JPH10171669A - Computer resource access method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To shorten the time when the overhead caused by the conversion between an identifier and an address and a resource access occurring at the end of a process are inhibited with an access right control function kept as it is by controlling the access right based on only the comparison result of the generation identification information. SOLUTION: The component elements concerning the access right control include an identifier 600, a resource generation frequency counter 603, the generation identification information 605 and the resources 608. Then head 32 bits of the identifier 600 which are received as the arguments of the system calls issued by a user application are extracted and used as a resource address 601, and latter 32 bits of the identifier 600 are extracted as the generation identification information 602. Then 32 bits are read out of the head of resources based on the address 601 and used as the generation identification information 609 (read mem). The information 601 and 609 are compared with each other. If no coincidence is confirmed between both information, no access is given to the resources and an error is returned. If the coincidence is confirmed between both information, the resources are accessed.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

The present invention relates to a method for accessing computer resources in an operating system.

[0002]

2. Description of the Related Art An operating system which provides a multi-process function has a function of protecting resources allocated to a certain process from unauthorized access by another process (access right control function). The access right control described here is a control on the assumption that access rights can be set for each process and that there is simultaneous access from a plurality of processes, similarly to the access right control for a file. A system call is an interface for calling a function of the operating system from a user application. For example, if a pointer is used as an argument of this system call, an application specifies an invalid address and an important address in the operating system can be specified. There is a risk that important data may be destroyed.
To avoid this, using an identifier instead of a pointer as an argument is an example of access right control.

In the access right control method using an identifier as an argument of a system call issued by a user application, when accessing a resource, it is necessary to convert the identifier into an address of the resource inside the operating system. The simplest conversion method is a method using a hash function.

The method using a hash function is a method in which an identifier is assigned to a hash function as a key, and the obtained hash value is used as an address.

[0005] An access right control method using a hash function will be described below.

§1. Configuration As shown in FIG. 1, the operating system assigns the identifier RID to the hash function F101 as a key, and assigns the hash value to the In function in the resource management data table 104 as the hash value.
Obtain dex102. The resource management data 105 includes an identifier, a pointer to the resource 103, and the second resource management data 1
06, a pointer to the resource management data 106, and a pointer to the process management data 107, thereby obtaining the resource address.

[0007] The hash function may return the same Index for different identifiers RID, causing a collision of Index.
In this case, the second and subsequent resource management data 106 are stored in the overflow area, and the address of the resource management data 106 is stored in the immediately preceding resource management data 105.

If the resource is a shared resource, the same identifier RI
There are multiple processes that have access to D. In that case, the second and subsequent process identifier data 10
8 is stored in the previous process identifier data 107. FIG. 2 shows resource management data 200 and process management data 206. At the end of the user application, it is necessary to know the identifier of the resource to which the process has access in order to release the resources used by the process. Therefore, the operating system has a process-specific identifier list 109 for the process, and registers the identifier 110 in the identifier list 09 at the time of resource creation and when the access right to the shared resource is obtained.

§2. Resource Generation Processing FIG. 3 shows a flowchart of the resource generation processing.

When a system call for a resource allocation request is issued from the user application to the operating system, the operating system:
A resource is allocated (step 300), a unique identifier RIDx is acquired in the system (step 301), and the identifier RIDx is input to the hash function as a key, and the resource is an address for storing “resource management data x”. An index in the management data table is obtained (step 302). “Resource management data y” already exists at the beginning of the area specified by Index, that is, when a collision of Index occurs (step 303), “Flag of presence / absence of next identifier management data” becomes
The pointer is repeatedly traced (step 305) while it is ON indicating that the next “identifier management data” is present (step 304). By following the pointer and finding the "resource management data z" in which the "next identifier management data presence / absence flag" is OFF, the "next identifier management data presence / absence flag" is turned ON (step 306) and a new An area for "resource management data x" is allocated to the overflow area (step 307), and the address of "resource management data x" is stored in "pointer of next resource management data" in "resource management data y" (step 307). Step 30
8).

If the next "identifier management data" is not stored in (step 303), an area of "resource management data x" is allocated to the main area (step 309).

