A method, apparatus and device for improving reliability of a redundant system

Abstract

The application relates to the storage field and discloses a method, device and equipment for improving the reliability of a redundant system. The method comprises the following steps: setting a readable and writable area of a first mirror image as a use area of system loading, and setting a readable and writable area of a second mirror image as a backup area of the use area; in response to the system starting to run, dynamically checking the data of the use area; and in response to the data of the use area having a checking error, recovering the data of the use area with the checking error through the data of the backup area, and again dynamically checking the data of the use area. The disclosed scheme re-plans the shared space and the independent space in combination with the read-only area and the readable and writable area of the mirror image of the redundant system, so that the reliability of the redundant system can be greatly improved.

Description

Technical Field

[0001] This invention relates to the field of storage, and more particularly to a method, apparatus, and device for improving the reliability of redundant systems. Background Technology

[0002] With the development of electronic technology, embedded software in electronic products generally adopts redundant systems, such as dual-image redundancy systems. An image is a binary executable program for embedded software. The read-only area of ​​an image is a region that can only be read and not written to, typically including areas storing code (file system, kernel, etc.) and fixed configuration areas (device tree, etc.). The read-write area of ​​an image is the region that the embedded software can read and write during operation, typically including configuration space (such as the mount point of the Linux conf partition), log storage space, etc. A dual-image redundancy system uses two identical images in the embedded software, with one image used as a backup. In a dual-image redundancy system, the system boots from Image1 by default, and Image2 serves as a backup image. If Image1 experiences data corruption due to interference or damage, the embedded system switches to Image2 for booting and restores Image1 after booting.

[0003] In existing technologies, redundant systems generally employ two redundancy schemes: one is to provide a physical storage area as a common area for the read / write areas of two mirrors; the other is to have each mirror's read / write area function as its own, without providing a shared physical storage area. Both methods have certain drawbacks in terms of system reliability: the first increases storage space consumption by adding a shared physical storage space, and the lack of backup increases the risk of data loss. If one mirror is partially damaged but the overall system architecture is not affected, the system will not switch to the other mirror, leading to partial malfunction and unrecoverable data loss in the embedded software. The second method requires the contents of the two independent spaces to be synchronized, which introduces a synchronization time difference and carries the risk of data loss. For example, if the data in the read / write areas are inconsistent due to time differences, a system restart can cause reverse synchronization in the read / write areas, resulting in partial data loss. Summary of the Invention

[0004] In view of this, the present invention proposes a method, apparatus and device for improving the reliability of a redundant system. By resetting the read-only area and read-write area of ​​a redundant image, the read-write area of ​​one image is used as the area to be used when the system is loaded, and the read-write area of ​​the remaining images is used as the spare area for this area. When the system is started, the read-only area of ​​the image that is started is statically verified, and the area to be used is dynamically verified when the system starts running. The reliability of the system is improved in this way.

[0005] Based on the above objectives, one aspect of the present invention provides a method for improving the reliability of a redundant system, the method comprising the following steps: setting a readable and writable area of ​​a first image as a usage area loaded by the system, and a readable and writable area of ​​a second image as a spare area of ​​the usage area; in response to the system starting to run, dynamically verifying the data in the usage area; in response to a verification error in the data in the usage area, recovering the verification error data in the usage area using the data in the spare area, and dynamically verifying the data in the usage area again.

[0006] In some embodiments, the method further includes: in response to system startup, loading a read-only region of the image that has started up according to configuration information and performing static verification on the data in the read-only region.

[0007] In some embodiments, the step of responding to a verification error in the data of the used area, restoring the data with the verification error in the used area using the data of the backup area, and then dynamically verifying the data of the used area again includes: responding to a verification error in the data of the used area again, restoring the data with the verification error in the used area and the corresponding data of the backup area using the default value of the read-only area.

[0008] In some embodiments, the step of loading the read-only region of the image to be started according to the configuration information and performing static verification on the data in the read-only region in response to system startup includes: loading the data and bootloader of the read-only region of the image to be started; calculating the integrity of the data in the read-only region of the image to be started, and verifying it with the verification value fixed in the read-only region of the image to be started.

