A virtual USB device connection method, system, device and storage medium

Abstract

The present invention discloses a virtual USB device connection method, system, device, and storage medium, relating to the field of computers. The method comprises: in response to a connection instruction from a target USB device, a virtual machine creates a corresponding USB device virtual instance for the target USB device via a virtual USB controller and generates a connection data packet; the connection data packet is forwarded to a USB hub via a back-end driver, so that the USB hub controls the connection of the target USB device based on the USB device virtual instance identifier. By assigning a unique identifier to each virtual USB device instance, USB device access between different virtual machines is isolated, preventing data leakage and unauthorized access. The virtual machine is allowed to access a physical USB device via the virtual USB controller, thereby enabling the virtual machine to access the USB device as if it were a local device.

Description

Technical Field

[0001] The present invention relates to the field of computers, and in particular to a virtual USB device connection method, system, device and storage medium. Background Art

[0002] In the field of embedded virtualization, hardware passthrough technology is widely used to efficiently allocate different hardware devices to different virtual machines. This technology allocates physical devices directly to specific virtual machines, bypassing the host operating system, significantly reducing device access latency and improving overall performance. Hardware passthrough is particularly suitable for performance-critical devices such as graphics processing units (GPUs) and network interface cards (NICs). It effectively ensures exclusive and efficient use of hardware resources by virtual machines, meeting the stringent real-time and performance requirements of embedded systems.

[0003] However, hardware passthrough technology has significant limitations when it comes to USB devices connected via a USB hub. Because the USB hub and host are connected via a single USB bus, hardware passthrough cannot effectively partition resources across multiple USB devices on that bus. In this scenario, all devices connected via the USB hub share the same bus bandwidth, making it impossible to independently assign individual USB devices to specific virtual machines. This not only limits the virtual machine's flexible use of USB devices but can also trigger resource contention between devices, impacting overall system performance and stability. Summary of the Invention

[0004] The primary purpose of the present invention is to provide a virtual USB device connection method, system, device, and storage medium. Through virtualization technology, multiple virtual machines can share the same physical USB device, improving USB device utilization. By assigning a unique identifier to each virtual USB device instance, USB device access between different virtual machines is isolated, preventing data leakage and unauthorized access. By allowing virtual machines to access physical USB devices through a virtual USB controller, virtual machines can access USB devices as if they were local devices.

[0005] In order to achieve the above objectives, the embodiments of the present application provide the following technical solutions:

[0006] According to a first aspect of an embodiment of the present application, a virtual USB device connection method is provided, the method comprising:

[0007] In response to a connection instruction from a target USB device, the virtual machine creates a corresponding USB device virtual instance for the target USB device through a virtual USB controller and generates a connection data packet, wherein the connection data packet carries a USB device virtual instance identifier;

[0008] The connection data packet is forwarded to the USB hub through a back-end driver, so that the USB hub controls the connection of the target USB device according to the USB device virtual instance identifier.

[0009] Optionally, the virtual machine creates a corresponding USB device virtual instance for the target USB device through a virtual USB controller and generates a connection data packet, including:

[0010] The virtual machine creates a corresponding USB device virtual instance according to the attribute configuration of the target USB device through a virtual USB controller, and allocates a unique USB device virtual instance identifier to the USB device virtual instance;

[0011] A corresponding connection data packet is generated according to the USB device virtual instance, where the connection data packet includes the USB device virtual instance identifier and a connection instruction of the target USB device.

[0012] Optionally, before responding to the connection instruction of the target USB device, the method further includes:

[0013] A port control signal is sent to the USB hub via a sideband control bus to set or change identification information of several physical ports connected to the USB hub.

[0014] Optionally, the USB hub controls the connection of the target USB device according to the USB device virtual instance identifier, including:

[0015] The USB hub determines whether the USB device virtual instance identifier matches according to a pre-configured identifier filter rule, wherein the identifier filter rule represents a mapping relationship between the USB device virtual instance identifier, the corresponding virtual machine, and the identifier information of the physical port;

[0016] If the USB device virtual instance identifier matches successfully, the corresponding physical port is controlled to be mapped to the corresponding virtual port to achieve connection of the target USB device; if the match fails, the USB hub discards the connection data packet.

[0017] Optionally, the USB hub determines whether the USB device virtual instance identifier matches according to a preconfigured identifier filter rule, including:

[0018] The USB hub determines a requesting virtual machine for connection request according to the USB device virtual instance identifier;

[0019] Searching the identification information of the physical port for a list of virtual machines that are allowed to establish a connection;

[0020] The list of virtual machines allowed to establish connections is searched to see whether there is the requested virtual machine; if so, the match is successful; if not, the match fails.

