KR102602288B1 - Method and apparatus for access control and allocation of system resources - Google Patents

Abstract

The system resource access control and allocation method performed by the system resource access control and allocation device according to an embodiment includes importance information assigned to the user when authentication is permitted based on the user's importance and system resource usage. providing a token; granting or denying access to system resources based on priorities including current system resource utilization, importance of the user, and importance of the application in response to an access request using the token for a system application; and allocating necessary resources based on resource monitoring and task management situations for requests granting access to the system resources.

Description

System resource access control and allocation method and device {METHOD AND APPARATUS FOR ACCESS CONTROL AND ALLOCATION OF SYSTEM RESOURCES}

The present invention relates to a method and apparatus for controlling and allocating access to system resources.

Most management and response systems for war, disaster, and crisis operate in harsh and dynamic environments. Therefore, the risk of failure, breakdown, and load surge is very high, but rapid recovery, repair, and expansion are greatly limited. Therefore, for these systems, efficient and effective use of limited resources is very important.

When system resources are insufficient, an approach that differentially allocates available resources according to priority is essential. In the network field, such an approach is already being widely implemented and applied under the name of QoS (quality of service). QoS basically allocates bandwidth resources differently to traffic based on priority.

The function and performance of QoS largely depend on which priority criteria are applied and how. Various priority criteria are available depending on the purpose. For example, in the case of military communication network QoS, the triple-metric priority standard is widely cited and applied. The triple-metric priority criteria consists of performance, importance, and urgency, with performance being related to the type of traffic, importance being related to the user or mission, and urgency being related to the delivery deadline.

Republic of Korea Patent Publication No. 10-2015-0013482, published on February 5, 2015.

According to one embodiment, a system resource access control and allocation method for allocating necessary resources based on resource monitoring and task management situations while granting access based on priority including importance for access requests to applications of the system, and Provides a device.

The problems to be solved by the present invention are not limited to those mentioned above, and other problems to be solved that are not mentioned will be clearly understood by those skilled in the art to which the present invention pertains from the following description.

The system resource access control and allocation method performed by the system resource access control and allocation device according to the first aspect includes importance information assigned to the user when authentication is permitted based on the user's importance and system resource usage. providing a token; granting or denying access to system resources based on priorities including current system resource utilization, importance of the user, and importance of the application in response to an access request using the token for a system application; and allocating necessary resources based on resource monitoring and task management situations for requests granting access to the system resources.

A system resource access control and allocation device according to a second aspect includes: a memory including instructions; and a processor that performs a system resource access control and allocation method by executing the command, wherein the system resource access control and allocation method is performed when authentication is permitted based on the user's importance and system resource usage. Providing a token containing importance information assigned to the user; granting or denying access to system resources based on priorities including current system resource utilization, importance of the user, and importance of the application in response to an access request using the token for a system application; and allocating necessary resources based on resource monitoring and task management situations for requests granting access to the system resources.

A computer-readable recording medium storing a computer program according to the third aspect includes instructions for causing the processor to perform the system resource access control and allocation method when the computer program is executed by a processor.

A computer program stored in a computer-readable recording medium according to the fourth aspect includes instructions for causing the processor to perform the system resource access control and allocation method when the computer program is executed by a processor.

According to one embodiment, necessary resources are allocated based on resource monitoring and task management status while granting access based on priority, including importance, for access requests to applications of the system. It supports efficient and effective operation in an environment where multiple users and applications compete for limited and scarce resources.

Figure 1 is a configuration diagram of a system resource access control and allocation device according to an embodiment of the present invention.
Figure 2 is a configuration diagram conceptually showing the functions of a resource access and allocation program according to an embodiment of the present invention.
Figure 3 is a flowchart illustrating a system resource access control and allocation method according to an embodiment of the present invention.

The advantages and features of the present invention and methods for achieving them will become clear with reference to the embodiments described below along with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below and may be implemented in various different forms. The present embodiments are merely provided to ensure that the disclosure of the present invention is complete and to be understood by those skilled in the art. It is provided to fully inform those who have the scope of the invention, and the present invention is only defined by the scope of the claims.

The terms used in this specification will be briefly explained, and the present invention will be described in detail.

The terms used in the present invention are general terms that are currently widely used as much as possible while considering the function in the present invention, but this may vary depending on the intention or precedent of a person working in the art, the emergence of new technology, etc. In addition, in certain cases, there are terms arbitrarily selected by the applicant, and in this case, the meaning will be described in detail in the description of the relevant invention. Therefore, the terms used in the present invention should be defined based on the meaning of the term and the overall content of the present invention, rather than simply the name of the term.

