Multiprocessing unit access method, system

Abstract

The application provides a multi-processing unit access method and system. The multi-processing unit access method comprises the following steps: receiving an access instruction sent by an external terminal device through a first physical serial port device, wherein the access instruction comprises user operation data and a unit identifier of a target processing unit; according to a plurality of mapping relationships, screening a target virtual serial port device corresponding to the unit identifier from a plurality of virtual serial port devices, and forwarding the user operation data to a second physical serial port device of the target processing unit through the target virtual serial port device; receiving response data returned by the target processing unit, and returning the response data to the external terminal device through the first physical serial port device. According to the embodiment of the application, only the first physical serial port device of the main control unit needs to be accessed, so that the second physical serial port devices of all processing units can be flexibly accessed, and the operation and maintenance convenience and efficiency of the multi-service firewall device are greatly improved.

Description

Technical Field

[0001] This application relates to the field of computer technology, specifically to a method and system for accessing multiple processing units. Background Technology

[0002] The multi-service firewall device adopts a modular architecture, consisting of a main control unit and multiple processing units. In actual operation and maintenance, when performing bootware upgrades or troubleshooting processing units, it is necessary to access the independent serial port views of each processing unit to perform user operations and collect logs.

[0003] Traditional solutions require a separate physical serial cable for each processing unit, employing a "one board, one cable" independent access and debugging mode. When the number of processing units is large, this mode necessitates a large number of serial cables and serial servers, significantly increasing cabling complexity and hardware costs, and hindering centralized equipment management and efficient operation and maintenance. Summary of the Invention

[0004] In view of this, this application proposes a multi-processing unit access method and system to solve the problem in related technologies that when upgrading the bootware of multi-service firewall devices or locating anomalies in processing units, a large number of serial cables and serial servers are required, which increases the complexity of cabling and is not conducive to centralized management and maintenance of the devices.

[0005] A first aspect of this application provides a method for accessing multiple processing units. The method is applied to the main control unit of a multi-service firewall device. The multi-service firewall device includes the main control unit and multiple processing units with different processing capabilities. The main control unit includes a first physical serial port device and multiple virtual serial port devices. The first physical serial port device is used to connect to an external terminal device. Each virtual serial port device establishes a mapping relationship with a second physical serial port device of a corresponding processing unit. The method includes: The system receives an access command sent by the external terminal device via the first physical serial port device. The access command includes user operation data and the unit identifier of the target processing unit. Based on the multiple mapping relationships, a target virtual serial port device corresponding to the unit identifier is selected from the multiple virtual serial port devices, and the user operation data is forwarded to the second physical serial port device of the target processing unit through the target virtual serial port device. The system receives the response data returned by the target processing unit and transmits it back to the external terminal device via the first physical serial port device.

[0006] This application embodiment selects the target virtual serial port device corresponding to the unit identifier from multiple virtual serial port devices based on multiple mapping relationships, and forwards the user operation data to the second physical serial port device of the target processing unit through the target virtual serial port device. Only the first physical serial port device of the main control unit needs to be connected to flexibly access the second physical serial port devices of all processing units, which greatly improves the convenience and efficiency of operation and maintenance of multi-service firewall devices, effectively avoids the cumbersome process of independent serial port wiring and debugging for each processing unit under the traditional solution, simplifies hardware design and wiring, and reduces maintenance costs.

[0007] In this embodiment, a serial port relay service process is deployed on each of the plurality of processing units; forwarding the user operation data to the second physical serial port device of the target processing unit through the target virtual serial port device includes: The user operation data is encapsulated into inter-board protocol frames; Determine whether the operating system of the target processing unit is in the running stage; If the operating system is in the running phase, the inter-board protocol frame is sent to the serial port relay service process of the target processing unit via the inter-board communication link through the target virtual serial port device, so that the serial port relay service process of the target processing unit writes the decrypted user operation data into the second physical serial port device of the target processing unit.

[0008] In this embodiment of the application, the method further includes: If the operating system is not in the running phase, the inter-board protocol frame is sent to the hardware relay circuit of the target processing unit via the backplane hardware link through the target virtual serial port device, so that the hardware relay circuit writes the decrypted user operation data into the second physical serial port device of the target processing unit.

[0009] This application embodiment determines whether the operating system of the target processing unit is in the running stage. If the operating system of the target processing unit is not in the running stage, the inter-board protocol frame is sent to the hardware relay circuit of the target processing unit through the target virtual serial port device via the backplane hardware link. This allows the hardware relay circuit to write the decrypted user operation data into the second physical serial port device of the target processing unit. This achieves the purpose of supporting early-stage serial port debugging and upgrades such as BootWare / BootROM, facilitating system booting, firmware upgrades, and fault location.

[0010] In this embodiment of the application, selecting the target virtual serial port device corresponding to the unit identifier from the plurality of virtual serial port devices according to the plurality of mapping relationships includes: The access command is authenticated. After the access command authentication is successful, the user operation data is verified according to the preset access control policy to determine whether the external terminal device has access rights to the target processing unit. After the permission verification is passed, the target mapping relationship corresponding to the unit identifier is selected from the multiple mapping relationships: The target virtual serial port device is determined based on the target mapping relationship.

[0011] The embodiments of this application, by first authenticating the identity and then verifying the access permissions, can greatly improve the reliability and security of multi-service firewall devices.

