Method and system for deploying a specified application based on a host operating system

Abstract

Provided are a method and system for deploying a specified application based on a host operating system. The method comprises: constructing a single-application space and loading code related to the specified application into the single-application space; constructing an operating system of the single application and associating the operating system with the single-application space; switching into the operating system of the single application and executing the code related to the specified application in the operating system to start a corresponding process, wherein the corresponding process is used to complete a function of the specified application and check a resource access request from the specified application. Embodiments of the disclosure logically distinguish access control and resource management, and deploy access control strategies of multiple applications in multiple agent processes, so that an attack on a certain agent process does not affect all agent processes, and thus the security is better.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of computer, and in particular, to a method and system for deploying a specified application based on a host operating system. BACKGROUND

[0002] Currently, in the cloud business deployment scenario, various applications are usually deployed to the cloud server based on virtual machines or containers. Virtual Machine refers to a complete computer system running in a completely isolated environment through software simulation, which has complete hardware system functions. Through virtual machine software, one or more virtual computers can be simulated on a physical computer, and various applications can be deployed in different virtual machines. A container is a kernel-level resource management concept, which can be understood as a set of constraints on system resources, and deploying an application in a container means subjecting the application to the constraints.

[0003] However, the virtualization technology simulates a complete computer system, resulting in high resource occupation, and the number of virtual machines running is limited. While the container technology such as docker relies on a large Linux kernel to complete resource isolation and security protection. Although the security and isolation of virtual machines are better than containers, the functions of Internet businesses change frequently today, and old applications may need to be updated every day, and new applications need to be deployed as soon as possible. However, due to the above-mentioned disadvantages such as high resource occupation, the virtual machine technology is difficult to meet the needs of application deployment in terms of efficiency and resource allocation. The operation and maintenance personnel hope to provide a new deployment scheme to balance the needs of application deployment in terms of security and deployment efficiency. SUMMARY

[0004] Therefore, the purpose of the present disclosure is to provide a method and system for deploying a specified application based on a host operating system to solve the above problems.

[0005] To achieve this purpose, according to a first aspect of the present disclosure, the embodiments of the present disclosure provide a method for deploying a specified application based on a host operating system, comprising:

[0006] constructing a single-application space and loading the code related to the specified application into the single-application space; constructing an operating system of a single application and associating it with the single-application space;

[0007] switching into the operating system of the single application and executing the code related to the specified application in it to start a corresponding process, wherein the corresponding process is used to complete the functions of the specified application and check the resource access request from the specified application.

[0008] Optionally, the corresponding processes include an application process and an agent process, the application process is configured to complete the function of the specified application, and the agent process is configured to provide a resource access control policy and check a resource access request from the application process based on the resource access control policy.

[0009] Optionally, the single-application space is divided into a high-privilege-level space and a low-privilege-level space, the application process can only access the low-privilege-level space, and the agent process can access the high-privilege-level space and the low-privilege-level space.

[0010] Optionally, from the perspective of the application process, the first address of the low-privilege-level space is 0 and the high-privilege-level space is invisible.

[0011] Optionally, the method further includes: deploying and starting a shadow process based on the host operating system, and the shadow process establishes address mapping data consistent with the perspective of the agent process based on the resource access request.

[0012] Optionally, the application process sends the resource access request to the agent process, the agent process sends the resource access request to the shadow process through an operating system of the single application and the host operating system, the shadow process checks the resource access request, and then sends the resource access request to the host operating system, the host operating system applies for a resource based on the resource access request and sends a resource handle to the shadow process, so that the shadow process records address mapping data.

[0013] Optionally, the operating system of the single application is limited to a virtual machine that runs only processes related to the specified application.

[0014] Optionally, the application process calls a system function provided by the host operating system for file read / write operations.

[0015] Optionally, the application process calls a virtual storage access interface provided by the agent process, and the agent process completes file read / write operations through a virtualization technology.

[0016] Optionally, the host operating system is Linux.

[0017] According to a second aspect of the present disclosure, embodiments of the present disclosure provide a system, comprising:

[0018] a host operating system;

[0019] an operating system of a single application;

[0020] a process related to a specified application executed in the operating system of the single application,

[0021] The host operating system constructs a single-application space at startup, loads the code related to the specified application into the single-application space, constructs an operating system of the single application associated with the single-application space, and then switches into the operating system of the single application to execute the code related to the specified application, so as to start a process related to the specified application.

[0022] Optionally, the operating system of the single application is limited to a virtual machine running only the process related to the specified application, and the host operating system is Linux.

