Communication method and device based on KVM virtual machine accessing host physical serial port

Abstract

The present invention provides a communication method and device based on a KVM virtual machine accessing a host physical serial port, and relates to the field of computer technology. The method includes creating a KVM virtual machine configured with a virtual serial port; wherein the virtual serial port is directed to a pseudo terminal; installing a serial port proxy program according to a user request; wherein the user request includes monitoring data of a target physical serial port and forwarding it; binding the serial port proxy program to the pseudo terminal, and realizing communication between the virtual serial port of the KVM virtual machine directed to the pseudo terminal and the target physical serial port through the serial port proxy program and the pseudo terminal. The solution provides a more flexible, secure, scalable, and more manageable serial port virtualization solution, and realizes secure communication between a physical serial port and a virtual serial port.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a communication method and device based on a KVM virtual machine accessing a host physical serial port. Background Art

[0002] Serial communication still plays an important role in embedded system development, remote device management, automated testing and other fields. Currently, serial port access control generally adopts the following methods: 1) Serial devices are directly connected through the physical serial bus; 2) The physical serial bus is converted into network communication through a serial server, and remote access is performed through the TCP / IP protocol; 3) In the virtualization or hyper-convergence scenarios of industrial control target ranges and industrial simulations, the physical serial port is directly mapped to the virtual host, which is used exclusively by the virtual machine, and the serial port application is installed in the virtual machine; 4) For the secure operation and maintenance of a single serial port, by adding a portable operation and maintenance gateway with a paired serial port, the two serial ports of the paired serial port are connected to the serial port of the operated device and the operation and maintenance notebook with a serial port, such as a portable operation and maintenance scenario; 5) Containerize serial port-related tools or applications, and use the device mapping function of docker to access the physical serial port of the hardware.

[0003] However, the above serial port access control method still has the following problems: 1) Due to the exclusivity of the serial port, it can only be exclusively accessed by one application, making it difficult to debug and restore the data that has been delivered for operation; 2) Although the use of a serial port server solves the problem of remote access, it cannot meet the requirements of safe operation and maintenance of serial port devices on site; 3) Due to the exclusive characteristics of the serial port physical signal, it is impossible to use multiple applications for access and monitoring, and it is also impossible to meet the requirements of safe operation and maintenance such as data monitoring, flow control, and data auditing; 4) In the portable operation and maintenance scenario, three terminal devices, namely the operated and maintained device, the portable operation and maintenance gateway, and the operation and maintenance notebook, are used, which is not only costly but also complicated in terms of on-site wiring; 5) At present, most of the digital twins and network security target fields that combine virtuality and reality use the conversion of serial port servers, or exclusively bind serial port device mapping in virtual machines, and cannot directly capture and simulate the serial port application data of the upper and lower computers, and cannot directly restore the communication process between the serial port application and the lower computer, resulting in simulation distortion, let alone security analysis; 6) A large number of serial bus communication applications are implemented based on windows SDK, and there are compatibility issues between containerization technology and applications. Therefore, it is very necessary to provide a communication method and device based on the KVM virtual machine accessing the host physical serial port. Summary of the invention

[0004] In order to solve one or more technical problems existing in the prior art, the present invention provides a communication method and device based on a KVM virtual machine accessing a host physical serial port, provides a more flexible, secure, scalable, and more manageable serial port virtualization solution, and realizes secure serial port communication.

[0005] In a first aspect, an embodiment of the present invention provides a communication method based on a KVM virtual machine accessing a host physical serial port, comprising:

[0006] Creating a KVM virtual machine configured with a virtual serial port; wherein the virtual serial port is directed to a pseudo terminal;

[0007] Installing a serial port proxy program according to a user request; wherein the user request includes monitoring data of a target physical serial port and forwarding the data;

[0008] The serial port proxy program is bound to the pseudo terminal, and communication between the virtual serial port of the KVM virtual machine directed to the pseudo terminal and the target physical serial port is achieved through the serial port proxy program and the pseudo terminal.

[0009] Optionally, binding the serial port proxy program to the pseudo terminal includes:

[0010] According to the serial port proxy program, a target KVM virtual machine where the virtual serial port is located is determined from the virtual serial port in an idle state; wherein the target KVM virtual machine is used to complete the processing of the data of the target physical serial port;

[0011] Bind the pseudo terminal corresponding to the target KVM virtual machine to the serial port proxy program.