When it is said that a part ‘includes’ a certain element throughout the specification, this does not mean excluding other elements, but may further include other elements, unless specifically stated to the contrary.

Additionally, the term ‘unit’ used in the specification refers to software or hardware components such as FPGA or ASIC, and the ‘unit’ performs certain roles. However, ‘wealth’ is not limited to software or hardware. The 'part' may be configured to reside on an addressable storage medium and may be configured to reproduce on one or more processors. Therefore, as an example, 'part' refers to components such as software components, object-oriented software components, class components and task components, processes, functions, properties, procedures, Includes subroutines, segments of program code, drivers, firmware, microcode, circuits, data, databases, data structures, tables, arrays, and variables. The functionality provided within components and parts can be combined into a smaller number of components and parts or further separated into additional components and parts.

Below, with reference to the attached drawings, embodiments of the present invention will be described in detail so that those skilled in the art can easily implement the present invention. In order to clearly explain the present invention in the drawings, parts unrelated to the description are omitted.

Figure 1 is a configuration diagram of a system resource access control and allocation device according to an embodiment of the present invention.

Referring to FIG. 1, a system resource access control and allocation device 100 according to an embodiment includes a memory 110 and a processor 120 including instructions, and an input unit 130 and/or an output unit 140. ) may further be included.

The memory 110 of the system resource access control and allocation device 100 can store a resource access and allocation program 111 and a resource database 112, and various information required for execution of the resource access and allocation program 111. You can save more. For example, the resource access and allocation program 111 is programmed to allocate necessary resources based on resource monitoring and task management context while granting access based on priority, including importance, for access requests to applications of the system. It may refer to software that includes specified instructions.

The processor 120 of the system resource access control and allocation device 100 executes the resource access and allocation program 111 and the resource access and allocation program 111 in the memory 110. Information required for execution can be loaded.

The processor 120 can perform the system resource access control and allocation method according to an embodiment of the present invention by executing the instructions of the resource access and allocation program 111.

Figure 2 is a block diagram conceptually illustrating the function of the resource access and allocation program 111 according to an embodiment.

Referring to Figures 1 and 2, the resource access and allocation program 111 may include an identification/access management unit 210 and a resource allocation unit 220.

The identification/access management unit 210 and resource allocation unit 220 shown in FIG. 2 conceptually divide the functions of the resource access and allocation program 111 to facilitate understanding of the resource access and allocation program 111, It is not limited to this. Depending on the embodiment, each function of the identification/access management unit 210 and the resource allocation unit 220 can be merged/separated and implemented as a series of instructions included in one program.

The identification/access management unit 210 of the resource access and allocation program 111 provides a token containing the importance information given to the user when authentication is permitted based on the user's importance and system resource usage, and provides the system application For access requests using tokens, access to system resources is granted or denied based on priorities including current system resource utilization, user importance, and application importance.

The resource allocation unit 220 of the resource access and allocation program 111 allocates necessary resources based on resource monitoring and task management situations for requests authorizing access to system resources. For example, when allocating resources, the utilization rate of system resources can be measured and managed in real time through resource monitoring. In addition, in allocating resources, when a new request arrives in a resource shortage situation, one or more of the following can be performed: stopping or suspending existing tasks according to priority, recovering and preempting resources, and restarting stopped tasks. Additionally, when allocating resources, resources can be allocated based on priorities including performance, importance, and urgency.

Referring again to FIG. 1, the input unit 130 can receive various information necessary for the processor 120 to perform the system resource access control and allocation method by the resource access and allocation program 111. These types of information can be input in real time, and if input in advance, the information can be stored in the memory 110. For example, the input unit 130 may include a data interface through which various information can be input in the form of data, a communication module through which various information can be received through a communication channel, a sensor module through which various information can be collected, etc. there is.

The output unit 140 may output various processed data generated as the processor 120 performs the system resource access control and allocation method by the resource access and allocation program 111. For example, the output unit 130 includes a data interface that can output various processed data to external peripheral devices, a communication module that can transmit various processed data through a communication channel, and a visual or auditory signal that transmits various processed data from the outside. It may include a playback device that can play so that it can be recognized as.

Figure 3 is a flowchart illustrating a system resource access control and allocation method according to an embodiment of the present invention.

Referring to FIG. 3, the system resource access control and allocation method according to the embodiment includes the step of providing a token containing importance information assigned to the user when authentication is permitted based on the user's importance and system resource usage ( S310) and a step of granting or denying access to system resources based on priorities including current system resource utilization, user importance, and application importance for access requests using tokens for system applications (S320) ) includes.

In addition, the system resource access control and allocation method according to the embodiment further includes a step (S330) of allocating necessary resources based on resource monitoring and task management situations for requests authorizing access to system resources.

