CN116737445B - Control method for realizing resource isolation by using pseudo container - Google Patents
Control method for realizing resource isolation by using pseudo container Download PDFInfo
- Publication number
- CN116737445B CN116737445B CN202311015888.1A CN202311015888A CN116737445B CN 116737445 B CN116737445 B CN 116737445B CN 202311015888 A CN202311015888 A CN 202311015888A CN 116737445 B CN116737445 B CN 116737445B
- Authority
- CN
- China
- Prior art keywords
- pseudo
- container
- pseudo container
- real
- control method
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 title claims abstract description 81
- 238000002955 isolation Methods 0.000 title claims abstract description 28
- 230000008569 process Effects 0.000 claims abstract description 61
- 230000036541 health Effects 0.000 claims abstract description 10
- 238000012544 monitoring process Methods 0.000 claims abstract description 10
- 230000005012 migration Effects 0.000 claims abstract description 9
- 238000013508 migration Methods 0.000 claims abstract description 9
- 230000002159 abnormal effect Effects 0.000 claims description 10
- 238000013024 troubleshooting Methods 0.000 claims description 4
- 230000005856 abnormality Effects 0.000 claims description 2
- 238000012545 processing Methods 0.000 description 6
- 238000004891 communication Methods 0.000 description 2
- 230000006870 function Effects 0.000 description 2
- 230000007547 defect Effects 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
- G06F11/079—Root cause analysis, i.e. error or fault diagnosis
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/604—Tools and structures for managing or administering access control systems
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/2141—Access rights, e.g. capability lists, access control lists, access tables, access matrices
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Health & Medical Sciences (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- Quality & Reliability (AREA)
- Biomedical Technology (AREA)
- Automation & Control Theory (AREA)
- Bioethics (AREA)
- General Health & Medical Sciences (AREA)
- Computer Hardware Design (AREA)
- Computer Security & Cryptography (AREA)
- Software Systems (AREA)
- Debugging And Monitoring (AREA)
Abstract
The invention provides a control method for realizing resource isolation by using a pseudo container, which comprises the following steps: 1) Configuring a pseudo container in an operating system; 2) Setting access rights of the pseudo container in an operating system; 3) Running a process packet of the DSP in the pseudo container; 4) After the pseudo container is started, the running state of the pseudo container is monitored in real time; 5) Judging whether a fault occurs according to the real-time health monitoring result; 6) Judging the type of the fault; 7) Determining a corresponding measure for removing the obstacle; by providing the corresponding pseudo container and setting the access authority of the pseudo container in the operating system, the resource isolation and authority control exceeding the process level can be realized on the DSP chip, and by providing the movable container package on the DSP chip, when the application on the DSP chip is determined to fail through real-time health monitoring, the DSP chip can have higher operation reliability and continuity through executing strategies such as fault migration and the like.
Description
Technical Field
The invention relates to the technical field of DSP chip processors, in particular to a control method for realizing resource isolation by using a pseudo container.
Background
The DSP chip emphasizes the real-time performance of digital signal processing, and the DSP chip can be used as a digital signal processing device to convert analog signals into digital signals, and is suitable for high-speed real-time processing of a special processor. The interface function of the interface has high speed, flexibility, programmability and low power consumption, and plays an increasingly important role in the communication fields of graphic image processing, voice processing, signal processing and the like.
With the increasing complexity of DSP application scenarios, it has been difficult to solve the requirement of more distributed scenarios for "software defined functions" in the traditional bare program running mode or operating system running mode. The existing operating system only can realize dynamic loading of application programs, but can not well solve the problems such as version dependence of a dynamic library, isolation of a file system and the like, and after the system has faults in the running process, the reliability of the system is guaranteed without means such as fault migration and the like. The concrete steps are as follows:
on the one hand, the prior art can only realize dynamic loading of applications on a DSP chip at most, but the authority of the applications to access resources cannot be controlled, and the problem of malicious resource access among the applications cannot be avoided.
On the other hand, in the prior art, when the application of the DSP chip fails, the whole environment (such as a configuration file, a shared library, etc.) on which the application of the DSP chip depends cannot be migrated, and the continuity of the service cannot be ensured.
Therefore, there is a need to provide a control method for realizing resource isolation by using a pseudo container, so as to solve the above-mentioned drawbacks and disadvantages of the prior art.
Disclosure of Invention
In order to solve the defects and shortcomings in the prior art, the invention provides a control method for realizing resource isolation by using a pseudo container.
