An isolation method, system and related devices

Abstract

The application discloses an isolation method, system and related device. In the method, when receiving a request of a user device to access an isolated device, the host can determine whether to allow the user device to access the isolated device based on the access record of the isolated device. In this way, not only can the privacy leakage problem caused by the simultaneous access of multiple user devices to the same isolated device be avoided, but also the isolation efficiency can be improved. In addition, an isolation module can be set in the kernel of the host operating system to realize dynamic isolation of the isolated device in a non-intrusive manner, so that additional configuration is not required in different platforms or systems, which is conducive to achieving cross-version compatibility of the system kernel.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to an isolation method, system and related apparatus. Background Technology

[0002] With the development of computer and internet technologies, scenarios where multiple user devices connect to the same host are becoming increasingly common. Multiple user devices can connect to the same host simultaneously, allowing all user devices to share the hardware resources provided by the host in a time-sharing manner.

[0003] However, some hardware resources provided by the host machine contain devices that require isolation. These devices can only be accessed by one user or one user group at a time. If multiple user devices (e.g., the first user device and the second user device) simultaneously access the same device on the host machine (e.g., a camera, a speaker, etc.), these multiple user devices will cross-read and write data related to that device. In this case, the first user device may read data written by the second user device, leading to a leakage of user privacy. Summary of the Invention

[0004] This application provides an isolation method, system, and related apparatus. In this method, when a host receives a request from a user device to access an isolation device, it can determine whether to allow the user device to access the isolation device based on the access record of the isolation device, thereby realizing dynamic isolation of the isolation device.

[0005] In a first aspect, this application provides an isolation method, comprising: a host receiving a first access request sent by a first user equipment, the first access request being used to request control of a first isolation device to perform a first function; in response to the first access request, when the host determines that an access record of the first isolation device exists in an access record table, and the user equipment that previously accessed the isolation device in the access record of the first isolation device is the first user equipment, and the access record of the first isolation device is valid, the host controls the first isolation device to perform the first function; wherein, the access record table includes device identifiers of one or more isolation devices and access records of one or more isolation devices, and the access record includes the device identifier of the user equipment that previously accessed the isolation device and valid information of the access record.

[0006] It should be noted that the first isolation device can be an electronic device mounted on the host or a component on the host. The host can be used to determine whether the first user device has access rights to the first isolation device (i.e., whether the first user device can control the first isolation device to perform the first function through the host). The host can establish a wired or wireless communication connection with the first isolation device, and the host is used to control the first isolation device to perform the first function through this communication connection. The first function may include any one or more of the following: playing audio files, acquiring sound information, acquiring image information, printing files, displaying files, storing files, reading / writing files, etc.

[0007] Valid information can be used to indicate whether the previous user device's access to the isolated device was forcibly terminated, i.e., whether the previous user device is still accessing the isolated device. When the valid information in the access record is valid, the access record is valid, indicating that the previous user device may still be accessing the isolated device; when the valid information in the access record is invalid, the access record is invalid, indicating that the previous user device has terminated its access to the isolated device.

[0008] This prevents multiple user devices from accessing the same isolated device simultaneously, thus avoiding privacy leaks and other issues.

[0009] In one possible implementation, the method further includes: in response to a first access request, when the host determines that there is an access record for the first isolation device in the access record table, and the user device that previously accessed the isolation device in the access record of the first isolation device is different from the first user device, and the access record of the first isolation device is invalid, the host controls the first isolation device to perform a first function.

[0010] In one possible implementation, the method further includes: in response to the first access request, when the host determines that there is an access record for the first isolation device in the access record table, and the user device that previously accessed the isolation device in the access record of the first isolation device is the same as the first user device, and the access record of the first isolation device is invalid, the host sends a first notification to the first user device, the first notification being used to notify the first user device that it cannot control the first isolation device to perform the first function.

[0011] In one possible implementation, the access record also includes the access time of the user device that previously accessed the isolation device; the method further includes: in response to the first access request, when the host determines that there is an access record for the first isolation device in the access record table, and the user device that previously accessed the isolation device in the access record of the first isolation device is different from the first user device, and the access record of the first isolation device is valid, and the time interval between the access time of the user device that previously accessed the first isolation device and the current time is greater than a first threshold, the host controls the first isolation device to perform a first function.

[0012] In one possible implementation, the method further includes: in response to the first access request, when the host determines that there is an access record for the first isolation device in the access record table, and the user device that previously accessed the isolation device in the access record of the first isolation device is different from the first user device, and the access record of the first isolation device is valid, and the time interval between the access time of the user device that previously accessed the first isolation device and the current time is less than or equal to a first threshold, the host sends a first notification to the first user device, the first notification being used to notify the first user device that it cannot control the first isolation device to perform the first function.

[0013] In one possible implementation, the method further includes: in response to a first access request, when the host determines that there is no access record for the first isolation device in the access record table, the host controls the first isolation device to perform a first function.

[0014] The above method ensures that when a user device is accessing the isolation device, other user devices are denied access to the same isolation device, thus avoiding privacy leaks caused by simultaneous access to the same isolation device by multiple user devices. Furthermore, the method is time-efficient.

[0015] In one possible implementation, after the host controls the first isolation device to perform the first function, the method further includes: when the host determines that there is no access record for the first isolation device in the access record table, the host adds the access record for the first isolation device to the access record table.

[0016] In one possible implementation, after the host controls the first isolation device to perform the first function, the method further includes: when the host determines that there is an access record for the first isolation device in the access record table, and the user device that previously accessed the isolation device in the access record of the first isolation device is different from the first user device, and the access record of the first isolation device is invalid, the host changes the device identifier of the user device that previously accessed the isolation device in the access record of the first isolation device to the device identifier of the first user device, and the host changes the validity information of the access record to valid.

[0017] In one possible implementation, after the host controls the first isolation device to perform the first function, the method further includes: when the host determines that there is an access record for the first isolation device in the access record table, and the user device that previously accessed the isolation device in the access record of the first isolation device is the first user device, and the access record of the first isolation device is valid, the host changes the access time in the access record of the first isolation device to the current time.

[0018] In one possible implementation, after the host controls the first isolation device to perform the first function, the method further includes: when the host determines that there is an access record for the first isolation device in the access record table, and the user device that previously accessed the isolation device in the access record of the first isolation device is different from the first user device, and the access record of the first isolation device is valid, and the time interval between the access time of the user device that previously accessed the first isolation device and the current time is greater than a first threshold, the host changes the device identifier of the user device that previously accessed the isolation device in the access record of the first isolation device to the device identifier of the first user device, and the host changes the access time in the access record of the first isolation device to the current time.

[0019] In this way, by updating the access records of the isolated device in a timely manner, it is not necessary to pre-assign permissions to each user device, thus enabling dynamic isolation of the isolated device.

[0020] In one possible implementation, the first access request includes an access identifier for the first user equipment and a device identifier for the first isolation device; the device identifier of the first isolation device is the device identifier of the first isolation device; wherein, the device identifier of the first isolation device includes any of the following: the device name, device type, media access control MAC address, and Internet Protocol (IP) address of the first isolation device.

[0021] In one possible implementation, the first access request includes the device identifier of the first user device and the device identifier of the first isolation device; the method further includes: the host determining the identifier of the first isolation device based on the device identifier of the first isolation device using a hash algorithm, wherein the data size of the identifier of the first isolation device is less than the data size of the device identifier of the first isolation device.

[0022] By using a hash algorithm, the device identifier of the first isolated device can be compressed into a smaller device identifier for the first isolated device. This not only reduces the space occupied by data storage but also allows for faster determination of access records for the isolated device. Even with a large number of user devices, determining access records based on the device identifier of the first isolated device only requires a constant order of time, significantly improving the efficiency of the method.

[0023] In one possible implementation, the access record table is a hash table.

[0024] By using a hash table to store access records, it is easier to adjust the access records in real time and improve memory utilization.

[0025] In one possible implementation, the first access request further includes a first access type, which indicates the type of the first function; before the host controls the first isolation device to perform the first function, the method further includes: the host determining a first instruction based on the first access type, which instructs the first isolation device to perform the first function; the host controlling the first isolation device to perform the first function specifically includes: the host sending the first instruction to the first isolation device.

[0026] In one possible implementation, the method further includes: when the host determines that the first condition is met, the host changes the valid information in the access record of the first isolation device to invalid. In this way, when the first condition is met, the access rights of the previous user device to the first isolation device can be revoked in a timely manner, improving the utilization rate of the first isolation device.

[0027] In one possible implementation, the first condition is that the host receives a first input operation to terminate the user equipment's access to the first isolation device. This allows for flexible adjustment of the previous user equipment's access rights to the first isolation device according to actual needs, expanding the applicability of the method.

[0028] In another possible implementation, the first condition is that the host determines the first isolation device has been occupied for a longer period than a second threshold. This avoids the same user device from occupying the first isolation device for an extended period.

[0029] Secondly, this application provides an isolation system, including: a host, a first isolation device, and a first user device; the first user device is configured to send a first access request to the host, the first access request being used to request control of the first isolation device to perform a first function; the host is configured to receive the first access request; the host is further configured to, in response to the first access request, control the first isolation device to perform the first function when the host determines that an access record of the first isolation device exists in the access record table, and the user device that previously accessed the isolation device in the access record of the first isolation device is the first user device, and the access record of the first isolation device is valid; the first isolation device is configured to perform the first function; wherein, the access record table includes device identifiers of one or more isolation devices and access records of one or more isolation devices, and the access record includes the device identifier of the user device that previously accessed the isolation device and valid information of the access record.

[0030] In one possible implementation, the host is also configured to respond to the first access request by controlling the first isolation device to perform the first function when the host determines that there is an access record for the first isolation device in the access record table, and the user device that previously accessed the isolation device in the access record of the first isolation device is different from the first user device, and the access record of the first isolation device is invalid.

[0031] In one possible implementation, the host is further configured to respond to the first access request by sending a first notification to the first user device when the host determines that there is an access record for the first isolation device in the access record table, and the user device that previously accessed the isolation device in the access record of the first isolation device is the same as the first user device, and the access record of the first isolation device is invalid; wherein the first notification is used to notify the first user device that it cannot control the first isolation device to perform the first function.

[0032] In one possible implementation, the access record also includes the access time of the user device that previously accessed the isolation device; the host is also used to respond to the first access request, when the host determines that there is an access record for the first isolation device in the access record table, and the user device that previously accessed the isolation device in the access record of the first isolation device is different from the first user device, and the access record of the first isolation device is valid, and the time interval between the access time of the user device that previously accessed the first isolation device and the current time is greater than a first threshold, the host controls the first isolation device to perform the first function.

[0033] In one possible implementation, the host is further configured to respond to the first access request by sending a first notification to the first user device when the host determines that there is an access record for the first isolation device in the access record table, and the user device that previously accessed the isolation device in the access record of the first isolation device is different from the first user device, and the access record of the first isolation device is valid, and the time interval between the access time of the user device that previously accessed the first isolation device and the current time is less than or equal to a first threshold; wherein, the first notification is used to notify the first user device that it cannot control the first isolation device to perform the first function.

[0034] In one possible implementation, the host is also used to respond to the first access request and, when the host determines that there is no access record for the first isolation device in the access record table, control the first isolation device to perform a first function.

[0035] In one possible implementation, after the host controls the first isolation device to perform the first function, the host is also used to add an access record for the first isolation device to the access record table when the host determines that there is no access record for the first isolation device in the access record table.

[0036] In one possible implementation, after the host controls the first isolation device to perform the first function, the host is further configured to, when the host determines that there is an access record for the first isolation device in the access record table, and the user device that previously accessed the isolation device in the access record of the first isolation device is different from the first user device, and the access record of the first isolation device is invalid, change the device identifier of the user device that previously accessed the isolation device in the access record of the first isolation device to the device identifier of the first user device, and change the validity information of the access record to valid.