[0021] Optionally, forwarding the connection data packet to the USB hub via a back-end driver includes:

[0022] The virtual machine sends the connection data packet to the back-end driver, so that the back-end driver verifies the validity of the connection data packet;

[0023] If the verification is successful, the connection data packet is sent to the corresponding USB bus driver, so that the USB bus driver forwards the connection data packet to the USB hub.

[0024] Optionally, after controlling the mapping of the corresponding physical port to the corresponding virtual port to achieve connection of the target USB device, the method further includes:

[0025] The USB hub sends a connection confirmation signal to the USB bus driver, so that the USB bus driver forwards the connection confirmation signal to the back-end driver;

[0026] The back-end driver returns the connection confirmation signal to the corresponding virtual machine, so that the virtual machine exchanges data with the target USB device through the USB device virtual instance.

[0027] According to a second aspect of an embodiment of the present application, a virtual USB device connection system is provided, the system comprising:

[0028] a virtual module, configured to respond to a connection instruction of a target USB device, and to cause the virtual machine to create a corresponding USB device virtual instance for the target USB device through a virtual USB controller and generate a connection data packet, wherein the connection data packet carries a USB device virtual instance identifier;

[0029] The connection module is used to forward the connection data packet to the USB hub through the back-end driver, so that the USB hub controls the connection of the target USB device according to the USB device virtual instance identifier.

[0030] According to a third aspect of an embodiment of the present application, an electronic device is provided, comprising: a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor executes the computer program to implement the method described in the first aspect above.

[0031] According to a fourth aspect of an embodiment of the present application, a computer-readable storage medium is provided, on which computer-readable instructions are stored. The computer-readable instructions can be executed by a processor to implement the method described in the first aspect above.

[0032] In summary, the embodiments of the present application provide a virtual USB device connection method, system, device and storage medium. In response to the connection instruction of the target USB device, the virtual machine creates a corresponding USB device virtual instance for the target USB device through the virtual USB controller and generates a connection data packet, the connection data packet carries the USB device virtual instance identifier; the connection data packet is forwarded to the USB hub through the back-end driver, so that the USB hub controls the connection of the target USB device according to the USB device virtual instance identifier. Through virtualization technology, multiple virtual machines can share the same physical USB device, thereby improving the utilization rate of USB devices. By assigning a unique identifier to each virtual USB device instance, it is ensured that USB device access between different virtual machines is isolated, preventing data leakage and unauthorized access. Allowing virtual machines to access physical USB devices through virtual USB controllers enables virtual machines to access USB devices just like accessing local devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the structures shown in these drawings without paying any creative work.

[0034] The structures, proportions, sizes, etc. illustrated in this specification are intended solely to complement the contents disclosed herein and to facilitate understanding and reading by persons skilled in the art. They are not intended to limit the conditions under which the present invention may be implemented and therefore have no substantive technical significance. Any structural modifications, changes in proportions, or adjustments in sizes, without affecting the efficacy and objectives of the present invention, shall remain within the scope of the technical contents disclosed herein.

[0035] Figure 1 A flowchart of a virtual USB device connection method provided in an embodiment of the present application;

[0036] Figure 2 A schematic diagram of the system architecture provided in an embodiment of the present application;

[0037] Figure 3 A schematic diagram of a virtual USB device connection system provided in an embodiment of the present application;

[0038] Figure 4 A structural diagram of an electronic device provided in an embodiment of the present application is shown;

[0039] Figure 5 A diagram showing a computer-readable storage medium provided in an embodiment of the present application.

[0040] The purpose, features and advantages of the present invention will be further described with reference to the accompanying drawings and in conjunction with the embodiments. DETAILED DESCRIPTION

[0041] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0042] It should be noted that all directional indications (such as up, down, left, right, front, back, etc.) in the embodiments of the present invention are only used to explain the relative position relationship, movement status, etc. between the various components under a certain specific posture (as shown in the accompanying drawings). If the specific posture changes, the directional indication will also change accordingly.

[0043] In addition, the terms "first," "second," and so on, used in this disclosure are for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of the technical features being referenced. Thus, a feature specified as "first" or "second" may explicitly or implicitly include at least one such feature. In the description of this disclosure, "plurality" means at least two, such as two or three, unless otherwise specifically defined.

[0044] In the present invention, unless otherwise specified or limited, the terms "connection" and "fixation" should be understood in a broad sense. For example, "fixation" can mean fixed connection, detachable connection, or integration; mechanical connection or electrical connection; direct connection or indirect connection through an intermediate medium; internal communication between two elements or interaction between two elements, unless otherwise specified. Those skilled in the art will be able to understand the specific meanings of the above terms in the present invention based on specific circumstances.