[0023] According to a third aspect of the present disclosure, an embodiment of the present disclosure provides a server, comprising a memory and a processor, the memory further storing computer instructions executable by the processor, and the computer instructions, when executed, implement the method described in any of the preceding embodiments.

[0024] According to a fourth aspect of the present disclosure, an embodiment of the present disclosure provides a computer readable medium, which stores computer instructions executable by an electronic device, and the computer instructions, when executed, implement the method described in the preceding embodiments.

[0025] According to a fifth aspect of the present disclosure, an embodiment of the present disclosure provides a processor, comprising a plurality of processor cores, each of which is in a kernel state or a user state independently of other processor cores, each of which executes a host operating system in the kernel state and allocates a single-application space for a specified application, selects an arbitrary one of the processor cores as a processor core for executing the single-application space, and stores code related to the specified application in the single-application space, and the host operating system switches to the user state on the selected processor core and then enters the single-application space to execute the code therein, so as to start an operating system of the single application and a process related to the specified application.

[0026] Embodiments of the present disclosure separate the access policy control for computer resources from the host operating system and implement it in an independent agent process, logically distinguishing access control from resource management. The application agent can be deployed on the host operating system, or a single-application operating system can be established on the host operating system, and if the application is deployed in the single-application operating system, the specified application can be migrated to other single-application operating systems, which can realize hot migration and is more efficient.

[0027] Multiple applications can be distributed in different agent processes for access policy control of computer resources, and an attack on a certain agent process will not affect all agent processes, so the security is better than that of the container technology.

[0028] The single-application operating system is usually a lightweight operating system, for example, can be a lightweight virtual machine, and specifically can be a virtual machine built by KVM of Linux, but with functions simplified and limited to only allow processes related to the specified application to be executed therein. BRIEF DESCRIPTION OF DRAWINGS

[0029] The above and other objects, features and advantages of the present disclosure will become more apparent from the following description of embodiments of the present disclosure, taken in conjunction with the accompanying drawings, in which:

[0030] Figure 1 is a schematic diagram of a data center of a three-layer structure;

[0031] Figure 2 shows Figure 1 the physical connection of components in the layered data center of

[0032] Figure 3 is an example diagram of a server in Figure 2

[0033] Figure 4 is an example block diagram of a single-application environment provided by embodiments of the present disclosure;

[0034] Figure 5 is a schematic block diagram of a process space provided by embodiments of the present disclosure;

[0035] Figure 6 and Figure 7 are example block diagrams of two IO selections applied to embodiments of the present disclosure;

[0036] Figure 8 is a flowchart of deployment and start of various processes according to embodiments of the present disclosure. DETAILED DESCRIPTION

[0037] The present disclosure is described below based on embodiments, but the present disclosure is not limited to only these embodiments. In the following detailed description of the present disclosure, some specific details are described in detail. The present disclosure can also be fully understood without the description of these details by those skilled in the art. In order to avoid confusion of the essence of the present disclosure, well-known methods, processes, flows are not described in detail. In addition, the drawings are not necessarily drawn to scale.

[0038] The processor component mentioned in the following at least one embodiment can be a single-processor-core processor, or a processor including multiple processor cores, or a combination processor including one or more of a central processor, a digital processor, a special-purpose processor (such as various acceleration units for executing neural network models), etc. However, the specific category of the processor component is not the focus of the present invention, and therefore the processor component can be basically treated as a whole in the following embodiments.​

[0039] The processing device mentioned hereinafter can be various types of computer systems, including but not limited to desktops, servers, notebooks and workstations, and can also be various embedded products, including but not limited to cellular phones, Internet Protocol devices, digital cameras, Personal Digital Assistants (PDAs), handheld PCs, Network Computers (NetPCs), set-top boxes, network hubs, Wide Area Network (WAN) switches. The processing device is deployed with a control system implemented based on software and hardware, which can be partially integrated in the processing device and partially deployed to the processing device by installation.

[0040] For a server, the operating system installed thereon is usually in a multi-user management mode, including at least two users: a normal privilege user and a highest privilege user. The operating system in the multi-user management mode logically divides the addressing space of the memory into a kernel space and at least one user space, for example, the Linux operating system divides the highest 1 G byte (from virtual address 0xC0000000 to 0xFFFFFFFF) as the kernel space and the lower 3 G byte (from virtual address 0x00000000 to 0xBFFFFFFF) as the user space. The kernel space stores the code and data of the operating system, and the user space stores the code and data of the user-created user program. The working mode of the processor can be divided into a kernel mode and a user mode. The processor has more privileges in the kernel mode than in the user mode, for example, the processor working in the kernel mode can access all the data and instructions in the kernel space and the user space, and can access the peripheral devices including hard disks, network cards via device drivers. The processor working in the user mode can only access the data and instructions in the user space thereof. However, the processor working in the user space can switch from the user space to the kernel space, i.e., from the user mode to the kernel mode, via system calls, exceptions and interrupts of the peripheral devices.