The specific scheme provided by the invention is as follows:
a control method for realizing resource isolation by using a pseudo container is characterized in that: the method comprises the following steps:
1) Configuring a pseudo container in an operating system;
2) Setting access rights of the pseudo container in an operating system;
3) Running a process packet of the DSP in the pseudo container;
4) After the pseudo container is started, the running state of the pseudo container is monitored in real time;
5) Judging whether a fault occurs according to the real-time health monitoring result;
6) Judging the type of the fault;
7) And determining a corresponding measure for removing the obstacle.
As a further preferred embodiment of the present invention, in the step 1), the dummy container is configured in the operating system by means of a container mirroring package.
As a further preferred embodiment of the present invention, in the step 2), the access right of the pseudo container is set to: the current pseudo container is isolated from other pseudo containers in terms of resources so that the current pseudo container cannot access the resources inside the other pseudo containers.
As a further preferred embodiment of the present invention, the isolated resources include at least: kernel objects, file systems, device files, and shell commands.
As a further preferred embodiment of the present invention, in the step 4), the real-time health monitoring items include at least: the real-time occupancy rate of the process running in the pseudo container to the CPU, the real-time occupancy of the process running in the pseudo container to the memory, and the running state of the current process.
As a further preferred embodiment of the present invention, in the step 5), when any one of the following determination conditions is satisfied, it is determined that a failure has occurred:
the real-time occupancy rate of the process running in the pseudo container to the CPU exceeds the preset occupancy rate; or (b)
The real-time occupied memory of the process running in the pseudo container exceeds the preset maximum value; or (b)
The running state of the current process is a stopped state.
As a further preferred embodiment of the present invention, in the step 6), the types of faults include at least:
unauthorized access to the resource; and
the process is abnormal.
As a further preferred embodiment of the present invention, the type of the fault is that when there is an abnormality in the process, at least one of the following processes occurs in the process:
the process accesses the memory without access rights; or (b)
The process performs 0 removal operation; or (b)
The process itself enters an abnormal business process.
As a further preferred embodiment of the present invention, in the step 7), the corresponding measure for removing the obstacle at least includes:
for faults of unauthorized access to resources, the corresponding measure of troubleshooting is as follows: performing resource isolation and prompting that no operation authority exists;
for the abnormal faults of the process, the corresponding fault removal actions are as follows: restarting the corresponding pseudo container process through fault migration.
As a further preferred embodiment of the present invention, the fault migration comprises the steps of:
7.1 Confirming that a node having a plurality of runnable pseudo containers is in an available state;
7.2 A pseudo container is configured on one of the nodes;
7.3 When a false container fails on that node, deploying the failed false container image to another available node;
7.4 A pseudo container is started on the newly available node and services continue to be provided to the outside.
Compared with the prior art, the invention has the following technical effects:
1) The invention provides a control method for realizing resource isolation by using a pseudo container, which can realize the resource isolation and the authority control exceeding the process level on a DSP chip by providing a corresponding pseudo container and setting the access authority of the pseudo container in an operating system.
2) The invention provides a control method for realizing resource isolation by using a pseudo container, which is characterized in that a mobilizable container mirror package is provided on a DSP chip, and when the application on the DSP chip is determined to have faults through real-time health monitoring, the DSP chip can be applied to more complex application scenes by executing strategies such as fault migration and the like, and has higher operation reliability and continuity.
Drawings
A flowchart of the steps of the present invention is shown in fig. 1.
Detailed Description
The following description of the embodiments of the present invention will be made clearly and completely with reference to the accompanying drawings, in which it is apparent that the embodiments described are only some embodiments of the present invention, but not all embodiments. All other embodiments, which can be made by those skilled in the art based on the embodiments of the invention without making any inventive effort, are intended to be within the scope of the invention.
In the description of the present invention, it should be noted that the directions or positional relationships indicated by the terms "upper", "lower", "inner", "outer", "front", "rear", "both ends", "one end", "the other end", etc. are based on the directions or positional relationships shown in the drawings, are merely for convenience of describing the present invention and simplifying the description, and do not indicate or imply that the devices or elements referred to must have a specific direction, be configured and operated in the specific direction, and thus should not be construed as limiting the present invention. Furthermore, the terms "first," "second," and the like, are used for descriptive purposes only and are not to be construed as indicating or implying relative importance.