[0009] In some embodiments, calculating the integrity of the data in the read-only region of the startup image and verifying it against the checksum embedded in the read-only region of the startup image includes: in response to the calculated value of the data in the read-only region of the startup image being consistent with the checksum embedded in the read-only region of the startup image, starting the software via the bootloader.

[0010] In some embodiments, calculating the integrity of the data in the read-only region of the image to be started and verifying it with the checksum embedded in the read-only region of the image to be started further includes: in response to the inconsistency between the calculated value of the data in the read-only region of the image to be started and the checksum embedded in the read-only region of the image to be started, loading another image for startup.

[0011] In some embodiments, the dynamic verification of the data in the usage area in response to the system starting to run includes: loading the data in the usage area and a verification table; calculating the integrity of the data in the usage area and verifying it with the data in the verification table.

[0012] In some embodiments, the step of responding to a verification error in the data of the usage area, recovering the data with the verification error in the usage area using the data of the backup area, and then performing dynamic verification on the data of the usage area again includes: responding to a discrepancy between the calculated value of the data of the usage area and the verification value in the verification table, recovering the data with the discrepancy in the verification value of the usage area using the data of the backup area, and then performing integrity calculation on the data of the usage area again.

[0013] In some embodiments, the step of responding to the inconsistency between the calculated value of the data in the usage area and the check value in the check table, restoring the data in the usage area that is inconsistent with the check value through the data in the spare area, and performing integrity calculation on the data in the usage area again includes: re-checking the obtained calculated value with the data in the check table; and responding to the inconsistency between the calculated value of the data in the usage area and the check value in the check table again, restoring the data in the usage area and the spare area that is inconsistent with the check value through the default value of the read-only area.

[0014] In some embodiments, the method further includes: in response to receiving a trigger signal, updating the corresponding data of the usage area and the verification table of the usage area according to the trigger signal, and synchronizing it to the spare area.

[0015] In another aspect, the present invention provides an apparatus for improving the reliability of a redundant system. The apparatus includes: a first module configured to set a readable and writable area of ​​a first image as a system-loaded usage area, and a readable and writable area of ​​a second image as a spare area of ​​the usage area; a second module configured to dynamically verify the data in the usage area in response to system startup; and a third module configured to recover the data with verification errors in the usage area from the data in the spare area in response to a verification error in the data in the usage area, and to dynamically verify the data in the usage area again.

[0016] In another aspect of the present invention, a computer device is also provided, including at least one processor; and a memory storing computer instructions executable on the processor, the instructions, when executed by the processor, implementing the steps of any of the methods described above.

[0017] In another aspect of the present invention, a computer-readable storage medium is provided, which stores a computer program that, when executed by a processor, implements any of the method steps described above.

[0018] This invention has at least the following beneficial effects: This application proposes a method and apparatus for improving the reliability of redundant systems. The embedded software performs static verification of the read-only area, dynamic verification of the readable area, and shared configuration of the independent space of the readable and writable areas. The read-only and readable / writable areas of the redundant system's image are replanned using a combination of shared and independent spaces, which can greatly improve the reliability of the redundant system. Specifically, it solves the problem of certain functional abnormalities caused by interference or partial damage to the image during long-term use, avoiding losses in various aspects due to system malfunctions; it solves the problem of data loss caused by inconsistent data in the image's readable and writable areas, and makes full use of resources, avoiding waste; it solves the problem of program abnormalities caused by illegal modification of configuration and other readable / writable content; it does not require specific hardware design for the operating platform, but is implemented based on algorithm logic and software coding, making it easy to promote. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other embodiments can be obtained based on these drawings without creative effort.

[0020] Figure 1 The diagram shown is an embodiment of a method for improving the reliability of a redundant system provided by the present invention;

[0021] Figure 2 The diagram shown is a schematic diagram of static verification of read-only regions provided by the present invention;

[0022] Figure 3 The diagram shown illustrates the shared configuration of the independent space of the readable and writable area provided by the present invention.

[0023] Figure 4 The diagram shown is a schematic diagram of dynamic verification of readable and writable areas provided by the present invention;

[0024] Figure 5A schematic diagram illustrating an embodiment of a device for improving the reliability of a redundant system provided by the present invention;

[0025] Figure 6 A schematic diagram illustrating an embodiment of a computer device provided by the present invention;

[0026] Figure 7 This is a schematic diagram of an embodiment of a computer-readable storage medium provided by the present invention. Detailed Implementation

[0027] The following describes embodiments of the present invention. However, it should be understood that the disclosed embodiments are merely examples, and other embodiments may take various alternative forms.

