Network isolation communication system and method

Abstract

The application provides a network isolation communication system and method, the system comprising: a shared memory arranged in a host computer, provided with a host computer memory segment and at least one virtual machine memory segment; a host computer management unit arranged in the host computer and associated with the host computer memory segment; used for reading data from the associated host computer memory segment when reading data; used for writing data into the virtual machine memory segment associated with the virtual machine to be written when writing data; at least one virtual machine arranged in the host computer and associated with different virtual machine memory segments; used for reading data from the associated virtual machine memory segment when reading data; used for writing data into the host computer memory segment or the virtual machine memory segment associated with the virtual machine to be written when writing data. The system can guarantee the data communication between the host computer and the virtual machine and between the virtual machines without affecting the network isolation, and the communication is simple and reliable. The shared memory is orderly managed, and the safety of the communication is improved.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of network security and data security, and particularly relates to a network isolation communication system and method. BACKGROUND

[0002] ivshmem (Inter-VM shared memory device) is a special device for sharing memory between a host and a virtual machine or between multiple virtual machines provided by QEMU. The special device can realize sharing memory communication between the host and the virtual machine or between the multiple virtual machines.

[0003] Although the prior art provides specific communication channels between the host and the virtual machine or between the multiple virtual machines, it lacks a general communication method, and it is difficult to guarantee the correctness and security of data communication between the host and the virtual machine or between the multiple virtual machines. SUMMARY

[0004] In view of the defects in the prior art, the present application provides a network isolation communication system and method, which can guarantee data communication between the host and the virtual machine or between the multiple virtual machines and improve the security of communication.

[0005] In a first aspect, a network isolation communication system comprises:

[0006] Shared memory: the shared memory is deployed in the host, and the shared memory is provided with a host memory segment and at least one virtual machine memory segment;

[0007] Host management unit: the host management unit is arranged in the host and is associated with the host memory segment; the host management unit is used for reading data from the associated host memory segment when reading data; and the host management unit is used for writing data into the virtual machine memory segment associated with the virtual machine to be written when writing data;

[0008] At least one virtual machine: the virtual machine is deployed in the host, and different virtual machines are associated with different virtual machine memory segments; the virtual machine is used for reading data from the associated virtual machine memory segment when reading data; and the virtual machine is used for writing data into the host memory segment or the virtual machine memory segment associated with the virtual machine to be written when writing data.

[0009] Preferably, the number of virtual machine memory segments in the shared memory is consistent with the number of virtual machines.

[0010] Preferably, all virtual machine memory segments are equal in size.

[0011] Preferably, the shared memory is further provided with a management segment; the management segment is used for identifying at least one of the following data:

[0012] whether the shared memory is used for the first time, size of the shared memory, number of virtual machines, number of concurrences, size of the memory segment of the virtual machine, size of the memory segment of the host, identification of the host, number of each type of data stored in the memory segment of the host, offset of each type of data in the memory segment of the host, identification of the virtual machine, number of each type of data stored in the memory segment of the virtual machine, offset of each type of data in the memory segment of the virtual machine.

[0013] Preferably, a plurality of message queues storing different types of data are arranged in the memory segment of the host and the memory segment of the virtual machine.

[0014] Each message queue stores an INFO lock structure; the INFO lock structure comprises a synchronization lock, a lock identification and a data amount; the lock identification is used to identify an operation object of the synchronization lock of the message queue, the operation object being the host management unit or the virtual machine; the data amount is used to identify the number of data in the message queue.

[0015] Preferably, the method for reading data by the host management unit and the virtual machine comprises:

[0016] locking the synchronization of the message queue to be read;

[0017] setting the lock identification of the message queue as the number of the operation object plus 1;

[0018] copying the data in the message queue to the cache of the operation object;

[0019] correcting the data amount in the message queue;

[0020] setting the lock identification of the message queue as 0;

[0021] unlocking the synchronization of the message queue.

[0022] Preferably, the method for writing data by the host management unit and the virtual machine comprises:

[0023] locking the thread of the operation object;

[0024] locking the synchronization of the message queue to be written;

[0025] setting the lock identification of the message queue as the number of the operation object plus 1;

[0026] copying the data from the cache of the operation object to the free space of the shared memory;

[0027] correcting the data amount in the message queue;

[0028] setting the lock identification of the message queue as 0;

[0029] unlocking the synchronization of the message queue;

[0030] unlocking the thread of the operation object.