[0037] In one possible implementation, after the host controls the first isolation device to perform the first function, the host is further configured to change the access time in the access record of the first isolation device to the current time when the host determines that there is an access record of the first isolation device in the access record table, and the user device that previously accessed the isolation device in the access record of the first isolation device is the first user device, and the access record of the first isolation device is valid.

[0038] In one possible implementation, after the host controls the first isolation device to perform the first function, the host is further configured to, when the host determines that there is an access record for the first isolation device in the access record table, and the user device that previously accessed the isolation device in the access record of the first isolation device is different from the first user device, and the access record of the first isolation device is valid, and the time interval between the access time of the user device that previously accessed the first isolation device and the current time is greater than a first threshold, change the device identifier of the user device that previously accessed the isolation device in the access record of the first isolation device to the device identifier of the first user device, and change the access time in the access record of the first isolation device to the current time.

[0039] In one possible implementation, the first access request includes an access identifier for the first user equipment and a device identifier for the first isolation device; the device identifier of the first isolation device is the device identifier of the first isolation device; wherein, the device identifier of the first isolation device includes any of the following: the device name, device type, media access control MAC address, and Internet Protocol (IP) address of the first isolation device.

[0040] In another possible implementation, the first access request includes a device identifier for a first user device and a device identifier for a first isolation device; the host is further configured to determine an identifier for the first isolation device using a hash algorithm based on the device identifier of the first isolation device, wherein the data size of the identifier of the first isolation device is less than the data size of the device identifier of the first isolation device. The access record table can be a hash table.

[0041] In one possible implementation, the first access request further includes a first access type, which indicates the type of the first function; the host is also used to determine a first instruction based on the first access type, which instructs the first isolation device to perform the first function; the host is also used to send the first instruction to the first isolation device.

[0042] In one possible implementation, the host is further configured to change valid information in the access record of the first isolation device to invalid when the host determines that a first condition is met. The first condition may be that the host receives a first input operation to terminate the user equipment's occupation of the first isolation device. Alternatively, the first condition may be that the host determines that the occupation time of the first isolation device is greater than a second threshold.

[0043] Thirdly, this application provides an electronic device, which is a host, including a communication module and an isolation module; the communication module is used to receive a first access request, the first access request being used to request control of a first isolation device to perform a first function; the isolation module is used to respond to the first access request to determine whether there is an access record of the first isolation device in the access record table, and whether the user device that previously accessed the isolation device in the access record of the first isolation device is the first user device, and whether the access record of the first isolation device is valid; wherein, the access record table includes device identifiers of one or more isolation devices and access records of one or more isolation devices, and the access record includes the device identifier of the user device that previously accessed the isolation device and the validity information of the access record; the communication module is also used to instruct the first isolation device to perform the first function when the isolation module determines that there is an access record of the first isolation device in the access record table, and that the user device that previously accessed the isolation device in the access record of the first isolation device is the first user device, and that the access record of the first isolation device is valid.

[0044] In one possible implementation, the isolation module is further configured to respond to the first access request by determining whether an access record for the first isolation device exists in the access record table, and whether the user device that previously accessed the isolation device in the access record of the first isolation device is different from the first user device, and whether the access record of the first isolation device is invalid; the communication module is further configured to instruct the first isolation device to perform the first function when the isolation module determines that an access record for the first isolation device exists in the access record table, and that the user device that previously accessed the isolation device in the access record of the first isolation device is different from the first user device, and whether the access record of the first isolation device is invalid.

[0045] In one possible implementation, the isolation module is further configured to respond to the first access request by determining whether an access record for the first isolation device exists in the access record table, and whether the user device that previously accessed the isolation device in the access record of the first isolation device is the same as the first user device, and whether the access record of the first isolation device is invalid; the communication module is further configured to send a first notification to the first user device when the isolation module determines that an access record for the first isolation device exists in the access record table, and that the user device that previously accessed the isolation device in the access record of the first isolation device is the same as the first user device, and whether the access record of the first isolation device is invalid; wherein, the first notification is used to notify the first user device that it cannot control the first isolation device to perform the first function.

[0046] In one possible implementation, the access record also includes the access time of the user device that previously accessed the isolation device; the isolation module is further configured to, in response to the first access request, determine whether there is an access record for the first isolation device in the access record table, and whether the user device that previously accessed the isolation device in the access record of the first isolation device is different from the first user device, and whether the access record of the first isolation device is valid, and whether the time interval between the access time of the user device that previously accessed the first isolation device and the current time is greater than a first threshold; the communication module is further configured to, when the isolation module determines that there is an access record for the first isolation device in the access record table, and whether the user device that previously accessed the isolation device in the access record of the first isolation device is different from the first user device, and whether the access record of the first isolation device is valid, and whether the time interval between the access time of the user device that previously accessed the first isolation device and the current time is greater than a first threshold, instruct the first isolation device to perform a first function.

[0047] In one possible implementation, the isolation module is further configured to respond to the first access request by determining whether an access record for the first isolation device exists in the access record table, and that the user device that previously accessed the isolation device in the access record for the first isolation device is different from the first user device, and that the access record for the first isolation device is valid, and that the time interval between the access time of the user device that previously accessed the first isolation device and the current time is less than or equal to a first threshold; the communication module is further configured to send a first notification to the first user device when the isolation module determines that an access record for the first isolation device exists in the access record table, and that the user device that previously accessed the isolation device in the access record for the first isolation device is different from the first user device, and that the access record for the first isolation device is valid, and that the time interval between the access time of the user device that previously accessed the first isolation device and the current time is less than or equal to the first threshold; wherein, the first notification is used to notify the first user device that it cannot control the first isolation device to perform the first function.

[0048] In one possible implementation, the isolation module is further configured to, in response to the first access request, determine whether there is no access record for the first isolation device in the access record table; the communication module is further configured to, when the isolation module determines that there is no access record for the first isolation device in the access record table, instruct the first isolation device to perform a first function.

[0049] In one possible implementation, after the communication module instructs the first isolation device to perform the first function, the isolation module is further configured to add the access record of the first isolation device to the access record table when the isolation module determines that there is no access record of the first isolation device in the access record table.

[0050] In one possible implementation, after the communication module instructs the first isolation device to perform the first function, the isolation module is further configured to, when the isolation module determines that there is an access record of the first isolation device in the access record table, and the user device that previously accessed the isolation device in the access record of the first isolation device is different from the first user device, and the access record of the first isolation device is invalid, change the device identifier of the user device that previously accessed the isolation device in the access record of the first isolation device to the device identifier of the first user device, and change the validity information of the access record to valid.

[0051] In one possible implementation, after the communication module instructs the first isolation device to perform the first function, the isolation module is further configured to change the access time in the access record of the first isolation device to the current time when the isolation module determines that there is an access record of the first isolation device in the access record table, and the user device that previously accessed the isolation device in the access record of the first isolation device is the first user device, and the access record of the first isolation device is valid.

[0052] In one possible implementation, after the communication module instructs the first isolation device to perform the first function, the isolation module is further configured to, when the isolation module determines that there is an access record of the first isolation device in the access record table, and the user device that previously accessed the isolation device in the access record of the first isolation device is different from the first user device, and the access record of the first isolation device is valid, and the time interval between the access time of the user device that previously accessed the first isolation device and the current time is greater than a first threshold, change the device identifier of the user device that previously accessed the isolation device in the access record of the first isolation device to the device identifier of the first user device, and change the access time in the access record of the first isolation device to the current time.

[0053] In one possible implementation, the first access request includes an access identifier for the first user equipment and a device identifier for the first isolation device; the device identifier of the first isolation device is the device identifier of the first isolation device; wherein, the device identifier of the first isolation device includes any of the following: the device name, device type, media access control MAC address, and Internet Protocol (IP) address of the first isolation device.

[0054] In another possible implementation, the first access request includes the device identifier of the first user device and the device identifier of the first isolation device; the isolation module is further configured to determine the identifier of the first isolation device using a hash algorithm based on the device identifier of the first isolation device, wherein the data size of the identifier of the first isolation device is less than the data size of the device identifier of the first isolation device. The access record table can be a hash table.

[0055] In one possible implementation, the first access request further includes a first access type, which indicates the type of the first function; the isolation module is further configured to determine a first instruction based on the first access type, which instructs the first isolation device to perform the first function; and the communication module is further configured to send the first instruction to the first isolation device.

[0056] In one possible implementation, the isolation module is further configured to change valid information in the access record of the first isolation device to invalid when the isolation module determines that a first condition is met. The first condition may be that the isolation module receives a first input operation to terminate the user equipment's occupation of the first isolation device. Alternatively, the first condition may be that the isolation module determines that the occupation time of the first isolation device is greater than a second threshold.

[0057] Fourthly, this application provides an electronic device, a host, comprising one or more processors and one or more memories. The one or more memories are coupled to the one or more processors, and the one or more memories are used to store computer program code, which includes computer instructions. When the one or more processors execute the computer instructions, the host causes the host to perform the isolation method in any possible implementation of any of the above aspects.

[0058] In this way, by setting an isolation module in the kernel of the host operating system, dynamic isolation of the isolation device can be achieved in a non-intrusive manner. No additional configuration is required on different platforms or systems, which is conducive to achieving cross-version compatibility of the system kernel.

[0059] Fifthly, embodiments of this application provide a computer storage medium including computer instructions that, when executed on a computer, cause the computer to perform the isolation method in any of the possible implementations of any of the above aspects.

[0060] Sixthly, embodiments of this application provide a computer program product that, when run on a computer, causes the computer to execute the isolation method in any possible implementation of any of the above aspects.

[0061] For the beneficial effects of aspects two through six, please refer to the beneficial effects of aspect one, which will not be repeated here. Attached Figure Description

[0062] Figure 1 A schematic diagram of the architecture of a system 10 provided in an embodiment of this application;

[0063] Figure 2A This is a schematic diagram of a scenario for an in-vehicle entertainment system provided in an embodiment of this application;

[0064] Figure 2BThis is a schematic diagram of a smart conference room system provided in an embodiment of this application;

[0065] Figure 3A A schematic diagram of the hardware structure of an electronic device 100 provided in an embodiment of this application;

[0066] Figure 3B A schematic diagram of the hardware structure of an electronic device 200 provided in an embodiment of this application;

[0067] Figure 3C A schematic diagram of the hardware structure of an electronic device 300 provided in an embodiment of this application;

[0068] Figure 4 A flowchart illustrating an isolation method provided in an embodiment of this application;

[0069] Figure 5 A schematic diagram illustrating a process for determining user device access permissions based on access records, provided as an embodiment of this application;

[0070] Figure 6 This is a schematic diagram of the structure of an isolation module 60 provided in an embodiment of this application;

[0071] Figure 7 This is a schematic diagram of the functional modules of a host provided in an embodiment of this application. Detailed Implementation

[0072] The technical solutions in the embodiments of this application will be clearly and thoroughly described below with reference to the accompanying drawings. In the description of the embodiments of this application, unless otherwise stated, " / " means "or," for example, A / B can mean A or B; the word "and / or" in the text is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Furthermore, in the description of the embodiments of this application, "multiple" refers to two or more than two.

[0073] Hereinafter, the terms "first" and "second" are used for descriptive purposes only and should not be construed as implying or suggesting relative importance or implicitly indicating the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature, and in the description of the embodiments of this application, unless otherwise stated, "multiple" means two or more.

[0074] The following describes a system architecture provided by an embodiment of this application.

[0075] Figure 1 A schematic diagram of the architecture of a system 10 provided in an embodiment of this application is shown.

[0076] like Figure 1 As shown, system 10 includes a host 11, one or more isolation devices, and multiple user devices. An isolation device is a device that can only be accessed by one user device or the same group of user devices at a time; an isolation device may include isolation device 12. User devices can access the isolation devices through the host 11; user devices may include user devices 13 and 14. An isolation device may also include isolation device 15.

