the OPC UA protocol, MQTT protocol, or other similar formats. In particular, the data format can be selected according to the data format that the second virtual machine VM2 can directly process.

[0058] Next, the output data is transmitted from the first virtual machine VM1 to the second virtual machine VM2 via the virtual network VN. In this way, the second virtual machine VM2 can directly receive the output data, meaning that there is no need to actively access the storage unit. This enables fast and secure data exchange between virtual machines VM1 and VM2.

[0059] Data exchange between virtual machines VM1 and VM2 can be bidirectional, particularly the transfer of data (especially control data) from the second virtual machine VM2 to the external device G via the first virtual machine VM1.

[0060] According to the embodiment of FIG1, control data can be temporarily stored in a memory unit accessible to both the first and second virtual machines VM1 and VM2, particularly the shared main memory sub-region 3.3, in order to further transmit control data.

[0061] The second virtual machine VM2 stores control data in the storage unit. Both the first and second virtual machines VM1 and VM2 can access the storage unit, especially the shared main memory area 3.3.

[0062] The data transfer program 4 can be configured to read control data from the storage unit (in particular the common main memory area 3.3) and store it in the main memory area 3.1 allocated to the first virtual machine VM1, in particular the main memory sub-area 3.1.1 specifically for use by the data transfer program 4.

[0063] Next, the stored control data is read from the main memory area 3.1 and integrated into control data with a data format readable by the external device G. After the control data is generated, the data transfer program 4 transfers the control data to the external device G.

[0064] According to the embodiment in Figure 2, first control data provided by the second virtual machine VM2 and containing control data can be transmitted to the first virtual machine VM1 through a virtual network VN, so as to achieve the purpose of transmitting control data from the second virtual machine VM2 to the external device G. The first control data can use a first data format.

[0065] The data transfer program 4 is configured to receive control data provided in a first data format and extract the control data contained in the control data. Then the extracted control data is stored in the main memory area 3.1 allocated to the first virtual machine VM1, specifically in the main memory sub-area 3.1.1 dedicated to the use of the data transfer program 4.

[0066] Next, the main memory area 3.1 reads the stored control data and integrates it into control data with a data format that can be read by the external device G. After the control data is generated, the data transfer program 4 transfers the control data to the external device G.

[0067] In this way, secure data communication from the second virtual machine VM2 to the external device G can be achieved through the computer module 1, without the second virtual machine VM2 directly transmitting control data to the external device G.

[0068] The hypervisor is preferably a so-called bare-metal hypervisor. This provides the possibility of influencing the operating systems of virtual machines VM1 and VM2, especially when the state of the second virtual machine VM2 changes, it can trigger the operating system of the first virtual machine VM1, and vice versa.

[0069] The data transfer program 4 is preferably configured to perform, check, or analyze functions based on device payload data or control data stored in the main memory region 3.1 allocated to the first virtual machine VM1 (specifically, the main memory sub-region 3.1.1 specifically for use by the data transfer program 4). For example, mathematical operations or threshold checks can be performed, and the transmission of device payload data or control data can be blocked based on the check results. This further enhances security by blocking data transmission if the device payload data or control data is below or above a threshold, thereby preventing erroneous data transmission or incorrect control of external devices.

[0070] Furthermore, the data transfer program 4 can be configured to visualize device payload data or control data. In particular, the data transfer program 4 can provide a network server to enable data visualization.

[0071] Figure 3 shows a third embodiment of the computer module 1. The following description only describes the differences between this computer module 1 and the embodiments of Figures 1 and 2. Apart from these differences, the foregoing explanation also applies to the embodiment of Figure 3.

[0072] The main difference of computer module 1 in Figure 3 is that the virtual machine hypervisor provides at least three virtual machines VM1, VM1a, and VM2, wherein the first and third virtual machines VM1 and VM1a each have a data transfer program 4. In this embodiment, the first virtual machine VM1 is connected to an external device G. For example, device G is a machine responsible for processing its machine data. For example, the third virtual machine VM1a can be connected to an external device different from the one connected to the first virtual machine VM1, particularly to a data storage device, the cloud, or other IT system, as shown in Figure 3.