[0041] Data center

[0042] A data center is a globally collaborative network of specific devices used to deliver, accelerate, exhibit, compute and store data information on the Internet network infrastructure. In the future development, the data center will also become an asset for enterprise competition. In a traditional large data center, the network structure is usually a three-layer structure, i.e., a hierarchical inter-networking model, as shown in the figure. This model includes the following three layers: Figure 1

[0043] ​Access Layer 103: Also sometimes referred to as the edge layer, includes access switches 130 and servers 140 connected to the access switches. Servers 140 are the processing and storage entities of the data center, where the bulk of the data center's processing and storage is done. Access switches 130 are the switches that provide access to the data center for the servers. One access switch 130 provides access to multiple servers 140. Access switches 130 are often located at the top of racks, so they are also referred to as Top of Rack switches, and they are physically connected to the servers.

[0044] Aggregation Layer 102: Also sometimes referred to as the distribution layer, includes aggregation switches 120. Each aggregation switch 120 connects multiple access switches, while also providing additional services such as firewall, intrusion detection, network analysis, etc.

[0045] Core Layer 101: Includes core switches 110. Core switches 110 provide high-speed forwarding for packets coming in and out of the data center, and provide connectivity for multiple aggregation layers. The network of the entire data center is split into L3 routed networks and L2 routed networks, and core switches 110 provide a resilient L3 routed network for the network of the entire data center.

[0046] Typically, aggregation switches 120 are the point of demarcation between L2 and L3 routed networks, with L2 networks below the aggregation switches 120 and L3 networks above the aggregation switches 120. Each set of aggregation switches manages a point of delivery (POD), and each POD is an independent VLAN network. Servers migrating within a POD do not have to modify IP addresses and default gateways, because a POD corresponds to one L2 broadcast domain.

[0047] Spanning Tree Protocol (STP) is typically used between aggregation switches 120 and access switches 130. STP makes only one aggregation layer switch 120 available for a VLAN network, with other aggregation layer switches 120 being used only in case of failure (dashed lines in the figure). That is, at the aggregation layer, horizontal scaling is not possible, because even if multiple aggregation switches 120 are added, only one is in operation.

[0048] Figure 2 The physical connections of the components in a hierarchical data center are shown in Figure 1 Figure 2 ​As shown, one core switch 110 connects multiple aggregation switches 120, one aggregation switch 120 connects multiple access switches 130, and one access switch 130 connects multiple servers 140. The servers 140 are the real computing devices of the data center.

[0049] The servers 140 are processing devices that perform computing tasks based on the cooperation of software and hardware. As shown in FIG. 1, the servers 140 are connected to each other through the core switches 110, the aggregation switches 120, and the access switches 130. The servers 140 are connected to the storage devices 201 through the core switches 110, the aggregation switches 120, and the access switches 130. Figure 3 As shown, the servers 140 include storage devices 201 and processing systems 300. The processing systems 300 include storage controllers 301, I / O controllers 303, processor components 304, and storage devices 306 coupled via an interconnect unit 302. In some embodiments, the processing systems 300 can be considered as a chip package, i.e., a system on a chip.

[0050] The storage controllers 301 are coupled to the external storage devices 201 and control read and write operations to the storage devices 201 through the storage controllers 301. In some embodiments, the storage controllers 301 and the storage devices 201 are integrated as one physical element. The storage devices 306 and the storage devices 201 can be implemented based on any of a wide range of information storage technologies. Generally, the storage devices 306 have higher storage efficiency than the storage devices 201, but the storage devices 201 have larger storage capacity than the storage devices 202. In some embodiments, the storage devices 306 are, for example, read-only memory (ROM), random access memory (RAM), dynamic RAM (DRAM), double data rate DRAM (DDRAM), synchronous DRAM (SDRAM), static RAM (SRAM), programmable ROM (PROM), erasable programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), flash memory, or the like, and the storage devices 201 are multiple ferromagnetic disk drives organized into a redundant array of independent disks or RAID array. It should be noted that although the storage devices are shown as separate elements, they can include multiple elements based on the same or different storage technologies.

[0051] The processor components 304 can include one or more processor cores, which can include, for example, higher speed, higher complexity high-power cores and lower speed, lower complexity low-power cores. The processor cores can have the same or different instruction sets, through which the processor cores can decode and execute program instructions within the user space 3051 or the kernel space 3052.