[0012] In this embodiment of the application, sending the inter-board protocol frame to the serial port relay service process of the target processing unit includes: In the presence of multiple inter-board protocol frames, determine the frame type of each inter-board protocol frame; Based on the frame type of each inter-board protocol frame, each inter-board protocol frame is assigned to a corresponding priority queue in a multi-level queue structure, so as to perform differentiated priority scheduling of the multiple inter-board protocol frames through the multi-level queue structure; the multi-level queue structure includes multiple queues with decreasing priority.

[0013] In this embodiment of the application, the plurality of queues includes a first priority queue, a second priority queue, a third priority queue, and a fourth priority queue with decreasing priority. The differentiated priority scheduling includes: If the frame type of the first inter-board protocol frame is a serial port flow control signal frame or an error report frame, then the first inter-board protocol frame is assigned to the first priority queue; the first inter-board protocol frame is any one of the plurality of inter-board protocol frames. If the priority of the second inter-board protocol frame being transmitted is lower than that of the first inter-board protocol frame when the first inter-board protocol frame is in the transmission queue, the transmission process of the second inter-board protocol frame is interrupted, the first inter-board protocol frame is inserted into the head of the transmission queue and transmitted, and the transmission of the second inter-board protocol frame is resumed after the first inter-board protocol frame has been transmitted.

[0014] In this embodiment of the application, the differentiated priority scheduling further includes: If the frame type of the first inter-board protocol frame is a session establishment frame, a session closing frame, or an authorization verification frame, then the first inter-board protocol frame is allocated to the second priority queue; the inter-board protocol frames in the second priority queue have a preset proportion of bandwidth in the inter-board communication link; When the first inter-board protocol frame and the third inter-board protocol frame of the fourth priority queue are sent in parallel, the first inter-board protocol frame receives bandwidth allocation before the third inter-board protocol frame.

[0015] In this embodiment of the application, the differentiated priority scheduling further includes: If the frame type of the first inter-board protocol frame is a heartbeat keep-alive frame, then the first inter-board protocol frame is allocated to the third priority queue, and the inter-board protocol frames in the third priority queue are sent by the timed triggering mechanism at the scheduling time. If the frame type of the first inter-board protocol frame is a data instruction frame, then the first inter-board protocol frame is allocated to the fourth priority queue. The fourth priority queue sends frames when all other priority queues are empty. If any other priority queue has a frame to be sent during the transmission process, the current transmission operation of the fourth priority queue is suspended and resumed after the other priority queues are cleared.

[0016] This application's embodiments identify the frame type of each inter-board protocol frame and dynamically allocate it to the corresponding priority queue in a multi-level queue structure, implementing differentiated scheduling. This achieves precise matching between protocol frame transmission methods and priorities, resulting in service quality assurance, improved bandwidth utilization, and system-level performance optimization. Specifically, control frames employ preemptive interrupt transmission to ensure millisecond-level response; session management frames ensure deterministic low latency through bandwidth reservation; heartbeat keep-alive frames achieve low-overhead, precise monitoring based on timed triggering; and data command frames dynamically reuse remaining bandwidth to maximize throughput. This mechanism enables a synergistic improvement in the transmission efficiency of inter-board protocol frames across throughput, real-time performance, and reliability.

[0017] A second aspect of this application provides a multi-processing unit access system. The system is applied to the main control unit of a multi-service firewall device. The multi-service firewall device includes the main control unit and multiple processing units with different processing capabilities. The main control unit includes a first physical serial port device and multiple virtual serial port devices. The first physical serial port device is used to connect to external terminal devices. Each virtual serial port device establishes a mapping relationship with the second physical serial port device of a corresponding processing unit. The system includes: The access instruction receiving module is used to receive the access instruction sent by the external terminal device through the first physical serial port device. The access instruction includes user operation data and the unit identifier of the target processing unit. The data sending module is used to filter out the target virtual serial port device corresponding to the unit identifier from the plurality of virtual serial port devices according to the plurality of mapping relationships, and forward the user operation data to the second physical serial port device of the target processing unit through the target virtual serial port device. The response data feedback module is used to receive the response data returned by the target processing unit and transmit it back to the external terminal device via the first physical serial port device.

[0018] An embodiment of the third aspect of this application provides a computer device including a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the computer instructions to perform the multiprocessor access method described in the first aspect above.

[0019] An embodiment of the fourth aspect of this application provides a computer-readable storage medium storing computer instructions for causing a computer to perform the multiprocessor access method described in the first aspect above.

[0020] Additional aspects and advantages of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application. Attached Figure Description

[0021] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the scope of this application. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings: Figure 1 A schematic diagram of the structure of a multi-service firewall device provided in an embodiment of this application is shown; Figure 2 A flowchart illustrating a multi-processing unit access method provided in an embodiment of this application is shown. Figure 3 This illustration shows a schematic diagram of the structure of a multi-processing unit access system provided in one embodiment of this application; Figure 4 This illustration shows a schematic diagram of the structure of a computer device according to an embodiment of this application; Figure 5 A schematic diagram of a storage medium provided in one embodiment of this application is shown. Detailed Implementation

[0022] Exemplary embodiments of this application will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of this application are shown in the drawings, it should be understood that this application may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of this application and to fully convey the scope of this application to those skilled in the art.

[0023] It should be noted that, unless otherwise stated, the technical or scientific terms used in this application shall have the ordinary meaning as understood by one of ordinary skill in the art to which this application pertains.

[0024] The technical scenarios involved in the embodiments of this application are described below.