[0028] Furthermore, it should be noted that all uses of the terms "first" and "second" in the embodiments of this invention are for the purpose of distinguishing two entities or parameters with the same name but different names. Therefore, "first" and "second" are merely for convenience of expression and should not be construed as limiting the embodiments of this invention. Subsequent embodiments will not elaborate on this further. The terms "comprising," "including," or any other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements may include not only those elements but also elements not expressly listed or inherent to those processes, methods, articles, or apparatuses.

[0029] One or more embodiments of this application will now be described with reference to the accompanying drawings.

[0030] Based on the above objectives, the first aspect of the present invention provides an embodiment of a method for improving the reliability of a redundant system. Figure 1 The diagram shown is a schematic representation of an embodiment of a method for improving the reliability of a redundant system provided by the present invention. Figure 1 As shown, a method for improving the reliability of a redundant system according to an embodiment of the present invention includes the following steps:

[0031] S1. Set the read / write area of ​​the first image to the area used by the system loading, and set the read / write area of ​​the second image to the spare area of ​​the area used.

[0032] S2. In response to the system starting up, dynamically verify the data in the area of ​​use;

[0033] S3. In response to the presence of a verification error in the data of the usage area, the data with the verification error in the usage area is recovered using the data of the backup area, and the data of the usage area is dynamically verified again.

[0034] According to several embodiments of this application, it further includes: in response to system startup, loading a read-only region of the image that has started startup according to configuration information and performing static verification on the data in the read-only region.

[0035] According to several embodiments of this application, in response to a verification error in the data of the used area, restoring the data with the verification error in the used area using the data of the backup area, and performing dynamic verification on the data of the used area again includes: in response to a verification error in the data of the used area again, restoring the data with the verification error in the used area and the corresponding data of the backup area using the default value of the read-only area.

[0036] According to several embodiments of this application, in response to system startup, loading the read-only region of the startup image according to configuration information and performing static verification on the data in the read-only region includes: loading the data and boot program of the startup image's read-only region; calculating the integrity of the data in the startup image's read-only region and verifying it with the verification value stored in the startup image's read-only region.

[0037] According to several embodiments of this application, calculating the integrity of the data in the read-only region of the image at startup and verifying it against the checksum stored in the read-only region of the image at startup includes: in response to the calculated value of the data in the read-only region of the image at startup being consistent with the checksum stored in the read-only region of the image at startup, starting the software via the bootloader.

[0038] According to several embodiments of this application, calculating the integrity of the data in the read-only region of the image to be started and verifying it with the check value stored in the read-only region of the image to be started further includes: in response to the inconsistency between the calculated value of the data in the read-only region of the image to be started and the check value stored in the read-only region of the image to be started, loading another image to start.

[0039] According to several embodiments of this application, in response to the system starting to run, dynamic verification of the data in the usage area includes: loading the data in the usage area and a verification table; calculating the integrity of the data in the usage area and verifying it with the data in the verification table.

[0040] According to several embodiments of this application, in response to a verification error in the data of the usage area, restoring the data with the verification error in the usage area using data from the backup area, and then performing dynamic verification on the data of the usage area again includes: in response to a discrepancy between the calculated value of the data of the usage area and the verification value in the verification table, restoring the data with the discrepancy in the verification value of the usage area using data from the backup area, and then performing integrity calculation on the data of the usage area again.

[0041] According to several embodiments of this application, in response to a discrepancy between the calculated value of the data in the usage area and the check value in the check table, restoring the data in the usage area with the discrepancy using the data in the spare area, and performing integrity calculation on the data in the usage area again includes: re-checking the obtained calculated value with the data in the check table; in response to a discrepancy between the calculated value of the data in the usage area and the check value in the check table again, restoring the data in the usage area and the spare area with the discrepancy using the default value of the read-only area.

[0042] According to several embodiments of this application, it further includes: in response to receiving a trigger signal, updating the corresponding data of the usage area and the verification table of the usage area according to the trigger signal, and synchronizing it to the spare area.