[0052] The I / O controllers 303 are coupled to the I / O devices 202, which can be, for example, display screens, keyboards, network devices, and the like, and the I / O devices 202 are operable through the I / O controllers 303. In some embodiments, the I / O controllers 303 and the I / O devices 202 are integrated as one physical element.

[0053] The storage device 201 is generally used to store codes and data of various applications. The storage device 306 is used to store some core codes and data, such as codes and data of an operating system, codes and data of a driver, and can also provide a process running space required by various programs (including an operating system, a driver and an application) during running.

[0054] When the server is powered on, the process running space of the storage device 306 is divided into a kernel space 3052 and one or more user spaces 3051 by the operating system. The user space 331 is a running space of a user program, and the kernel space 3052 is a running space of an operating system and a system program.

[0055] In the kernel space, there are stored a conversion table 3053, a user permission table 3054, a block buffer 3055, an interrupt table 3056, a page table 3057 and many other table items related to the running of the operating system. The page table 3057 relates the virtual address of a page to the physical address of the page. The block buffer 3055 is used to cache data in the storage device 201 in the form of blocks, and can provide page data retrieved in the form of pages. The conversion table 3053 relates the virtual address of a page to the identifier of one or more data blocks in the storage device 201 including the content of the page. The user permission table 3054 is a relationship table of a plurality of users and permissions. Meanwhile, the kernel space 3052 provides a running environment for an operating system 340 composed of a mode controller 3401, a storage driver 3402 and an I / O driver 3403. The mode controller 3401, the storage driver 3402 and the I / O driver 3403 can have independent running environments in the kernel space 3053. Each running environment can store some to-be-executed codes, some input data, some intermediate operation data and some final result data. The operating system 340 can be one of a WINDOWS operating system, a UNIX operating system, a Linux operating system, an Android operating system and a RealTime OS operating system. TM The operating system version, the UNIX operating system, the Linux operating system, the Android operating system, the RealTime OS operating system.

[0056] The user space 3051 is used to provide a running environment for various application processes. The running environment of each application program can store some to-be-executed codes, some input data, some intermediate operation results and some final result data of the application program.

[0057] The processor component 304 can read and execute the code of each application from the user space 3051 one by one. The processor component 304 can read and execute the code of the operating system 340 from the kernel space 3052 one by one. Wherein, the processor state of executing the code of the kernel space 3052 is called kernel mode, and the processor state of executing the code of the user space 3051 is called user mode. Since the processor component 304 can include one or more processor cores, when the processor component 304 contains multiple processor cores, there are three cases about the state of the processor: all processor cores are in kernel mode; all processor cores are in user mode; and part of the processor cores are in user mode and the other part of the processor cores are in kernel mode.

[0058] The processor core has more permissions in kernel mode than in user mode, for example, the processor core working in kernel mode can access all data and instructions in the kernel space and the user space, and can access peripheral devices including hard disk, network card via device driver. The processor core executing in user mode can only access data and instructions in its own user space. But when the processor core works in user space, it can switch from user space to kernel space, i.e. from user mode to kernel mode, via system call, exception and interruption of peripheral device. In addition, it should be understood that in a multi-user operating system, the processor core can only access the resources of the corresponding user in the user mode of the user, for example, the processor core switches to the user mode of USER1, and can only access the resources that USER1 has the permission to access.

[0059] Although not shown, as an optional deployment, the operating system can also be deployed with multiple virtual machines, and if the virtual machine is also in multi-user mode, the storage space of the virtual machine can also be divided into kernel space and user space, so that the application is deployed in the user space inside the virtual machine, and the kernel component of the virtual machine runs in the kernel space. As an example, KVM (Kernel-based Virtual Machine) is a complete virtualization solution for Linux on x86 hardware, containing virtualization extensions (Intel VT or AMD-V). It consists of a loadable kernel module kvm.ko that provides the core virtualization infrastructure and processor-specific modules kvm-intel.ko or kvm-amd.ko. Using KVM, you can run multiple virtual machines running unmodified Linux or Windows images. Each virtual machine has dedicated virtual hardware: network cards, disks, graphics adapters, etc.

[0060] Figure 4is an exemplary block diagram of a single-application environment provided by embodiments of the present disclosure. The single-application environment 200 is located above the software kernel layer shown in the figure. Multiple single-application environments 200 can be built above the software kernel layer. In the figure, the single-application environment 200 is an execution environment built for a specified application. The single-application environment 200 includes a shadow process 201 and an operating system 202 of the single application. An application process 2021 and an agent process 2022 are executed in the operating system 202 of the single application. The application process 2021 is an execution process corresponding to the specified application. The agent process 2022 isolates the application process 2021 from the software kernel layer 122 and provides an access policy and access control for the application process 2021 to system resources, including I / O, storage, and network. Specifically, the agent process 2022 sets an access policy for the specified application, and when receiving an access request sent from the application process 2021, first performs permission checking according to the access policy, sends the access request that passes the permission checking to the software kernel layer 122, and obtains an audit result from the software kernel layer 122.