[0025] Multi-service firewall devices typically include a main control unit, a backup main control unit, and multiple processing units. When a multi-service firewall device needs to be upgraded using bootware (an emergency remedial upgrade method that uses the device's underlying bootloader, primarily for scenarios where the device fails to boot into the operating system) or when troubleshooting abnormal restarts of processing units, a separate serial port view is required to access the processing unit's page for operation or to collect the serial port print information. Currently, the common approach is to connect each processing unit to a serial port cable, or to connect several processing units first and then add others as needed. When dealing with large cluster devices, even more serial ports and serial port servers are required, which is detrimental to device management and maintenance.

[0026] To address the aforementioned technical shortcomings, the embodiments of this application allow maintenance personnel to flexibly access, operate, and debug the first physical serial port devices of all boards (including service boards, backup main control boards, and mother boards) within the device simply by connecting external terminal devices to the serial port of the main control unit. This significantly improves the convenience and efficiency of maintenance for multi-service firewall devices. It effectively avoids the cumbersome process of independent serial port wiring and debugging for each processing unit under traditional solutions, simplifies hardware design and wiring, and reduces maintenance costs.

[0027] According to an embodiment of this application, a method for accessing multiple processing units is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0028] This embodiment provides a multi-processing unit access method, applied to the main control unit of a multi-service firewall device. The device structure of the multi-service firewall device is as follows: Figure 1 As shown, it includes a main control unit and multiple processing units with different processing performance; the main control unit includes a first physical serial port device and multiple virtual serial port devices. The first physical serial port device is used to connect to external terminal devices, and each virtual serial port device establishes a mapping relationship with the second physical serial port device of the corresponding processing unit.

[0029] Figure 2This is a flowchart of a multi-processing unit access method according to an embodiment of this application, such as... Figure 2 As shown, the process includes the following steps: Step S101: Receive the access command sent by the external terminal device through the first physical serial port device.

[0030] Specifically, the access instruction includes user operation data and the unit identifier of the target processing unit.

[0031] Specifically, the first physical serial port device refers to the hardware interface through which devices transmit physical layer data via serial communication protocols, including but not limited to RS232 interfaces and USB to TTL.

[0032] Specifically, external terminal devices refer to various external computer devices that are connected to multi-service firewall devices through a first physical serial port device to perform operations such as management, configuration, debugging, and monitoring.

[0033] In some specific embodiments, the main control unit integrates a serial port driver adapter module to be compatible with multiple physical serial port protocols and to support automatic detection of serial port connection status, baud rate, and serial port parameter configuration.

[0034] In this embodiment, through the serial port driver adapter module, the multi-service firewall device can simultaneously support serial port devices with different level standards such as RS232, RS485, and TTL without the need for an external converter; it can also automatically detect the connection status between the first physical serial port device and the external terminal device, and automatically communicate when the external terminal device and the first physical serial port device are in a serial port connection state; it can also perform intelligent parameter recognition, such as automatically detecting parameters such as baud rate (9600 / 115200, etc.), data bits (8 bits / 7 bits), stop bits, and parity mode, without the need for manual configuration.

[0035] In some specific embodiments, the main control unit also incorporates a serial port data transmission and reception buffer, an anomaly detection mechanism, a flow control mechanism, and a packet loss self-healing mechanism to ensure reliable data transmission and packet loss self-healing.

[0036] In this embodiment, a serial port data transmission and reception buffer is used to temporarily store data to prevent data from being discarded due to insufficient processing time caused by the main control unit's CPU being busy; an anomaly detection mechanism is used to monitor anomalies such as line noise, data errors, and device disconnection in real time; a flow control mechanism is used to automatically send a pause signal to the terminal when the data in the serial port data transmission and reception buffer reaches a preset storage threshold to prevent data overflow; and a packet loss self-healing mechanism is used to automatically retransmit or request retransmission after detecting data loss to ensure complete command execution.

[0037] Step S102: Based on the multiple mapping relationships, select the target virtual serial port device corresponding to the unit identifier from the multiple virtual serial port devices, and forward the user operation data to the second physical serial port device of the target processing unit through the target virtual serial port device.

[0038] In some specific embodiments, a corresponding virtual serial port device is created for each processing unit on the main control unit to realize the mapping and switching between each virtual serial port device and the second physical serial port device of the corresponding processing unit.

[0039] In some specific embodiments, a serial port relay service process is deployed on each of the plurality of processing units. Each serial port relay service process is used for data forwarding, command response and link maintenance between the second physical serial port device of the corresponding processing unit and the main control unit.

[0040] In some specific embodiments, the main control unit and the plurality of processing units establish a data forwarding channel through an inter-board communication link (e.g., Ethernet, PCIe, dedicated backplane bus, or custom message channel).

[0041] In some specific embodiments, step S102 above includes steps a1-a3: Step a1: Encapsulate the user operation data into an inter-board protocol frame.

[0042] In this embodiment, an efficient frame format is used for encapsulation, and the structure is shown in Table 1:

[0043] Table 1 The frame format of the above inter-board protocol frames is described as follows: It supports frame numbering and checksums to ensure data integrity and order; it supports batch data frames, heartbeat detection, and automatic link reconstruction; a session ID is used to distinguish multiple concurrent serial port sessions, allowing multiple users to operate different board serial ports simultaneously; the load data area supports various types such as raw serial port data, control commands, and status information, facilitating protocol expansion; and extended fields are provided for subsequent integration of encryption, compression, and other features. Regarding exception handling and security: Automatic retransmission and out-of-order correction are supported when data packets are lost or corrupted; session timeout detection and breakpoint resumption are supported, with automatic reconnection when the link is disconnected; high-strength encryption algorithms and authentication such as AES are supported to ensure secure data transmission.