"Process management data" is allocated to the process management area, and the process identifier is stored (step 3).
10). At the same time, the identifier is added to the process-specific identifier list.
Register RIDx (step 311). Store the respective values in the identifier RIDx, the "process management data pointer", and the "resource pointer" in the allocated "resource management data x", and turn off the "next resource management data presence / absence flag".
(Step 312), and returns the identifier RIDx to the user application (step 313). §3. Resource Access Processing When the user application issues a resource access request system call to the operating system, the processing performed by the operating system is shown in FIG.
Shown in

The operating system substitutes the identifier RIDx, which is an argument of the system call, for the hash function to obtain the index of "resource management data" (step 40).
0). The identifier RID in the “resource management data” at the position of the index is compared with the argument RIDx (step 401), and the values are different, and the “next resource management data presence / absence flag” in the “resource management data” is ON. , Next "resource management data"
If there is (step 402), the "pointer of the next resource management data" is traced (step 403), and the identifiers are compared again (step 401). If the identifier RID and the argument RIDx in all the "resource management data" traced by the pointer do not match, it is regarded that the requested resource does not exist and an error is returned to the user application (step 404). If the identifier RID in the "resource management data" matches the argument RIDx in step 401, the process identifier PIDx of the process performing the resource access is compared with the process identifier PID in the "process management data" (step 405). . If the values are different in step 405, the "next process management data presence / absence flag" in the "process management data" is ON, that is, if there is the next "process management data" (step 406), the "next process management data" Following the "data pointer" (step 407), the process identifier is compared again (step 405). If the process identifier PID and the argument PIDx in all the “process management data” that can be traced by the pointer do not match, it is assumed that there is no access right to the resource, and an error is returned to the user application (step 40).
8).

In step 405, if the process identifiers match, the resource is accessed using the resource address stored in the "resource pointer" in the "resource management data" (step 409).

§4. Resource release processing When a user application issues a resource release request system call to the operating system, or when the release of a resource is required due to an abnormal termination of the process, The following processing shown in FIG. 5 is performed on resources corresponding to all identifiers in the identifier list. operating·
The system prohibits access to all resources (step 500), and uses the identifier RIDx of the released resource as a key.
The index of the “resource management data” is obtained by substituting into the hash function (step 501). The identifier RID and the identifier RIDx in the “resource management data” in the area indicated by the Index are compared (step 502), and the values are different, and the “next resource management data presence / absence flag” is ON, ie, the next “resource management data” Is found (step 503), the "pointer of the next resource management data" is traced (step 504), and the identifiers are compared again (step 502). Identifier RID and identifier RID in all "resource management data" traceable by pointer
If x does not match, it is assumed that the requested resource does not exist and an error is returned to the user application (step 505).

If the identifiers match in step 502, the address of the "process management data" stored in the "pointer of the process management data" is obtained (step 506), and if there is the next "resource management data", ,
After the connection of the "resource management data pointer" is changed (step 508), the "resource management data" of the identifier RIDx is changed.
Is released (step 509). Next, step 5
Follow the pointer acquired in step 06, and turn on the flag for the presence or absence of the next process management data in the process management data.
If it is (step 510), a "pointer of the next process management data" is obtained (step 511), and a notification that the "process management data" is released and that the identifier RID is no longer usable is sent to the user application. hand,
That is, the process is performed for each process (step 512). In step 510, if the "next process management data presence / absence flag" is OFF, the last "process management data" is released, and a notification that the identifier RID cannot be used is sent to the user application (step 510). 5
13) Restart access to all resources.

In this method, at the time of resource access,
Even if an invalid identifier RIDz is substituted into the hash function as a key and an Index in the resource management data table is obtained, the invalid identifier RIDz as a key is not stored in the `` resource management data '' traceable from the Index. Therefore, the address of the resource cannot be obtained and the access cannot be performed. Even if the invalid identifier RIDz is stored in the "resource management data" that can be traced by Index, the process identifier of the accessing process is not stored in the "process management data". Cannot be obtained, and unauthorized access can be prohibited.