[0061] In some embodiments, the software kernel layer 122 includes a host operating system and virtual machine software (or only includes a host operating system). The software kernel layer 122 processes the access request of the application process 2021, for example, if the access request is a request to access an IO device, the agent process 2022 sends the request to the software kernel layer 122 after the permission checking, the software kernel layer 122 returns an operation handle of the IO device to the agent process 2022, and the agent process 2022 returns to the application process 2021, and for another example, if the access request is a request to apply for memory space, the agent process 2022 sends the request to the software kernel layer 122 after the permission checking, and the software kernel layer 122 provides an access address of a specific memory space to the application process 2021 and the agent process 2022 through a memory management system.

[0062] As a specific implementation, the application process 2021 can first execute a function call, which takes the resource identification information to be accessed as a parameter, and makes the program execution jump to the agent process 2022 through the call (corresponding to step 1 in the figure). The agent process 2022 executes a permission checking module, which judges whether the application process has access rights to the resource to be accessed based on a predetermined access policy, and if so, makes the program execution jump to the host operating system for execution through a system call provided by the host operating system (corresponding to step 2 in the figure). The host operating system applies for resources for the application process 2021, and returns a handle and a permission of resource access to the agent process 2022 (corresponding to step 7 in the figure), and then the agent process 2022 provides the handle and the permission to the application process 2021 (corresponding to step 8 in the figure). That is, steps 1, 2, 7, and 8 in the figure constitute a closed-loop resource access processing logic.

[0063] As another specific implementation, the proxy process 2022 can first execute a proxy kernel call, which takes the resource identifier information to be accessed as a parameter. Through this call, the program execution jumps to the proxy process 2022 (corresponding to step 1 in the figure). The proxy process 2022 executes the permission check module. The permission check module determines whether the application process has access rights to the resource to be accessed based on the predetermined access policy. If it does, the program execution jumps to the host operating system for execution through the system call provided by the host operating system (corresponding to step 2 in the figure). The host operating system sends the request to shadow process 201 (corresponding to step 3 in the diagram). Shadow process 201 then processes the access request and sends it back to the host operating system (corresponding to step 4 in the diagram). The host operating system requests resources and provides the resource address to the shadow process (corresponding to step 5 in the diagram). Shadow process 201 records resource usage information and transmits it to the host operating system (corresponding to step 6 in the diagram). The host operating system provides the resource handle and permissions to agent process 2022 (corresponding to step 7 in the diagram). Agent process 2022 then provides the resource handle and permissions to application process 2021. Steps 1-8 in the diagram form a closed-loop resource access processing logic. The reason for adding a shadow process is that when program execution needs to jump from the agent process to execute the host operating system, the processor cannot directly switch from the user-mode single-user operating system to the kernel-mode host operating system. Therefore, a switch is needed through a shadow process. The existence of the shadow process also makes the host operating system believe that all resource requests come from the shadow process, which is transparent to the single-application operating system. Figure 5 This is a schematic block diagram of the process space provided in this embodiment. The single application space can be viewed as the process space from the perspective of the proxy operating system. The global space can be viewed as the process space from the perspective of the host operating system. The shadow space can be viewed as the process space from the perspective of the shadow process. As shown in the figure, from the perspective of the host operating system, the process space of application process 2021 and the process space of proxy process 2022 are both part of the memory space they manage. The host operating system can perform arbitrary operations on them (including reading and writing). The shadow space is an address space that corresponds one-to-one with the single application space. Any operation performed by shadow process 201 on the shadow space will affect the single application space.

[0064] In some embodiments, the host operating system is responsible for maintaining the address mapping data between the global space and the multiple single-application spaces, for example, by maintaining the address mapping data between the global space and all single-application spaces in a global address table, which can include the process name, process ID of the application process, and the start and end addresses of the single-application space. Each proxy process 2022 then maintains a local address table related to itself, and each shadow process also maintains a local address table of the corresponding proxy process 2022 (the shadow process and the proxy process are one-to-one). The local address table of the proxy process 2022 can include the code start and end addresses and the data start and end addresses. For example, in the global address table, the start address of the single-application space of application A is addr1, and the size is 1M. In the local address table of application A, the data start address of the designated proxy process is dataAddr1, and the size is 1M. The code start address is codeAddr1, and the size is 1M. The data address of the application process is dataAddr2, and the size is 1M. The code start address is codeAddr2, and the size is 2M.