[0043] The following is another embodiment of a method for improving the reliability of a redundant system according to the present invention. In this embodiment, a dual-mirror redundancy system is used. It should be understood that dual mirroring is only one method of redundancy system, and multiple mirror redundancy systems can be set up in practical applications. Static verification is performed on the read-only area in the dual-mirror redundancy system, the independent space of the read-write area is configured as shared, one mirror's read-write area is used as the system loading area, and the other is used as a spare area for the used area, and dynamic verification is performed on the used area.

[0044] Figure 2 The diagram shown is a schematic representation of the static verification of read-only regions provided by the present invention, as follows: Figure 2 As shown, when the system starts, it first selects the image to boot from based on the configuration information, and then enters the bootloader stage of that image. During the bootloader stage, the integrity of the data in the read-only regions to be loaded by the image to be booted is calculated. In this embodiment, the data in the read-only regions is checked using SHA-1, and then compared with the SHA-1 checksum embedded in the program. If they match, the embedded software boots normally; if they don't match, the configuration of the current boot image is marked as corrupted, and another image is selected for booting. For example, in a Linux system, the bootloader is U-Boot. After U-Boot boots, the static verification module for the read-only regions reads the device tree, kernel file system, and other programs and related fixed configurations into memory, and then checks the content of each read-only region using SHA-1. This is then compared one by one with the checksums of these read-only regions embedded in the image. If they don't match, a new image is selected for booting; if they all match, the kernel bootloader loads normally.

[0045] Figure 3 The diagram shown illustrates a shared configuration of independent spaces for the readable and writable regions provided by this invention. Figure 3As shown, in a dual-image redundancy system, each image has an independent read / write area. However, these areas are no longer used exclusively by each image; instead, they are shared areas. One image's read / write area is fixed as the system's load area, while the other serves as a backup. Upon system startup, it first selects to boot from Image1 or Image2 based on configuration information (loading the read-only area of ​​Image1 or Image2). Regardless of which image it boots from, after loading the selected read-only area and starting the system, it can access the resources of each image's read / write area. The first image's read / write area serves as the running area, and the second image's read / write area serves as the shared backup area. If the shared area is corrupted or damaged, the data in the running area is restored using the data from the backup area.

[0046] Figure 4 The diagram illustrates the dynamic verification of read / write areas provided by this invention. When the system starts running, it loads the data in the usage area and performs integrity calculations on the data. In this embodiment, the MD5 value of the data in the usage area is calculated and compared with a stored MD5 checksum table. If the comparison is successful, the data in the usage area is loaded and the system runs normally; if the comparison fails, the data in the usage area is considered corrupted, and the data in the usage area is restored using data from the backup area. After restoration, the data in the usage area is verified again. If the comparison is successful, the data in the usage area is loaded and the system runs normally; if the comparison fails, the data in both read / write areas is considered corrupted, and the data in the usage area and the backup area is restored using default values ​​stored in the read-only area. After restoration, the data in the usage area is loaded normally, and the system starts running.

[0047] During system operation, when the system receives an external trigger signal (such as a human-computer interaction interface: adding a user, changing a password, changing access permissions, etc.), it modifies the corresponding data in the usage area according to the trigger content, calculates the MD5 checksum of the modified data and updates it to the MD5 checksum table of the usage area, and then synchronizes the above data to the backup area.

[0048] A second aspect of the present invention provides an apparatus for improving the reliability of redundant systems. Figure 5 The diagram shown is a schematic representation of an embodiment of a device for improving the reliability of a redundant system provided by the present invention. Figure 5As shown, the present invention provides an apparatus for improving the reliability of a redundant system, comprising: a first module 011 configured to set a readable and writable area of ​​a first image as the usage area loaded by the system, and a readable and writable area of ​​a second image as a spare area of ​​the usage area; a second module 012 configured to dynamically verify the data in the usage area in response to the system starting to run; and a third module 013 configured to, in response to a verification error in the data of the usage area, recover the verification error data of the usage area using the data in the spare area, and dynamically verify the data of the usage area again.