[0077] It should be noted that the host 11 can be a mobile phone, tablet computer, desktop computer, laptop computer, handheld computer, notebook computer, ultra-mobile personal computer (UMPC), netbook, as well as cellular phone, personal digital assistant (PDA), augmented reality (AR) device, virtual reality (VR) device, artificial intelligence (AI) device, wearable device, in-vehicle device, smart home device and / or smart city device. This application embodiment does not impose any special restrictions on the specific type of the host 11.

[0078] The isolation device can be a component on the host 11 (e.g., a camera, speaker, microphone, display screen, etc. built into the host 11). The isolation device can also be an external electronic device connected to the host 11 (e.g., a microphone, headphones, or storage media such as a USB flash drive or hard drive). For example, Figure 1 In the system 10 shown, isolation device 12 can be a microphone, and isolation device 15 can be a printer.

[0079] In some embodiments, the isolation device may also be a mobile phone, tablet computer, desktop computer, laptop computer, handheld computer, notebook computer, UMPC, netbook, as well as cellular phone, PDA, AR device, VR device, AI device, wearable device, in-vehicle device, smart home device and / or smart city device. The embodiments of this application do not impose any special restrictions on the specific type of the isolation device.

[0080] User equipment can be an electronic device that only has input and output functions. In some embodiments, user equipment can also be a mobile phone, tablet computer, desktop computer, laptop computer, handheld computer, notebook computer, UMPC, netbook, as well as cellular phone, PDA, AR device, VR device, AI device, wearable device, in-vehicle device, smart home device and / or smart city device. The embodiments of this application do not impose special restrictions on the specific type of user equipment.

[0081] When the isolation device 12 is an electronic device connected to the host 11, a first communication connection can be established between the isolation device 12 and the host 11. The first communication connection can be a wired connection or a wireless connection. The wireless connection can be a wireless local area network (WLAN) connection, a wireless fidelity (Wi-Fi) connection, a Bluetooth connection, an infrared connection, a near field communication (NFC) connection, a ZigBee connection, or other short-range wireless communication technologies that have emerged in subsequent developments.

[0082] A second communication connection can be established between the user equipment and the host 11. This second communication connection can be a short-range connection or a long-range connection. For short-range connections, refer to the relevant content in the first communication connection section; it will not be repeated here. Long-range connections include, but are not limited to, long-range connections based on mobile networks using 2G, 3G, 4G, 5G, and subsequent standard protocols. The user equipment can also log in to the same user account (e.g., a Huawei account) as the host 11 and then establish a long-range connection through the server.

[0083] The user equipment can send an access request to the host 11 for an isolation device (e.g., isolation device 12) via a second communication device. This access request is used to request access rights to the isolation device 12. The host 11 can send instructions to the isolation device 12 via a first communication connection. These instructions are used to instruct the isolation device 12 to perform operations corresponding to the instructions. In some embodiments, the host 11 contains related files (e.g., executable files) for the isolation device 12. In this case, the host 11 can perform read and write operations on the related files of the isolation device 12 based on the access request sent by the user equipment.

[0084] This application describes a namespace isolation method that creates a namespace for each user device, allowing each user device to access only one or more isolated devices within its corresponding namespace. This avoids privacy breaches caused by multiple user devices simultaneously accessing the same isolated device, provided that each isolated device exists in only one namespace at a time.

[0085] For example, in system 10 described above, the isolation devices may include a microphone and a printer. User device 13 corresponds to a first namespace, and user device 14 corresponds to a second namespace. The first namespace includes the microphone, and the second namespace includes the printer. In this case, user device 13 can only access the microphone through host 11, but cannot access other isolation devices such as the printer. Similarly, user device 14 can only access the printer through host 11, but cannot access other isolation devices such as the microphone.

[0086] Specifically, adding or removing an isolated device from a namespace can be achieved by adding or removing the isolated device's identifier in the user-space file system of host 11. It should be noted that the operating system of host 11 can include kernel space and user space, where the user-space file system runs in user space. A user device can access an isolated device if and only if the identifier of the isolated device exists in the user-space file system corresponding to that user device. For example, when host 11 needs to add a printer to the first namespace, it can add the printer's identifier to the user-space file system of user device 13 and remove the printer's identifier from the user-space file systems of other user devices besides user device 13, thereby isolating the printer. This effectively avoids privacy leaks and other problems caused by multiple user devices simultaneously accessing the same isolated device.

[0087] Host 11 can also periodically monitor the isolated device to determine whether it is being accessed and which user devices are accessing it. It can dynamically remove currently accessed isolated devices from the namespaces of other user devices to ensure that only one user device accesses the same isolated device at a time. After a user device finishes accessing the isolated device, host 11 can re-add the isolated device to the namespaces of other user devices. Furthermore, when two user devices initiate access requests to the same device, an additional synchronization mechanism can determine the processing order of the two access requests. For example, the access request from the user device that initiated it earlier can be processed first, while the other user device's access request is added to the request queue of the isolated device and processed only after the isolated device has finished being accessed.

[0088] In this way, the isolation device can be accessed by different user devices at different times, which can achieve dynamic isolation of the isolation device. However, using the above method, the host 11 needs to frequently add or remove the isolation device from the namespace of the user device. Moreover, as the number of user devices increases, the time consumption of this step will become longer and longer. Therefore, when the number of user devices is large, this method has a large time overhead and is not efficient.

[0089] This application also introduces a control group-based isolation method. A control group can be set up in the host 11, which can contain multiple controllers. Each controller includes a series of process groups, and each process group includes a set of processes and a control policy. The control policy includes an allow list and a deny list. Processes within a process group can operate on devices in the allow list but cannot operate on devices in the deny list. The host can configure different process groups for different user devices to achieve device isolation. However, the time overhead of this method is linearly related to the number of user devices. When the number of user devices is large, the time overhead required by the method is also large, resulting in low efficiency.

[0090] Therefore, this application proposes an isolation method in which the host, upon receiving a request from a user device to access the isolation device, determines whether to allow the user device to access the isolation device based on the access record of the isolation device. This not only effectively avoids privacy leaks caused by multiple user devices simultaneously accessing the same isolation device, but also improves isolation efficiency. Furthermore, by setting an isolation module in the host operating system kernel, dynamic isolation of the isolation device can be achieved in a non-intrusive manner. This eliminates the need for additional configuration on different platforms or systems, facilitating cross-version compatibility with the system kernel.

[0091] The following describes the application scenarios of the isolation method provided in the embodiments of this application.

[0092] Figure 2A The illustration shows a scenario diagram of an in-vehicle entertainment system provided in an embodiment of this application.

[0093] like Figure 2A As shown, the in-vehicle entertainment system 20 may include a host unit 21 and multiple touch displays, including touch displays 22 and 23, etc. Touch display 22 is for the driver, and touch display 23 is for the rear passengers. The in-vehicle entertainment system 20 is also connected to a speaker 24.

[0094] Host 21 can be one of the above-mentioned... Figure 1 In the illustrated embodiment, the host 11 in system 10 and the multiple touch displays can be user equipment in system 10, and the speaker 24 can be an isolation device in system 10.

[0095] In a multi-touch display system, any one of the touch displays can send an access request to the host 21 to request access to the speaker 24. Upon receiving the access request, the host 21 can determine whether the touch display has the necessary access rights based on the request and the speaker 24's access history. Only when the touch display has the necessary access rights can it access the speaker 24 through the host 21. This isolates the speaker 24 in the in-vehicle entertainment system 20, preventing multiple users from simultaneously playing audio files through the speaker 24 via different touch displays, thus avoiding disruption to the driver's driving.

[0096] Figure 2B The illustration shows a scene diagram of an intelligent conference room system provided in an embodiment of this application.

[0097] like Figure 2B As shown, the intelligent conferencing system 30 may include a host 31, a camera 32, a central microphone 33, a large display 34, one or more touch displays 35, and user devices 36. The meeting host can use the user device 36 to connect securely to the host 31 for a secret meeting, and other participants can request services provided by the intelligent conferencing system 30 through one of the touch displays 35. In some embodiments, the user device 36 can also remotely connect to the host 31 via a secure line for a remote secret meeting; this application does not limit this to specific scenarios.

[0098] Host 31 can be one of the above-mentioned... Figure 1 In the illustrated embodiment, the host 11, one or more touch displays 35 and user equipment 36 in system 10 can be user equipment in system 10, and the camera 32, central microphone 33 and large display 34 can be isolation devices in system 10.

[0099] In the aforementioned smart conference room scenario, the touch display 35 and user device 36 can send access requests to the host 31. Since user device 36 is always connected to the host 31 via a secure line, while the touch display 35 may be connected via a non-secure line, when the host 31 receives an access request from the touch display 35 for any one or more of the isolated devices such as camera 32, central microphone 33, and large display 34, the host 31 can directly reject the touch display 35's access to prevent information leakage via the non-secure line. When the host 31 receives an access request from user device 36 for any one or more of the isolated devices, it can determine whether user device 36 has the necessary access rights based on the access request and the access records of the isolated devices. User device 36 can access the isolated devices through the host 31 only if it has the necessary access rights.

[0100] In this way, devices such as camera 32, central microphone 33, and large display 34 can be isolated to prevent the content collected by these devices from being transmitted through insecure lines, which could lead to the leakage of confidential information involved in the meeting and affect the interests of users.

[0101] The hardware structure of the electronic device provided in the embodiments of this application is described below.

[0102] Figure 3A A schematic diagram of the hardware structure of the electronic device 100 is shown.

[0103] Electronic device 100 may be a mobile phone, tablet computer, desktop computer, laptop computer, handheld computer, notebook computer, ultra-mobile personal computer (UMPC), netbook, as well as cellular phone, personal digital assistant (PDA), augmented reality (AR) device, virtual reality (VR) device, artificial intelligence (AI) device, wearable device, in-vehicle device, smart home device and / or smart city device. The embodiments of this application do not impose any special restrictions on the specific type of electronic device.

[0104] Electronic device 100 may include processor 110, external memory interface 120, internal memory 121, universal serial bus (USB) interface 130, charging management module 140, power management module 141, battery 142, antenna 1, antenna 2, mobile communication module 150, wireless communication module 160, audio module 170, speaker 170A, receiver 170B, microphone 170C, headphone jack 170D, sensor module 180, button 190, motor 191, indicator 192, camera 193, display screen 194, and subscriber identification module (SIM) card interface 195, etc. The sensor module 180 may include a pressure sensor 180A, a gyroscope sensor 180B, a barometric pressure sensor 180C, a magnetic sensor 180D, an accelerometer sensor 180E, a distance sensor 180F, a proximity sensor 180G, a fingerprint sensor 180H, a temperature sensor 180J, a touch sensor 180K, an ambient light sensor 180L, a bone conduction sensor 180M, etc.

[0105] It is understood that the structures illustrated in the embodiments of the present invention do not constitute a specific limitation on the electronic device 100. In other embodiments of this application, the electronic device 100 may include more or fewer components than illustrated, or combine some components, or split some components, or have different component arrangements. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0106] Processor 110 may include one or more processing units, such as application processors (APs), modem processors, graphics processing units (GPUs), image signal processors (ISPs), controllers, video codecs, digital signal processors (DSPs), baseband processors, and / or neural network processing units (NPUs). These different processing units may be independent devices or integrated into one or more processors.

[0107] The controller can generate operation control signals based on the instruction opcode and timing signals to complete the control of instruction fetching and execution.

[0108] The processor 110 may also include a memory for storing instructions and data. In some embodiments, the memory in the processor 110 is a cache memory. This memory can store instructions or data that the processor 110 has just used or that are used repeatedly. If the processor 110 needs to use the instruction or data again, it can retrieve it directly from the memory. This avoids repeated accesses, reduces the waiting time of the processor 110, and thus improves the efficiency of the system.