[0012] Optionally, the implementing the communication between the virtual serial port of the KVM virtual machine directed to the pseudo terminal and the target physical serial port through the serial port proxy program and the pseudo terminal includes:

[0013] The target physical serial port receives first data sent by an external serial port device;

[0014] The serial port proxy program acquires the first data by monitoring, and forwards the first data to the pseudo terminal bound to the serial port proxy program;

[0015] The pseudo terminal sends the received first data to the virtual serial port of the KVM virtual machine directed to the pseudo terminal, completing the communication from the target physical serial port to the virtual serial port.

[0016] Optionally, the implementing the communication between the virtual serial port of the KVM virtual machine directed to the pseudo terminal and the target physical serial port through the serial port proxy program and the pseudo terminal includes:

[0017] After the KVM virtual machine receives the data from the target physical serial port, obtaining second data output by the KVM virtual machine;

[0018] Sending the second data to a pseudo terminal corresponding to the KVM virtual machine through the virtual serial port of the KVM virtual machine;

[0019] The serial port proxy program reads the second data received by the pseudo terminal and forwards the second data to the target physical serial port, so as to send the second data to the external serial port device through the target physical serial port.

[0020] Optionally, the user request further includes: performing data restoration, data filtering, logging, auditing, and protocol parsing on communication data between the virtual serial port and the target physical serial port, and performing identity authentication or authorization management between the virtual serial port and the target physical serial port.

[0021] In a second aspect, the present invention further provides a communication device based on a KVM virtual machine accessing a host physical serial port, comprising:

[0022] A KVM module, used to create a KVM virtual machine configured with a virtual serial port; wherein the virtual serial port is directed to a pseudo terminal;

[0023] A serial port proxy module, used to install a serial port proxy program according to a user request; wherein the user request includes monitoring data of a target physical serial port and forwarding the data;

[0024] The KVM module is further used to bind the serial port proxy program to the pseudo terminal;

[0025] The serial port proxy module is also used to realize the communication between the virtual serial port of the KVM virtual machine directed to the pseudo terminal and the target physical serial port through the serial port proxy program and the pseudo terminal.

[0026] Optionally, the serial port proxy module includes a proxy transceiver module and a security module;

[0027] The proxy transceiver module is used to monitor the data of the target physical serial port according to the serial port proxy program and forward it to the pseudo terminal bound to the serial port proxy program, and read the data of the pseudo terminal bound to the serial port proxy program and forward it to the target physical serial port;

[0028] The security module is used to perform data restoration, data filtering, log recording, auditing, protocol analysis on the data of the target physical serial port monitored by the proxy transceiver module and / or the data read from the pseudo terminal, and to perform identity authentication or authorization management between the virtual serial port and the target physical serial port.

[0029] Optionally, the KVM module is further used to perform the following operations:

[0030] According to the serial port proxy program, a target KVM virtual machine where the virtual serial port is located is determined from the virtual serial port in an idle state; wherein the target KVM virtual machine is used to complete the processing of the data of the target physical serial port;

[0031] Bind the pseudo terminal corresponding to the target KVM virtual machine to the serial port proxy program.

[0032] In a third aspect, an embodiment of the present invention further provides a computing device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method described in any first aspect of this specification is implemented.

[0033] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, enables the computer to execute the method described in any first aspect of this specification.

[0034] The embodiment of the present invention provides a communication method and device for accessing a host physical serial port based on a KVM virtual machine. The method creates a virtual machine directed to a pseudo terminal based on KVM, and installs a serial port proxy program that can monitor and forward target physical serial port data in the user space of the host machine. In this way, the pseudo terminal can communicate with both the target physical serial port and the virtual serial port by using the serial port proxy program bound to the pseudo terminal, thereby realizing secure communication between the target physical serial port and the virtual serial port through the pseudo terminal, and further enabling an external serial port device to realize secure communication of the serial port through the method. At the same time, the serial port proxy program can be flexibly customized according to user requirements, and supports concurrent access by multiple virtual machines, so the method is more flexible and more scalable. In addition, since the KVM virtual machine runs the original operating system and application program, the compatibility is better, and no code modification or transplantation is required. Moreover, the serial port proxy program is in the user space of the host machine, and will not affect the operation of the virtual machine. Without modifying the application program inside the virtual machine, the virtualization of serial port communication can still be realized. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0036] Figure 1 It is a flow chart of a communication method based on a KVM virtual machine accessing a host physical serial port provided by an embodiment of the present invention;