[0045] In addition, the technical solutions between the various embodiments of the present invention can be combined with each other, but it must be based on the fact that ordinary technicians in this field can implement it. When the combination of technical solutions is mutually contradictory or cannot be implemented, it should be deemed that such a combination of technical solutions does not exist and is not within the scope of protection required by the present invention.

[0046] USB virtualization is a technology that implements the functions of physical USB devices in a virtual machine. Its core is to abstract the USB resources of the physical machine into virtual resources that can be used by the virtual machine, allowing the virtual machine to access these virtual devices as if they were local devices. Currently, USB virtualization is usually implemented in the following ways:

[0047] 1. Directly call the host USB device: This method is suitable for the Linux operating system. The virtual machine can directly use the USB devices on the host, but it is limited to specific types of devices, such as keyboards and mice.

[0048] 2. Full virtualization: By simulating USB devices, applications running inside a virtual machine can access virtual devices just like accessing real devices. This invention does not belong to the above existing methods and achieves more efficient and flexible USB device access.

[0049] 3. Network redirection: USB redirection technology transfers USB device data packets from the host to the virtual machine via network protocols. This method requires specific client software. This invention achieves more precise control and more efficient resource management by customizing the USB hub and sideband control bus.

[0050] In addition, the USB host controller transparent transmission technology implements the transparent transmission of the USB host controller through the system's VFIO framework and IOMMU hardware, allowing the virtual machine to directly access the physical USB host controller and dynamically perceive the plugging and unplugging of USB devices on the host manager. USB port transparent transmission allows the transparent transmission of a specified USB port to the virtual machine, so that different USB devices mounted under the same host controller can be assigned to different virtual machines. These technologies have met the demand for USB device access in a virtualized environment to a certain extent, but there are still some limitations. The present invention provides a more flexible solution by introducing ID-based domain division and custom USB Hub, allowing multiple virtual machines to share devices under the same USB host controller.

[0051] While existing USB virtualization technologies enable virtual machines to access USB devices to a certain extent, they still have significant drawbacks. For example, directly calling host USB devices is limited to specific types of devices and cannot flexibly allocate devices. While full virtualization can emulate devices, it suffers from significant performance loss and cannot meet the needs of applications with high real-time requirements. Network redirection requires additional client software support, increasing system complexity and deployment difficulty. Furthermore, while USB host controller transparent transmission technology can transparently transmit the entire USB host controller, it can only be used by one virtual machine, and neither the host nor other virtual machines can use the USB devices mounted on it, lacking flexibility. While USB port transparent transmission allows for the transparent transmission of specified USB ports to virtual machines, support for dynamic device plugging and unplugging and multi-virtual machine sharing is still limited. These drawbacks limit the widespread use of USB virtualization technology in complex application scenarios and fail to meet the demand for efficient and flexible USB device allocation in embedded virtualization environments.

[0052] In order to solve the problem of how to efficiently and securely allocate physical USB devices to different virtual machines in a virtualized environment, traditional virtualization technologies often face problems such as large performance loss, incomplete resource isolation, and device access conflicts.

[0053] The embodiments of this application aim to improve virtual machine access efficiency to USB devices and enhance resource isolation security through innovative USB virtualization technology, meeting the demand for efficient and flexible USB device allocation in embedded virtualization environments. By introducing ID-based domain partitioning and custom implementation of the USB Hub in a virtualized environment, multiple virtual machines can isolate and control access to multiple USB devices connected to the same USB host. By integrating software and hardware, an ID filtering mechanism is added to the data transmission path to ensure that each virtual machine can only access its assigned USB devices, thereby achieving effective resource isolation and secure access.

[0054] Each virtual machine is connected to the host machine through a virtual USB controller, and the virtual USB controller is connected to the simulated USB device; each simulated USB device is connected to the actual USB bus through a back-end driver; the USB bus driver on the host machine manages data transmission on the USB bus; the custom USB Hub is connected to the host machine and physical USB devices through a high-speed bus and a sideband control bus, and an ID filter is set in the USB Hub; an ID filter is set in front of each physical USB device to decide whether to allow the data packet to pass through the corresponding USB interface based on the ID information carried by the data packet.

[0055] Figure 1A virtual USB device connection method provided in an embodiment of the present application is shown, the method comprising:

[0056] Step 101: In response to a connection instruction from a target USB device, the virtual machine creates a corresponding USB device virtual instance for the target USB device through a virtual USB controller and generates a connection data packet, wherein the connection data packet carries a USB device virtual instance identifier.