[0073] The second virtual machine VM2 is equivalent to the second virtual machine VM2 in the embodiments of Figures 1 and 2 mentioned above, because they both have a client operating system and application-specific programs installed separately from the first and third virtual machines VM1 and VM1a by the virtual machine manager. For example, the second virtual machine VM2 can evaluate the device data provided to the second virtual machine VM2 by the data transfer program 4 through the first virtual machine VM1 according to the client's needs.

[0074] Like the first virtual machine VM1, the third VM1a virtual machine also has a guest operating system and a main memory region 3.4 allocated to the third virtual machine VM1a. This main memory region 3.4 is reserved specifically for the third virtual machine VM1a. In addition, the third virtual machine VM1a also has a data transfer program 4 installed. This data transfer program 4 has the same functions as the data transfer program 4 installed on the first virtual machine VM1 in the embodiments of FIG1 and FIG2. In particular, the main memory region 3.4 allocated to the third virtual machine VM1a reserves a dedicated main memory sub-region 3.4.1 for the data transfer program 4 of the third virtual machine VM1a, that is, the data transfer program 4 of the third virtual machine VM1a can use this sub-region.

[0075] The data transfer program 4 of the first and third virtual machines VM1 and VM1a can exchange information between main memory sub-regions 3.1.1 and 3.4.1, which are located in the main memory regions 3.1 and 3.4 reserved for the data transfer program 4 of virtual machines VM1 and VM1a.

[0076] As shown by the double arrows in Figure 3, data can be transferred from the main memory sub-region 3.1.1 in the first main memory region 3.1, which is dedicated to the data transfer program 4, to the main memory sub-region 3.4.1 in the third main memory region 3.4, which is also dedicated to the data transfer program 4, and vice versa. This can be accomplished by sharing the main memory region 3.3, as described in the embodiment of Figure 1. Alternatively, data exchange can be performed via a virtual network, as described in the embodiment of Figure 2.

[0077] Figure 4 shows a block diagram illustrating the steps of a method for data transfer via computer module 1. Computer module 1 includes a circuit board having at least one processor unit and one main memory. A virtual machine manager is installed on the computer module, and the virtual machine manager provides at least two virtual machines. This method includes the following steps:

[0078] First, a first virtual machine coupled to an external device receives device data according to a first data format provided by the external device. The first virtual machine has a data transfer program installed (S10).

[0079] The data transfer program of the first virtual machine decompresses the device payload data from the received device data (S11).

[0080] The decompressed device load data is stored in the main memory area allocated to the first virtual machine (S12).

[0081] Finally, the data transfer program of the first virtual machine provides output data in a predefined output data format (S13). In the first method, the first virtual machine provides output data (including device payload data of external devices) according to the second data format based on the stored device payload data, and transmits the output data from the first virtual machine to the second virtual machine through a virtual network.

[0082] The second method involves the first virtual machine transferring the device payload data stored in the main memory area allocated to the first virtual machine to a storage unit accessible to both the first and second virtual machines, and storing it in that memory unit. Then, the second virtual machine reads the device payload data from that storage unit.

[0083] Finally, the device payload data is evaluated and / or further processed by the second virtual machine (S14).

[0084] The present invention has been described above with reference to the embodiments. It is understood that many modifications and variations can be made without departing from the scope of protection defined in the patent claims. [Simplified Explanation of the Diagram]

[0034] [Figure 1]: A general schematic block diagram of a computer module having a virtual machine manager and two virtual machines in the first embodiment;

[0035] [Figure 2]: A general schematic block diagram of a computer module having a virtual machine manager and two virtual machines in the second embodiment;

[0036] [Figure 3]: A schematic block diagram of a computer module with one virtual machine manager and three virtual machines;

[0037] [Figure 4]: A flowchart illustrating the data transmission method.