[0044] Step a2: Determine whether the operating system of the target processing unit is in the running stage.

[0045] Specifically, when the operating system of the target processing unit is in the running stage, the operating system of the target processing unit will periodically send a specific heartbeat signal to the main control unit. Therefore, the main control unit can determine whether the operating system of the target processing unit is in the running stage by using the heartbeat signal. For example, if a valid heartbeat is received multiple times (e.g., 3 times), it is determined that the operating system of the target processing unit is running.

[0046] Step a3: If the operating system is in the running phase, the inter-board protocol frame is sent to the serial port relay service process of the target processing unit via the inter-board communication link through the target virtual serial port device, so that the serial port relay service process of the target processing unit writes the decrypted user operation data into the second physical serial port device of the target processing unit.

[0047] Specifically, the serial port relay service process belongs to the software layer and mainly functions to read the inter-board protocol frame from the inter-board communication link, decapsulate the inter-board protocol frame to obtain the user operation data, and then forward the user operation data to the second physical serial port device of the target processing unit. The second physical serial port device is connected to the processing device of the target processing unit so that the processing device can process the user operation data sent by the second physical serial port device and generate corresponding response data.

[0048] In some specific embodiments, after step a3 above, the method further includes: Step a4: If the operating system is not in the running stage, the inter-board protocol frame is sent to the hardware relay circuit of the target processing unit via the backplane hardware link through the target virtual serial port device, so that the hardware relay circuit writes the desealed user operation data into the second physical serial port device of the target processing unit.

[0049] In this embodiment, a backplane hardware link (i.e., a data channel available during the BootWare / BootROM stage) is provided between the main control unit and each processing unit. This enables the transmission of user operation data through the backplane hardware link even when the operating system of each processing unit is not running. It also ensures that data can be sent independently and concurrently when the operating systems of multiple processing units are simultaneously in the non-running stage.

[0050] In some specific embodiments, when a periodic heartbeat signal is detected from the serial port relay service process of the target processing unit to the main control unit, the system switches from hardware relay mode to software relay mode (i.e., the inter-board protocol frame is sent to the serial port relay service process of the target processing unit via the inter-board communication link). If the heartbeat signal is interrupted within a preset timeout threshold or the serial port relay service process exits abnormally, the system automatically falls back to hardware relay mode (i.e., the inter-board protocol frame is sent to the hardware relay circuit of the target processing unit via the backplane hardware link) to ensure the continuity of serial port access.

[0051] In some specific embodiments, step S102 above further includes steps S1021-S1024: Step S1021: Authenticate the access command.

[0052] Specifically, the authentication method is not limited and may include at least one of the following: determining whether the IP address of the external terminal device that issued the access command is in a predefined whitelist for operation and maintenance, or authenticating the identity through a device certificate or key.

[0053] Step S1022: After the access command authentication is successful, the user operation data is verified according to the preset access control policy to determine whether the external terminal device has access rights to the target processing unit.

[0054] Specifically, at least one allowed processing unit corresponding to the user information in the user operation data can be selected from the preset access control policy, and it can be determined whether the target processing unit exists in the at least one allowed processing unit. If the target processing unit exists in the at least one allowed processing unit, it is determined whether the external terminal device has access rights to the target processing unit. Conversely, if the target processing unit does not exist in the at least one allowed processing unit, it is determined that the external terminal device does not have access rights to the target processing unit.

[0055] Step S1023: After the permission verification is passed, the target mapping relationship corresponding to the unit identifier is selected from the multiple mapping relationships.

[0056] Step S1024: Determine the target virtual serial port device based on the target mapping relationship.

[0057] Specifically, each mapping relationship represents the association between the corresponding virtual serial port device and the second physical serial port device of the corresponding processing unit. The target mapping relationship containing the unit identifier of the target processing unit can be selected from multiple mapping relationships, and then the virtual serial port device in the target mapping relationship is used as the target virtual serial port device.

[0058] In some specific embodiments, sending the inter-board protocol frame to the serial port relay service process of the target processing unit includes steps 201-202: Step 201: In the case of multiple inter-board protocol frames, determine the frame type of each inter-board protocol frame.

[0059] Specifically, the frame types of inter-board protocol frames mainly include three categories: the first category is control frames, including serial port flow control signal frames and error report frames; the second category is session management frames, including session establishment frames, session closing frames, and permission verification frames; the third category is heartbeat keep-alive frames; and the fourth category is data command frames.

[0060] Step 202: Based on the frame type of each inter-board protocol frame, allocate each inter-board protocol frame to the corresponding priority queue in the multi-level queue structure, so as to perform differentiated priority scheduling of the multiple inter-board protocol frames through the multi-level queue structure.

[0061] Specifically, the multi-level queue structure includes multiple queues, such as a first priority queue, a second priority queue, a third priority queue, and a fourth priority queue with decreasing priority.