[0057] Step 102: forwarding the connection data packet to the USB hub through a backend driver, so that the USB hub controls the connection of the target USB device according to the USB device virtual instance identifier.

[0058] In a possible implementation, before responding to the connection instruction of the target USB device, the method further includes: sending a port control signal to the USB hub via a sideband control bus to set or change identification information of several physical ports connected to the USB hub.

[0059] This feature allows the host to dynamically set or change the identification information of physical ports on the USB hub via the sideband control bus, thereby controlling which virtual machines can access specific USB devices. This enhances system security and isolation by ensuring that each virtual machine can only access the USB devices assigned to it. Through dynamic configuration and precise control, the management and allocation of USB devices is optimized, resulting in more efficient resource utilization.

[0060] In a possible implementation, in step 101, the virtual machine creates a corresponding USB device virtual instance for the target USB device through a virtual USB controller and generates a connection data packet, including:

[0061] The virtual machine creates a corresponding USB device virtual instance according to the attribute configuration of the target USB device through a virtual USB controller, and assigns a unique USB device virtual instance identifier to the USB device virtual instance; and generates a corresponding connection data packet according to the USB device virtual instance, the connection data packet including the USB device virtual instance identifier and a connection instruction of the target USB device.

[0062] By assigning unique identifiers to each virtual instance of a USB device and including these identifiers in connection packets, you can precisely control a virtual machine's access to USB devices.

[0063] Suppose a data center runs multiple virtual machines, each of which requires access to different types of USB devices, such as storage devices, printers, or scanners. Before starting a virtual machine, the system administrator can use the management interface to select which virtual machines need access to specific USB devices and send port control signals to the USB hub via the sideband control bus to set or change the identification information of the physical port. For example, USB port 1 is assigned to virtual machine A, and port 2 is assigned to virtual machine B. When virtual machine A requests a connection to its assigned USB storage device, the virtual machine creates a corresponding virtual instance of the USB device through the virtual USB controller and assigns a unique identifier (such as ID_A) to the instance. The virtual machine then generates a connection packet containing ID_A and a connection instruction.

[0064] The connection packet is forwarded to the USB hub via the backend driver. The USB hub identifies the request as coming from VM A based on ID_A and checks whether the identification information for port 1 matches ID_A. If so, the USB hub maps port 1 to VM A's virtual port, allowing VM A to access the USB storage device. Because each VM has a unique identifier, and the USB hub controls port mapping based on these identifiers, VM A can access only its assigned USB storage devices and not VM B's devices. This enhances system security and isolation.

[0065] In a possible implementation, in step 102, the USB hub controls the connection of the target USB device according to the USB device virtual instance identifier, including:

[0066] The USB hub determines whether the USB device virtual instance identifier matches based on a preconfigured identifier filter rule, wherein the identifier filter rule represents a mapping relationship between the USB device virtual instance identifier, the corresponding virtual machine, and the identifier information of the physical port; if the USB device virtual instance identifier matches successfully, the USB hub controls the mapping of the corresponding physical port to the corresponding virtual port to achieve connection with the target USB device; if the match fails, the USB hub discards the connection data packet.

[0067] Through pre-configured identification filter rules, the USB hub precisely controls which virtual machines can access specific USB devices. This ensures that only virtual instance identities with matching identities can successfully establish connections, preventing unauthorized access and enhancing the security of virtualized environments. By discarding unmatched connection packets, only the correct packets are routed to the appropriate virtual machine, avoiding data confusion and potential security risks.

[0068] In a possible implementation, the USB hub determines whether the USB device virtual instance identifier matches according to a preconfigured identifier filter rule, including:

[0069] The USB hub determines a requesting virtual machine for connection according to the USB device virtual instance identifier; searches for a list of virtual machines allowed to establish a connection in the identification information of the physical port; searches for the requesting virtual machine in the list of virtual machines allowed to establish a connection; if so, matching is successful; otherwise, matching fails.

[0070] Suppose a system administrator preconfigures identification filter rules for a USB hub based on business requirements. For example, the rules might specify that virtual machine VM1 can access a USB key on USB port 1, while virtual machine VM2 can access a USB drive on USB port 2. When virtual machine VM1 needs to access the USB key, it creates a virtual USB device instance through the virtual USB controller and generates a connection packet containing a unique identifier (ID_VM1). Upon receiving the connection packet, the USB hub determines that the connection request is from virtual machine VM1 based on ID_VM1. The USB hub searches the list of virtual machines allowed to establish connections in the identification information of physical port 1 and searches for virtual machine VM1 within that list. If VM1 is found, a match is successful, and the USB hub maps physical port 1 to VM1's virtual port, thus enabling the USB key connection. If virtual machine VM2 attempts to access the USB key (by sending a connection packet containing ID_VM2), the USB hub cannot find VM2 in the list of allowed connections on physical port 1. The match fails, and the USB hub discards the connection packet, preventing VM2 from unauthorized access to the USB key.