[0049] To achieve the above objectives, a third aspect of the present invention provides a computer device. Figure 6 The diagram shown is a schematic representation of an embodiment of a computer device provided by the present invention. Figure 6 As shown, an embodiment of a computer device provided by the present invention includes the following modules: at least one processor 021; and a memory 022, the memory 022 storing computer instructions 023 that can be executed on the processor 021, the computer instructions 023 implementing the steps of the method described above when executed by the processor 021.

[0050] The present invention also provides a computer-readable storage medium. Figure 7 The diagram shown is a schematic representation of an embodiment of a computer-readable storage medium provided by the present invention. Figure 7 As shown, computer-readable storage medium 031 stores a computer program 032 that, when executed by a processor, performs the following steps.

[0051] Finally, it should be noted that those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program for setting system parameters can be stored in a computer-readable storage medium. When executed, the program can include the processes of the embodiments of the above methods. The storage medium for the program can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc. The above computer program embodiments can achieve the same or similar effects as any of the corresponding foregoing method embodiments.

[0052] Furthermore, the method disclosed in the embodiments of the present invention can also be implemented as a computer program executed by a processor, which may be stored in a computer-readable storage medium. When the computer program is executed by the processor, it performs the functions defined in the method disclosed in the embodiments of the present invention.

[0053] Furthermore, the above-described method steps and system units can also be implemented using a controller and a computer-readable storage medium for storing a computer program that enables the controller to perform the functions of the above-described steps or units.

[0054] Those skilled in the art will also understand that the various exemplary logic blocks, modules, circuits, and algorithm steps described in conjunction with the disclosure herein can be implemented as electronic hardware, computer software, or a combination of both. To clearly illustrate this interchangeability between hardware and software, the functionality of various illustrative components, blocks, modules, circuits, and steps has been generally described. Whether this functionality is implemented as software or as hardware depends on the specific application and the design constraints imposed on the system as a whole. Those skilled in the art can implement the functionality in various ways for each specific application, but such implementation decisions should not be construed as departing from the scope of the embodiments disclosed herein.

[0055] In one or more exemplary designs, functionality may be implemented in hardware, software, firmware, or any combination thereof. If implemented in software, the functionality may be stored as one or more instructions or code on or transmitted via a computer-readable medium. Computer-readable media include computer storage media and communication media, including any medium that facilitates the transfer of a computer program from one location to another. Storage media may be any available medium accessible to a general-purpose or special-purpose computer. By way of example, and not limitation, computer-readable media may include RAM, ROM, EEPROM, CD-ROM or other optical disc storage devices, disk storage devices or other magnetic storage devices, or any other medium that may be used to carry or store the required program code in the form of instructions or data structures and is accessible to a general-purpose or special-purpose computer or a general-purpose or special-purpose processor. Furthermore, any connection may be appropriately referred to as computer-readable media. For example, if software is transmitted from a website, server, or other remote source using coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technologies such as infrared, radio, and microwave, then the aforementioned coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, radio, and microwave are all included in the definition of media. As used herein, disks and optical discs include compact discs (CDs), laser discs, optical discs, digital versatile discs (DVDs), floppy disks, and Blu-ray discs, where disks typically reproduce data magnetically, while optical discs reproduce data optically using lasers. Combinations of the above should also be included within the scope of computer-readable media.

[0056] The above are exemplary embodiments disclosed in this invention. However, it should be noted that various changes and modifications can be made without departing from the scope of the embodiments of this invention as defined by the claims. The functions, steps, and / or actions of the methods according to the disclosed embodiments described herein do not need to be performed in any particular order. Furthermore, although the elements disclosed in the embodiments of this invention may be described or claimed individually, they may be understood as multiple unless explicitly limited to a singular number.

[0057] It should be understood that, as used herein, the singular form “a” is intended to include the plural form as well, unless the context clearly supports an exception. It should also be understood that, as used herein, “and / or” refers to any and all possible combinations of one or more of the associated listed items.

[0058] The embodiment numbers disclosed in the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0059] Those skilled in the art will understand that all or part of the steps of the above embodiments can be implemented by hardware or by a program instructing related hardware. The program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk.

[0060] Those skilled in the art should understand that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of the invention (including the claims) is limited to these examples. Within the framework of the invention, technical features of the above embodiments or different embodiments can be combined, and many other variations of different aspects of the invention exist, which are not provided in the details for the sake of brevity. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the invention should be included within the protection scope of the invention.