At the time of resource release, the user
By prohibiting all application access, protect resources during resource release processing, invalidate identifiers,
By releasing "resource management data" and "process management data" traceable from x and notifying the process of resource release, illegal access prohibition after resource release is realized.

[0019]

In the above-described method of accessing a resource by substituting an identifier into a hash function as a key and obtaining an index of resource management data storing an address of the resource, access right control is possible. However, there are the following drawbacks in processing that performs real-time processing, allocates CPU time at regular intervals, or requires high-speed processing of large amounts of data, such as multimedia data processing.

(1) When a plurality of processes simultaneously access one data, a hash value collision occurs in the access method using the hash function, and it is necessary to follow the pointer in the overflow area until the identifier of the desired resource is found. There is.

When the identifier is found, it is necessary to follow the pointer in the process management data until the process identifier is found in order to check whether the process trying to access has the access right. For this reason, there are cases where the processing overhead is large and the memory access time is too long, so that the data cannot be reproduced.

(2) When a user application releases a resource, the operating system must follow all process management data pointers in order to obtain the process identifier of the process using the resource. . Then, it is necessary to release all the found process management data and notify each process that the resources cannot be used. During this search and the following processing, access to all resources from the user application is prohibited. Real-time processing cannot be realized because the overhead time of the search for the process sharing the processing resource and the subsequent release processing affects the CPU allocation time of the process requiring the real-time processing.

An object of the present invention is to provide an access method for reducing the overhead associated with the conversion of an identifier and an address and the resource access prohibition state time generated at the time of process termination processing while maintaining the access right control function of the conventional method. It is to propose.

[0024]

In order to solve the above-mentioned problems, at the time of resource generation, an identifier composed of resource address information and generation identification information is assigned to the resource. The above-mentioned generation identification information is stored, and at the time of resource access, the generation identification information is extracted from the identifier passed as an argument of the system call issued by the user application, and this is compared with the generation identification information stored at the head of the resource. Then, when both generation identification information match, access to the resource is permitted, and when both generation identification information do not match, access is prohibited. The access right is controlled only by comparing the generation identification information.

[0025]

DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, §1. To §2. Figure 6 ~
The first embodiment of the present invention will be described with reference to FIG. Next, the second and third embodiments will be described.

§1. Configuration Main components relating to access right control will be described with reference to FIG. FIG. 6 shows an identifier 600 and a resource generation counter 6.
03, generation identification information 605, and resources 608.

The identifier 600 is a 64-bit argument of a system call issued by a user application for use in accessing resources. The first 32 bits are the first address 601 of the resource 608, and the second 32 bits are the generation identification information 602 of 605. Identifier 600
Are created when a resource is created, and are used to access the resource until the resource is released.

The resource generation number counter 603 is a counter for creating one for each process at the time of process generation and recording the resource generation number. As the counter value 604 of the resource generation counter, 0 is input as an initial value, and 1
To increase.

In the generation identification information 605, the top 16 bits are the counter value 606 of the resource generation counter, and the latter 16 bits
It is composed of a process identifier 607.

Hereinafter, a resource in which the generation identification information 609 is stored at the head of the resource is referred to as a resource 608.

§2. Outline of User Application Resource Access Processing FIG. 7 shows a flowchart of a program flow of the resource access processing of the present method.

(1) The user application issues a system call for process creation processing to the operating system, and the operating system creates a resource creation counter 603 for the created process (step 700).

(2) The user application issues a system call for resource generation processing to the operating system (step 701).

(3) If the user application is (2)
Issues a system call for access processing to the resources allocated in step (70) to the operating system.
2).

(4) The user application
A system call for releasing resources allocated in (2) is issued to the operating system (step 70).
3).

The processing of each system call will be described in detail below.

§2.1. Resource Generation Processing FIG. 8 shows a flowchart of the resource generation processing (step 701). The resource generation counter is incremented by one (step 800), and generation identification information is created (make)
-Idinf) (step 801), resource area allocation (alloc_mem) (step 802), identifier creation (make-id) (step 803), and generation identification information stored in the first 32 bits of the returned resource area (step 801) 804).