In the description of the present invention, it should be noted that, unless explicitly specified and limited otherwise, the terms "mounted," "provided," "connected," and the like are to be construed broadly, and may be fixedly connected, detachably connected, or integrally connected, for example; can be mechanically or electrically connected; can be directly connected or indirectly connected through an intermediate medium, and can be communication between two elements. The specific meaning of the above terms in the present invention will be understood in specific cases by those of ordinary skill in the art.
First embodiment
As shown in fig. 1, a first embodiment of the present invention provides a control method for implementing resource isolation by using a pseudo container, including the following steps:
1) Configuring a pseudo container in an operating system; for example, the pseudo container may be configured in the operating system by means of a container mirror package, and the pseudo container may be installed and packaged in the container mirror package, and the container mirror package may package processes, shared libraries, configuration files, and the like on the DSP chip.
2) Setting access rights of the pseudo container in an operating system; in the present embodiment, the access right of the pseudo container is set as: the current pseudo container and other pseudo containers are subjected to resource isolation, so that the current pseudo container cannot access resources in other pseudo containers, malicious resource access and other conditions among applications can be effectively avoided, meanwhile, a person skilled in the art knows that the access authority of the pseudo container can be set to be in other resource isolation modes in an operating system, for example, the current pseudo container cannot have the authority of accessing the resources in other pseudo containers or the like in a preset time period or at a preset moment, different resource isolation requirements are met, and therefore the resource isolation beyond a process level and authority control are realized on a DSP chip.
In this embodiment, the isolated resources include at least: kernel objects, file systems, device files, shell commands, etc.; wherein the kernel object contains information such as semaphores, message queues, etc.; the file system refers to an independent root file system owned by each pseudo container; the device file refers to the detailed permission judgment limit of the accessible devices and files in the pseudo container; the shell command refers to an independent shell terminal provided in the pseudo container, and corresponding restrictions and the like of the shell command which can be supported in the terminal.
3) Running a process packet of the DSP in the pseudo container; and corresponding fault judgment is carried out through knowing the process package of the DSP.
4) After the pseudo container is started, the running state of the pseudo container is monitored in real time; the real-time health monitoring project at least comprises: the real-time occupancy rate of the process running in the pseudo container to the CPU, the real-time occupancy of the process running in the pseudo container to the memory, and the running state of the current process. The CPU occupancy rate ranges from 0% to 100%, and a person skilled in the art can set the CPU preset occupancy rate according to actual use requirements, so that the real-time occupancy rate of a process running in the pseudo container to the CPU does not exceed the CPU preset occupancy rate, and the high-efficiency safety and stability of the CPU work during the process running are ensured; similarly, the occupied memory is also provided with a preset maximum value, and a person skilled in the art can define and adjust the preset maximum value according to actual use requirements, so that the real-time occupied memory of the CPU by the process running in the pseudo container does not exceed the preset maximum value of the CPU, and when the real-time occupied memory exceeds the preset occupancy rate and the preset maximum value of the CPU, the corresponding warning can be controlled to be sent to prompt a user.
5) Judging whether a fault occurs according to the real-time health monitoring result; when any one of the following judging conditions is met, judging that the fault occurs:
the real-time occupancy rate of the process running in the pseudo container to the CPU exceeds the preset occupancy rate; or (b)
The real-time occupied memory of the process running in the pseudo container exceeds the preset maximum value; or (b)
The running state of the current process is a stopped state.
6) Judging the type of the fault; on the basis of determining that the fault has occurred, further determining the type of the fault at least comprises: unauthorized access to resources and processes is abnormal.
Wherein, the failure of unauthorized access resource may be that the kernel object is unauthorized access, and some kernel objects without authority are operated, such as resources like semaphores, etc.; it is also possible that files and devices are unauthorized to be accessed, e.g. in an attempt to open some devices or files that are not authorized to be accessed, etc.
When there is an abnormal fault in the process, it may be that at least one of the following processes occurs in the process: the process accesses the memory without access rights; or the process performs a divide by 0 operation; or the process itself enters an abnormal business process, etc.
7) And determining a corresponding measure for removing the obstacle, and determining the corresponding measure for removing the obstacle after determining the corresponding fault type.
In the present embodiment of the present invention, in the present embodiment,
for faults of unauthorized access to resources, the corresponding measure of troubleshooting is as follows: performing resource isolation and prompting that no operation authority exists;
for the abnormal faults of the process, the corresponding fault removal actions are as follows: restarting the corresponding pseudo container process through fault migration; in this embodiment, the fault migration includes the following steps:
7.1 Confirming that a node having a plurality of runnable pseudo containers is in an available state; nodes in the available state are the preconditions on which to configure pseudo-containers through container mirroring packages;
7.2 A pseudo container is configured on one of the nodes;
7.3 When a false container fails on that node, deploying the failed false container image to another available node;
7.4 The pseudo container is started on the newly available node, and the external service is continuously provided, so that the DSP chip can be applied to more complex application scenes and has higher operation reliability and continuity.