[0062] In some specific embodiments, differentiated priority scheduling includes: Step b1: If the frame type of the first inter-board protocol frame is a serial port flow control signal frame (such as XON / XOFF) or an error report frame (such as CRC check failure, link disconnection), then the first inter-board protocol frame is assigned to the first priority queue; the first inter-board protocol frame is any one of the plurality of inter-board protocol frames. Step b2: If the priority of the second inter-board protocol frame being transmitted is lower than that of the first inter-board protocol frame when the first inter-board protocol frame has entered the transmission queue, then the transmission process of the second inter-board protocol frame is interrupted, the first inter-board protocol frame is inserted into the head of the transmission queue and transmitted, and the transmission of the second inter-board protocol frame is resumed after the first inter-board protocol frame has been transmitted.

[0063] In this embodiment, by allocating flow control signal frames and error report frames to the first priority queue and implementing transmit interrupt preemption, the end-to-end latency of such critical frames can be ensured to be controlled within milliseconds (typically <2ms), meeting the real-time requirements of serial port hardware flow control. This method guarantees that the XOFF flow control signal arrives at the corresponding processing unit without delay, completely avoiding serial port data overflow and frame loss, ensuring the bit integrity of firmware image transmission during BootWare upgrades, and reducing the upgrade failure rate.

[0064] In some specific embodiments, differentiated priority scheduling includes: Step c1: If the frame type of the first inter-board protocol frame is a session establishment frame, a session closing frame, or an authorization verification frame, then the first inter-board protocol frame is allocated to the second priority queue; the inter-board protocol frames in the second priority queue have a preset proportion of bandwidth in the inter-board communication link. In step c2, when the first inter-board protocol frame and the third inter-board protocol frame of the fourth priority queue are sent in parallel, the first inter-board protocol frame receives bandwidth allocation before the third inter-board protocol frame.

[0065] In this embodiment, a certain percentage of bandwidth (e.g., 15%-20% of the total bandwidth) is reserved for the second priority queue in the inter-board communication link (such as PCIe, shared memory channel). This quota is independent of the occupancy of the sending queue. That is to say, even if the sending queue is empty, other priority queues cannot fully occupy this part of the bandwidth; once the session management frame arrives, it immediately enjoys the minimum bandwidth guarantee.

[0066] In some specific embodiments, differentiated priority scheduling includes: Step d1: If the frame type of the first inter-board protocol frame is a heartbeat keep-alive frame, then the first inter-board protocol frame is allocated to the third priority queue. The inter-board protocol frames in the third priority queue are sent by the timed triggering mechanism at the scheduling time.

[0067] In this embodiment, the priority (3) of the heartbeat keep-alive frame is lower than that of the control frame (1) and the session management frame (2), but higher than that of the data instruction frame (4). This priority design reflects the characteristics of the heartbeat keep-alive frame as "moderately important and with constant periodicity"—it cannot be blocked for a long time, nor does it need to be preempted in an emergency.

[0068] In this embodiment of the application, the timed triggering mechanism is generated in batches by an independent timer (e.g., triggered once every 100ms) at a preset scheduling time and added to the sending queue. The sending queue only takes out heartbeat keep-alive frames from the third priority queue for sending when the bandwidth is idle or when the heartbeat sending window is reached.

[0069] In some specific embodiments, differentiated priority scheduling includes: Step e1: If the frame type of the first inter-board protocol frame is a data instruction frame, then the first inter-board protocol frame is allocated to the fourth priority queue.

[0070] In this embodiment of the application, the fourth priority queue transmits frames when all other priority queues are empty. If any other priority queue has a frame to be transmitted during the transmission process, the current transmission operation of the fourth priority queue is suspended and resumed after the other priority queues are cleared.

[0071] Step S103: Receive the response data returned by the target processing unit and transmit it back to the external terminal device via the first physical serial port device.

[0072] In this embodiment, the target processing unit selects the corresponding data channel to send response data based on whether its operating system is running. For example, when the target processing unit's operating system is running, the response data is sent to the main control unit through the inter-board communication link. Conversely, when the target processing unit's operating system is not running, the response data is sent to the main control unit through the backplane hardware link, and then the first physical serial port device of the main control unit sends the response data to the external terminal device.

[0073] In some specific embodiments, a serial port session management engine is maintained on the main control board, supporting concurrent access by multiple users / sessions. After logging into the main control unit via an external terminal device, users can select the target processing unit to access through command-line menus, shortcuts, or customized interaction protocols (e.g., entering "connect slot 2" switches to the serial port session of processing unit number 2). Data transmission and reception targets are automatically switched, transparently forwarding data from the first physical serial port device of the main control unit to the second physical serial port device of the target processing unit / backup main control unit, and transmitting the returned data back to the first physical serial port device of the main control unit in real time, achieving an operational experience as if directly connected to the second physical serial port device of the target processing unit. Functions such as session persistence, automatic disconnection upon timeout, permission management, and operation auditing are supported to ensure security and traceability in multi-user scenarios.

[0074] In some specific embodiments, the main control unit and each processing unit have built-in health monitoring mechanisms to monitor the status of inter-board communication links and serial port proxy services in real time.

[0075] In this embodiment, when a link anomaly, processing unit restart, or data interruption is detected through the health monitoring mechanism, self-healing mechanisms such as reconnection, caching, and breakpoint resumption are automatically initiated to maximize the continuity and reliability of the serial port session. Serial port session logs, anomaly alarms, and remote diagnostics are supported, facilitating later maintenance and problem localization.

[0076] In some specific embodiments, the implementation of this application supports multi-service firewall devices of different models and architectures, and can be compatible with various board topologies through configuration files or automatic discovery mechanisms.

[0077] In this embodiment, dynamic power-on / off and hot-swapping of the service unit / standby master control unit are supported, as well as smooth migration of serial port sessions during master control unit switching. It can be expanded to support concurrent operations of multiple serial port terminals, facilitating subsequent function upgrades and adaptation to multiple scenarios.

[0078] In some specific embodiments, after a user accesses the system through the first physical serial port device of the main control unit, the system automatically loads the serial port session resources of all available processing units and displays the accessible targets according to slot number, board type, and other methods.

[0079] In this embodiment, after the user selects the second serial port device of the target processing unit, the main control unit forwards the serial port access traffic to the corresponding processing unit. The user can then perform operations such as login, debugging, and upgrades as if directly connected to the processing unit. If frequent switching between different processing units is required, the system supports optimized functions such as command-line quick switching, session persistence, and automatic restoration of the last access state. For scenarios requiring special debugging in the early stages, such as BootWare / BootROM, the user can enter the BootWare serial port session of the specified processing unit through specific commands to perform operations such as boot loading and firmware upgrades.

[0080] In some specific embodiments, when multiple users / terminals simultaneously access different processing units through the first physical serial port device of the main control unit, session resources can be automatically managed and allocated to prevent conflicts and resource preemption. If session conflicts occur (such as multiple users attempting to access the same processing unit), coordinated scheduling can be performed according to preset strategies (such as queuing, read-only access, administrator priority, etc.). Serial port sessions and all operations are logged, facilitating problem tracing and security compliance.

[0081] The embodiments of this application have the following technical effects: 1. Maintenance personnel only need to connect to the first physical serial port device of the main control unit to flexibly access, operate, and debug all processing units (including processing units and backup main control units), which greatly improves the convenience and efficiency of maintenance of multi-board firewall devices; effectively avoids the cumbersome process of independent serial port wiring and debugging for each processing unit under the traditional solution, simplifies hardware design and wiring, and reduces maintenance costs; 3. Supports early-stage serial port debugging and upgrades such as BootWare / BootROM, facilitating system booting, firmware upgrades, and fault location; 4. The security management, fault detection, and self-healing mechanisms for serial port sessions effectively improve the reliability and security of the system; 5. It has good compatibility, scalability and high availability, and is suitable for various network security devices containing multiple processing units; 6. It provides efficient multi-user access, session conflict management, and operation auditing capabilities to meet the automated operation and maintenance needs of large-scale data centers and cloud environments.

[0082] Corresponding to the above implementation of the multi-processing unit access method, this application embodiment also provides a multi-processing unit access system for executing the multi-processing unit access method described in any of the above embodiments.

[0083] This multi-processing unit access system is applied to the main control unit of a multi-service firewall device. The multi-service firewall device includes the main control unit and multiple processing units with different processing performance. The main control unit includes a first physical serial port device and multiple virtual serial port devices. The first physical serial port device is used to connect to external terminal devices. Each virtual serial port device establishes a mapping relationship with the second physical serial port device of the corresponding processing unit. like Figure 3 As shown, the multiprocessor access system includes: The access instruction receiving module is used to receive the access instruction sent by the external terminal device through the first physical serial port device. The access instruction includes user operation data and the unit identifier of the target processing unit. The data sending module is used to filter out the target virtual serial port device corresponding to the unit identifier from the plurality of virtual serial port devices according to the plurality of mapping relationships, and forward the user operation data to the second physical serial port device of the target processing unit through the target virtual serial port device. The response data feedback module is used to receive the response data returned by the target processing unit and transmit it back to the external terminal device via the first physical serial port device.

[0084] Optionally, the data sending module is further configured to encapsulate the user operation data into an inter-board protocol frame; determine whether the operating system of the target processing unit is in the running stage; if the operating system is in the running stage, then send the inter-board protocol frame to the serial port relay service process of the target processing unit via the inter-board communication link through the target virtual serial port device, so that the serial port relay service process of the target processing unit writes the decapsulated user operation data into the second physical serial port device of the target processing unit.

[0085] Optionally, the data transmission module is further configured to, if the operating system is not in the running phase, send the inter-board protocol frame to the hardware relay circuit of the target processing unit via the target virtual serial port device through the backplane hardware link, so that the hardware relay circuit writes the decrypted user operation data into the second physical serial port device of the target processing unit.

[0086] Optionally, the data sending module is further configured to authenticate the access command; after the access command is authenticated, the user operation data is verified according to a preset access control policy to determine whether the external terminal device has access rights to the target processing unit; after the permission verification is passed, a target mapping relationship corresponding to the unit identifier is selected from multiple mapping relationships; and the target virtual serial port device is determined based on the target mapping relationship.

[0087] Optionally, the data sending module is further configured to, when there are multiple inter-board protocol frames, determine the frame type of each inter-board protocol frame; and, according to the frame type of each inter-board protocol frame, allocate each inter-board protocol frame to a corresponding priority queue in a multi-level queue structure, so as to perform differentiated priority scheduling of the multiple inter-board protocol frames through the multi-level queue structure; the multi-level queue structure includes multiple queues with decreasing priority.