§2.1.1. Resource area reservation (make
-Idinf) Process FIG. 9 shows a flowchart of the make_idinf process (step 801). The generation identification information is created based on a pair of a resource generation counter value and a process ID of a process that performs resource generation. Acquire the process ID (step 90
0), 32-bit generation identification information including the resource generation count counter value in the first 16 bits and the random number generated in the second 16 bits is created (step 901). The created generation identification information is returned (step 902).

§2.1.2. Allocate resource area (all
c_mem) Process FIG. 10 shows a flowchart of the alloc_mem process (step 802). Since the resource area is composed of the generation identification information area and the resource area, the generation identification information data size 3
The resource area size obtained by adding 2 bits is obtained (Step 1)
000). Secure an area with the obtained size (step 10
01), and returns the start address of the area (step 100)
2).

§2.1.3. Identifier creation (make_i
d) Process FIG. 11 shows a flowchart of the make_id process (step 803). An identifier is created by a pair of a resource address and generation identification information. Alloc in the first 32 bits
The address of the resource secured in the _mem process (step 802) and the generation identification information created in the make_idinf process (step 801) are entered in the latter 32 bits.
A 64-bit identifier is created (step 1100).
The created identifier is returned as an argument for accessing the resource (step 1101).

§2.2. Resource Access Process FIG. 12 shows a flowchart of the resource access process (step 702). First 3 of the identifier passed as an argument of the system call issued by the user application
Take out 2 bits and use it as resource address
t is taken out as generation identification information S1 (step 12
00). Next, based on the resource address, 32
The bit is read and set as S2 (read_mem) (step 1201), and the extracted generation identification information S1 and S2
Are compared (step 702), and if they do not match, the resource is not accessed and an error is returned (step 120).
3). If the comparison results match, a resource access process (step 1204) is performed.

§2.3. Resource Release Processing In the resource release processing (step 703), as in the resource access processing (step 702), the first 32 bits of the identifier passed as an argument of the system call issued by the user application are taken out as a resource address. The latter 32 bits are extracted and used as generation identification information S1 (step 700). Next, 32 bits from the top of the resource
Is read and set as S2 (read_mem) (step 1201), and the extracted generation identification information S1 and S2 are compared (step 1202). If they do not match, an error is returned without releasing the resources. If the comparison result matches, the resource is released.

With the above method, the following can be realized.

(1) § 2.2. As shown in the resource access processing, since the address to the resource is included in the identifier which is the argument of the system call issued from the user application to the operating system, the hash function for converting the identifier and the address is used instead. In addition, by accessing the resource using the address in the identifier, it is possible to reduce the overhead when the hash function is used.

(2) Process A and process B are resources X
Considering the case where the process A issues a system call that releases the resource X, in the conventional method, the operating system obtains the Index obtained by using the hash function.
And retrieves an identifier in the resource management data, obtains the address of the resource, and releases the resource. Further, another process sharing the resource X is searched to release all found process management data and to notify that the resource X is invalid. During that time, the operating system has barred all access to resources from user applications. In this method, since the address in the identifier of the resource X to be released is included, the resource address can be obtained and released without following the pointer to obtain the resource address. Also,§
2.3. As shown in (1), the operating system performs access right control only by comparing the generation identification information S1 in the identifier assigned to the resource X with the generation identification information S2 stored at the top of the resource X. The system only releases resource X.

As a result, the resource access prohibition state during the process termination processing can be reduced to only the release processing time of the resource X.

(3) When the process C generates the resource Y and allocates the resource Y to the address to which the resource X has been allocated in the state where the resource X is released, the operating system allocates the resource X. Since the process B is not notified of the release, the process B may try to access the resource Y based on the address information in the identifier of the process B. However, since the identifier includes not only the address information but also the generation identification information, and the generation identification information of the identifier assigned to the resource X is different from that of the identifier assigned to the resource Y, access to the resource using the identifier of the process B is performed. Can not access the resource Y. As a result, as in the conventional method, unauthorized access prohibition can be realized.

§3. Embodiments of the Second and Third Methods of the Present Invention Embodiments other than the first method of the present invention using the number of resource generations as generation identification information are described below. §3.1. Embodiment of the second method of the present invention At the time of system startup, a 32-bit system clock that holds the time from startup in units of 10 microseconds is created.