[0071] In a possible implementation, in step 102, forwarding the connection data packet to the USB hub via a backend driver includes:

[0072] The virtual machine sends the connection data packet to the back-end driver so that the back-end driver verifies the validity of the connection data packet; if the verification is successful, the connection data packet is sent to the corresponding USB bus driver so that the USB bus driver forwards the connection data packet to the USB hub.

[0073] The back-end driver verifies the validity of the connection data packets to ensure that only data packets with correct format and complete content can be forwarded, thereby improving the security and stability of the system.

[0074] In a possible implementation, after controlling the mapping of the corresponding physical port to the corresponding virtual port to achieve connection of the target USB device, the method further includes:

[0075] The USB hub sends a confirmation connection signal to the USB bus driver, so that the USB bus driver forwards the confirmation connection signal to the back-end driver; the back-end driver returns the confirmation connection signal to the corresponding virtual machine, so that the virtual machine exchanges data with the target USB device through the USB device virtual instance.

[0076] The USB hub sends a connection confirmation signal to the USB bus driver, which is then returned to the virtual machine via the backend driver, ensuring that the virtual machine knows whether the connection is established. After the connection is confirmed, the virtual machine is allowed to exchange data with the target USB device through the USB device virtual instance, allowing the virtual machine to use the USB device normally.

[0077] The method provided in the embodiments of the present application is described in detail below with reference to the accompanying drawings.

[0078] Figure 2 The system architecture provided by an embodiment of the present application is shown, demonstrating how USB virtualization technology is used in a virtualized environment to connect and isolate multiple virtual machines (VM1 and VM2) from multiple physical USB devices (Device 1 to Device n). The entire system consists of the following main components:

[0079] 1. Virtual Machines (VM1 and VM2):

[0080] Each virtual machine is connected to the host machine through a USB port, and each virtual machine has an emulated USB controller (Emulate USB Controller) and an emulated USB device (Emulate USB Device). Emulated devices are distinguished from each other by adding an ID mark.

[0081] 2. Emulated USB controllers and devices:

[0082] Within each VM, an emulated USB controller connects to emulated USB devices (Emulate USB Device). These emulated devices are distinguished from each other by adding ID tags (Add ID Tags). Within each VM, the host's hypervisor provides a virtual USB controller. This virtual controller appears to the VM to operate identically to a real USB controller. Emulated USB devices are provided under the virtual controller, virtualizing USB devices into individual ports. This allows the VM to identify these ports even if physical USB devices are not connected.

[0083] 3. Back-end Driver:

[0084] Each emulated USB device is connected to a backend driver that is responsible for sending data packets to the actual USB bus.

[0085] The data packet with the ID tag is sent to the actual USB bus through the back-end driver.

[0086] 4. USB bus driver: The USB bus driver on the host is responsible for managing data transmission on the USB bus.

[0087] 5. USB Hub: A USB hub is a hardware device that expands the number of USB ports, allowing multiple USB devices to be connected simultaneously to a computer or other host system. A USB hub connects to the host computer via a single USB port and provides multiple USB ports for other devices to use. A USB hub is a key component for connecting physical USB devices, communicating with the host computer and physical devices via a high-speed USB bus and sideband signals (sideband control bus).

[0088] The USB hub communicates with the host and physical devices via two types of buses: a high-speed bus for transmitting USB data packets, i.e., the actual data information. A sideband control bus for transmitting control information, such as the ID information for each physical port of the USB hub. This bus is used only for transmitting control information and is a low-speed bus. In this embodiment, the I2C bus is used.

[0089] The USB hub parses USB data packets transmitted via the high-speed bus. Based on the ID information carried in the packets, the USB hub decides whether to allow these packets to pass through the corresponding USB interface. This is a key step in controlling virtual machine access to physical USB devices.

[0090] It should be noted that the USB Hub in this context is not a standard USB Hub. Instead, it is a custom, dedicated hub implemented by connecting an FPGA (field programmable gate array) to a ULPI (USB Link Power Management Interface) USB PHY physical layer interface. In the implementation of this application, a USB3340 chip is used as the USB PHY. This custom USB Hub receives ID control signals from the host computer via a sideband control bus (such as the I2C bus). These signals are used to set the ID information of each physical port of the USB Hub, thereby controlling which data packets can pass through.