Claims

1. A computer module comprising a circuit board having at least one processor unit (2) and a main memory (3), wherein the computer module (1) has a virtual machine manager (4) installed, wherein the virtual machine manager (4) provides at least two virtual machines (VM1, VM1a, VM2), wherein a first virtual machine (VM1) can be connected to at least one external device (G) to receive device data provided by the external device (G), wherein the first virtual machine (VM1) has a data transfer program (4) configurable to receive device data according to a first data format, wherein the data transfer program (4) of the first virtual machine (VM1) can be configured to extract device payload data from the received device data and store it in a main memory area (3.1) allocated to the first virtual machine (VM1), wherein the data transfer program (4) of the first virtual machine (VM1) can be configured to provide output data in a predefined output data format, wherein: - The first virtual machine (VM1) provides output data according to a second data format based on stored device payload data, which includes device payload data of external devices (G), and the output data is transferred from the first virtual machine (VM1) to the second virtual machine (VM2) via a virtual network (VN); or - the first virtual machine (VM1) transfers and stores the device payload data stored in the main memory area (3.1) allocated to the first virtual machine (VM1) to a storage unit accessible to both the first and second virtual machines (VM1, VM2), and the second virtual machine (VM2) can be configured to read the device payload data from the storage unit; wherein the second virtual machine (VM2) can be configured to read and evaluate and / or further process the device payload data from the storage unit.

2. The computer module of claim 1, wherein the data transfer program (4) of the first virtual machine (VM1) does not directly transfer the device payload data of the first data format to the output interface, but extracts the device payload data from the first data format and stores it in the main storage area (3.1) allocated to the first virtual machine (VM1), and after rereading the device payload data from the main storage area (3.1), provides output data in a predefined output data format.

3. The computer module as requested in item 1 or 2, wherein the storage unit is an external storage unit that can be coupled to the computer module (1) via a data connection, or the storage unit is a main memory area that can be shared by the first and second virtual machines (VM1, VM2) (3.3).

4. The computer module of request item 1 or 2, wherein a main memory sub-region (3.1.1) of the main memory region (3.1) allocated to the first virtual machine (VM1) is reserved exclusively for the data transfer program (4), and only the data transfer program (4) can access the main memory sub-region (3.1.1).

5. The computer module of request item 1 or 2, wherein the data transfer program (4) may be configured to transfer control data from a second virtual machine (VM2) to an external device (G) via a first virtual machine (VM1), wherein the second virtual machine (VM2) transfers the first control data to the first virtual machine (VM1) via a virtual network (VN). For this purpose, the data transfer program (4) may be configured to: - extract and decompress the control data contained in the first control data, and store the decompressed control data in the main memory area (3.1) allocated to the first virtual machine (VM1); - read the stored control data from the main memory area (3.1) allocated to the first virtual machine (VM1), and integrate it into a second control data having a data format that the external device (G) can read; - transfer the second control data to the external device (G).

6. The computer module of claim 1 or 2, wherein the data transfer program (4) may be configured to transfer control data from a second virtual machine (VM2) to an external device (G) via a first virtual machine (VM1), wherein the second virtual machine (VM2) stores the control data contained in the first control data in a storage unit accessible to both the first virtual machine (VM1) and the second virtual machine (VM2), and the data transfer program (4) may be configured to: - read the control data from the storage unit and store the read control data in the main storage area (3.1) allocated to the first virtual machine (VM1); - read the stored control data from the main storage area (3.1) allocated to the first virtual machine (VM1) and integrate it into the second control data having a data format readable by the external device (G); - transfer the second control data to the external device (G).

7. The computer module of claim 6, wherein the storage unit is an external storage unit that can be coupled to the computer module (1) via a data connection, or the storage unit is a main memory area (3.3) that can be shared by the first and second virtual machines (VM1, VM2).