[0031] In a second aspect, a network isolation communication method is applied to the network isolation communication system of the first aspect. The network isolation communication method comprises:

[0032] The virtual machine writes data into the host memory segment or the virtual machine memory segment associated with the virtual machine to be written;

[0033] The host management unit writes data into the virtual machine memory segment associated with the virtual machine to be written;

[0034] The host management unit reads data from the associated host memory segment;

[0035] The virtual machine reads data from the associated virtual machine memory segment.

[0036] Preferably, the method for the host management unit and the virtual machine to read data comprises:

[0037] Synchronizing the message queue to be read;

[0038] Setting the lock identifier of the message queue to the number of the operation object + 1;

[0039] Copying the data in the message queue to the cache of the operation object;

[0040] Correcting the data amount in the message queue;

[0041] Setting the lock identifier of the message queue to 0;

[0042] Releasing the synchronization lock of the message queue.

[0043] Preferably, the method for the host management unit and the virtual machine to write data comprises:

[0044] Thread locking the operation object;

[0045] Synchronizing the message queue to be written;

[0046] Setting the lock identifier of the message queue to the number of the operation object + 1;

[0047] Copying the data from the cache of the operation object to the free space of the shared memory;

[0048] Correcting the data amount in the message queue;

[0049] Setting the lock identifier of the message queue to 0;

[0050] Releasing the synchronization lock of the message queue;

[0051] Releasing the thread lock of the operation object.

[0052] According to the technical scheme, the network isolation communication system and method provided by the application segment the shared memory, each shared memory segment stores data to be read by the host computer and the virtual machine, the host computer and the virtual machine write data to be written into the shared memory segment associated with the other party, and read data from the shared memory segment associated with the self, so that the data communication between the host computer and the virtual machine and between the virtual machines is guaranteed without affecting the network isolation, and the communication is simple and reliable. The network isolation communication system orderly manages the shared memory, prevents disorder during data reading and writing, improves the safety and efficiency of the communication, and makes the communication smooth and accurate. BRIEF DESCRIPTION OF DRAWINGS

[0053] In order to more clearly illustrate the technical scheme in the specific embodiments or prior art of the present application, the drawings needed to be used in the specific embodiments or prior art description will be briefly introduced below. In all the drawings, similar elements or parts are generally identified by similar reference numerals. In the drawings, each element or part is not necessarily drawn according to the actual proportion.

[0054] Figure 1 The block diagram of the network isolation communication system provided for the present embodiment.

[0055] Figure 2 The schematic diagram of the shared memory provided for the present embodiment.

[0056] Figure 3 The flowchart of reading and writing data of the shared memory provided for the present embodiment. DETAILED DESCRIPTION

[0057] The embodiments of the technical scheme of the present application will be described in detail below with reference to the drawings. The following embodiments are only used to more clearly illustrate the technical scheme of the present application, and therefore only serve as examples, but cannot limit the protection scope of the present application. It should be noted that, unless otherwise specified, the technical terms or scientific terms used in the present application should be understood as the general meanings understood by the persons skilled in the art.

[0058] It should be understood that, when used in the present specification and the appended claims, the terms "comprise" and "include" indicate the existence of the described features, integers, steps, operations, elements, and / or components, but do not exclude one or more other features, integers, steps, operations, elements, components, and / or sets thereof.

[0059] It should also be understood that the terms used in the present specification of the present application are only for the purpose of describing specific embodiments and do not intend to limit the present application. As used in the present specification and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include the plural forms.

[0060] As used in the specification and the appended claims, the term "if' can be interpreted as meaning "when" or "upon" or "in response to a determination" or "in response to detecting" depending on the context. Similarly, the phrase "if it is determined" or "if [a described condition or event] is detected" can be interpreted as meaning "upon determining" or "in response to determining" or "upon detecting [the described condition or event]" or "in response to detecting [the described condition or event]" depending on the context.

[0061] Embodiments:

[0062] A network isolation communication system, referring to Figure 1 , comprising:

[0063] Shared memory 1: The shared memory 1 is deployed in the host computer, and the shared memory 1 is provided with a host computer memory segment and at least one virtual machine memory segment;

[0064] Host computer management unit 2: The host computer management unit 2 is arranged in the host computer and is associated with the host computer memory segment; the host computer management unit 2 is used to read data from the associated host computer memory segment when reading data; and write data into the virtual machine memory segment associated with the virtual machine 3 to be written when writing data;

[0065] At least one virtual machine 3: The virtual machine 3 is deployed in the host computer, and different virtual machines 3 are associated with different virtual machine memory segments; the virtual machine 3 is used to read data from the associated virtual machine memory segment when reading data; and write data into the host computer memory segment or the virtual machine memory segment associated with the virtual machine 3 to be written when writing data.