Hereinafter, with reference to FIGS. 1 to 3, we will take a closer look at the system resource access control and allocation method performed by the system resource access control and allocation device according to an embodiment of the present invention.

First, the processor 120 of the system resource access control and allocation device 100 runs the resource access and allocation program 111 and the resource access and allocation program ( 111) can be loaded with information necessary for execution. Additionally, the processor 120 can perform system resource access control and allocation methods by executing instructions of the resource access and allocation program 111.

During the performance of this system resource access control and allocation method, the identification/access management unit 210 of the resource access and allocation program 111 determines the importance assigned to the user when authentication is granted based on the user's importance and system resource usage. Provides a token containing information. For example, when a user requests authentication through log-in, etc., the identification/access management unit 210 allows or denies the user's authentication by considering the current system resource usage rate and the importance of the user. At this time, if authentication is permitted, the result is delivered to the user through a token.

In addition, the identification/access management unit 210 provides access to system resources based on priorities including current system resource utilization, user importance, and application importance for access requests using tokens for system applications. Permit or deny. For example, when a user requests access to a system application using a token, access to the system resource can be granted or denied considering the current system resource usage rate and the importance of the user and application.

In this way, the identification/access management unit 210 can additionally apply priority-based access control and PBAC (priority based access control) in addition to the existing access control for system security purposes, and PBAC determines the resource usage status of the system. Considering this, the user's access request can be granted or denied based on the importance of the user and application.

Next, the resource allocation unit 220 of the resource access and allocation program 111 allocates the necessary resources based on the resource monitoring and task management status for requests authorizing access to system resources. For example, when allocating resources, the utilization rate of system resources can be measured and managed in real time through resource monitoring. In addition, in allocating resources, when a new request arrives in a resource shortage situation, one or more of the following can be performed: stopping or suspending existing tasks according to priority, recovering and preempting resources, and restarting stopped tasks. Additionally, when allocating resources, resources can be allocated based on priorities including performance, importance, and urgency. If available resources are insufficient, resources of users and applications with lower importance than the importance of the user and application of the new request can be recovered and allocated to the user and application of the new request. If all existing users and applications are performing important transactions that cannot be stopped or stopped, new requests can be queued. By sending relevant messages to users of stopped or suspended applications and blocking access requests from the users for a certain period of time, additional load due to continuous retries can be prevented. Users and applications suspended due to resource reclaim can be restarted when resources become available again. For example, the resource allocation unit 220 performs stopping or halting of existing tasks according to priority, resource recovery and preemption, and restart of stopped tasks when a new request arrives in a resource shortage situation during resource monitoring and task management situations. can do.

The identification/access management unit 210 and the resource allocation unit 220 can collaborate and share information between all functions of the information system. As an interface for real-time or synchronous information sharing, it can be implemented as a function call between functions, or it can be implemented through the resource database 112 as an interface for asynchronous information sharing.

Meanwhile, we will look at the system resource usage rate, priority standards, and application that the identification/access management unit 210 and the resource allocation unit 220 use as a basis for system resource access control and allocation.

System resource utilization can be managed in various types, levels, and units depending on the size, composition, and technology of the system. Representative examples of system resources include CPU, memory, and computers. It is also possible to virtualize physical resources and manage them as logical resources. How to manage which resources may depend on management policies and technologies for each system. For example, real-time utilization by system and resource can be measured using the basic functions of the OS.

Priority criteria and application can be applied to resource allocation using the triple-metric priority criteria of performance, importance, and urgency, which is one of the existing QoS priority criteria.

Among the triple-metric priority criteria, performance priority allows traffic to be differentially processed according to the performance needs of the traffic. In other words, it is possible to allocate more bandwidth resources to traffic requiring higher performance. DiffServ's service class-based traffic differentiation processing is a representative example of QoS applying performance priority. Performance requirements for system resources may be different depending on the application or type of application. This invention can categorize applications into three types: realtime, interactive, and batch. Real-time applications are real-time multimedia applications based on voice and video, interactive applications are data applications that require immediate or quick response, and batch applications are those that operate synchronously for reasons such as not being urgent or taking a long time. This refers to data applications that do not require any data. Each has different performance requirements and may require differential processing accordingly. For example, in a manner similar to traffic engineering in communication network QoS, resource requests for each application can be processed by appropriately allocating system resources in advance for each application type. That is, by measuring the resource requirements for each type over a certain period of time and allocating available resources to each type in absolute quantity or ratio in advance, system resources for the application of that type can be guaranteed. Additionally, there may be applications where system resources must always and absolutely be guaranteed. For example, the DiffServ approach in communication network QoS allocates control service class traffic to an EF (expedited forward) queue and allocates sufficient bandwidth resources to the queue through traffic engineering to prevent congestion between control traffic. there is. This type of application can be further classified as a non-preemptive application and sufficient system resources can be allocated to this type of application so that no congestion or competition between resource requests occurs. Which applications are classified as non-preemptive applications may depend on system-specific policies.