[0065] In other embodiments, the global address table of the host operating system records the address mapping data of all applications, which includes the data start and end addresses and the code start and end addresses of each application, and each proxy process maintains a data copy related to itself, and each shadow process also maintains such a copy.

[0066] In some embodiments, as shown in the figure, the process space of the proxy process 2022 in the single-application space is a high-privilege-level space, and the process space of the application process 2021 is a low-privilege-level space. The process space of the application process 2021 is addressed from the 0 address, so that from the perspective of the application process 2021, the process space of the proxy process 2022 does not exist, which can avoid the application process 2021 accessing the process space of the proxy process 2022, thereby achieving isolation between the application process and the proxy process. If a Linux system or a unix system is used, the high-privilege-level space can correspond to the kernel space, and the low-privilege-level space can correspond to the user space, i.e., the process space of the proxy process 2022 belongs to the kernel space, and the process space of the application process 2021 belongs to the user space. Accordingly, the processor executes the code of the proxy process 2022 in the kernel state and executes the code of the application process 2021 in the user state.

[0067] The above embodiment separates the access policy control of computer resources from the software kernel layer, and implements the access policy control in an independent agent process, logically distinguishes the access control and the resource management, and compared with the virtual machine technology, the single-application operating system is more lightweight and more resource-saving. Meanwhile, since the access policy controls of computer resources of multiple applications are distributed in different agent processes, the attack on a certain agent process will not affect all the agent processes, and thus compared with the container technology, the security is better.

[0068] Figure 6 and Figure 7 are exemplary block diagrams of two IO selections applied to the embodiments of the present disclosure. As shown in Figure 6 , in one implementation, the single-application operating system 202 includes a file system component (if it is a Linux system, the component is a Sandboxed Host Linux FS) to support the application process 2021 to call a system-level file read-write operation (syscall), and the read-write operation is directly forwarded to the host to complete the file read-write operation. As shown in Figure 7 , in another implementation, an independent file system or a storage API (Virtual FS / Storgae API) conforming to a certain standard can be presented to the application 2021. At this time, the read-write of the application 2021 to the file is completed by the agent process 2022 based on the virtualization technology.

[0069] The above two flexible IO implementation mechanisms, that is, the IO is implemented based on the host file system or the virtual device.

[0070] Figure 8 is a flowchart of the deployment and startup of various processes according to the embodiments of the present disclosure. As shown in the figure, step S01 is to build a single-application space for a specified application, and load the code related to the application into the single-application space. Generally, the Linux operating system is started, and the dynamic library file ld.so file of the operating system is loaded and executed first. During the execution of the library file, a series of operations such as device driver, memory management, etc. are implemented, which include building a single-application space for a specified application, and loading the code related to the application into the single-application space. The code related to the application includes the code of the above-mentioned agent process.

[0071] Step S02 is to build a single-application operating system and associate it with the single-application space. For example, during the execution of the dynamic library file ld.so, a container loader is called to build a single-application operating system, which can be understood as a virtual machine or a light-weight virtual machine. The operating system is set to be operable in the single-application space, i.e., to read, write and execute the code in the single-application space. In an optional implementation, step S01 also stores the code of the single-application operating system in the single-application space, and the container loader loads the code of the single-application operating system in the single-application space to build the single-application operating system.

[0072] Step S03 is to switch into the single-application operating system and start the agent process by executing the code of the agent process. When the processor switches into the single-process operating system, only the single-application space can be read, written and executed, so as to isolate the single-application space from the host operating system, and then start the agent process in the single-application operating system.

[0073] Step S04 is to execute the code of the application process by the agent process to start the application process. The application process is used to complete the function of the specified application. The application process can access external resources via the agent process. The agent process is responsible for auditing and converting the resource access request provided by the application process, and providing the resource access request that passes the check to the single-application operating system and the host operating system. It should be noted that in this step, the code of the application process can be loaded into the single-application space by the agent process before the code of the application process is executed, or the code of the application process can be loaded into the single-application space together with the code of the agent process when the code of the agent process is loaded into the single-application space in step S01.

[0074] Step S05 is to start the shadow process. The shadow process is used to audit the resource access request from the application process and record the processing result of the host operating system on the resource access request. The shadow process usually establishes the same address mapping data as the single-application space.

[0075] Based on the embodiment, the host operating system is initialized to build a single-application space, then loads the code of the agent process into the single-application space, then builds a single-application operating system (similar to a light-weight computer system), and enters the single-application operating system to execute the code of the agent process in the single-application space to complete the start of the agent process.