As a further preferable mode of this embodiment, a corresponding software management platform may be provided, and operations such as configuration of the pseudo container, access authority setting, real-time health monitoring, judging whether a fault occurs, judging a fault type, and corresponding troubleshooting measures may be performed through the software management platform.
It will be evident to those skilled in the art that the invention is not limited to the details of the foregoing illustrative embodiments, and that the present invention may be embodied in other specific forms without departing from the spirit or essential characteristics thereof. The present embodiments are, therefore, to be considered in all respects as illustrative and not restrictive, the scope of the invention being indicated by the appended claims rather than by the foregoing description, and all changes which come within the meaning and range of equivalency of the claims are therefore intended to be embraced therein. Any reference sign in a claim should not be construed as limiting the claim concerned.
Claims (8)
1. A control method for realizing resource isolation by using a pseudo container is characterized in that: the method comprises the following steps:
1) Configuring a pseudo container in an operating system;
2) Setting access rights of the pseudo container in an operating system;
3) Running a process packet of the DSP in the pseudo container;
4) After the pseudo container is started, the running state of the pseudo container is monitored in real time;
5) Judging whether a fault occurs according to the real-time health monitoring result;
6) Judging the type of the fault;
7) Determining a corresponding measure for removing the obstacle;
in the step 7), the corresponding measure for removing the obstacle at least comprises:
for faults of unauthorized access to resources, the corresponding measure of troubleshooting is as follows: performing resource isolation and prompting that no operation authority exists;
for the abnormal faults of the process, the corresponding fault removal actions are as follows: restarting the corresponding pseudo container process through fault migration;
the fault migration comprises the following steps:
7.1 Confirming that a node having a plurality of runnable pseudo containers is in an available state;
7.2 A pseudo container is configured on one of the nodes;
7.3 When a false container fails on that node, deploying the failed false container image to another available node;
7.4 A pseudo container is started on the newly available node and services continue to be provided to the outside.
2. The control method for realizing resource isolation by using a pseudo container according to claim 1, wherein: in the step 1), the pseudo container is configured in the operating system in a container mirror package mode.
3. The control method for realizing resource isolation by using a pseudo container according to claim 1, wherein: in the step 2), the access authority of the pseudo container is set as follows: the current pseudo container is isolated from other pseudo containers in terms of resources so that the current pseudo container cannot access the resources inside the other pseudo containers.
4. A control method for implementing resource isolation using pseudo-containers according to claim 3, characterized in that: the isolated resources include at least: kernel objects, file systems, device files, and shell commands.
5. The control method for realizing resource isolation by using a pseudo container according to claim 1, wherein: in the step 4), the real-time health monitoring items at least include: the real-time occupancy rate of the process running in the pseudo container to the CPU, the real-time occupancy of the process running in the pseudo container to the memory, and the running state of the current process.
6. The control method for realizing resource isolation by using a pseudo container according to claim 1, wherein: in the step 5), when any one of the following determination conditions is satisfied, it is determined that a failure has occurred:
the real-time occupancy rate of the process running in the pseudo container to the CPU exceeds the preset occupancy rate; or (b)
The real-time occupied memory of the process running in the pseudo container exceeds the preset maximum value; or (b)
The running state of the current process is a stopped state.
7. The control method for realizing resource isolation by using a pseudo container according to claim 1, wherein: in the step 6), the types of faults at least include:
unauthorized access to the resource; and
the process is abnormal.