[0066] In this embodiment, generally, one or more virtual machines 3 can be deployed on the host computer, wherein the host computer can communicate with the virtual machines 3, and the virtual machines 3 can also communicate with each other, and the communication between the host computer and the virtual machines 3 and the communication between the virtual machines 3 can be realized through the communication channel of the shared memory 1.

[0067] In this embodiment, the shared memory 1 is deployed in the host computer, and the shared memory 1 is provided with a host computer memory segment for the host computer and a virtual machine memory segment for each virtual machine 3, wherein the number of virtual machine memory segments in the shared memory 1 is consistent with the number of virtual machines 3. For example Figure 1In this embodiment, two virtual machines 3 (virtual machine A and virtual machine B) are deployed in the host computer, and the shared memory 1 is provided with a virtual machine memory segment A and a virtual machine memory segment B, wherein the virtual machine A is associated with the virtual machine memory segment A, and the virtual machine B is associated with the virtual machine memory segment B. The size of the host computer memory segment and the virtual machine memory segment can be set according to actual use. The location of the host computer memory segment and the virtual machine memory segment in the shared memory 1 can also be set according to user usage habits or actual use, for example Figure 1 In this embodiment, the first segment of the shared memory 1 is set as the host computer memory segment, and the other segments are sequentially set as corresponding virtual machine memory segments, for example, the second segment is the virtual machine memory segment A, and the third segment is the virtual machine memory segment B.

[0068] In this embodiment, the host computer management unit 2 is set in the host computer, and the communication between the host computer and the virtual machine 3 is realized through the host computer management unit 2 and the virtual machine 3. The host computer management unit 2 is associated with the host computer memory segment, so that the host computer management unit 2 can directly read the data of the host computer memory segment. Similarly, the virtual machine 3 is associated with the virtual machine memory segment, so that the virtual machine 3 can directly read the data of the virtual machine memory segment.

[0069] In this embodiment, the communication method of the host computer and the virtual machine 3 is as follows: when the virtual machine A initiates a request to the host computer, the virtual machine A writes the request data into the host computer memory segment, the host computer management unit 2 reads the request data from the host computer memory segment, the host computer generates response data after processing the request data, the host computer management unit 2 writes the response data into the virtual machine memory segment A, and the virtual machine A reads the response data from the virtual machine memory segment A, so that the virtual machine A can process the response data, thereby completing the process of the virtual machine A requesting data from the host computer. Similarly, when the host computer initiates a request to the virtual machine A, the host computer management unit 2 writes the request data into the virtual machine memory segment A, the virtual machine A reads the request data from the virtual machine memory segment A, the virtual machine A generates response data after processing the request data, the virtual machine A writes the response data into the host computer memory segment, and the host computer reads the response data from the host computer memory segment, so that the host computer can process the response data, thereby completing the process of the host computer requesting data from the virtual machine A.

[0070] In the embodiment, the communication method between the virtual machines 3 is as follows: when the virtual machine A initiates a request to the virtual machine B, the virtual machine A writes the request data into the virtual machine memory segment B, the virtual machine B reads the request data from the virtual machine memory segment B, the virtual machine B generates response data after processing the request data, the virtual machine B writes the response data into the virtual machine memory segment A, the virtual machine A reads the response data from the virtual machine memory segment A, and the virtual machine A can process the response data, thereby completing the process of the virtual machine A requesting data from the virtual machine B. Similarly, when the virtual machine B initiates a request to the virtual machine A, the virtual machine B writes the request data into the virtual machine memory segment A, the virtual machine A reads the request data from the virtual machine memory segment A, the virtual machine A generates response data after processing the request data, the virtual machine A writes the response data into the virtual machine memory segment B, the virtual machine B reads the response data from the virtual machine memory segment B, and the virtual machine B can process the response data, thereby completing the process of the virtual machine B requesting data from the virtual machine A.

[0071] The network isolation communication system segments the shared memory, and each shared memory segment stores data to be read by the host computer and the virtual machines. The host computer and the virtual machines write data to be written into the shared memory segments associated with the other party and read data from the shared memory segments associated with themselves. In this way, the data communication between the host computer and the virtual machines and between the virtual machines can be ensured without affecting the network isolation, and the communication is simple and reliable. The network isolation communication system orderly manages the shared memory to prevent disorder during data reading and writing, improves the security and efficiency of the communication, and makes the communication smooth and error-free.

[0072] Further, in some embodiments, all the virtual machine memory segments are equal in size.

[0073] In the embodiment, the network isolation communication system sets all the virtual machine memory segments to be equal in size for the convenience of managing the virtual machine memory segments.

[0074] Further, in some embodiments, the shared memory 1 further has a management segment; the management segment is used to identify at least one of the following data:

[0075] whether the shared memory 1 is used for the first time, the size of the shared memory 1, the number of the virtual machines 3, the number of concurrent processes, the size of the virtual machine memory segment, the size of the host computer memory segment, the host computer identifier, the number of each type of data stored in the host computer memory segment, the offset of each type of data in the host computer memory segment, the virtual machine 3 identifier, the number of each type of data stored in the virtual machine memory segment, and the offset of each type of data in the virtual machine memory segment.

[0076] In the embodiment, refer to Figure 2The network isolation communication system can set a management section in the front of the shared memory 1. The size of the management section can be set as 512B, and the management section can store a plurality of identifiers for identifying the above data. The identifiers of the management section can be increased or decreased according to the use of the shared memory 1. For example, the identifiers of the management section can be set as F, T, N, C, U, P, H, V, S1, S2, S3, S4, 01, 02, 03, 04, and the like. The definitions of the identifiers are described in the following table:

[0077]

[0078] From the above table, it can be seen that the upload message, the regular message, the synchronization message, and the Apache message are types of data. The user can customize the types of data according to actual conditions. Assuming that the shared memory 1 only has a host memory section, the management section includes the number of each type of data that the host memory section can store and the offset of each type of data in the host memory section. If the shared memory 1 has a host memory section, a virtual machine memory section A, and a virtual machine memory section B, the management section also needs to add other identifiers, such as S11-S14 to represent the number of each type of data stored in the virtual machine memory section A, 011-014 to represent the offset of each type of data in the virtual machine memory section A, S21-S24 to represent the number of each type of data stored in the virtual machine memory section B, and 021-024 to represent the offset of each type of data in the virtual machine memory section B. The offset of a certain type of data in the management section can be the starting address of the type of data.

[0079] In the embodiment, in order to facilitate the management of the shared memory 1, the shared memory 1 can store each type of data in blocks. For example, referring to Figure 2 , the first block space of the shared memory 1 stores the management section, the second block space of the shared memory 1 stores the upload information of the host, the third block space of the shared memory 1 stores the regular message of the host, the fourth block space of the shared memory 1 stores the synchronization message of the host, the fifth block space of the shared memory 1 stores the download message of the virtual machine A, the sixth block space of the shared memory 1 stores the regular message of the virtual machine A, the seventh block space of the shared memory 1 stores the synchronization message of the virtual machine A, and the eighth block space of the shared memory 1 stores the Apache message of the virtual machine A. The management section can be initialized by the host process. For example, the management section is initialized by the host process when it is used for the first time, and the data of the last management section can be directly loaded by the host process when it is not used for the first time. In this way, the host and the virtual machine 3 obtain the message structure of the entire shared memory 1 according to the content of the management section, and read and write data from specific storage addresses.

[0080] Further, in some embodiments, a plurality of message queues storing different types of data are provided in both the host memory segment and the virtual machine memory segment.

[0081] Each message queue stores an INFO lock structure; the INFO lock structure includes a synchronization lock, a lock identifier, and a data amount; the lock identifier is used to identify an operation object of the synchronization lock on the message queue, and the operation object is the host management unit 2 or the virtual machine 3; the data amount is used to identify the amount of data in the message queue.

[0082] In the present embodiment, Figure 2 Each space in the memory segment can be set as a message queue, and an INFO lock structure is stored in front of each message queue. The INFO lock structure includes a synchronization lock, a lock identifier, and a data amount; the lock identifier is used to identify an operation object of the synchronization lock on the message queue, for example, if the host management unit 2 adds a synchronization lock on the message queue, the lock identifier can be set as the number of the host or the host management unit 2, and if the virtual machine 3 adds a synchronization lock on the message queue, the lock identifier can be set as the number of the virtual machine 3. The data amount in the INFO lock structure is used to identify the amount of data in the message queue.

[0083] Further, in some embodiments, referring to Figure 3 , the method for reading data by the host management unit 2 and the virtual machine 3 includes:

[0084] adding a synchronization lock on the message queue to be read;

[0085] setting the lock identifier of the message queue as the number of the operation object + 1;

[0086] copying the data in the message queue to the cache of the operation object;

[0087] correcting the data amount in the message queue;

[0088] setting the lock identifier of the message queue as 0;

[0089] releasing the synchronization lock on the message queue.

[0090] In the present embodiment, a read data process can be provided in the host management unit 2 and the virtual machine 3 for reading data from the shared memory 1. Before reading data, the read data process needs to add a synchronization lock to the message queue to be read. When the synchronization lock is added to the message queue, other operation objects cannot operate the message queue. Then the read data process sets the lock identifier to the number of the operation object + 1. In this way, when an operation object operates the message queue, the lock identifier will be set to a non-zero value. Then the read data process reads the data amount in the INFO lock structure to obtain how many data are contained in the message queue, and copies the data in the message queue to the cache of the operation object according to the data amount. For example, if the host reads the shared data, the host management unit 2 copies the read data to the cache of the host. If the virtual machine reads the shared data, the virtual machine copies the read data to its cache. After the read data process completes the data copying, it corrects the data amount in the INFO lock structure according to the data amount in the message queue. Finally, the lock identifier is set to 0 to release the synchronization lock of the message queue. When the message queue is unlocked, other operation objects can operate the message queue.

[0091] Further, in some embodiments, referring to Figure 3 , the method for writing data by the host management unit 2 and the virtual machine 3 includes:

[0092] adding a thread lock to the operation object;

[0093] adding a synchronization lock to the message queue to be written;

[0094] setting the lock identifier of the message queue to the number of the operation object + 1;

[0095] copying data from the cache of the operation object to the free space of the shared memory 1;

[0096] correcting the data amount in the message queue;

[0097] setting the lock identifier of the message queue to 0;

[0098] releasing the synchronization lock of the message queue;

[0099] releasing the thread lock of the operation object.

[0100] In the embodiment, the host management unit 2 and the virtual machine 3 can be provided with a write data process for writing data into the shared memory 1. The write data process acquires a thread lock of the operation object before writing data, so that other operation objects cannot read and write data into the shared memory, and then acquires a synchronization lock of the message queue to be written. Then the write data process sets the lock identifier to the number of the operation object + 1, acquires the free space in the shared space, copies the data to be written from the cache of the operation object to the free space in the shared memory 1, and when the data copying is completed, corrects the data amount of the INFO lock structure according to the data amount in the message queue. Finally, the lock identifier is set to 0, and the synchronization lock and the thread lock of the message queue are released. When the message queue is unlocked, other operation objects can operate the message queue and the shared memory.

[0101] A network isolation communication method applied to the network isolation communication system, the network isolation communication method comprising:

[0102] The virtual machine 3 writes data into the host memory segment or the virtual machine memory segment associated with the virtual machine 3 to be written when writing data;

[0103] The host management unit 2 writes data into the virtual machine memory segment associated with the virtual machine 3 to be written when writing data;

[0104] The host management unit 2 reads data from the associated host memory segment when reading data;

[0105] The virtual machine 3 reads data from the associated virtual machine memory segment when reading data.

[0106] Further, in some embodiments, the method for reading data by the host management unit 2 and the virtual machine 3 comprises:

[0107] Acquiring a synchronization lock of the message queue to be read;

[0108] Setting the lock identifier of the message queue to the number of the operation object + 1;

[0109] Copying the data in the message queue to the cache of the operation object;

[0110] Correcting the data amount in the message queue;

[0111] Setting the lock identifier of the message queue to 0;

[0112] Releasing the synchronization lock of the message queue.

[0113] Further, in some embodiments, the method for writing data by the host management unit 2 and the virtual machine 3 comprises:

[0114] Acquiring a thread lock of the operation object;

[0115] Synchronize the message queue to be written;

[0116] Set the lock identification of the message queue as the number of the operation object + 1;

[0117] Copy the data from the cache of the operation object to the free space of the shared memory 1;

[0118] Correct the data amount in the message queue;

[0119] Set the lock identification of the message queue as 0;

[0120] Release the synchronization lock of the message queue;

[0121] Release the thread lock of the operation object.

[0122] The method provided by the embodiments of the present application is described briefly, and the embodiments not mentioned in the embodiment part can refer to the corresponding content in the foregoing embodiments.

[0123] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application, and they should be covered in the scope of the claims and the specification of the present application.

Claims

1. A network isolation communication system, comprising: The application relates to a shared memory and a method for reading and writing data in the shared memory. The shared memory is arranged in a host computer, and comprises a host memory segment and at least one virtual machine memory segment; A host management unit is arranged in the host computer and is associated with the host memory segment; the host management unit is used to read data from the associated host memory segment when reading data, and write data into the virtual machine memory segment associated with a virtual machine to be written when writing data; At least one virtual machine is arranged in the host computer, and different virtual machines are associated with different virtual machine memory segments; the virtual machine is used to read data from the associated virtual machine memory segment when reading data, and write data into the host memory segment or the virtual machine memory segment associated with a virtual machine to be written when writing data; The shared memory is segmented, each shared memory segment stores data to be read by a host computer and a virtual machine, and the host computer and the virtual machine write data to be written into the shared memory segment associated with the other and read data from the associated shared memory segment; the host management unit and the virtual machine write data into the memory segment associated with the other and read data from the memory segment associated with the self; The number of virtual machine memory segments in the shared memory is consistent with the number of virtual machines; All the virtual machine memory segments are equal in size; The shared memory further comprises a management segment; the management segment is used to identify at least one of the following data: whether the shared memory is used for the first time, the size of the shared memory, the number of virtual machines, the number of concurrent processes, the size of the virtual machine memory segment, the size of the host memory segment, the identification of the host computer, the number of each type of data stored in the host memory segment, the offset of each type of data in the host memory segment, the identification of the virtual machine, the number of each type of data stored in the virtual machine memory segment, and the offset of each type of data in the virtual machine memory segment; A plurality of message queues for storing different types of data are arranged in the host memory segment and the virtual machine memory segment; Each message queue stores an INFO lock structure; the INFO lock structure comprises a synchronization lock, a lock identification and a data amount; the lock identification is used to identify an operation object of the synchronization lock of the message queue, and the operation object is a host management unit or a virtual machine; The data amount is used to identify the number of data in the message queue; The method for reading data by the host management unit and the virtual machine comprises the following steps: adding the synchronization lock to the message queue to be read; setting the lock identification of the message queue to the number of the operation object plus 1; copying the data in the message queue to the cache of the operation object; correcting the data amount in the message queue; setting the lock identification of the message queue to 0; releasing the synchronization lock of the message queue; The method for writing data by the host management unit and the virtual machine comprises the following steps: adding a thread lock to the operation object; adding the synchronization lock to the message queue to be written; setting the lock identification of the message queue to the number of the operation object plus 1; ​ copying data from the cache of the operation object to the free space of the shared memory; correcting the data amount in the message queue; setting the lock identification of the message queue to 0; releasing the synchronization lock of the message queue; releasing the thread lock of the operation object.

2. A method for network isolation communication, the method comprising: The network isolation communication method is applied to the network isolation communication system of claim 1, and the network isolation communication method comprises: When writing data, the virtual machine writes data into the host memory segment or the virtual machine memory segment associated with the virtual machine to be written; When writing data, the host management unit writes data into the virtual machine memory segment associated with the virtual machine to be written; When reading data, the host management unit reads data from the associated host memory segment; When reading data, the virtual machine reads data from the associated virtual machine memory segment; The method for the host management unit and the virtual machine to read data comprises: locking the message queue to be read with the synchronization lock; setting the lock identification of the message queue to the number of the operation object + 1; copying data from the cache of the operation object to the free space of the shared memory; correcting the data amount in the message queue; setting the lock identification of the message queue to 0; releasing the synchronization lock of the message queue; The method for the host management unit and the virtual machine to write data comprises: locking the operation object with a thread lock; locking the message queue to be written with the synchronization lock; setting the lock identification of the message queue to the number of the operation object + 1; copying data from the cache of the operation object to the free space of the shared memory; correcting the data amount in the message queue; setting the lock identification of the message queue to 0; releasing the synchronization lock of the message queue; releasing the thread lock of the operation object.

Images