[0037] Figure 2 is a hardware architecture diagram of a computing device provided by an embodiment of the present invention;

[0038] Figure 3 It is a structural schematic diagram of a communication device based on a KVM virtual machine accessing a host physical serial port provided by an embodiment of the present invention;

[0039] Figure 4 It is a structural schematic diagram of another communication device based on a KVM virtual machine accessing a host physical serial port provided by an embodiment of the present invention;

[0040] Figure 5 is a schematic diagram of the software and hardware architecture of a computing device provided by an embodiment of the present invention;

[0041] Figure 6 The present invention is a structural diagram of a serial port security operation and maintenance system in an existing portable operation and maintenance scenario. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0043] The specific implementation of the concept of this application is described below.

[0044] Please refer to Figure 1 The embodiment of the present invention provides a communication method based on a KVM virtual machine accessing a host physical serial port, which is applied in a host machine and includes:

[0045] Step 100, creating a KVM virtual machine configured with a virtual serial port; wherein the virtual serial port is directed to a pseudo terminal;

[0046] Step 102, installing a serial port proxy program according to a user request; wherein the user request includes monitoring data of a target physical serial port and forwarding the data;

[0047] Step 104, binding the serial port proxy program to the pseudo terminal;

[0048] Step 106: Implement communication between the virtual serial port of the KVM virtual machine directed to the pseudo terminal and the target physical serial port through the serial port proxy program and the pseudo terminal.

[0049] In the embodiment of the present invention, a virtual machine directed to a pseudo terminal is created based on KVM, and a serial port proxy program capable of monitoring and forwarding target physical serial port data is installed in the user space of the host machine. In this way, the serial port proxy program bound to the pseudo terminal enables the pseudo terminal to communicate with both the target physical serial port and the virtual serial port, thereby realizing secure communication between the target physical serial port and the virtual serial port through the pseudo terminal, and further enabling the external serial port device to realize secure communication of the serial port through the method. At the same time, the serial port proxy program can be flexibly customized according to user requirements, and supports concurrent access by multiple virtual machines, so the method is more flexible and scalable. In addition, since the KVM virtual machine runs the original operating system and application program, the compatibility is better, and there is no need to modify or transplant the code, and the serial port proxy program is in the user space of the host machine, and will not affect the operation of the virtual machine. Without modifying the application program inside the virtual machine, the virtualization of the serial port communication can still be realized.

[0050] Described below Figure 1 How the various steps are performed.

[0051] First, for step 100, a KVM virtual machine with a virtual serial port directed to a pseudo terminal is obtained by editing the virtual machine's XML configuration file or using a command, for example, the command is qemu-system-x86_64kvm-enable-kvm -m2G-drive file=disk.img,format=raw -serial pty.

[0052] It should be noted that KVM is the abbreviation of Kernel-Based Virtual Machine, which is an open source virtualization technology based on the Linux kernel. It should be noted that the virtual serial port is a virtual character device, not a physical serial port device. More importantly, the configuration of the virtual serial port (including baud rate, data bit, stop bit, check bit, etc.) needs to be consistent with the configuration of the physical serial port on the host machine. Specifically, the configuration data is loaded from the host machine to perform preliminary configuration and mapping between the physical serial port and the virtual serial port, so that the serial port application of the KVM virtual machine has a seamless and consistent configuration before and after virtualization.

[0053] In the present invention, since a KVM virtual machine with a complete hardware layer and driver layer is adopted, compared with the docker containerization technology that does not virtualize the hardware driver, each system can run stably in the KVM virtual machine with higher compatibility and better universality.

[0054] In step 102, the serial port proxy program is used to complete the user request. Specifically, the configuration of serial port data forwarding and the like is completed according to the user request by configuration loading startup to install the serial port proxy program.

[0055] In the present invention, the serial port proxy program can not only be flexibly customized according to user requests in the user space of the host machine, but also can realize relevant user requests while monitoring the data of any physical serial port and forwarding it, and the serial port proxy program does not affect the operation of each application program in the application layer of the host machine, and supports concurrent access of multiple virtual machines, so it has higher flexibility and scalability. At the same time, the serial port proxy program is responsible for managing and forwarding serial port data to avoid multiple processes accessing the same physical serial port.

[0056] In a preferred embodiment, the user request also includes: data restoration, data filtering, logging, auditing, protocol parsing of communication data between the virtual serial port and the target physical serial port, and identity authentication or authorization management between the virtual serial port and the target physical serial port.

[0057] In the present invention, since the serial port proxy program runs in the user space of the host machine and does not affect the operation of the KVM virtual machine, the identity authentication and authorization management between the virtual serial port and the target physical serial port can be realized in the serial port proxy program, and the audit of the communication data between the two can be realized to meet the needs of safe operation and maintenance; and the communication data between the two can be obtained through asynchronous operations and data restoration, data filtering, log recording, protocol parsing, etc. In this way, while the serial port physical signal is monopolized, the requirements of safe operation and maintenance such as data monitoring, flow control, and data auditing can be realized through the serial port proxy program located between the physical serial port and the virtual serial port communication connection; and there is no need to connect an additional portable operation and maintenance gateway, which further reduces the cost.

[0058] In the existing virtual combination scheme, digital twins and network security target ranges mostly use serial port server conversion, or map serial port devices in virtual machines for exclusive binding. At this time, the computer used for simulation and the real instrument and equipment are still connected through a serial bus, and the serial bus has the exclusive characteristics of physical signals, so it is not possible to directly capture and simulate the serial port application data of the host and slave computers. Since the communication process between the serial port application and the slave computer cannot be directly restored, the simulation is distorted. However, in the present invention, since the serial port proxy program can obtain the real data of the real instrument and equipment through the physical serial port, the KVM virtual machine can interact with the real physical device in a real way.

[0059] In step 104, the serial port proxy program is bound to the pseudo terminal, including:

[0060] According to the serial port proxy program, a target KVM virtual machine where the virtual serial port is located is determined from the virtual serial port in an idle state; wherein the target KVM virtual machine is used to complete the processing of the data of the target physical serial port;

[0061] Bind the pseudo terminal corresponding to the target KVM virtual machine to the serial port proxy program.

[0062] It should be noted that, in the present invention, the configuration of the virtual serial port directed to the pseudo terminal bound to the serial port proxy program is consistent with the configuration of the target physical serial port monitored by the serial port proxy program.

[0063] In the present invention, since the serial port proxy program can monitor the target physical serial port, in order to use the pseudo terminal to realize the communication between the virtual serial port and the physical serial port, it is also necessary to bind the pseudo terminal and the serial port proxy program, so that the virtual serial port directed to the pseudo terminal can communicate with the target physical serial port through the forwarding function of the serial port proxy program.

[0064] In a preferred embodiment, according to the serial port proxy program, determining the target KVM virtual machine where the virtual serial port is located from the virtual serial port in the idle state includes:

[0065] Determine the virtual serial port in idle state;

[0066] Get the current running status and initial capacity parameters of the KVM virtual machine where the virtual serial port is located;

[0067] Determine the remaining available resources of the KVM virtual machine based on the initial capacity parameters and the current operating status;

[0068] Determine whether the remaining available resources of the KVM virtual machine can run the serial port host program accessed by the physical serial port;

[0069] If the judgment result is yes, the KVM virtual machine is determined as the target KVM virtual machine;

[0070] If the result of the determination is no, a new KVM virtual machine configured with a virtual serial port directed to the pseudo terminal is created or the KVM virtual machine is adjusted.

[0071] Specifically, any KVM virtual machine whose remaining available resources can run the serial port host program can act as the target KVM virtual machine. It should be noted that the initial capacity parameters of the KVM virtual machine minus the resources occupied in the current running state are the remaining available resources. The initial capacity parameters include the initial memory size, the initial disk space size and the CPU resources. The resources occupied in the current running state include the occupied memory size, the occupied disk space, the CPU usage rate, and the load rate. The remaining available resources include the remaining available memory size, the remaining available disk space size, 1-CPU usage rate, and 1-load rate. The remaining available resources of the KVM virtual machine that can run the serial port host program refer to that the remaining available memory size, the remaining available disk space size, 1-CPU usage rate, and 1-load rate after the KVM virtual machine runs the serial port host program are all greater than 0.