Among the triple-metric priority criteria, when congestion or competition occurs between resource requests of the same type, system resources can be allocated first to users or applications with high importance. It is assumed that the importance of each user, application, or application type is determined in advance through system-specific policies and management, and their importance may be managed through identity management. And for this purpose, the identification/access management unit 210 and the resource allocation unit 220 can collaborate. The importance of each user and application can be divided into N (number of 1 or more) levels, and considering that many of the existing communication network QoS implementations classify and apply importance levels of about 5, the importance of the resource allocation unit 220 It can also be divided into about 4 to 5 grades.

Among the triple-metric priority criteria, urgency may be associated with the application's processing or response deadline. The response time limit for real-time applications is ‘immediately’, which is the same or similar, so differentiated processing according to urgency may not be possible. However, interactive applications and batch applications may have slightly different response or processing time limits for each request. Additionally, requests that have expired can be canceled to prevent waste of system resources. In addition, it is possible to allow requests that have room for response or processing deadlines to yield their order to requests that do not.

Meanwhile, in importance priority-based access control and resource allocation, a simple access control and resource allocation algorithm using a threshold can be applied to resource requests. The identification/access management unit 210 may apply a threshold value (N-1) that is 1 less than the classification value (N) of the importance priority standard to the system resource or resource usage rate. And when resource utilization exceeds the first threshold, system access (log-in) and resource requests (application access) from the lowest priority users can be restricted. And if the second threshold is exceeded, access and resource requests of the next most important users can be further restricted. This can be repeated until the N-1th threshold is crossed. Access and resource requests from the highest priority users may not be restricted.

If the system resource to be allocated to a new resource request that has passed the access control by the identification/access management unit 210 is not available, the resource allocation unit 220 applies a resource request of lower importance than the new resource request among existing resource requests. You can stop (if stopping is not possible, you can stop), reclaim the resources, and allocate them to new resource requests. At this time, the resource allocation unit 220 can consider the importance of both the user and the application. The importance assessment method for each resource request may depend on system-specific policies. For example, the importance of the application may be considered first.

When recovering system resources for a low-priority user, the resource allocation unit 220 may share the user's identification information with the identification/access management unit 210. If system resources in use are withdrawn, the user's system operation may also be halted or halted. The typical behavior of users in these cases is continuous retries, which can worsen the system resource shortage situation. To prevent this, the identification/access management unit 210 can send an appropriate message to the user and restrict the user's access request for a certain period of time.

Additionally, the identification/access management unit 210 and the resource allocation unit 220 may share user importance information through a token. A token is a data structure or document used to communicate and share authentication results for users in multiple authentication or identification/access solutions. You can add a line to your token or access token, for example:

User Importance: # // # = integer from 1 to N, N = number of importance levels

These sentences may vary depending on the token content writing grammar provided by the underlying identification/access solution.

As discussed so far, according to the embodiment, access is granted based on priority including importance for access requests to applications of the system, and necessary resources are allocated based on resource monitoring and task management situations. It supports efficient and effective operation in an environment where multiple users and applications compete for limited and scarce resources.

Meanwhile, each step included in the system resource access control and allocation method according to the above-described embodiment may be implemented in a computer-readable recording medium that records a computer program programmed to perform these steps.

Additionally, each step included in the system resource access control and allocation method according to the above-described embodiment may be implemented in the form of a computer program stored in a computer-readable recording medium that is programmed to perform these steps.

Combinations of each step in each flowchart attached to the present invention may be performed by computer program instructions. Since these computer program instructions can be mounted on the processor of a general-purpose computer, special-purpose computer, or other programmable data processing equipment, the instructions performed through the processor of the computer or other programmable data processing equipment perform the functions described in each step of the flowchart. It creates the means to carry out these tasks. These computer program instructions may also be stored on a computer-usable or computer-readable recording medium that can be directed to a computer or other programmable data processing equipment to implement a function in a particular way, so that the computer program instructions are computer-usable or computer-readable. The instructions stored in the recording medium can also produce manufactured items containing instruction means that perform the functions described in each step of the flowchart. Computer program instructions can also be mounted on a computer or other programmable data processing equipment, so that a series of operational steps are performed on the computer or other programmable data processing equipment to create a process that is executed by the computer, thereby generating a process that is executed by the computer or other programmable data processing equipment. Instructions that perform processing equipment may also provide steps for executing the functions described in each step of the flowchart.