[0088] Optionally, the differentiated priority scheduling includes: if the frame type of the first inter-board protocol frame is a serial port flow control signal frame or an error report frame, then the first inter-board protocol frame is allocated to the first priority queue; the first inter-board protocol frame is any one of the plurality of inter-board protocol frames; when the first inter-board protocol frame enters the transmission queue, if the priority of the second inter-board protocol frame being transmitted is lower than that of the first inter-board protocol frame, then the transmission process of the second inter-board protocol frame is interrupted, the first inter-board protocol frame is inserted into the head of the transmission queue and transmitted, and the transmission of the second inter-board protocol frame is resumed after the first inter-board protocol frame has been transmitted.

[0089] Optionally, the differentiated priority scheduling includes: if the frame type of the first inter-board protocol frame is a session establishment frame, a session closure frame, or an authorization verification frame, then the first inter-board protocol frame is allocated to the second priority queue; the inter-board protocol frames in the second priority queue have a preset proportion of bandwidth in the inter-board communication link; when the first inter-board protocol frame and the third inter-board protocol frame in the fourth priority queue are sent in parallel, the first inter-board protocol frame receives bandwidth allocation with priority over the third inter-board protocol frame.

[0090] Optionally, the differentiated priority scheduling includes: if the frame type of the first inter-board protocol frame is a heartbeat keep-alive frame, then the first inter-board protocol frame is allocated to the third priority queue, and the inter-board protocol frames in the third priority queue are sent by a timed triggering mechanism at the scheduling time; if the frame type of the first inter-board protocol frame is a data instruction frame, then the first inter-board protocol frame is allocated to the fourth priority queue, and the fourth priority queue sends frames when all other priority queues are empty, and if any other priority queue has a frame to be sent during the sending process, the current sending operation of the fourth priority queue is suspended, and the current sending operation is resumed after the other priority queues are cleared.

[0091] The multiprocessor access system provided in the above embodiments of this application and the multiprocessor access method provided in the embodiments of this application are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented by the applications stored therein.

[0092] This application also provides a computer device for executing the above-described multiprocessor unit access method. Please refer to... Figure 4 This illustrates a schematic diagram of a computer device provided by some embodiments of this application. For example... Figure 4 As shown, the computer device 4 includes: a processor 400, a memory 401, a bus 402, and a communication interface 403. The processor 400, the communication interface 403, and the memory 401 are connected via the bus 402. The memory 401 stores a computer program that can run on the processor 400. When the processor 400 runs the computer program, it executes the multiprocessor access method provided in any of the foregoing embodiments of this application.

[0093] The memory 401 may include high-speed random access memory (RAM) or non-volatile memory, such as at least one disk storage device. Communication between this system network element and at least one other network element is achieved through at least one communication interface 403 (which can be wired or wireless), such as the Internet, wide area network, local area network, or metropolitan area network.

[0094] Bus 402 can be an ISA bus, PCI bus, or EISA bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. Memory 401 is used to store programs. After receiving an execution instruction, the processor 400 executes the program. The multi-processor unit access method disclosed in any of the foregoing embodiments can be applied to the processor 400, or implemented by the processor 400.

[0095] The processor 400 may be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed by the integrated logic circuitry in the hardware of the processor 400 or by instructions in software form. The processor 400 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), an off-the-shelf programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules may reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The storage medium is located in memory 401. The processor 400 reads the information in memory 401 and, in conjunction with its hardware, completes the steps of the above method.

[0096] The computer device and the multiprocessing unit access method provided in the embodiments of this application are based on the same inventive concept and have the same beneficial effects as the methods they adopt, operate or implement.

[0097] This application also provides a computer-readable storage medium corresponding to the multi-processing unit access method provided in the foregoing embodiments. Please refer to... Figure 5 The computer-readable storage medium shown is an optical disc 30, on which a computer program (i.e., a program product) is stored. When the computer program is run by a processor, it executes the multiprocessor access method provided in any of the foregoing embodiments.

[0098] It should be noted that examples of the computer-readable storage medium may also include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other optical and magnetic storage media, which will not be elaborated here.

[0099] The computer-readable storage medium provided in the above embodiments of this application and the multiprocessing unit access method provided in the embodiments of this application are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented by the applications stored therein.

[0100] It should be noted that: Numerous specific details are set forth in the specification provided herein. However, it will be understood that embodiments of this application may be practiced without these specific details. In some instances, well-known structures and techniques have not been shown in detail so as not to obscure the understanding of this specification.

[0101] Similarly, it should be understood that, for the sake of brevity and to aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of this application, various features of this application are sometimes grouped together in a single embodiment, figure, or description thereof. However, this disclosure should not be construed as reflecting a schematic diagram in which the claimed application requires more features than expressly recited in each claim. Rather, as reflected in the following claims, inventive aspects lie in fewer than all features of a single foregoing disclosed embodiment. Therefore, the claims following the detailed description are hereby expressly incorporated into that detailed description, wherein each claim itself is a separate embodiment of this application.

[0102] Furthermore, those skilled in the art will understand that although some embodiments described herein include certain features but not others included in other embodiments, combinations of features from different embodiments are intended to be within the scope of this application and form different embodiments. For example, in the following claims, any of the claimed embodiments can be used in any combination.