8. The computer module of request item 1 or 2, wherein the virtual machine manager (4) is a bare-metal virtual machine manager.

9. The computer module of request item 1 or 2, wherein the virtual machine manager (4) may be configured to provide the device payload data to the second virtual machine (VM2) as output data according to the output data format when the data transfer program (4) stores the device payload data in the storage unit accessible by the first and second virtual machines (VM1, VM2), and trigger the second virtual machine (VM2) to read the device payload data stored in the storage unit according to the event.

10. A computer implementation method for data transmission using a computer module (1), the computer module (1) including a circuit board having at least one processor unit (2) and a main memory (3), wherein the computer module (1) has a virtual machine manager (4) installed, wherein the virtual machine manager (4) provides at least two virtual machines (VM1, VM1a, VM2), the method comprising the following steps: - receiving device data according to a first data format provided by the external device (G) by a first virtual machine (VM1) coupled to an external device (G) and having a data transmission program (4) (S10); - extracting device payload data from the received device data through the data transmission program (4) (S11); - storing the decompressed device payload data in a main memory area allocated to the first virtual machine (VM1) (3.1) (S12); - providing output data in a predefined output data format through the data transmission program (4) of the first virtual machine (VM1) in the following manner: ● The first virtual machine (VM1) provides output data according to a second data format based on the stored device payload data, which includes the device payload data of external devices (G). Simultaneously, the output data is transferred from the first virtual machine (VM1) to the second virtual machine (VM2) via a virtual network (VN); or ● The first virtual machine (VM1) transfers and stores the device payload data stored in the main memory area (3.1) allocated to it to a storage unit accessible to both the first and second virtual machines (VM1, VM2), while the second virtual machine (VM2) reads the device payload data from the storage unit; - The device payload data is evaluated and / or further processed by the second virtual machine (VM2) (S14).

11. The method of claim 10, wherein the data transfer program (4) of the first virtual machine (VM1) does not directly transfer device data of the first data format to the output interface, but extracts and stores device payload data from the first data format, and provides output data in a predefined output data format after rereading the device payload data from the storage unit.

12. The method of request item 10 or 11, wherein a main memory subregion (3.1.1) of the main memory region (3.1) allocated to the first virtual machine (VM1) is reserved exclusively for the data transfer program (4), and only the data transfer program (4) can access the main memory subregion (3.1.1).

13. The method of claim 10 or 11, wherein the data transfer program (4) transfers control data from a second virtual machine (VM2) to an external device (G) via a first virtual machine (VM1) in such a way that the second virtual machine (VM2) transfers the first control data to the first virtual machine (VM1) via a virtual network (VN), wherein the data transfer program (4): - decompresses the control data contained in the first control data and stores the decompressed control data in a main memory area (3.1) allocated to the first virtual machine (VM1); - reads the stored control data from the main memory area (3.1) allocated to the first virtual machine (VM1) and integrates it into second control data having a data format that can be read by the external device (G); - transfers the second control data to the external device (G).

14. The method of claim 10 or 11, wherein the data transfer program (4) transfers control data from a second virtual machine (VM2) to an external device (G) via a first virtual machine (VM1), wherein the second virtual machine (VM2) stores the control data contained in the first control data in a storage unit accessible to both the first virtual machine (VM1) and the second virtual machine (VM2), for which the data transfer program (4): - reads the control data from the storage unit and stores the read control data in the main storage area (3.1) allocated to the first virtual machine (VM1); - reads the stored control data from the main storage area (3.1) allocated to the first virtual machine (VM1) and integrates it into the second control data having a data format readable by the external device (G); - transfers the second control data to the external device (G).

15. The method of request item 10 or 11, wherein when the data transfer program (4) stores device payload data in a storage unit accessible to the first and second virtual machines (VM1, VM2), the virtual machine manager (4) provides the device payload data as output data to the second virtual machine (VM2) according to the output data format, and triggers the second virtual machine (VM2) to read the device payload data stored in the storage unit according to the event.

Images