Claims

1. A method for improving the reliability of a redundant system, characterized in that, include: The read-only and read-write areas of the redundant images are reset, and the read-write area of ​​the first image is set as the area used by the system loading, and the read-write area of ​​the second image is set as the spare area of ​​the area used. In response to system startup, the read-only region of the image to be started is loaded according to the configuration information, and the data in the read-only region is statically verified. In response to the system starting up, the data in the area of ​​use is dynamically verified; In response to a verification error in the data of the usage area, the data with the verification error in the usage area is recovered using the data of the backup area, and the data of the usage area is dynamically verified again.

2. The method according to claim 1, characterized in that, The step of responding to a verification error in the data of the usage area, recovering the data with the verification error in the usage area using data from the backup area, and then dynamically verifying the data in the usage area again includes: In response to a new verification error in the data of the used area, the data with the verification error in the used area and the corresponding data in the spare area are restored using the default value of the read-only area.

3. The method according to claim 1, characterized in that, The step of responding to system startup by loading the read-only region of the image that is about to start up according to the configuration information and performing static verification on the data in the read-only region includes: Load the data and bootloader from the read-only region of the image that is about to start; The integrity of the data in the read-only region of the image that is started is calculated and verified against the checksum stored in the read-only region of the image that is started.

4. The method according to claim 3, characterized in that, The calculation of the integrity of the data in the read-only region of the image that has started to boot, and the verification with the checksum stored in the read-only region of the image that has started to boot, includes: The software is started via the bootloader when the calculated value of the data in the read-only region of the image being started is consistent with the verification value embedded in the read-only region of the image being started.

5. The method according to claim 4, characterized in that, The step of calculating the integrity of the data in the read-only region of the image that has started to boot, and verifying it with the checksum stored in the read-only region of the image that has started to boot, further includes: If the calculated value of the data in the read-only region of the image being started is inconsistent with the verification value embedded in the read-only region of the image being started, another image is loaded for startup.

6. The method according to claim 1, characterized in that, The dynamic verification of data in the usage area in response to the system starting up includes: Load the data and verification table of the area being used; The integrity of the data in the area of ​​use is calculated and verified against the data in the verification table.

7. The method according to claim 6, characterized in that, The step of responding to a verification error in the data of the usage area, recovering the data with the verification error in the usage area using data from the backup area, and then dynamically verifying the data in the usage area again includes: In response to the discrepancy between the calculated value of the data in the usage area and the check value in the check table, the data with the discrepancy in the check value of the usage area is recovered using the data in the spare area, and the integrity calculation of the data in the usage area is performed again.

8. The method according to claim 7, characterized in that, The step of responding to a discrepancy between the calculated value of the data in the usage area and the check value in the check table, restoring the data with the discrepancy using the data in the spare area, and then performing an integrity calculation on the data in the usage area again includes: The calculated value is then verified again against the data in the verification table. If the calculated value of the data in the usage area is inconsistent with the check value in the check table again, the data in the usage area and the spare area that is inconsistent with the check value is restored by the default value of the read-only area.

9. The method according to claim 1, characterized in that, Also includes: In response to receiving a trigger signal, the corresponding data of the used area and the verification table of the used area are updated according to the trigger signal, and synchronized to the spare area.

10. An apparatus for improving the reliability of a redundant system, characterized in that, The device includes: The first module configures the read-only and read-write areas of redundant images to be reset, setting the read-write area of ​​the first image as the area used by the system loading, and the read-write area of ​​the second image as the spare area of ​​the area used. The second module is configured to dynamically verify the data in the area in use in response to the system starting up. The third module is configured to respond to a verification error in the data of the usage area by recovering the data with the verification error in the usage area using the data of the backup area, and then dynamically verifying the data of the usage area again. And a module configured for the following functions: in response to system startup, loading the read-only region of the image to be started according to the configuration information and performing static verification on the data in the read-only region.

11. A computer device, characterized in that, include: At least one processor; as well as A memory storing computer instructions executable on the processor, which, when executed by the processor, implement the steps of the method according to any one of claims 1-9.

Images