[0103] The above description is merely a preferred embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for accessing multiple processing units, characterized in that, The method is applied to the main control unit of a multi-service firewall device, which includes the main control unit and multiple processing units with different processing capabilities. The main control unit includes a first physical serial port device and multiple virtual serial port devices. The first physical serial port device is used to connect to external terminal devices, and each virtual serial port device establishes a mapping relationship with the second physical serial port device of the corresponding processing unit. The method includes: The system receives an access command sent by the external terminal device via the first physical serial port device. The access command includes user operation data and the unit identifier of the target processing unit. Based on the multiple mapping relationships, a target virtual serial port device corresponding to the unit identifier is selected from the multiple virtual serial port devices, and the user operation data is forwarded to the second physical serial port device of the target processing unit through the target virtual serial port device. The system receives the response data returned by the target processing unit and transmits it back to the external terminal device via the first physical serial port device.

2. The method according to claim 1, characterized in that, Each of the multiple processing units deploys a serial port relay service process; forwarding the user operation data to the second physical serial port device of the target processing unit through the target virtual serial port device includes: The user operation data is encapsulated into inter-board protocol frames; Determine whether the operating system of the target processing unit is in the running stage; If the operating system is in the running phase, the inter-board protocol frame is sent to the serial port relay service process of the target processing unit via the inter-board communication link through the target virtual serial port device, so that the serial port relay service process of the target processing unit writes the decrypted user operation data into the second physical serial port device of the target processing unit.

3. The method according to claim 2, characterized in that, The method further includes: If the operating system is not in the running phase, the inter-board protocol frame is sent to the hardware relay circuit of the target processing unit via the backplane hardware link through the target virtual serial port device, so that the hardware relay circuit writes the decrypted user operation data into the second physical serial port device of the target processing unit.

4. The method according to claim 1 or 2, characterized in that, Based on multiple mapping relationships, the target virtual serial port device corresponding to the unit identifier is selected from the multiple virtual serial port devices, including: The access command is authenticated. After the access command authentication is successful, the user operation data is verified according to the preset access control policy to determine whether the external terminal device has access rights to the target processing unit. After the permission verification is passed, the target mapping relationship corresponding to the unit identifier is selected from the multiple mapping relationships: The target virtual serial port device is determined based on the target mapping relationship.

5. The method according to claim 2, characterized in that, The serial port relay service process that sends the inter-board protocol frame to the target processing unit includes: In the presence of multiple inter-board protocol frames, determine the frame type of each inter-board protocol frame; Based on the frame type of each inter-board protocol frame, each inter-board protocol frame is assigned to a corresponding priority queue in a multi-level queue structure, so as to perform differentiated priority scheduling of the multiple inter-board protocol frames through the multi-level queue structure; the multi-level queue structure includes multiple queues with decreasing priority.

6. The method according to claim 5, characterized in that, The multiple queues include a first priority queue, a second priority queue, a third priority queue, and a fourth priority queue, with priorities decreasing in order. The differentiated priority scheduling includes: If the frame type of the first inter-board protocol frame is a serial port flow control signal frame or an error report frame, then the first inter-board protocol frame is assigned to the first priority queue; the first inter-board protocol frame is any one of the plurality of inter-board protocol frames. If the priority of the second inter-board protocol frame being transmitted is lower than that of the first inter-board protocol frame when the first inter-board protocol frame is in the transmission queue, the transmission process of the second inter-board protocol frame is interrupted, the first inter-board protocol frame is inserted into the head of the transmission queue and transmitted, and the transmission of the second inter-board protocol frame is resumed after the first inter-board protocol frame has been transmitted.

7. The method according to claim 6, characterized in that, The differentiated priority scheduling also includes: If the frame type of the first inter-board protocol frame is a session establishment frame, a session closing frame, or an authorization verification frame, then the first inter-board protocol frame is allocated to the second priority queue; the inter-board protocol frames in the second priority queue have a preset proportion of bandwidth in the inter-board communication link; When the first inter-board protocol frame and the third inter-board protocol frame of the fourth priority queue are sent in parallel, the first inter-board protocol frame receives bandwidth allocation before the third inter-board protocol frame.

8. The method according to claim 6 or 7, characterized in that, The differentiated priority scheduling also includes: If the frame type of the first inter-board protocol frame is a heartbeat keep-alive frame, then the first inter-board protocol frame is allocated to the third priority queue, and the inter-board protocol frames in the third priority queue are sent by the timed triggering mechanism at the scheduling time. If the frame type of the first inter-board protocol frame is a data instruction frame, then the first inter-board protocol frame is allocated to the fourth priority queue. The fourth priority queue sends frames when all other priority queues are empty. If any other priority queue has a frame to be sent during the transmission process, the current transmission operation of the fourth priority queue is suspended and resumed after the other priority queues are cleared.

9. A multi-processing unit access system, characterized in that, The system is applied to the main control unit of a multi-service firewall device, which includes the main control unit and multiple processing units with different processing capabilities. The main control unit includes a first physical serial port device and multiple virtual serial port devices. The first physical serial port device is used to connect to external terminal devices, and each virtual serial port device establishes a mapping relationship with the second physical serial port device of its corresponding processing unit. The system includes: The access instruction receiving module is used to receive the access instruction sent by the external terminal device through the first physical serial port device. The access instruction includes user operation data and the unit identifier of the target processing unit. The data sending module is used to filter out the target virtual serial port device corresponding to the unit identifier from the plurality of virtual serial port devices according to the plurality of mapping relationships, and forward the user operation data to the second physical serial port device of the target processing unit through the target virtual serial port device. The response data feedback module is used to receive the response data returned by the target processing unit and transmit it back to the external terminal device via the first physical serial port device.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing the computer to perform the multiprocessor access method according to any one of claims 1 to 8.

Images