At the time of resource generation, the value of the system clock is taken out as generation identification information, and the generation identification information is stored at the head of the resource. A 64-bit identifier is created with the resource address in the upper 32 bits and the generation identification information in the lower 32 bits.

At the time of resource access, the generation identification information is extracted from the identifier passed as an argument of the system call from the user application to the operating system, and is compared with the generation identification information stored at the head of the resource. Gives access to resources. If they do not match, the resource is not accessed and an error is returned.

§3.2. Embodiment of the third method of the present invention At the time of system startup, a 32-bit counter for recording only the number of resource generations in the system is created, 0 is input as an initial value of the counter, and the counter value is used as generation identification information. And

At the time of resource generation, the generation identification information is incremented by one,
The generation identification information is stored at the head of the resource. A 64-bit identifier is created with the resource address in the upper 32 bits and the generation identification information in the lower 32 bits.

At the time of resource access, the above-described §
3.1. The same process is performed at the time of resource access.

[0054]

As described above, according to the present invention, the overhead involved in the conversion of addresses and identifiers and the search for checking the presence or absence of an access right, the access performance is improved, and the resources generated at the end of the process are reduced. This has the effect of protecting resources from resource destruction due to unauthorized access to resources from a process that does not have access to the resources.

[Brief description of the drawings]

FIG. 1 is a diagram showing a main configuration related to access right control in a conventional method.

FIG. 2 is a diagram showing resource management data and process management data.

FIG. 3 is a flowchart showing an outline of a resource allocation process according to a conventional method.

FIG. 4 is a flowchart showing an outline of a resource access process according to a conventional method.

FIG. 5 is a flowchart showing an outline of a resource release process according to a conventional method.

FIG. 6 is a diagram showing main components related to access right control.

FIG. 7 is a flowchart showing an outline of a resource access process.

FIG. 8 is a flowchart showing a resource allocation process.

FIG. 9: Generation identification information creation (make_idinf)
5 is a flowchart showing processing.

FIG. 10 is a flowchart showing a resource area securing (alloc_mem) process.

FIG. 11 is a flowchart showing an identifier creation (make_id) process;

FIG. 12 is a flowchart showing a resource access process.

[Explanation of symbols]

100 resource identifier, 101 hash function, 102 resource management data Index, 103 resource, 104 resource management data table, 105 resource management data, 106 second resource management data, 107 process management data, 108 ... second process management data, 109 ... resource list, 110, 111 ... identifier, 200
... Resource management data, 201 ... Identifier, 202 ... Next identification stomach presence / absence flag, 203 ... Next identifier pointer, 204 ... Process management data pointer, 205 ... Resource pointer, 206 ... Process management data, 207 ... Process Identifier, 208: next process identifier presence / absence flag, 209: next process identifier pointer, 600 ... identifier, 601 ... resource address, 602 ...
Generation identification information, 603: Resource generation counter, 604: Counter value, 605: Generation identification information, 606: Counter value, 607:
Process identifier, 608 ... resource, 609 ... generation identification information

 ──────────────────────────────────────────────────続 き Continuing from the front page (72) Inventor Kazuto Serizawa 1099 Ozenji Temple, Aso-ku, Kawasaki-shi, Kanagawa Prefecture, Hitachi, Ltd.

Claims (3)

[Claims] In an operating system, when a resource is generated, an identifier composed of address information and generation identification information of the resource is assigned to the resource, and at the same time, the generation identification information is stored at the head of the resource. At the time of resource access, the generation identification information is extracted from the identifier passed as an argument of the system call issued by the user application, and this is compared with the generation identification information stored at the head of the resource. A resource access method characterized by permitting access to a resource when they match with each other and prohibiting access when both generation identification information do not match with each other, and controlling the access right only by a comparison result of the generation identification information. . 2. A resource access method according to claim 1, wherein a part of the time at which the resource was generated is used as generation identification information as generation identification information. 3. The resource access method according to claim 1, wherein a unique counter is provided in the system as generation identification information, and when the resource is generated, this counter value is incremented by one, and the counter value is used as generation identification information. how to access.