[0109] The charging management module 140 receives charging input from the charger. The charger can be a wireless charger or a wired charger. In some other embodiments, the power management module 141 may also be located within the processor 110. In still other embodiments, the power management module 141 and the charging management module 140 may be located in the same device.

[0110] The wireless communication function of electronic device 100 can be realized through antenna 1, antenna 2, mobile communication module 150, wireless communication module 160, modem processor and baseband processor, etc.

[0111] Antennas 1 and 2 are used to transmit and receive electromagnetic wave signals. The mobile communication module 150 can provide wireless communication solutions, including 2G / 3G / 4G / 5G, for use on the electronic device 100. In some embodiments, at least some functional modules of the mobile communication module 150 can be housed in the processor 110. In some embodiments, at least some functional modules of the mobile communication module 150 and at least some modules of the processor 110 can be housed in the same device.

[0112] The modem processor may include a modulator and a demodulator. The modulator modulates the low-frequency baseband signal to be transmitted into a mid-to-high frequency signal. The demodulator demodulates the received electromagnetic wave signal into a low-frequency baseband signal. The demodulator then transmits the demodulated low-frequency baseband signal to the baseband processor for processing. After processing by the baseband processor, the low-frequency baseband signal is transmitted to the application processor. The application processor outputs sound signals through an audio device (not limited to speaker 170A, receiver 170B, etc.) or displays images or videos through the display screen 194. In some embodiments, the modem processor may be a separate device. In other embodiments, the modem processor may be independent of the processor 110 and may be housed in the same device as the mobile communication module 150 or other functional modules.

[0113] The wireless communication module 160 can provide solutions for wireless communication applications on the electronic device 100, including wireless local area networks (WLANs) (such as wireless fidelity (Wi-Fi) networks), Bluetooth (BT), global navigation satellite system (GNSS), frequency modulation (FM), near field communication (NFC), and infrared (IR) technologies. The wireless communication module 160 can be one or more devices integrating at least one communication processing module. The wireless communication module 160 receives electromagnetic waves via antenna 2, demodulates and filters the electromagnetic wave signals, and sends the processed signal to processor 110. The wireless communication module 160 can also receive signals to be transmitted from processor 110, frequency modulate and amplify them, and then convert them into electromagnetic waves for radiation via antenna 2.

[0114] In some embodiments, antenna 1 of electronic device 100 is coupled to mobile communication module 150, and antenna 2 is coupled to wireless communication module 160, enabling electronic device 100 to communicate with networks and other devices via wireless communication technology. The wireless communication technology may include Global System for Mobile Communications (GSM), General Packet Radio Service (GPRS), Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), Time Division Code Division Multiple Access (TD-SCDMA), Long Term Evolution (LTE), BT, GNSS, WLAN, NFC, FM, and / or IR technologies, etc. The GNSS may include the Global Positioning System (GPS), the Global Navigation Satellite System (GLONASS), the BeiDou Navigation Satellite System (BDS), the Quasi-Zenith Satellite System (QZSS), and / or satellite-based augmentation systems (SBAS).

[0115] Internal memory 121 may include one or more random access memory (RAM) and one or more non-volatile memory (NVM).

[0116] The random access memory can be directly read and written by the processor 110. It can be used to store executable programs (such as machine instructions) of the operating system or other running programs, as well as user and application data.

[0117] Non-volatile memory can also store executable programs and user and application data, and can be pre-loaded into random access memory for direct reading and writing by the processor 110.

[0118] The external memory interface 120 can be used to connect to external non-volatile memory, thereby expanding the storage capacity of the electronic device 100. The external non-volatile memory communicates with the processor 110 through the external memory interface 120 to perform data storage functions. For example, music, video, and other files can be stored in the external non-volatile memory.

[0119] Buttons 190 include a power button, volume buttons, etc. Buttons 190 can be mechanical buttons or touch-sensitive buttons. Electronic device 100 can receive button input and generate key signal inputs related to user settings and function control of electronic device 100.

[0120] Optionally, the electronic device 100 may also include any one or more of the following: a speaker 170A, a receiver 170B, a microphone 170C, a headphone jack 170D, a sensor module 180, a motor 191, an indicator 192, a camera 193, a display screen 194, and a SIM card interface 195.

[0121] Electronic device 100 can implement display functions through a GPU, display screen 194, and application processor. The GPU is a microprocessor for image processing, connected to the display screen 194 and the application processor. The GPU is used to perform mathematical and geometric calculations and for graphics rendering. Processor 110 may include one or more GPUs, which execute program instructions to generate or modify display information. Display screen 194 is used to display images, videos, etc. Display screen 194 includes a display panel.

[0122] The electronic device 100 can perform shooting functions through an ISP, a camera 193, a video codec, a GPU, a display 194, and an application processor. The ISP processes data fed back from the camera 193. In some embodiments, the ISP can be integrated into the camera 193. The camera 193 captures still images or videos. An object passes through a lens to generate an optical image projected onto a photosensitive element. The photosensitive element converts the light signal into an electrical signal, which is then passed to the ISP for conversion into a digital image signal. The ISP outputs the digital image signal to a DSP for processing. The DSP converts the digital image signal into image signals in standard formats such as RGB and YUV. In some embodiments, the electronic device 100 may include one or N cameras 193, where N is a positive integer greater than 1. The digital signal processor processes digital signals, including digital image signals and other digital signals.

[0123] Video codecs are used to compress or decompress digital video. Electronic device 100 may support one or more video codecs. Thus, electronic device 100 can play or record videos in various encoding formats, such as Moving Picture Experts Group (MPEG) 1, MPEG2, MPEG3, MPEG4, etc.

[0124] An NPU (Neural Processing Unit) is a computational processor for neural networks (NNs). By borrowing the structure of biological neural networks, such as the transmission patterns between neurons in the human brain, it can rapidly process input information and continuously learn on its own. NPUs enable intelligent cognitive applications in electronic devices, such as image recognition, facial recognition, speech recognition, and text understanding.

[0125] Electronic device 100 can implement audio functions, such as music playback and recording, through audio module 170, speaker 170A, receiver 170B, microphone 170C, headphone jack 170D, and application processor.

[0126] The audio module 170 is used to convert digital audio information into analog audio signals for output, and also to convert analog audio input into digital audio signals. The audio module 170 can also be used for encoding and decoding audio signals. In some embodiments, the audio module 170 may be located in the processor 110, or some functional modules of the audio module 170 may be located in the processor 110.

[0127] The speaker 170A, also known as a "loudspeaker," is used to convert audio electrical signals into sound signals. The electronic device 100 can listen to music or make hands-free calls through the speaker 170A.

[0128] The receiver 170B, also known as the "earpiece," is used to convert audio electrical signals into sound signals. When the electronic device 100 answers a telephone call or voice message, the receiver 170B can be brought close to the ear to listen to the voice.

[0129] Microphone 170C, also known as a "microphone" or "voice transducer," is used to convert sound signals into electrical signals. When making a phone call or sending a voice message, the user can speak by bringing their mouth close to microphone 170C, inputting the sound signal into microphone 170C. Electronic device 100 may have at least one microphone 170C. In some embodiments, electronic device 100 may have two microphones 170C, which, in addition to collecting sound signals, can also perform noise reduction. In other embodiments, electronic device 100 may also have three, four, or more microphones 170C, which can collect sound signals, reduce noise, identify the sound source, and perform directional recording, etc.

[0130] The 170D headphone jack is used to connect wired headphones. The 170D headphone jack can be a USB 130 interface or a 3.5mm Open Mobile Terminal Platform (OMTP) standard interface, a CTIA (Cellular Telecommunications Industry Association of the USA) standard interface.

[0131] Motor 191 can generate vibration alerts. Indicator 192 can be an indicator light, used to indicate charging status, battery level changes, messages, missed calls, notifications, etc. SIM card interface 195 is used to connect a SIM card. Electronic device 100 interacts with the network via the SIM card to achieve functions such as making calls and data communication.

[0132] Figure 3B A schematic diagram of the hardware structure of the electronic device 200 is shown.

[0133] like Figure 3B As shown, the electronic device 200 may include: a processor 201, a memory 202, a display module 203, a power supply module 204, a communication module 205, and buttons 206. Wherein:

[0134] Processor 201 can be used to read and execute computer-readable instructions. In a specific implementation, processor 201 mainly includes a controller, an arithmetic logic unit (ALU), and registers. The controller is primarily responsible for instruction decoding and issuing control signals for the operations corresponding to the instructions. The ALU is primarily responsible for storing register operands and intermediate operation results temporarily stored during instruction execution. In a specific implementation, the hardware architecture of processor 201 can be an application-specific integrated circuit (ASIC) architecture, a MIPS architecture, an ARM architecture, or an NP architecture, etc.

[0135] In some embodiments, the processor 201 can be used to parse signals received by the communication module 205, such as pairing mode modification requests sent by the electronic device 100 or other electronic devices, etc. The processor 201 can be used to perform corresponding processing operations based on the parsing results, such as generating a pairing mode modification response, etc.

[0136] Memory 202 is coupled to processor 201 and is used to store various software programs and / or sets of instructions. In specific implementations, memory 202 may include high-speed random access memory; in some embodiments, memory 202 may also include non-volatile memory. Memory 202 may store communication programs that can be used to communicate with electronic device 100 or other devices. In other embodiments, memory 202 may also store an operating system, such as uCOS, VxWorks, RTLinux, or other embedded operating systems.

[0137] In some embodiments, the electronic device 200 may further include a display module 203, which can be used to display a user interface that can prompt the user to perform input operations and can also be used to display the user's input operations and the results of the input operations.

[0138] The power module 204 can be used to provide system power to the electronic device 200, powering various modules of the electronic device 200; and supporting the electronic device 200 to receive charging input, etc. The power module 204 may include a power management unit (PMU) and a battery. The PMU can receive external charging input; provide electrical signals input from the charging circuit to the battery for charging; and can also provide electrical signals provided by the battery to other modules in the electronic device 200 to prevent overcharging, over-discharging, short circuits, or overcurrent. In some embodiments, the power module 204 may also include a wireless charging coil for wirelessly charging the electronic device 200. Additionally, the power management unit can also be used to monitor parameters such as battery capacity, battery cycle count, and battery health status (leakage current, impedance).

[0139] The communication module 205 can be used to establish a communication connection with the electronic device 100. The communication module 205 may include a wired communication module and / or a wireless communication module. The wired communication module may include one or more input / output interfaces, which can be used to provide a wired communication connection between the electronic device 200 and the electronic device 100. In some embodiments, the input / output interface may be a USB interface. The wireless communication module may include a Bluetooth communication module. Additionally, the communication module 205 may also include an antenna, through which the communication module 205 receives electromagnetic waves, frequency-modulates and filters the electromagnetic wave signals, and sends the processed signal to the processor 201. The communication module 205 can also receive signals to be transmitted from the processor 201, frequency-modulate and amplify them, and then convert them into electromagnetic waves for radiation via the antenna.

[0140] Button 206 can be a physical button or a touch button (used in conjunction with a touch sensor), used to trigger operations such as power on, power off, pause, play, record, start pairing, and reset.

[0141] Optionally, in some embodiments, the electronic device 200 may further include a sensor 207. For example, in some embodiments, the touch sensor can detect touch operations such as single click, double click, multiple clicks, long press, and heavy pressure, and can also perform user fingerprint recognition to authenticate user identity in security-sensitive business scenarios.

[0142] Understandable Figure 3B The electronic device 200 shown is merely an example, and the electronic device 200 may have more than... Figure 3B The more or fewer components shown can be combined into two or more components, or they can have different component configurations. The various components shown in the figure can be implemented in hardware, software, or a combination of hardware and software, including one or more signal processing and / or application-specific integrated circuits.