[0072] In a more preferred embodiment, after the judgment result is yes, the method further includes:

[0073] Determine the KVM virtual machine as the first KVM virtual machine;

[0074] Determine the number of failures and the total running time according to the acquired historical running status data of the first KVM virtual machine;

[0075] According to the remaining available resources, the number of failures, and the total running time of the first KVM virtual machine, the availability score of the first KVM virtual machine is determined; the availability score is determined by the following formula:

[0076]

[0077] in, An availability score of the first KVM virtual machine; is the number of failures of the first KVM virtual machine; is the total running time of the first KVM virtual machine; The total running time of the KVM virtual machine with the longest running time among all KVM virtual machines; The remaining available memory size of the first KVM virtual machine; is the initial memory size of the first KVM virtual machine; The remaining available disk space size of the first KVM virtual machine; is the initial disk space size of the first KVM virtual machine; is the CPU usage of the first KVM virtual machine; is the load rate of the first KVM virtual machine; is a natural constant;

[0078] The first KVM virtual machine corresponding to the maximum available score is determined as the target KVM virtual machine.

[0079] In the present invention, the availability of the KVM virtual machine is evaluated by considering the remaining available resources, number of failures, and total running time of the KVM virtual machine. The higher the availability score, the more sufficient the remaining available resources of the KVM virtual machine and the more stable its operation. The first KVM virtual machine with the highest availability score is preferably used as the target KVM virtual machine.

[0080] In step 106, communication between the virtual serial port of the KVM virtual machine directed to the pseudo terminal and the target physical serial port is implemented through the serial port proxy program and the pseudo terminal, including:

[0081] The target physical serial port receives first data sent by the external serial port device;

[0082] The serial port proxy program acquires the first data by monitoring, and forwards the first data to the pseudo terminal bound to the serial port proxy program;

[0083] The pseudo terminal sends the received first data to the virtual serial port of the KVM virtual machine directed to the pseudo terminal, completing the communication from the target physical serial port to the virtual serial port.

[0084] Specifically, in the communication process from the external serial port device to the KVM virtual machine: taking the Linux kernel host machine as an example, the external serial port device sends the first data to the target physical serial port (ttyS) of the host machine through the serial bus, and the tty driver of the host machine receives the first data from the target physical serial port; the serial port agent receives the first data through monitoring, and forwards the first data to the corresponding pseudo-terminal device; since the virtual serial port is directed to the pseudo-terminal, KVM will send the first data to the virtual serial port of the KVM virtual machine, thereby realizing communication from the target physical serial port to the virtual serial port.

[0085] In step 106, communication between the virtual serial port of the KVM virtual machine directed to the pseudo terminal and the target physical serial port is implemented through the serial port proxy program and the pseudo terminal, including:

[0086] After the KVM virtual machine receives the data from the target physical serial port, the second data output by the KVM virtual machine is obtained;

[0087] Sending the second data to the pseudo terminal corresponding to the KVM virtual machine through the virtual serial port of the KVM virtual machine;

[0088] The serial port proxy program reads the second data received by the pseudo terminal and forwards the second data to the target physical serial port, so as to send the second data to the external serial port device through the target physical serial port.

[0089] Specifically, in the communication process from the KVM virtual machine to the external serial port device: taking the Linux kernel host machine as an example, after the KVM virtual machine receives the first data, the virtual machine serial port application (i.e., the serial port host program) sends the second data to the KVM through the virtual serial port, and the KVM sends the second data to the pseudo terminal directed to the KVM virtual machine; because the serial port proxy program is bound to the pseudo terminal and can forward data, the serial port proxy program can read the second data from the pseudo terminal and forward the second data to the target physical serial port, so that the second data can be sent to the external serial port device through the serial bus.

[0090] In the present invention, several serial port proxy programs can also be installed according to user requests, and each serial port proxy program is used to monitor and forward the data of a target physical serial port. In this way, different serial port proxy programs can realize the communication between virtual serial ports directed to different pseudo terminals and the corresponding target physical serial ports, that is, many-to-many communication is realized; each serial port proxy program can realize the communication between a pair of virtual serial ports and the target physical serial port, that is, one-to-one communication; at the same time, serial port proxy programs that monitor and forward the data of several target physical serial ports can also be installed according to user requests, so that the communication between multiple pairs of virtual serial ports and the target physical serial port can also be realized through one serial port proxy program, that is, one-to-many communication, and independent serial port access of multiple virtual machines is realized.

[0091] In the present invention, the serial port virtualization is realized by using the serial port proxy program of the host user space, and the serial port proxy program is based on software implementation, and can be flexibly configured according to the actual scenario, and the number of virtual serial ports can also be dynamically managed, which further improves the flexibility and scalability. At the same time, the virtual machine and the physical serial port are isolated by the virtual serial port, and the application program inside the virtual machine directly operates the virtual serial port without worrying about the connection details of the underlying physical serial port. When the serial port proxy program is only responsible for data monitoring and forwarding, transparent two-way data forwarding is realized, which improves the versatility of the method. In addition, it can also run in the bastion host, and can also realize unified management, authentication, authorization and auditing to meet the needs of safe operation and maintenance.

[0092] like Figure 2 , Figure 3 As shown, an embodiment of the present invention provides a communication device based on a KVM virtual machine accessing a host physical serial port. The device embodiment can be implemented by software, or by hardware or a combination of software and hardware. From the hardware level, Figure 2 As shown, a hardware architecture diagram of a computing device where a communication device based on a KVM virtual machine accessing a host physical serial port is located is provided in an embodiment of the present invention, except Figure 2In addition to the processor, memory, network interface, and non-volatile memory shown in the figure, the computing device in which the device is located in the embodiment may also generally include other hardware, such as a forwarding chip responsible for processing messages, etc. Taking software implementation as an example, Figure 3 As shown, as a device in a logical sense, the CPU of the computing device in which it is located reads the corresponding computer program in the non-volatile memory into the memory and runs it. This embodiment provides a communication device based on a KVM virtual machine accessing a host physical serial port, the device comprising:

[0093] The KVM module 300 is used to create a KVM virtual machine configured with a virtual serial port; wherein the virtual serial port is directed to a pseudo terminal;

[0094] The serial port proxy module 302 is used to install the serial port proxy program according to the user request; wherein the user request includes monitoring the data of the target physical serial port and forwarding it;

[0095] The KVM module 300 is also used to bind the serial port proxy program to the pseudo terminal;

[0096] The serial port proxy module 302 is also used to implement communication between the virtual serial port of the KVM virtual machine directed to the pseudo terminal and the target physical serial port through the serial port proxy program and the pseudo terminal.

[0097] In some specific implementations, the KVM module 300 may be used to execute the above steps 100 and 104 , and the serial port proxy module 302 may be used to execute the above steps 102 and 106 .

[0098] In a preferred embodiment, Figure 4 As shown, the serial port proxy module 302 includes a proxy transceiver module 3021 and a security module 3022;

[0099] The proxy transceiver module 3021 is used to monitor the data of the target physical serial port according to the serial port proxy program and forward it to the pseudo terminal bound to the serial port proxy program, and read the data of the pseudo terminal bound to the serial port proxy program and forward it to the target physical serial port;

[0100] The security module 3022 is used to restore, filter, log, audit, and parse the target physical serial port data monitored by the proxy transceiver module 3021 and / or the pseudo terminal data read, and to perform identity authentication or authorization management between the virtual serial port and the target physical serial port.

[0101] In a preferred embodiment, the KVM module 300 is also used to perform the following operations:

[0102] According to the serial port proxy program, a target KVM virtual machine where the virtual serial port is located is determined from the virtual serial port in an idle state; wherein the target KVM virtual machine is used to complete the processing of the data of the target physical serial port;

[0103] Bind the pseudo terminal corresponding to the target KVM virtual machine to the serial port proxy program.

[0104] In a specific embodiment, Figure 5 A computing device taking a Linux Host as an example is shown. In the host, KVM is a KVM module, a serial port proxy program is a serial port proxy module, and the host is configured with several physical serial ports such as physical serial port 1 and physical serial port 2; the operating system of the created KVM virtual machine configured with several virtual serial ports such as virtual serial port 1 and virtual serial port 2 is the same as the operating system of the host, and the KVM virtual machine communicates with the physical serial port of the host through a pseudo terminal; wherein the driver layer includes drivers such as serial_core, tty_port, and ptmx.

[0105] Figure 6 A serial port security operation and maintenance method in an existing portable operation and maintenance scenario is shown. This method uses three terminal devices, namely, the operated device, the portable operation and maintenance gateway, and the operation and maintenance notebook. This method is not only costly but also complicated in terms of on-site wiring. However, in the present invention, the computing device provided by the present invention is used as the operation and maintenance notebook. The operated device is directly connected to the operation and maintenance notebook via a serial port bus to realize serial port security operation and maintenance. No portable operation and maintenance gateway is required, which reduces costs and reduces the complexity of on-site wiring.

[0106] In summary, the present invention has the following beneficial effects:

[0107] (1) The software-based serial port proxy program of the present invention can be flexibly customized according to user needs and supports concurrent access of multiple virtual machines, which is more flexible and has higher scalability.

[0108] (2) The present invention utilizes the serial port proxy program to implement identity authentication, authorization management and audit records, meet the needs of secure operation and maintenance, and improve the security of serial port communications.

[0109] (3) The present invention utilizes existing server resources, reduces hardware investment, and can also use a standard Linux environment, reducing operation and maintenance costs.

[0110] (4) The serial port communication method provided by the present invention has higher compatibility because the virtual machine runs the original operating system and application program, which has better compatibility and does not require code modification or transplantation. The serial port data is securely monitored and controlled through the serial port proxy program, which does not affect the virtual machine's operating space at all.

[0111] (5) The present invention realizes dynamic allocation of serial port resources by using a pseudo terminal device, thereby improving resource utilization.

[0112] (6) The present invention can realize the real interaction between the virtual machine and the physical device, and can also run various native serial port test programs inside the virtual machine and perform serial port data capture and security control on the host side.

[0113] The present invention includes but is not limited to the following scenarios: Scenario 1: Hyper-convergence and virtualization scenarios, security control and audit access to industrial security buses. Scenario 2: Safe operation and maintenance of integrated serial bus, and security operation and maintenance audit according to the original design supporting procedures. Scenario 3: In a target range environment that combines the virtual and the real, the virtual environment and the physical construction are made consistent, especially in a simulated virtual host computer, the host computer program is not changed, and the virtual and the real are consistent with the physical environment. Scenario 4: Industrial field operation and maintenance debugging, compatible with old serial software operation and maintenance, incompatible with existing new operating systems, and virtualization of old operating systems. Scenario 5: Analyze serial bus data without changing the existing facility environment.

[0114] It is understandable that the structure illustrated in the embodiment of the present invention does not constitute a specific limitation on a communication device based on a KVM virtual machine accessing a host physical serial port. In other embodiments of the present invention, a communication device based on a KVM virtual machine accessing a host physical serial port may include more or fewer components than shown in the figure, or combine certain components, or split certain components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0115] The information interaction, execution process and other contents between the modules in the above-mentioned device are based on the same concept as the embodiment of the method of the present invention. For the specific contents, please refer to the description in the embodiment of the method of the present invention, and no further description is given here.

[0116] An embodiment of the present invention further provides a computing device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, a communication method based on a KVM virtual machine accessing a host physical serial port in any embodiment of the present invention is implemented.

[0117] An embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the processor executes a communication method based on a KVM virtual machine accessing a host physical serial port in any embodiment of the present invention.

[0118] Specifically, a system or device equipped with a storage medium can be provided, on which software program code that implements the functions of any of the above-mentioned embodiments is stored, and a computer (or CPU or MPU) of the system or device can be enabled to read and execute the program code stored in the storage medium.

[0119] In this case, the program code itself read from the storage medium can realize the function of any one of the above-mentioned embodiments, and thus the program code and the storage medium storing the program code constitute a part of the present invention.

[0120] The storage medium embodiments for providing the program code include a floppy disk, a hard disk, a magneto-optical disk, an optical disk (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), a magnetic tape, a non-volatile memory card, and a ROM. Alternatively, the program code can be downloaded from a server computer via a communication network.

[0121] In addition, it should be clear that the functions of any of the above embodiments can be implemented not only by executing the program code read by the computer, but also by enabling the operating system on the computer to complete part or all of the actual operations based on the instructions of the program code.

[0122] In addition, it can be understood that the program code read from the storage medium is written to a memory provided in an expansion board inserted into the computer or to a memory provided in an expansion module connected to the computer, and then based on the instructions of the program code, a CPU installed on the expansion board or expansion module is enabled to perform part or all of the actual operations, thereby realizing the functions of any of the above-mentioned embodiments.