[0091] 6. ID filter: There is an ID filter in front of each physical USB device, which is used to decide whether to allow the USB data packet to pass through the corresponding USB interface based on the ID information carried by the data packet.

[0092] To achieve resource isolation, ports belonging to a particular virtual machine are marked with ID tags. These ID tags are used to distinguish data packets from different virtual machines.

[0093] Through the above steps, the technical solution realizes that in a virtualized environment, physical USB devices can be effectively isolated and allocated to different virtual machines through USB virtualization technology, while ensuring the security and isolation of data transmission.

[0094] In traditional USB virtualization methods, virtual machines cannot recognize and access physical USB devices until they are actually connected to the USB ports. This can cause access delays, especially in scenarios where fast access is required. Pre-allocation allows the host to assign USB ports to specific virtual machines before the physical devices are connected, enabling instant recognition and access by the virtual machine upon device connection. This mechanism allows system administrators to plan and allocate USB ports in advance based on virtual machine needs and expected device connections, optimizing USB resource usage.

[0095] Furthermore, the host utilizes a sideband control bus (such as the I2C bus) to dynamically set the ID information for each physical port in the USB hub, pre-assigning these ports to specific virtual machines. This pre-assignment capability not only allows virtual machines to access physical devices immediately upon connection but also provides flexibility not available with traditional USB virtualization methods. The use of the sideband control bus provides the host with flexible control over USB device ownership, including pre-assigning USB ports and dynamically adjusting port assignments—control operations not available with the USB data bus, which is primarily used for data transfer rather than device control. This allows the system to more efficiently manage USB device resources, improving the performance and responsiveness of the virtualized environment.

[0096] Compared to existing technologies, the present invention only requires modifications to the virtual USB driver on the host machine, without modifying the client (virtual machine) implementation. This greatly simplifies the implementation process and improves the flexibility and scalability of the system. The steps to implement a virtual USB device connection are as follows:

[0097] Step 1: Emulation of virtual USB controller and device:

[0098] Within each VM, the hypervisor provides a virtual USB controller and emulates USB devices under it, virtualizing the USB devices into individual ports. This creates a virtual USB environment within the VM, allowing the VM to access the emulated USB devices as if they were real USB devices. This step provides the necessary environment for subsequent ID tag addition and data packet transmission.

[0099] Step 2: Implement resource isolation:

[0100] To achieve resource isolation, device ports belonging to a particular VM are marked with ID tags. These ID tags are used to distinguish packets from different VMs, which is key to device isolation and access control. They also provide identification for subsequent ID filters in the USB Hub. By marking each VM's USB device port with a unique ID tag, USB device isolation between VMs is achieved.

[0101] Step 3: Send data packets through the backend driver:

[0102] The backend driver sends data packets with ID tags to the actual USB bus. The transmission of data packets is the bridge connecting the virtual machine and the physical device. It connects the simulated device inside the virtual machine with the physical device, realizing data transmission between the virtual machine and the physical USB device.

[0103] Step 4: Customize the USB Hub implementation:

[0104] A custom dedicated hub is implemented by connecting an FPGA to a ULPI-based USB PHY. This hub features a high-speed bus and a sideband control bus for transmitting USB packets and setting physical port ID information. The custom USB hub is a core component for device isolation and access control, and it determines packet forwarding based on the ID flag.

[0105] Step 5: ID filter settings:

[0106] The USB Hub parses incoming USB data packets and, based on the ID information carried in the packets, uses ID filters to determine whether to allow the USB packets to pass through the corresponding USB interface. The ID filter ensures that only authorized virtual machines can access specific USB devices.

[0107] Step 6: Use of Sideband Control Bus:

[0108] Access control to USB devices is achieved by setting the ID information of each physical port of the USB Hub through a sideband control bus (such as the I2C bus). The sideband control bus is used to transmit control signals and set ID filters to control which data packets can be forwarded to specific USB devices.

[0109] Step 7: Communication between host and USB Hub:

[0110] The host computer controls the USB hub's behavior by writing ID control signals to the USB hub via the I2C bus. The host computer sends control signals, and the USB hub sets port ID information based on these signals. Data packets are then forwarded or discarded based on the ID information, ensuring controlled access to USB devices by virtual machines, thereby improving system security and isolation.

[0111] This mechanism differs from existing technologies in that it only requires modifications to the virtual USB driver on the host machine, without modifying the virtual machine implementation, thus simplifying system deployment and maintenance. Through the collaborative work of these steps, this solution implements isolation and access control of USB devices in a virtualized environment, meeting the needs of different application scenarios. Application scenarios include but are not limited to:

[0112] Cloud computing platform: In the virtualized environment of a cloud service provider, physical USB devices (such as storage devices and network devices) need to be allocated to different virtual machines.

[0113] Enterprise data centers: In the virtualized environment of enterprise data centers, fine-grained access control of USB devices is required to improve data security.

[0114] Embedded system development: During embedded system development, it is necessary to simulate the behavior of USB devices in a virtual machine for system testing and debugging.

[0115] Internet of Things (IoT) devices: In IoT devices, access control to multiple USB devices needs to be implemented through virtualization technology to improve device flexibility and scalability.

[0116] In summary, an embodiment of the present application provides a virtual USB device connection method, in which, in response to a connection instruction of a target USB device, a virtual machine creates a corresponding USB device virtual instance for the target USB device through a virtual USB controller and generates a connection data packet, wherein the connection data packet carries a USB device virtual instance identifier; the connection data packet is forwarded to a USB hub through a back-end driver, so that the USB hub controls the connection of the target USB device according to the USB device virtual instance identifier. Through virtualization technology, multiple virtual machines can share the same physical USB device, thereby improving the utilization rate of USB devices. By assigning a unique identifier to each virtual USB device instance, it is ensured that USB device access between different virtual machines is isolated, preventing data leakage and unauthorized access. Allowing virtual machines to access physical USB devices through virtual USB controllers enables virtual machines to access USB devices just like accessing local devices.

[0117] Based on the same technical concept, the embodiment of the present application also provides a virtual USB device connection system, such as Figure 3 As shown, the system includes:

[0118] The virtual module 301 is configured to respond to a connection instruction from a target USB device, and to cause the virtual machine to create a corresponding USB device virtual instance for the target USB device through a virtual USB controller and generate a connection data packet, wherein the connection data packet carries a USB device virtual instance identifier;

[0119] The connection module 302 is configured to forward the connection data packet to the USB hub via a backend driver, so that the USB hub controls the connection of the target USB device according to the USB device virtual instance identifier.

[0120] The present application also provides an electronic device corresponding to the method provided in the above embodiment. Figure 4 , which shows an electronic device provided by some embodiments of the present application. The electronic device 20 may include: a processor 200, a memory 201, a bus 202, and a communication interface 203. The processor 200, the communication interface 203, and the memory 201 are connected via the bus 202. The memory 201 stores a computer program executable on the processor 200. When the processor 200 executes the computer program, it executes the method provided by any of the aforementioned embodiments of the present application.

[0121] Memory 201 may include high-speed random access memory (RAM) and may also include non-volatile memory, such as at least one disk storage. Communication between the system network element and at least one other network element is achieved through at least one physical port (which may be wired or wireless), and may utilize the Internet, a wide area network, a local area network, a metropolitan area network, or the like.

[0122] The bus 202 may be an ISA bus, a PCI bus, or an EISA bus. The bus may be divided into an address bus, a data bus, a control bus, etc. The memory 201 is used to store programs. The processor 200 executes the programs upon receiving execution instructions. The methods disclosed in any of the aforementioned embodiments of the present application may be applied to or implemented by the processor 200.

[0123] The processor 200 may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by hardware integrated logic circuits in the processor 200 or by software instructions. The above processor 200 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), an off-the-shelf field programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the various methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in conjunction with the embodiments of this application can be directly implemented and executed by a hardware decoding processor, or by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium mature in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, etc. The storage medium is located in the memory 201 , and the processor 200 reads the information in the memory 201 and completes the steps of the above method in combination with its hardware.

[0124] The electronic device provided in the embodiments of the present application and the method provided in the embodiments of the present application are based on the same inventive concept and have the same beneficial effects as the methods adopted, operated or implemented by them.

[0125] The present application also provides a computer-readable storage medium corresponding to the method provided in the above embodiment. Figure 5The computer-readable storage medium shown is a CD 30 on which a computer program (ie, a program product) is stored. When the computer program is run by a processor, the method provided by any of the aforementioned embodiments is executed.

[0126] It should be noted that examples of the computer-readable storage medium may also include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other optical or magnetic storage media, which are not listed here one by one.

[0127] The computer-readable storage medium provided in the above-mentioned embodiments of the present application and the method provided in the embodiments of the present application are based on the same inventive concept and have the same beneficial effects as the method adopted, run or implemented by the application program stored therein.

[0128] It should be noted that the above embodiments illustrate rather than limit the present application, and that a person skilled in the art may devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference symbols placed between brackets should not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present application may be implemented by means of hardware comprising several different elements and by means of appropriately programmed computers. In a unit claim enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third etc. does not indicate any order. These words may be interpreted as names.