[0143] Figure 3C A schematic diagram of the hardware structure of electronic device 300 is shown.

[0144] like Figure 3C As shown, the electronic device 300 may include a processor 301, a memory 302, and a communication module 303. Wherein:

[0145] Processor 301 can be used to read and execute computer-readable instructions. In a specific implementation, processor 301 mainly includes a controller, an arithmetic logic unit (ALU), and registers. The controller is primarily responsible for instruction decoding and issuing control signals for the operations corresponding to the instructions. The ALU is primarily responsible for storing register operands and intermediate operation results temporarily stored during instruction execution. In a specific implementation, the hardware architecture of processor 301 can be an application-specific integrated circuit (ASIC) architecture, a MIPS architecture, an ARM architecture, or an NP architecture, etc.

[0146] In some embodiments, the processor 301 can be used to parse signals received by the communication module 303, such as pairing mode modification requests sent by the electronic device 100 or other electronic devices, etc. The processor 301 can be used to perform corresponding processing operations based on the parsing results, such as generating a pairing mode modification response, etc. In some embodiments, the processor 301 can also be used to parse instructions received by the communication module 303 and perform the operations indicated by the instructions based on the parsing results (e.g., acquiring sound information, acquiring image information, playing audio files, etc.).

[0147] Memory 302 is coupled to processor 301 and is used to store various software programs and / or multiple sets of instructions. In specific implementations, memory 302 may include high-speed random access memory; in some embodiments, memory 302 may also include non-volatile memory. Memory 302 may store communication programs that can be used to communicate with electronic device 100 or other devices. In other embodiments, memory 302 may also store an operating system, such as uCOS, VxWorks, RTLinux, or other embedded operating systems.

[0148] The communication module 303 can be used to establish a communication connection with the electronic device 100. The communication module 303 may include a wired communication module and / or a wireless communication module. A detailed description of the communication module 303 can be found in [reference needed]. Figure 3B The relevant description of the communication module 205 in the illustrated embodiment will not be repeated here.

[0149] Optionally, in some embodiments, the electronic device 300 may further include other modules, such as a display, buttons, a power module, etc. It is understood that... Figure 3C The electronic device 300 shown is merely an example, and the electronic device 300 may have more than Figure 3C The more or fewer components shown can be combined into two or more components, or they can have different component configurations. The various components shown in the figure can be implemented in hardware, software, or a combination of hardware and software, including one or more signal processing and / or application-specific integrated circuits.

[0150] In this application, host 11 can be as described above. Figure 3A The electronic device 100 shown may be a user device as described above. Figure 3B The electronic device 200 shown can also be Figure 3A The illustrated electronic device 100 (e.g., in the case where user equipment 13 is remotely connected to host 11, user equipment 13 may be...) Figure 3A The electronic device 100 shown. The isolation device can be the one described above. Figure 3C The electronic device 300 shown can also be Figure 3A The components in the illustrated electronic device 100 (e.g., camera 193, display screen 194, speaker 170A, receiver 170B, or microphone 170C, etc.). In some embodiments, the isolation device may also be... Figure 3A The electronic device 100 shown in this case is an isolation device connected to the host 11. The user equipment can use the hardware resources provided by the electronic device 100 through the host 11, such as speakers, cameras, memory, etc.

[0151] Figure 4A flowchart illustrating an isolation method provided in an embodiment of this application is shown.

[0152] It should be noted that in this embodiment of the application, user equipment 13 can also be referred to as first user equipment, and isolation device 12 can also be referred to as first isolation device.

[0153] like Figure 4 As shown, the isolation method may include the following steps:

[0154] S401, User equipment 13 sends a first access request to host 11. The first access request is used to request host 11 to control isolation device 12 to perform a first function.

[0155] In some embodiments, the first access request may include the device identifier of the user equipment 13 and the device identifier of the isolation device 12. In some embodiments, the first access request may also include a first access type.

[0156] The device identifier of user equipment 13 is used to identify user equipment 13, and the device identifier of isolation device 12 is used to identify isolation device. The device identifier can be a device name, device type, MAC address or IP address, etc., used to identify the device, and this application does not limit it.

[0157] The first access type indicates the type of first function that the user equipment 13 requests the isolation device 12 to perform. The first access type may include any one or more of the following: requesting to play an audio file, requesting to acquire sound information, requesting to acquire image information, requesting to print a file, requesting to display a file, requesting to store a file, requesting to read / write a file, etc. For example, when the isolation device 12 is a speaker, the first access type may be requesting to play a specified audio file. As another example, when the isolation device 12 is a camera, the first access type may be requesting to acquire image information, etc. The first function may include any one or more of the following: playing an audio file, acquiring sound information, acquiring image information, printing a file, displaying a file, storing a file, reading / writing a file, etc.

[0158] Optionally, user equipment 13 may send all the contents of the first access request (the device identifier of user equipment 13 and the device identifier of isolation device 12) to host 11 together, or it may send the contents of the first access request to host 11 in batches. For example, user equipment 13 may first send the device identifier of user equipment 13, then send the device identifier of isolation device 12, and finally send the first access type, etc.

[0159] S402, the host 11 determines the first key value based on the device identifier of the isolation device 12.

[0160] Step S402 is an optional step. In some embodiments, the host 11 can identify the device identifier of the isolation device 12 from the first access request, and determine the first key value based on the device identifier of the isolation device 12 using a data compression algorithm such as a hash algorithm. Optionally, the data size of the first key value is less than the data size corresponding to the device identifier of the isolation device 12.

[0161] Taking the 32-bit device identifier of isolation device 12 as an example, the device identifier of isolation device 12 can be 0110110100110101011010111100000111, and the first key value determined by host 11 can be 01. It is understood that this application is only illustrative to show that the data volume of the first key value is much smaller than the data volume corresponding to the device identifier of isolation device 12. Based on the above 32-bit device number, different first key values ​​can also be determined (e.g., 11, 010, or 1111, etc.). This application does not limit this.

[0162] By using hash algorithms or other data compression algorithms, the device identifier of isolated device 12 can be compressed into a smaller first key value. This not only reduces the space occupied by data storage, but also allows for faster determination of access records for the isolated device in subsequent step S403 compared to the device identifier. Even with a large number of user devices, determining access records based on the first key value only requires a constant amount of time, significantly improving the efficiency of the method.

[0163] When using hash algorithms to determine the key value of an isolation device, it is possible for different isolation devices to correspond to the same key value, i.e., a hash collision may occur. When a hash collision occurs, subsequent query steps require further comparison of multiple isolation devices with the same key value to determine the queried isolation device, increasing query time and reducing the efficiency of the method.

[0164] In some embodiments, the efficiency of the method can be improved by optimizing the hash algorithm to avoid different isolation devices corresponding to the same key value, thereby reducing the probability of hash collisions.

[0165] For example, after identifying the device identifier of the isolation device 12, the host 11 may determine the first key value based on the device identifier of the isolation device 12, which may also include the following steps:

[0166] 1. Host 11 calls the first hash function to determine the first key value based on the device identifier of the isolated device 12.

[0167] The first hash function can be a pre-built hash function. The device identifier of the isolation device 12 can be processed by the first hash function to output a first key value. The data size of the first key value is smaller than the data size of the device identifier of the isolation device 12.

[0168] 2. Host 11 determines whether the value of the first key is the same as the key value corresponding to other isolated devices.

[0169] After determining the first key value, host 11 can search among all the key values ​​corresponding to the isolation devices stored in host 11 to determine whether there is a key value with the same value as the first key value.

[0170] When host 11 determines that there are other isolation devices whose second key value is the same as the first key value, host 11 executes step 3 below. When host 11 determines that the key values ​​corresponding to other isolation devices are all different from the first key value, host 11 does not need to execute step 3 below and directly determines the first key value.

[0171] 3. Host 11 calls the second hash function to re-determine the first key value based on the device identifier of the isolated device 12. The first key value is different from the second key value.

[0172] The second hash function can also be a pre-built hash function, and the second hash function is different from the first hash function.

[0173] It is understood that this application is merely an illustrative example of how hash collisions can be avoided by optimizing the hash algorithm. This application may also employ other feasible optimization algorithms, and may also combine the characteristics of the isolation device to optimize the hash algorithm, etc. This application does not limit the scope of the application.

[0174] In this way, the probability of hash collisions can be reduced by optimizing the hash algorithm, thereby avoiding the time consumption caused by different isolation devices corresponding to the same key value and improving the efficiency of the method.

[0175] S403, host 11 determines whether there is an access record for isolation device 12 in the access record table. The access record for isolation device 12 includes user equipment identifier and valid information.

[0176] The access log table includes device identifiers for one or more isolation devices and access records for one or more isolation devices. The access record may include the device identifier (also referred to as the user equipment identifier) ​​of the user device that previously accessed the isolation device and valid information of the access record (also referred to as valid information). In some embodiments, the access record may also include the access time, which is used to indicate the access time of the user device that previously accessed the isolation device.

[0177] Host 11 can determine whether there is an access record for isolation device 12 in the access record table based on the device identifier of isolation device 12. The device identifier of isolation device 12 can be the device identifier of isolation device 12. In other embodiments, the device identifier of isolation device 12 can also be a key value (first key value) of isolation device 12.

[0178] An access record for isolation device 12 will appear in the access log table if and only if a user device has accessed isolation device 12. Therefore, if there is no access record for isolation device 12 in the access log table, it can be concluded that isolation device 12 has not been accessed by any user device before.

[0179] In step S403, the access record table can be a hash table or other types of tables.

[0180] For example, taking the access record as including user equipment identifier, valid information and access time as an example, as shown in Table 1, the access record table may include an index column and an access record column.

[0181] The index column includes device identifiers (e.g., A1 and A2) for one or more isolated devices.

[0182] The index bar can be used to find the access records of the isolation devices corresponding to the key values ​​in the index bar. As shown in Table 1, taking isolation device 12 as device identifier A1 and isolation device 15 as device identifier A2 as examples, the access records of isolation device 12 include: user device identifier X1, valid information is valid, and access time is 08:00 on April 1, 2022. The access records of isolation device 15 include: user device identifier X2, valid information is invalid, and access time is 22:11 on April 1, 2022.

[0183] The access log field may include a user device identification field, a valid information field, and an access time field.

[0184] The User Equipment Identifier field can be used to display the user equipment identifier in the access record. The user equipment identifier can also be used to display the device identifier of the user equipment that previously accessed the isolation device. As shown in Table 1, if the user equipment identifier field in the access record for isolation device 12 includes X1, it indicates that the device identifier of the user equipment that previously accessed isolation device 12 was X1. If the user equipment identifier field in the access record for isolation device 15 includes X2, it indicates that the device identifier of the user equipment that previously accessed isolation device 15 was X2.

[0185] The valid information field can be used to display valid information in the access log. Valid information can be used to indicate whether the previous user device's access to the isolated device has been forcibly terminated. Forced termination can occur when host 11 detects that a first condition is met, and then cancels the access permission of the user device currently accessing the isolated device. The first condition can include one or more of the following: host 11 receives an operation on an interface of host 11 from a user with administrator privileges; system 10 is about to start a private meeting; the user device's access time to the same isolated device exceeds a specific time interval (e.g., 30 minutes, 3 hours, etc.), etc.

[0186] For example, if the access log for isolation device 12 shows "valid" in the valid information field, it indicates that the previous user device's access to isolation device 12 was not forcibly terminated. If the access log for isolation device 15 shows "invalid" in the valid information field, it indicates that the previous user device's access to isolation device 15 has been forcibly terminated. After host 11 revokes the user device's access rights to isolation device 12, the "valid" value in the valid information field of the access log for isolation device 12 changes to "invalid".