Additionally, each step may represent a module, segment, or portion of code containing one or more executable instructions for executing specified logical function(s). Additionally, it should be noted that in some alternative embodiments it is possible for the functions mentioned in the steps to occur out of order. For example, two steps shown in succession may in fact be performed substantially simultaneously, or the steps may sometimes be performed in reverse order depending on the corresponding function.

The above description is merely an illustrative explanation of the technical idea of the present invention, and those skilled in the art will be able to make various modifications and variations without departing from the essential quality of the present invention. Accordingly, the embodiments disclosed in the present invention are not intended to limit the technical idea of the present invention, but are for illustrative purposes, and the scope of the technical idea of the present invention is not limited by these embodiments. The scope of protection of the present invention shall be interpreted in accordance with the claims below, and all technical ideas within the scope equivalent thereto shall be construed as being included in the scope of rights of the present invention.

100: System resource access control and allocation device
110: memory
111: Resource Access and Allocation Program
120: processor
210: Identification/Access Management Department
220: Resource allocation unit

Claims (8)

A system resource access control and allocation method performed by a system resource access control and allocation device,
providing a token containing importance information assigned to the user when authentication is permitted based on the user's importance and system resource usage;
To respond to at least one of war, disaster, and crisis based on priorities including current system resource utilization, importance of the user, and importance of the application, for access requests using the token to the application of the system. granting or denying access to system resources; and
Including, allocating necessary resources based on resource monitoring and task management situations for requests granting access to the system resources,
In the step of allocating the resources, when a new request with a higher priority than the existing task arrives in a resource shortage situation, the resources of the existing task are recovered and allocated to the new request.
System resource access control and allocation method. According to claim 1,
The step of allocating the resources involves measuring and managing the utilization rate of the system resources in real time through the resource monitoring.
System resource access control and allocation method. According to claim 1,
The step of allocating the resources is to stop or stop the existing task.
System resource access control and allocation method. According to claim 1,
The step of allocating the resources includes allocating the resources based on the priority, which further includes performance, importance, and urgency.
System resource access control and allocation method. memory containing instructions; and
A processor that performs a system resource access control and allocation method by executing the command,
The system resource access control and allocation method is,
providing a token containing importance information assigned to the user when authentication is permitted based on the user's importance and system resource usage;
To respond to at least one of war, disaster, and crisis based on priorities including current system resource utilization, importance of the user, and importance of the application, for access requests using the token to the application of the system. granting or denying access to system resources; and
Including, allocating necessary resources based on resource monitoring and task management status for requests granting access to the system resources.
In the step of allocating the resources, when a new request with a higher priority than the existing task arrives in a resource shortage situation, the resources of the existing task are recovered and allocated to the new request.
System resource access control and allocation device. According to claim 5,
Within the processor, a functional block that grants or denies access to the system resources and a functional block that allocates the resources perform real-time or synchronous information sharing through a function call method.
System resource access control and allocation device. A computer-readable recording medium storing a computer program,
When the computer program is executed by a processor,
Contains instructions for causing the processor to perform a system resource access control and allocation method performed by a system resource access control and allocation device,
The system resource access control and allocation method is,
providing a token containing importance information assigned to the user when authentication is permitted based on the user's importance and system resource usage;
To respond to at least one of war, disaster, and crisis based on priorities including current system resource utilization, importance of the user, and importance of the application, for access requests using the token to the application of the system. granting or denying access to system resources; and
Including, allocating necessary resources based on resource monitoring and task management situations for requests granting access to the system resources,
In the step of allocating the resources, when a new request with a higher priority than the existing task arrives in a resource shortage situation, the resources of the existing task are recovered and allocated to the new request.
A computer-readable recording medium. A computer program stored on a computer-readable recording medium,
When the computer program is executed by a processor,
Contains instructions for causing the processor to perform a system resource access control and allocation method performed by a system resource access control and allocation device,
The system resource access control and allocation method is,
providing a token containing importance information assigned to the user when authentication is permitted based on the user's importance and system resource usage;
To respond to at least one of war, disaster, and crisis based on priorities including current system resource utilization, importance of the user, and importance of the application, for access requests using the token to the application of the system. granting or denying access to system resources; and
Including, allocating necessary resources based on resource monitoring and task management status for requests granting access to the system resources.
In the step of allocating the resources, when a new request with a higher priority than the existing task arrives in a resource shortage situation, the resources of the existing task are recovered and allocated to the new request.
computer program.

Images