[0129] The above description is merely a preferred embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

[0130] The above description is only a preferred embodiment of the present invention and does not limit the patent scope of the present invention. All equivalent structural transformations made by using the contents of the present invention description and drawings under the concept of the present invention, or direct / indirect application in other related technical fields are included in the patent protection scope of the present invention.

Claims

1. A virtual USB device connection method, characterized in that: The method comprises: In response to a connection instruction from a target USB device, the virtual machine creates a corresponding USB device virtual instance for the target USB device through a virtual USB controller and generates a connection data packet, wherein the connection data packet carries a USB device virtual instance identifier; Forwarding the connection data packet to a USB hub through a back-end driver, so that the USB hub controls the connection of the target USB device according to the USB device virtual instance identifier; Before responding to the connection instruction of the target USB device, the method further includes: sending a port control signal to the USB hub via a sideband control bus to set or change identification information of a plurality of physical ports connected to the USB hub; The USB hub controls the connection of the target USB device according to the USB device virtual instance identifier, comprising: the USB hub determines whether the USB device virtual instance identifier matches according to a preconfigured identifier filter rule, wherein the identifier filter rule represents a mapping relationship between the USB device virtual instance identifier, the corresponding virtual machine, and the identifier information of the physical port; if the USB device virtual instance identifier matches successfully, controlling the corresponding physical port to be mapped to the corresponding virtual port to achieve connection with the target USB device; if the match fails, the USB hub discards the connection data packet.

2. The method according to claim 1, wherein The virtual machine creates a corresponding USB device virtual instance for the target USB device through a virtual USB controller and generates a connection data packet, including: The virtual machine creates a corresponding USB device virtual instance according to the attribute configuration of the target USB device through a virtual USB controller, and allocates a unique USB device virtual instance identifier to the USB device virtual instance; A corresponding connection data packet is generated according to the USB device virtual instance, where the connection data packet includes the USB device virtual instance identifier and a connection instruction of the target USB device.

3. The method according to claim 1, wherein The USB hub determines whether the USB device virtual instance identifier matches according to a pre-configured identifier filter rule, including: The USB hub determines a requesting virtual machine for connection request according to the USB device virtual instance identifier; Searching the identification information of the physical port for a list of virtual machines that are allowed to establish a connection; The list of virtual machines allowed to establish connections is searched to see whether there is the requested virtual machine; if so, the match is successful; if not, the match fails.

4. The method according to claim 1, wherein Forwarding the connection data packet to the USB hub via the backend driver, including: The virtual machine sends the connection data packet to the back-end driver, so that the back-end driver verifies the validity of the connection data packet; If the verification is successful, the connection data packet is sent to the corresponding USB bus driver, so that the USB bus driver forwards the connection data packet to the USB hub.

5. The method according to claim 3 or 4, wherein: After controlling the corresponding physical port to be mapped to the corresponding virtual port to achieve connection of the target USB device, the method further includes: The USB hub sends a connection confirmation signal to the USB bus driver, so that the USB bus driver forwards the connection confirmation signal to the back-end driver; The back-end driver returns the connection confirmation signal to the corresponding virtual machine, so that the virtual machine exchanges data with the target USB device through the USB device virtual instance.

6. A virtual USB device connection system, characterized in that: The system comprises: The virtual module is configured to, in response to a connection instruction from a target USB device, cause the virtual machine to create a corresponding USB device virtual instance for the target USB device via a virtual USB controller and generate a connection data packet, wherein the connection data packet carries an identifier of the USB device virtual instance; and before responding to the connection instruction from the target USB device, further comprising: sending a port control signal to a USB hub via a sideband control bus to set or change identifier information of a plurality of physical ports connected to the USB hub; A connection module is configured to forward the connection data packet to a USB hub via a back-end driver, so that the USB hub controls the connection of the target USB device according to the USB device virtual instance identifier. The USB hub controls the connection of the target USB device according to the USB device virtual instance identifier, wherein the USB hub determines, based on a preconfigured identification filter rule, whether the USB device virtual instance identifier matches, the identification filter rule representing a mapping relationship between the USB device virtual instance identifier, the corresponding virtual machine, and identification information of the physical port; if the USB device virtual instance identifier matches successfully, controlling the mapping of the corresponding physical port to the corresponding virtual port to achieve connection of the target USB device; and if the match fails, the USB hub discards the connection data packet.

7. An electronic device comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that Computer-readable instructions are stored thereon, and the computer-readable instructions can be executed by a processor to implement the method according to any one of claims 1 to 5.

Images