[0187] The access time column can be used to display the access time in the access record. The access time can be used to display the access time of the user device that previously accessed the isolation device. According to Table 1, the previous user device accessed isolation device 12 at 08:00 on April 1, 2022, and the previous user device accessed isolation device 15 at 22:11 on April 1, 2022.

[0188] It is understood that the access record table in Table 1 is only an exemplary illustration. The access record table in this application may also include more or fewer access records of isolation devices. In addition, the precision of the access time may also take other forms, such as the access time may be accurate to seconds or milliseconds, etc., which are not limited here.

[0189] Table 1 Access Record Table

[0190]

[0191] It should be noted that when access records are stored in the form of a hash table on host 11, one or more access records can be added or removed from the hash table at any time without affecting other access records in the hash table. Furthermore, hash tables do not require pre-allocating fixed memory space; the memory space occupied by the hash table increases as the number of access records increases. Therefore, using a hash table to store access records facilitates real-time adjustments to the access records and improves memory utilization.

[0192] When host 11 determines that there is an access record for isolation device 12 in the access record table, host 11 executes the following step S404. When host 11 determines that there is no access record for isolation device 12 in the access record table, that is, isolation device 12 has not been accessed before, host 11 executes the following steps S406 to S408 to allow user device 13 to access isolation device 12.

[0193] S404, Host 11 determines whether User Equipment 13 has access rights based on the access records of Isolation Device 12.

[0194] When it is determined that user equipment 13 has access rights, host 11 executes steps S406 to S408. When it is determined that user equipment 13 does not have access rights, optionally, host 11 may execute step S405.

[0195] Since multiple user devices in system 10 can request access to isolation device 12 through host 11, in order to avoid multiple user devices accessing the same isolation device at the same time, host 11 needs to determine whether there are other user devices currently accessing isolation device 12.

[0196] Host 11 can determine whether other user devices are accessing isolation device 12 based on the access records of isolation device 12. If it is determined that no other user devices are accessing isolation device 12, host 11 can determine that user device 13 has the necessary access rights. This avoids privacy leaks and other problems caused by multiple user devices accessing the same isolation device simultaneously.

[0197] For example, such as Figure 5 As shown, the specific process by which host 11 determines whether user equipment 13 has access rights based on the access records of isolation device 12 may include the following steps:

[0198] S501, determine whether the user equipment identifier in the access record is consistent with the device identifier of user equipment 13.

[0199] When the user equipment identifier in the access record matches the device identifier of user equipment 13, it indicates that user equipment 13 is the user equipment that previously accessed isolation device 12. In this case, host 11 executes step S502.

[0200] When the user equipment identifier in the access record is inconsistent with the device identifier of user equipment 13, it means that user equipment 13 is not the same user equipment as the user equipment that accessed the isolation device 12 in the previous access. In this case, host 11 executes step S503.

[0201] S502, determine whether the access record is valid based on the valid information in the access record.

[0202] After determining that user equipment 13 is the user equipment that previously accessed isolation device 12, host 11 can determine whether the access record is valid based on the valid information in the access record of isolation device 12.

[0203] When the access record is valid, it indicates that the previous access of user device 13 to isolation device 12 was not forcibly terminated, meaning that host 11 did not detect that the specific conditions for canceling access permissions were met (e.g., a private meeting is about to begin, user device 13 has occupied isolation device 12 for too long, or an operation on the interface by a user with administrator privileges has been received, etc.). In this case, it can be determined that no other user device is currently accessing isolation device 12. At this time, host 11 executes the following step S505 to determine that user device 13 has access permissions.

[0204] When an access record is invalid, meaning that the previous access of user device 13 to isolation device 12 has been forcibly terminated, or the host 11 detects that specific conditions for revoking access permissions have been met (e.g., a private meeting is about to begin, user device 13 has occupied isolation device 12 for too long, or an operation on the interface by a user with administrator privileges has been received, etc.), even though no other user device is currently accessing isolation device 12, because user device 13's access to isolation device 12 has been forcibly terminated, the host 11 executes step S506 to determine that user device 13 does not have access permissions.

[0205] S503 determines whether an access record is valid based on the valid information in the access record.

[0206] After determining that user equipment 13 is different from the user equipment that previously accessed isolation device 12, host 11 can determine whether the access record is valid based on the valid information in the access record of isolation device 12.

[0207] When the access record is valid, it indicates that the previous user device’s access to the isolation device 12 has not been forcibly terminated, meaning that the isolation device 12 may still be occupied by the previous user device. At this time, the host 11 executes the following step S504 to determine whether the previous user device is still accessing the isolation device 12 based on the access time.

[0208] When an access record is invalid, it indicates that the previous user device's access to the isolation device 12 has been forcibly terminated. In this case, it can be determined that no other user device is currently accessing the isolation device 12. At this time, the host 11 executes the following step S505 to determine that the user device 13 has the necessary access rights.

[0209] S504, determine whether the time interval between the current time and the access time is greater than the first threshold.

[0210] The current time can be the system time in host 11. The first threshold can be used to indicate the maximum time interval (e.g., 10 milliseconds, 1 second, 5 minutes, etc.) between two consecutive accesses to isolation device 12 by a user device. The first threshold can be preset by the system, for example, based on the type of isolation device 12, the hardware capabilities of host 11, or the application scenario of isolation device 12 (e.g., public entertainment scenario, private entertainment scenario, office scenario, etc.). In some embodiments, the first threshold can also be a user-defined setting with administrator privileges.

[0211] It should be noted that the user equipment's occupation of the isolation device through host 11 is not a continuous process, but a discrete one, achieved through multiple accesses with time intervals. The time interval between two consecutive accesses of the same user equipment to the same isolation device is related to the performance of the operating system in host 11. Given a fixed host 11, it can be determined whether the user equipment is still occupying the isolation device by judging whether the time interval between two consecutive accesses of the same user equipment to the same isolation device exceeds a specific threshold (e.g., a first threshold).

[0212] If the time interval between the current time and the access time is greater than a first threshold, it can be determined that the previous user device's occupation time of the isolation device 12 has exceeded the maximum time interval between two adjacent accesses, meaning that the previous user device is considered to have ended its access to the isolation device 12. In this case, it can be determined that no other user device is currently accessing the isolation device 12. Host 11 can execute step S505 to determine that user device 13 has access rights to the isolation device 12.

[0213] If the time interval between the current time and the access time is less than or equal to the first threshold, it indicates that the previous user device's access to the isolation device 12 did not exceed the maximum time interval between two adjacent accesses, meaning that the previous user device may still be occupying the isolation device 12. At this time, the host 11 can execute step S506 to determine that the user device 13 does not have access rights to the isolation device 12.

[0214] S505, confirming that user equipment 13 has access rights.

[0215] S506, It has been determined that user equipment 13 does not have access rights.

[0216] Understandable Figure 5 The illustrated embodiment is merely an example of a method for determining whether user equipment 13 has access rights based on access records. In this embodiment, a method based on access records can also be used. Figure 5 Fewer or more steps, or adopting the same Figure 5Different decision-making steps, etc., are used to determine whether user equipment 13 has access rights, which is not limited in this application.

[0217] In this way, when the isolation device 12 is accessed by other user devices, the host 11 can determine that the user device 13 does not have the right to access it based on the access records of the isolation device 12, thereby avoiding privacy leaks and other problems caused by multiple user devices accessing the same isolation device at the same time.

[0218] S405, host 11 sends the first notification to user equipment 13.

[0219] Step S405 is optional. After the host 11 determines that the user equipment 13 does not have access rights, optionally, the host 11 may send a first notification to the user equipment 13. This first notification is used to notify the user equipment 13 that it does not have access rights to the isolation device 12.

[0220] S406, the host 11 sends a first instruction to the isolation device 12, the first instruction being used to instruct the isolation device 12 to perform a first function.

[0221] Optionally, the host 11 can control the isolation device 12 to perform the first function through step S406.

[0222] After host 11 determines that user equipment 13 has access rights, host 11 can send a first instruction to isolation device 12. The first instruction can be used to instruct isolation device 12 to perform a first function. The first instruction may include any one or more of the following: playing an audio file, acquiring sound information, acquiring image information, printing a file, displaying a file, storing a file, reading / writing a file, etc. In some embodiments, the first instruction may also be an "enable" or "request use" instruction to enable or request the use of isolation device 12.

[0223] Host 11 can determine the first instruction based on the first access type in the first access request. For example, when the first access type is "play audio file", the first instruction can be "play audio file". Or, for example, when the first access type is "request to collect sound information", the first instruction can be "collect sound information", and so on.

[0224] In some embodiments, the host 11 may also determine the first instruction based on the device identifier of the isolation device 12. For example, when the isolation device 12 is a speaker, the host 11 may determine the first instruction as "play an audio file" based on the device identifier of the isolation device 12. As another example, when the isolation device 12 is a microphone, the host 11 may determine the first instruction as "acquire sound information" based on the device identifier of the isolation device 12, and so on.

[0225] After determining the first instruction, the host 11 can send the first instruction to the isolation device 12.

[0226] S407, Isolation device 12 performs the first function.

[0227] S408, Host 11 updates the access record of isolated device 12 in the access record table.

[0228] After determining that user equipment 13 has access rights, host 11 can modify the access record of isolation device 12 in the access record table. It should be noted that step S408 is not required to be executed in a specific order with the aforementioned steps S406 to S407.

[0229] When modifying the access record of the isolation device 12 in the access record table, you can modify only one or more items in the access record, or you can modify all the contents of the access record.

[0230] For example, the access record of the isolation device 12 determined in step S403 is shown in Table 2. A1 is the device identifier of the isolation device 12. In the access record, the user device identifier is X1, the valid information is valid, and the access time is 08:00 on April 1, 2022.

[0231] Table 2 Access Records of Isolation Device 12

[0232] A1 X1 efficient 2022.4.1 08:00

[0233] If the user identifier of user equipment 13 is X1, the record is valid, and the time interval between the current time and the access time is less than or equal to the first threshold, according to step S404, the user identifier X1 of user equipment 13 is consistent with the user equipment identifier X1 in the access records shown in Table 2. Therefore, user equipment 13 is the user equipment that previously accessed isolation device 12. At this time, the validity of the access record can be further determined based on the valid information in the access records shown in Table 2, that is, the access permission of user equipment 13 to isolation device 12 has not been revoked. Then, it can be further determined that the time interval between the current time and the access time in the access records shown in Table 2 is not greater than the first threshold, that is, the access time of user equipment 13 to isolation device 12 does not exceed the maximum time interval between two adjacent accesses. Therefore, it can be determined that user equipment 13 has access permission.

[0234] In the above situation, since the user equipment accessing the isolation device 12 has not changed and the validity of the access record has not changed, the host 11 can only change the access time in the access record shown in Table 2, changing the access time to the current time. The modified access record can be the access record shown in Table 3. As shown in Table 3, in the access record of the isolation device 12, the user equipment identifier is X1, the validity information is valid, and the access time is the current time 2022.4.108:15.

[0235] Table 3 Access Records of Isolation Device 12

[0236] A1 X1 efficient 2022.4.1 08:15

[0237] If the user identifier of user equipment 13 is not X1, the record is valid, and the time interval between the current time and the access time is greater than the first threshold, according to step S404, the user identifier X1 of user equipment 13 is inconsistent with the user equipment identifier X1 in the access records shown in Table 2. Therefore, user equipment 13 is not the user equipment that previously accessed isolation device 12. At this time, the validity of the access record can be further determined based on the valid information in the access records shown in Table 2, that is, the access permission of the user equipment that previously accessed isolation device 12 has not been revoked. Then, it can be further determined that the time interval between the current time and the access time in the access records shown in Table 2 is greater than the first threshold, that is, the access time of the user equipment that previously accessed isolation device 12 has exceeded the maximum time interval between two adjacent accesses, and it can be determined that the previous access has ended. Therefore, it can be determined that user equipment 13 has access permission.

[0238] In the above situation, since the user equipment accessing isolation device 12 has changed and the access time has also changed, host 11 can only change the user equipment identifier and access time in the access record shown in Table 2, changing the user equipment identifier to the device identifier of user device 13 and the access time to the current time. The modified access record can be the access record shown in Table 4. As shown in Table 4, in the access record of isolation device 12, the user equipment identifier is X2, X2 is the device identifier of user device 13, the valid information is valid, and the access time is the current time 2022.4.1 08:15.

[0239] Table 4 Access Records of Isolation Device 12

[0240] A1 X2 efficient 2022.4.1 08:15

[0241] For example, the access record of the isolation device 12 determined in step S403 is shown in Table 5. A1 is the device identifier of the isolation device 12. In the access record, the user device identifier is X1, the valid information is invalid, and the access time is 2022.4.108:00.

[0242] Table 5 Access Records of Isolation Device 12

[0243] A1 X1 invalid 2022.4.1 08:00

[0244] If the user identifier of user equipment 13 is different from X1 and the record is invalid, according to step S404, the user identifier X1 of user equipment 13 is inconsistent with the user equipment identifier X1 in the access records shown in Table 5. Therefore, user equipment 13 is not the user equipment that previously accessed isolation device 12. At this time, based on the valid information in the access records shown in Table 5, it can be further determined that the access record is invalid, that is, the access permission of the user equipment that previously accessed isolation device 12 has been revoked. At this point, it can be determined that the user equipment that previously accessed isolation device 12 has ended its access. Therefore, it can be determined that user equipment 13 has the access permission.

[0245] In the above scenario, since the user equipment accessing isolation device 12 has changed, as have the valid information and access time, host 11 can update all content in the access records shown in Table 5, changing the user equipment identifier to the device identifier of user equipment 13 and the access time to the current time. The modified access records can be the access records shown in Table 4. The specific content of Table 4 can be found in the relevant descriptions in the foregoing embodiments.

[0246] It should be noted that if step S403 determines that there is no access record for isolation device 12 in the access record table, an access record for isolation device 12 can be added to the access record table. In the newly added access record, the user equipment identifier is the device identifier of user device 13, the validity information is "valid", and the access time is the current time. The newly added access record can be the access record shown in Table 4.

[0247] By updating the access records, the access record table stored in host 11 changes as user devices access the isolation device. Therefore, the access permissions of user devices to the isolation device also change at different times. In this way, the isolation device can provide services to different user devices at different times without the need to plan the access permissions of different user devices in advance, thus improving the flexibility of the method.

[0248] In some embodiments, the priority of different user devices can also be considered to determine whether a user device has access to the isolation device.

[0249] For example, it can be done in the above Figure 5 Between steps S501 and S503 in the illustrated embodiment, the following step is added:

[0250] S503a, determine whether the priority of user equipment 13 is higher than the priority of the user equipment corresponding to the user equipment identifier.

[0251] Host 11 can determine the priority of user equipment 13 based on the device identifier of user equipment 13, determine the priority of the user equipment that previously accessed the isolation device 12 based on the user equipment identifier in the access record of the isolation device 12, and determine whether the priority of user equipment 13 is higher than the priority of the user equipment that previously accessed the isolation device 12.

[0252] After determining that user equipment 13 has a higher priority than the user equipment corresponding to the user equipment identifier, host 11 can determine that user equipment 13 has access to isolation device 12 and revoke the access rights of other user equipment to isolation device 12.

[0253] After determining that the priority of user equipment 13 is not higher than the priority of the user equipment corresponding to the user equipment identifier, the host 11 can execute... Figure 5 The steps shown are S503 and subsequent steps.

[0254] In this way, by adjusting the priority of different user devices, higher-priority user devices can be given priority access to isolated devices, thus enriching the application scenarios of the method.

[0255] by Figure 2A Taking the illustrated application scenario as an example, access priorities for the speaker 24 from multiple touch displays can be pre-set. For instance, the priority of touch display 22 can be set to the highest priority, and the priority of other touch displays (such as touch display 23) can be set to the second highest priority. In this case, when touch display 22 and touch display 23 simultaneously send access requests for the speaker 24 to the host 21, the host 21 will prioritize processing the access request sent by the first touch display 22. In some embodiments, when the speaker 24 is being accessed by touch display 23, after receiving the access request from touch display 22, the host 21 can forcibly terminate the access of touch display 23 to the speaker 24 by canceling the access permission of touch display 23 to the speaker, and determine that touch display 22 has access permission to the speaker 24. In other embodiments, after detecting that the car has started, it can also be determined that only the touch display 22 used by the driver has permission to access the speaker 24, while other touch displays do not have permission to access the speaker 24. This can prevent other users from interfering with the driver's driving through the speaker 24, ensuring driving safety.

[0256] In some embodiments, the host 11 may further include multiple management interfaces (e.g., a first management interface and a second management interface), which can be used to assist in managing the dynamic access permissions of user devices. For example, the first management interface can be used to manage isolation devices; that is, isolation devices can be added or removed through the first management interface. As another example, the second management interface can be used to forcibly terminate the exclusive access of a user device to an isolation device. In other embodiments, the management interface may further include a third management interface for adjusting the maximum available time for the isolation device (e.g., adjusting the first threshold corresponding to the isolation device 12, etc.). It is understood that the management interface may also include other interfaces that can be used to assist in managing the dynamic access permissions of user devices, which are not limited herein.

[0257] In some embodiments, when the operating system of host 11 is Linux, the aforementioned management interfaces can be mounted under the sysfs file system. The sysfs file system is a pseudo-file system that exists only in memory and can be used for interaction between the kernel and user-space programs; however, data writes to it are not guaranteed to be consistent after a reboot. Mounting the management interfaces under the sysfs file system conforms to the Linux programming paradigm and is beneficial for application developers to understand and adapt to.

[0258] It should be noted that when host 11 receives a message through the interface canceling access permissions of a user device to an isolation device, host 11 can change the valid information in the access record of that isolation device to invalid. For example, when host 11 receives a message through the interface canceling access permissions of user device X1 to isolation device 12, it can change the access record of isolation device 12 from Table 2 to Table 5.

[0259] In this way, multiple management interfaces can be used to assist in the management of dynamic access permissions for user devices, making it applicable to more complex and diverse application scenarios and expanding the scope of application of the method.

[0260] The isolation method provided in this application embodiment can be implemented in a non-intrusive manner, that is, by adding an isolation module to the operating system kernel of the host 11, the above isolation method can be implemented using the isolation module, so as not to affect the original operation of the operating system.

[0261] Before introducing the isolation module added in this application, it is necessary to briefly introduce the module mechanism in the operating system.

[0262] The module mechanism, officially known as the loadable kernel module (LKM), is often simply referred to as a module. A module is a program that runs in kernel space and can exist as an object file. Modules cannot run independently, but the code within a module can be linked into the operating system at runtime and run as part of the kernel. Modules can be used to implement a file system, a driver, or other higher-level kernel functionalities. Users can dynamically load modules into or remove them from the kernel as needed, without requiring recompilation.

[0263] This application provides an isolation module that may include hook functions. Hook functions can be used to record, allow, or block user equipment access to the isolation device. Hook function interfaces can be inserted into the code related to the access logic of the isolation device. When a user device attempts to access the isolation device, the hook function is triggered, executing the contents of the isolation module.

[0264] For example, Figure 6 A schematic diagram of an isolation module provided in an embodiment of this application is shown.

[0265] like Figure 6 As shown, the isolation module 60 may include a query unit 61, a decision unit 62, a response unit 63, and an access record unit 64.

[0266] The query unit 61 can be used to read the first access request, determine the first key value based on the device identifier of the isolation device 12 in the first access request, and send the first key value to the access record unit 64. The first key value is used to find the access record of the isolation device 12.

[0267] The content of the first access request, the method for determining the first key value, the content of the access record, and the method for searching the access record can be referred to the foregoing. Figure 4 The relevant content in the illustrated embodiments will not be repeated here.

[0268] The decision unit 62 can be used to determine whether the user equipment 13 has access rights based on the device identifier of the user equipment 13 and the access records of the isolation device 12, and send the output decision result to the response unit 63. When the decision result output by the decision unit 62 is that the user equipment 13 has access rights, the decision unit 62 can also be used to send the decision result to the access record unit 64.

[0269] For specific details, please refer to the foregoing embodiments; this application will not repeat them here.

[0270] The response unit 63 can be used to determine whether to allow or block the user equipment 13's access to the isolation device 12 based on the decision result output by the decision unit 62. When the decision result output by the decision unit 62 indicates that the user equipment 13 has access rights, the response unit 63 can be used to send a first instruction to the isolation device 12, instructing the isolation device 12 to perform the operation indicated by the first instruction. When the decision result output by the decision unit 62 indicates that the user equipment 13 does not have access rights, optionally, the response unit 63 can be used to send a first notification to the user equipment 13, notifying the user equipment 13 that it does not have access rights.

[0271] For details, please refer to the aforementioned text. Figure 4 The relevant content in the illustrated embodiments will not be repeated here.

[0272] The access record unit 64 can be used to store and modify access records. The access record unit 64 can receive a first key value sent by the query unit 61, search for the access records of the isolation device 12 based on the first key value, and send the query result to the decision unit 62. The access record unit 64 can also be used to receive the decision result sent by the decision unit 62 and modify the access records of the isolation device 12 based on the decision result. For specific modification methods, please refer to [reference needed]. Figure 4 The relevant content in the illustrated embodiments will not be repeated here.

[0273] Understandable Figure 6 The structure of the isolation module 60 shown is merely an example; in some embodiments, the isolation module 60 may have a structure with greater... Figure 6 The more or fewer units shown can also be... Figure 6 The two units in the application are combined into one or a unit is split into multiple units, etc., which are not limited in this application.

[0274] In this way, by simply reserving the hook function interface in the code related to the isolation device access logic in the host 11 operating system, dynamic isolation of the isolation device can be achieved through the isolation module without requiring additional adaptation to the operating system. It is understood that functions with the same or similar functionality as hook functions can also be used in the isolation module to achieve non-intrusive dynamic isolation; this application does not impose any limitations on this.

[0275] Figure 7 A schematic diagram of the functional modules of a host 11 provided in an embodiment of this application is shown.

[0276] like Figure 7 As shown, the host 11 includes an isolation module 60 and a communication module 70. The isolation module 60 can be as described above. Figure 6 The isolation module 60 shown.

[0277] Communication module 70 can be used to receive the first access request. A description of the first access request can be found in [reference needed]. Figure 4 The illustrated embodiment. When the isolation module 60 determines that the user equipment 13 has access rights, the communication module 70 can also be used to instruct the first isolation device to perform a first function. When the isolation module 60 determines that the user equipment 13 does not have access rights, the communication module 70 can also be used to send a first notification to the user equipment 13, which informs the user equipment 13 that it cannot control the isolation device 12 to perform the first function. For details, please refer to the above. Figure 4 The relevant descriptions in the illustrated embodiments will not be repeated here.

[0278] The isolation module 60 can be used to determine whether the user equipment 13 has access rights. The specific determination method can be found above. Figure 4 and Figure 5 The relevant content in the illustrated embodiment. The function of the isolation module 60 can also be referred to... Figure 6 The contents of the illustrated embodiment.

[0279] Understandable Figure 7 The structure of host 11 shown is only an example; in some embodiments, host 11 may have a structure with more... Figure 7 The more or fewer modules shown can also be... Figure 7 The application does not limit the scope of this application to combining two modules into one or splitting one module into multiple modules.

[0280] The various embodiments of this application can be combined arbitrarily to achieve different technical effects.

[0281] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state disk (SSD)).

[0282] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. This program can be stored in a computer-readable storage medium, and when executed, it can include the processes described in the above method embodiments. The aforementioned storage medium includes various media capable of storing program code, such as ROM or random access memory (RAM), magnetic disks, or optical disks.