[0076] It should be noted that the agent process is started in the single-application operating system, and the shadow process is started in the host operating system. The agent process and the shadow process cannot directly interact, and both of them must be implemented through the host operating system and / or the single-application operating system.

[0077] Based on this embodiment, access policy control for computer resources is separated from the host operating system and implemented in an independent agent process, logically distinguishing access control from resource management. The application agent can be deployed on the host operating system, or a separate single-application operating system can be built on top of the host operating system. If the application is deployed on a single-application operating system, migrating the specified application to another single-application operating system can achieve hot migration, resulting in higher migration efficiency.

[0078] Single-application operating systems are typically lightweight, such as lightweight virtual machines. More specifically, they can be virtual machines that, although built from Linux's KVM, have been streamlined and restricted to only allowing processes related to a specific application to run.

[0079] In some embodiments, the method provided in this embodiment may be powered by a multi-core processor (e.g., Figure 3 The processor component 304 executes the multi-core processor, which may include multiple processor cores that are functionally equivalent or at least use the same instruction set architecture. Each processor core can be in kernel mode or user mode independently of other processor cores. Each processor core executes the host operating system in kernel mode. The host operating system instances running on each processor core cooperate to allocate a single application space for the specified application to be deployed at the time of execution. Using its internal scheduler, it selects any one processor core as the processor core to execute in that single application space and stores the code related to the specified application within that single application space. The host operating systems running on multiple processor cores use their internal schedulers to determine when appropriate, switching to user mode on the selected processor core and then entering the single application space to execute the code, thereby starting the operating system for the single application and the processes related to the specified application. In this way, multiple applications can be deployed and executed separately by multiple processor cores to improve system processing performance. As a special case, some processor cores from multiple processor cores can be selected as the master processor core, which is specifically responsible for scheduling the allocation of slave processor cores. The master processor core can execute the host operating system in kernel mode. When the host operating system is executed, it allocates a single application space and a coprocessor core for each of the multiple applications to be deployed, and stores the relevant code of the corresponding application in the corresponding single application space. Then, it drives the corresponding coprocessor core to access the corresponding single application space in user mode to execute the code therein.

[0080] In some embodiments, the single application space is divided into high-privilege and low-privilege spaces, and the agent process can access all spaces, while the application process can only access the low-privilege space.

[0081] In some embodiments, the single-application operating system adopts a multi-user management mode, and thus includes at least two types of users: a normal privilege user and a highest privilege user. The agent process is started by the highest privilege user, and the application process is started by the normal privilege user, so that the agent process can access all spaces, while the application process can only access the low privilege level space. If the single-application operating system is implemented based on a Linux operating system, the high privilege level space herein can be regarded as the kernel space in the Linux operating system, and the low privilege level space can be regarded as the user space.

[0082] In some embodiments, the single-application operating system re-addresses the high privilege level space and the low privilege level space, so that from the perspective of the application process, the first address of the low privilege level space is 0, and the high privilege level space is invisible, so as to avoid the application process accessing the high privilege level space.

[0083] Corresponding to the above-mentioned embodiments, the present disclosure also provides a computer storage medium, such as various storage devices, magnetic disks, etc. Such storage devices are usually coupled with a processor and integrated inside a processing device. When the processing device is working, the processor can read and execute computer instructions from the storage device. The computer instructions stored in such computer storage medium can complete the following operations when executed by the processor: constructing a single-application space and loading code related to a specified application into the single-application space; constructing a single-application operating system and associating it with the single-application space; switching into the single-application operating system and executing the code related to the specified application in the single-application operating system, wherein the specified application includes an application process and an agent process for completing the function of the specified application.

[0084] Those skilled in the art can understand that the present disclosure can be implemented as a system, a method and a computer program product. Therefore, the present disclosure can be embodied in the form of a complete hardware, a complete software (including firmware, resident software, microcode), and also in the form of a software and hardware combination. In addition, in some embodiments, the present disclosure can also be embodied in the form of a computer program product in one or more computer readable media, which includes computer readable program code.

[0085] Any combination of one or more computer readable medium can be utilized. The computer readable medium can be a computer readable signal medium or a computer readable storage medium. A computer readable storage medium can be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of a computer readable storage medium can include, but are not limited to, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In this context, a computer readable storage medium can be any tangible medium that can contain or store a program for use by or in connection with a processing system, apparatus, or device.

[0086] A computer readable signal medium can include a propagated data signal with computer readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated signal can take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A computer readable signal medium can be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device.