[0123] It should be noted that, in this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical factors in the process, method, article or device including the elements.

[0124] A person of ordinary skill in the art can understand that all or part of the steps of implementing the above method embodiments can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above method embodiments; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk, etc., various media that can store program codes.

[0125] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A communication method based on a KVM virtual machine accessing a host physical serial port, characterized in that: include: Creating a KVM virtual machine configured with a virtual serial port; wherein the virtual serial port is directed to a pseudo terminal; Installing a serial port proxy program according to a user request; wherein the user request includes monitoring data of a target physical serial port and forwarding the data; the user request also includes: performing data restoration, data filtering, logging, auditing, protocol parsing on the communication data between the virtual serial port and the target physical serial port, and performing identity authentication or authorization management between the virtual serial port and the target physical serial port; Binding the serial port proxy program to the pseudo terminal, and realizing communication between the virtual serial port of the KVM virtual machine directed to the pseudo terminal and the target physical serial port through the serial port proxy program and the pseudo terminal; the target physical serial port communicates with the external serial port device through the serial bus, and the configuration of the virtual serial port is consistent with the configuration of the target physical serial port; The method of realizing communication between the virtual serial port of the KVM virtual machine directed to the pseudo terminal and the target physical serial port through the serial port proxy program and the pseudo terminal includes: The target physical serial port receives first data sent by an external serial port device; The serial port proxy program acquires the first data by monitoring, and forwards the first data to the pseudo terminal bound to the serial port proxy program; The pseudo terminal sends the received first data to the virtual serial port of the KVM virtual machine directed to the pseudo terminal, completing the communication from the target physical serial port to the virtual serial port; After the KVM virtual machine receives the data from the target physical serial port, obtaining second data output by the KVM virtual machine; Sending the second data to a pseudo terminal corresponding to the KVM virtual machine through the virtual serial port of the KVM virtual machine; The serial port proxy program reads the second data received by the pseudo terminal and forwards the second data to the target physical serial port, so as to send the second data to the external serial port device through the target physical serial port.

2. The method according to claim 1, characterized in that The step of binding the serial port proxy program to the pseudo terminal includes: According to the serial port proxy program, a target KVM virtual machine where the virtual serial port is located is determined from the virtual serial port in an idle state; wherein the target KVM virtual machine is used to complete the processing of the data of the target physical serial port; Bind the pseudo terminal corresponding to the target KVM virtual machine to the serial port proxy program.

3. A communication device based on a KVM virtual machine accessing a host physical serial port, used to implement the method according to claim 1 or 2, characterized in that: include: A KVM module, used to create a KVM virtual machine configured with a virtual serial port; wherein the virtual serial port is directed to a pseudo terminal; A serial port proxy module, used to install a serial port proxy program according to a user request; wherein the user request includes monitoring data of a target physical serial port and forwarding the data; The KVM module is further used to bind the serial port proxy program to the pseudo terminal; The serial port proxy module is also used to realize the communication between the virtual serial port of the KVM virtual machine directed to the pseudo terminal and the target physical serial port through the serial port proxy program and the pseudo terminal.

4. The device according to claim 3, characterized in that The serial port proxy module includes a proxy transceiver module and a security module; The proxy transceiver module is used to monitor the data of the target physical serial port according to the serial port proxy program and forward it to the pseudo terminal bound to the serial port proxy program, and read the data of the pseudo terminal bound to the serial port proxy program and forward it to the target physical serial port; The security module is used to perform data restoration, data filtering, log recording, auditing, protocol analysis on the data of the target physical serial port monitored by the proxy transceiver module and / or the data read from the pseudo terminal, and to perform identity authentication or authorization management between the virtual serial port and the target physical serial port.

5. The device according to claim 3 or 4, characterized in that The KVM module is also used to perform the following operations: According to the serial port proxy program, a target KVM virtual machine where the virtual serial port is located is determined from the virtual serial port in an idle state; wherein the target KVM virtual machine is used to complete the processing of the data of the target physical serial port; Bind the pseudo terminal corresponding to the target KVM virtual machine to the serial port proxy program.

6. A computing device, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method according to any one of claims 1 to 2 is implemented.

7. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method according to any one of claims 1 to 2.

Images