[0283] In summary, the above description is merely an embodiment of the technical solution of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made according to the disclosure of the present invention should be included within the scope of protection of the present invention.

Claims

1. An isolation method, characterized in that, include: The host receives a first access request sent by the first user equipment, the first access request being used to request control of the first isolation device to perform a first function; In response to the first access request, when the host determines that there is an access record for the first isolation device in the access record table, and the user device that previously accessed the isolation device in the access record of the first isolation device is the first user device, and the access record of the first isolation device is valid, the host controls the first isolation device to perform the first function. The access record table includes device identifiers for one or more isolated devices and access records for those isolated devices. The access records include the device identifier of the user device that previously accessed the isolated device and valid information of the access record.

2. The method according to claim 1, characterized in that, The method further includes: In response to the first access request, when the host determines that there is an access record for the first isolation device in the access record table, and the user device that previously accessed the isolation device in the access record of the first isolation device is different from the first user device, and the access record of the first isolation device is invalid, the host controls the first isolation device to perform the first function.

3. The method according to claim 1 or 2, characterized in that, The method further includes: In response to the first access request, when the host determines that there is an access record for the first isolation device in the access record table, and the user device that previously accessed the isolation device in the access record of the first isolation device is the same as the first user device, and the access record of the first isolation device is invalid, the host sends a first notification to the first user device. The first notification is used to notify the first user device that it cannot control the first isolation device to perform the first function.

4. The method according to any one of claims 1-3, characterized in that, The access records also include the access time of the user device that previously accessed the isolation device; The method further includes: In response to the first access request, when the host determines that there is an access record for the first isolation device in the access record table, and the user device that previously accessed the isolation device in the access record of the first isolation device is different from the first user device, and the access record of the first isolation device is valid, and the time interval between the access time of the user device that previously accessed the first isolation device and the current time is greater than a first threshold, the host controls the first isolation device to perform the first function.

5. The method according to claim 4, characterized in that, The method further includes: In response to the first access request, when the host determines that there is an access record for the first isolation device in the access record table, and the user device that previously accessed the isolation device in the access record of the first isolation device is different from the first user device, and the access record of the first isolation device is valid, and the time interval between the access time of the user device that previously accessed the first isolation device and the current time is less than or equal to a first threshold, the host sends a first notification to the first user device. The first notification is used to notify the first user device that it cannot control the first isolation device to perform the first function.

6. The method according to any one of claims 1-5, characterized in that, The method further includes: In response to the first access request, when the host determines that there is no access record for the first isolation device in the access record table, the host controls the first isolation device to perform the first function.

7. The method according to any one of claims 1-6, characterized in that, After the host controls the first isolation device to perform the first function, the method further includes: When the host determines that there is no access record for the first isolated device in the access record table, the host adds the access record for the first isolated device to the access record table.

8. The method according to any one of claims 1-6, characterized in that, After the host controls the first isolation device to perform the first function, the method further includes: When the host determines that there is an access record for the first isolation device in the access record table, and the user device that previously accessed the isolation device in the access record of the first isolation device is different from the first user device, and the access record of the first isolation device is invalid, the host changes the device identifier of the user device that previously accessed the isolation device in the access record of the first isolation device to the device identifier of the first user device, and the host changes the validity information of the access record to valid.

9. The method according to claim 4 or 5, characterized in that, After the host controls the first isolation device to perform the first function, the method further includes: When the host determines that there is an access record for the first isolation device in the access record table, and the user device that previously accessed the isolation device in the access record of the first isolation device is the first user device, and the access record of the first isolation device is valid, the host changes the access time in the access record of the first isolation device to the current time.

10. The method according to claim 4 or 5, characterized in that, After the host controls the first isolation device to perform the first function, the method further includes: When the host determines that there is an access record for the first isolation device in the access record table, and the user device that previously accessed the isolation device in the access record of the first isolation device is different from the first user device, and the access record of the first isolation device is valid, and the time interval between the access time of the user device that previously accessed the first isolation device and the current time is greater than a first threshold, the host changes the device identifier of the user device that previously accessed the isolation device in the access record of the first isolation device to the device identifier of the first user device, and the host changes the access time in the access record of the first isolation device to the current time.

11. The method according to any one of claims 1-10, characterized in that, The first access request includes the access identifier of the first user equipment and the device identifier of the first isolation device; the device identifier of the first isolation device is the device identifier of the first isolation device; wherein, the device identifier of the first isolation device includes any one of the following: the device name, device type, media access control MAC address, and Internet Protocol (IP) address of the first isolation device.

12. The method according to any one of claims 1-10, characterized in that, The first access request includes the device identifier of the first user equipment and the device identifier of the first isolation device; The method further includes: The host determines the identifier of the first isolation device based on the device identifier of the first isolation device using a hash algorithm, wherein the data size of the identifier of the first isolation device is smaller than the data size of the device identifier of the first isolation device.

13. The method according to claim 12, characterized in that, The access record table is a hash table.

14. The method according to any one of claims 1-13, characterized in that, The first access request also includes a first access type, which indicates the type of the first function; Before the host controls the first isolation device to perform the first function, the method further includes: The host determines a first instruction based on the first access type, and the first instruction is used to instruct the first isolation device to perform the first function. The host controls the first isolation device to perform the first function, specifically including: The host sends the first instruction to the first isolation device.

15. The method according to any one of claims 1-14, characterized in that, The method further includes: When the host determines that the first condition is met, the host changes the valid information in the access record of the first isolation device to invalid.

16. The method according to claim 15, characterized in that, The first condition is that the host receives a first input operation for terminating the user equipment's occupation of the first isolation device.

17. The method according to claim 15, characterized in that, The first condition is that the host determines that the first isolation device has been occupied for a longer period than the second threshold.

18. An isolation system, characterized in that, Includes the host, the first isolation device, and the first user equipment; The first user equipment is configured to send a first access request to the host, the first access request being used to request control of the first isolation device to perform a first function; The host is used to receive the first access request; The host is also configured to respond to the first access request, and when the host determines that there is an access record for the first isolation device in the access record table, and the user device that previously accessed the isolation device in the access record of the first isolation device is the first user device, and the access record of the first isolation device is valid, control the first isolation device to perform the first function. The first isolation device is used to perform the first function; The access record table includes device identifiers for one or more isolated devices and access records for those isolated devices. The access records include the device identifier of the user device that previously accessed the isolated device and valid information of the access record.

19. The system according to claim 18, characterized in that, The host is also configured to respond to the first access request by controlling the first isolation device to perform the first function when the host determines that there is an access record for the first isolation device in the access record table, and the user device that previously accessed the isolation device in the access record of the first isolation device is different from the first user device, and the access record of the first isolation device is invalid.

20. The system according to claim 18 or 19, characterized in that, The host is also configured to respond to the first access request by sending a first notification to the first user device when the host determines that there is an access record for the first isolation device in the access record table, and the user device that previously accessed the isolation device in the access record of the first isolation device is the same as the first user device, and the access record of the first isolation device is invalid. The first notification is used to inform the first user equipment that it cannot control the first isolation device to perform the first function.

21. The system according to any one of claims 18-20, characterized in that, The access records also include the access time of the user device that previously accessed the isolation device; The host is also configured to respond to the first access request by controlling the first isolation device to perform the first function when the host determines that there is an access record for the first isolation device in the access record table, and the user device that previously accessed the isolation device in the access record of the first isolation device is different from the first user device, and the access record of the first isolation device is valid, and the time interval between the access time of the user device that previously accessed the first isolation device and the current time is greater than a first threshold.

22. The system according to claim 21, characterized in that, The host is also configured to respond to the first access request by sending a first notification to the first user device when the host determines that there is an access record for the first isolation device in the access record table, and the user device that previously accessed the isolation device in the access record of the first isolation device is different from the first user device, and the access record of the first isolation device is valid, and the time interval between the access time of the previous user device accessing the first isolation device and the current time is less than or equal to a first threshold. The first notification is used to inform the first user equipment that it cannot control the first isolation device to perform the first function.

23. The system according to any one of claims 18-22, characterized in that, The host is also configured to respond to the first access request and, when the host determines that there is no access record for the first isolation device in the access record table, control the first isolation device to perform the first function.

24. The system according to any one of claims 18-23, characterized in that, After the host controls the first isolation device to perform the first function, the host is also configured to add an access record of the first isolation device to the access record table when the host determines that there is no access record of the first isolation device in the access record table.

25. The system according to any one of claims 18-23, characterized in that, After the host controls the first isolation device to perform the first function, the host is further configured to, when the host determines that there is an access record for the first isolation device in the access record table, and the user device that previously accessed the isolation device in the access record of the first isolation device is different from the first user device, and the access record of the first isolation device is invalid, change the device identifier of the user device that previously accessed the isolation device in the access record of the first isolation device to the device identifier of the first user device, and change the validity information of the access record to valid.

26. The system according to claim 21 or 22, characterized in that, After the host controls the first isolation device to perform the first function, the host is further configured to change the access time in the access record of the first isolation device to the current time when the host determines that there is an access record of the first isolation device in the access record table, and the user device that previously accessed the isolation device in the access record of the first isolation device is the first user device, and the access record of the first isolation device is valid.

27. The system according to claim 21 or 22, characterized in that, After the host controls the first isolation device to perform the first function, the host is further configured to, when the host determines that there is an access record for the first isolation device in the access record table, and the user device that previously accessed the isolation device in the access record of the first isolation device is different from the first user device, and the access record of the first isolation device is valid, and the time interval between the access time of the user device that previously accessed the first isolation device and the current time is greater than a first threshold, change the device identifier of the user device that previously accessed the isolation device in the access record of the first isolation device to the device identifier of the first user device, and change the access time in the access record of the first isolation device to the current time.

28. The system according to any one of claims 18-27, characterized in that, The first access request includes the access identifier of the first user equipment and the device identifier of the first isolation device; the device identifier of the first isolation device is the device identifier of the first isolation device; wherein, the device identifier of the first isolation device includes any one of the following: the device name, device type, media access control MAC address, and Internet Protocol (IP) address of the first isolation device.

29. The system according to any one of claims 18-27, characterized in that, The first access request includes the device identifier of the first user equipment and the device identifier of the first isolation device; The host is further configured to determine the identifier of the first isolation device based on the device identifier of the first isolation device using a hash algorithm, wherein the data size of the identifier of the first isolation device is smaller than the data size of the device identifier of the first isolation device.

30. The system according to claim 29, characterized in that, The access record table is a hash table.

31. The system according to any one of claims 18-30, characterized in that, The first access request also includes a first access type, which indicates the type of the first function; The host is also configured to determine a first instruction based on the first access type, the first instruction being configured to instruct the first isolation device to perform the first function; The host is also used to send the first instruction to the first isolation device.

32. The system according to any one of claims 18-31, characterized in that, The host is also configured to change valid information in the access record of the first isolation device to invalid when the host determines that the first condition is met.

33. The system according to claim 32, characterized in that, The first condition is that the host receives a first input operation for terminating the user equipment's occupation of the first isolation device.

34. The system according to claim 32, characterized in that, The first condition is that the host determines that the first isolation device has been occupied for a longer period than the second threshold.

35. An electronic device, a host computer, characterized in that, include: One or more processors, one or more memories; the one or more memories are coupled to the one or more processors, the one or more memories being used to store computer program code, the computer program code including computer instructions, which, when executed by the one or more processors, cause the host to perform the method of any one of claims 1-17.

36. A computer-readable storage medium comprising computer instructions, characterized in that, When the computer instructions are executed on the host computer, the host computer causes the host computer to perform the method of any one of claims 1-17.

37. A computer program product, characterized in that, When the computer program product is run on a computer, it causes the computer to perform the method according to any one of claims 1-17.

Images