[0087] Program code embodied on a computer readable medium can be transmitted using any appropriate medium, including but not limited to wireless, wire line, optical fiber cable, RF, etc., and any suitable combination of the foregoing.

[0088] Computer program code for carrying out embodiments of the present disclosure can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, C++, and conventional procedural programming languages, such as the C programming language. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer, or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, programmable logic circuitry, application specific circuitry, or field programmable gate array (FPGA) circuitry can execute the computer program code.

[0089] The above merely provides preferred embodiments of the present disclosure, and is not used to limit the present disclosure. For those skilled in the art, the present disclosure can have various modifications and changes. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present disclosure shall fall into the protective scope of the present disclosure.

Claims

1. A method for deploying a specified application based on a host operating system, comprising: Construct a single application space and load the code related to the specified application into the single application space; Build a single-application operating system and associate it with the single-application space; Switch into the operating system of a single application and execute the code related to the specified application to start the corresponding process. The corresponding process includes an application process and a proxy process. The application process is used to complete the function of the specified application, and the proxy process is used to provide resource access control policies and check resource access requests from the application process based on the resource access control policies. It also includes: deploying and starting a shadow process based on the host operating system; the application process sending the resource access request to the agent process; the agent process sending the resource access request to the shadow process through the single application's operating system and the host operating system; the shadow process checking the request and then sending it to the host operating system; the host operating system requesting resources and sending the resource handle to the shadow process so that the shadow process can record address mapping data.

2. The method according to claim 1, wherein the single application space is divided into a high-privilege space and a low-privilege space, the application process can only access the low-privilege space, and the proxy process can access both the high-privilege space and the low-privilege space.

3. The method according to claim 2, wherein, From the perspective of the application process, the starting address of the low privilege level space is 0 and the high privilege level space is invisible.

4. The method according to claim 1, further comprising: The shadow process establishes address mapping data consistent with the perspective of the proxy process based on the resource access request.

5. The method according to claim 1, wherein, The operating system for the single application is restricted to a virtual machine that only runs processes related to the specified application.

6. The method according to claim 1, wherein, The application process calls the system functions for files provided by the host operating system to perform file read and write operations.

7. The method according to claim 1, wherein, The application process calls the virtual storage access interface provided by the agent process, and the agent process performs read and write operations on the file through virtualization technology.

8. The method according to claim 1, wherein, The host operating system is Linux.

9. A system for deploying a specified application based on a host operating system, comprising: Host operating system; Single-application operating system; The operating system of the single application executes code related to the specified application. The host operating system constructs a single application space upon startup, loads the code related to the specified application into the single application space, and constructs an operating system associated with the single application space. Then, it switches into the operating system of the single application to execute the code related to the specified application, thereby starting a corresponding process related to the specified application. This corresponding process includes an application process and a proxy process. The application process is used to complete the functions of the specified application, and the proxy process is used to provide resource access control policies and check resource access requests from the application process based on the resource access control policies. It also includes: deploying and starting a shadow process based on the host operating system; the application process sending the resource access request to the agent process; the agent process sending the resource access request to the shadow process through the single application's operating system and the host operating system; the shadow process checking the request and then sending it to the host operating system; the host operating system requesting resources and sending the resource handle to the shadow process so that the shadow process can record address mapping data.

10. The system according to claim 9, wherein, The operating system for the single application is restricted to a virtual machine that only runs the corresponding processes related to the specified application, and the host operating system is Linux.

11. A server comprising a memory and a processor, the memory further storing computer instructions executable by the processor, the computer instructions, when executed, implementing the method as claimed in any one of claims 1 to 8.

12. A computer-readable medium storing computer instructions executable by an electronic device, wherein the computer instructions, when executed, implement the method as claimed in any one of claims 1 to 8.

13. A processor, the processor comprising a plurality of processor cores, wherein, Each processor core operates independently of other processor cores, either in kernel mode or user mode. In kernel mode, each processor core executes the host operating system and allocates a single application space for a specified application. It selects any processor core as the execution core for that single application space and stores the code related to the specified application within it. The host operating system switches to user mode on the selected processor core and then enters the single application space to execute the code, thereby launching a single application's operating system and corresponding processes related to the specified application. These corresponding processes include application processes and proxy processes. The application processes are used to complete the functions of the specified application, and the proxy processes are used to provide resource access control policies and check resource access requests from the application processes based on these policies. It also includes: deploying and starting a shadow process based on the host operating system; the application process sending the resource access request to the agent process; the agent process sending the resource access request to the shadow process through the single application's operating system and the host operating system; the shadow process checking the request and then sending it to the host operating system; the host operating system requesting resources and sending the resource handle to the shadow process so that the shadow process can record address mapping data.

Images