8. The control method for realizing resource isolation by using a pseudo container according to claim 7, wherein: the type of the fault is that when the process has abnormality, the process generates at least one of the following processes:
the process accesses the memory without access rights; or (b)
The process performs 0 removal operation; or (b)
The process itself enters an abnormal business process.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202311015888.1A CN116737445B (en) | 2023-08-14 | 2023-08-14 | Control method for realizing resource isolation by using pseudo container |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202311015888.1A CN116737445B (en) | 2023-08-14 | 2023-08-14 | Control method for realizing resource isolation by using pseudo container |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN116737445A CN116737445A (en) | 2023-09-12 |
| CN116737445B true CN116737445B (en) | 2023-10-27 |
Family
ID=87906438
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202311015888.1A Active CN116737445B (en) | 2023-08-14 | 2023-08-14 | Control method for realizing resource isolation by using pseudo container |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN116737445B (en) |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JPH0989805A (en) * | 1995-09-26 | 1997-04-04 | Sapporo Breweries Ltd | Device for inspecting container with self-diagnostic function |
| CN113037538A (en) * | 2017-04-19 | 2021-06-25 | 华为技术有限公司 | System and method for local scheduling of low-delay nodes in distributed resource management |
| WO2023103992A1 (en) * | 2021-12-07 | 2023-06-15 | 中兴通讯股份有限公司 | Container operation method and apparatus, electronic device, and storage medium |
| WO2023133990A1 (en) * | 2022-01-13 | 2023-07-20 | 南京翼辉信息技术有限公司 | Design method for implementing lightweight secure container on the basis of embedded real-time operating system |
Family Cites Families (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20110231011A1 (en) * | 2010-03-21 | 2011-09-22 | Brenda Bagavathi Powers | Distributed system of electronically controlled and monitored containment systems for the management and handling of solid and liquid material. |
| EP3206335B1 (en) * | 2014-11-03 | 2020-01-08 | Huawei Technologies Co. Ltd. | Virtual network function instance migration method, device and system |
| US9921885B2 (en) * | 2015-06-19 | 2018-03-20 | Vmware, Inc. | Resource management for containers in a virtualized environment |
-
2023
- 2023-08-14 CN CN202311015888.1A patent/CN116737445B/en active Active
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JPH0989805A (en) * | 1995-09-26 | 1997-04-04 | Sapporo Breweries Ltd | Device for inspecting container with self-diagnostic function |
| CN113037538A (en) * | 2017-04-19 | 2021-06-25 | 华为技术有限公司 | System and method for local scheduling of low-delay nodes in distributed resource management |
| WO2023103992A1 (en) * | 2021-12-07 | 2023-06-15 | 中兴通讯股份有限公司 | Container operation method and apparatus, electronic device, and storage medium |
| WO2023133990A1 (en) * | 2022-01-13 | 2023-07-20 | 南京翼辉信息技术有限公司 | Design method for implementing lightweight secure container on the basis of embedded real-time operating system |
Also Published As
| Publication number | Publication date |
|---|---|
| CN116737445A (en) | 2023-09-12 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110740072B (en) | Fault detection method, device and related equipment | |
| CN111709023B (en) | Application isolation method and system based on trusted operating system | |
| EP3761595A1 (en) | A method and a device comprising an edge cloud agent for providing a service | |
| CN109254777B (en) | Multi-channel multi-waveform deployment method based on software communication architecture | |
| CN108268305A (en) | For the system and method for virtual machine scalable appearance automatically | |
| CN110505220A (en) | Support the method, apparatus and communication terminal of the two-node cluster hot backup of OPC protocol realization | |
| CN112069511B (en) | Data protection method, device, electronic control unit, equipment and storage medium | |
| JP2005124204A (en) | Network monitoring method and system | |
| CN110730095B (en) | Cloud computing platform-oriented data security emergency drilling method and system | |
| CN116737445B (en) | Control method for realizing resource isolation by using pseudo container | |
| EP3680780B1 (en) | Cluster system, control method, and corresponding computer program | |
| CN115879409B (en) | Verification method, verification device, medium and electronic equipment | |
| CN105187482B (en) | A kind of method and message server of the realization of PaaS platform fault self-recovery | |
| CN106330595B (en) | Heartbeat detection method and device for distributed platform | |
| CN111934909B (en) | Main-standby machine IP resource switching method, device, computer equipment and storage medium | |
| CN113873041A (en) | Message transmission method, device, network equipment and computer readable storage medium | |
| CN114679295A (en) | Firewall security configuration method and device | |
| CN111400079B (en) | Isolator, and software resetting method, device and storage medium applicable to isolator | |
| CN113271235B (en) | Fuzzy test method and device for network traffic, storage medium and processor | |
| CN113326159B (en) | Method, apparatus, system and computer readable storage medium for fault injection | |
| CN111506441B (en) | Method, device, equipment and storage medium for monitoring Raid card information | |
| US20240159812A1 (en) | Method for monitoring in a distributed system | |
| CN114225384B (en) | Communication method, system, equipment and storage medium based on combinable GM instruction | |
| CN110955210B (en) | AGV scheduling method, device and system | |
| CN114401302B (en) | Linkage action execution method, linkage action execution device and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |