Memory management method and apparatus for multi-tenant environment

Abstract

The application provides a memory management method and device of a multi-tenant environment, which are applied to a network security device. The network security device includes a user state process, a memory, and supports multiple sub-services. Through the user state process, if it is found that a first tenant is configured for a first sub-service, when the first sub-service is configured for the first time, a first storage space of the memory is applied for the first sub-service, a global hash table of the first sub-service is stored in the first storage space, and the configuration of the first tenant for the first sub-service is stored in the first storage space. When the first sub-service is not configured for the first time, the configuration of the first tenant for the first sub-service is stored in a second storage space which has been applied for by the first sub-service. Thus, the waste of the memory is reduced.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a memory management method and apparatus for a multi-tenant environment. Background Technology

[0002] Network security devices can support various business types of deep packet inspection (DPI), such as intrusion prevention system (IPS), URL filtering, data filtering, and file filtering. For example, multiple business modules can be customized in network security devices, with each module performing a type of packet inspection, thereby achieving diversified deep packet inspection to ensure security.

[0003] In order to better provide security protection services, network security devices can support multi-tenant environments (vsystems) to customize DPI sub-services according to the needs of tenants. These DPI sub-services can include intrusion prevention IPS, URL filtering, data filtering, file filtering, and so on.

[0004] Currently, when supporting sub-services for various tenants, network security devices do not consider whether a tenant has initiated configuration for a particular service. Instead, they request memory from the kernel even without relevant configuration, waiting for the tenant to configure the service later. Understandably, when a network security device customizes a DPI sub-service but hasn't enabled the corresponding service configuration or only enabled configuration for some service modules, memory is already allocated for these unconfigured services. This memory is used to store the sub-service's feature database data or a global hash table for global configuration when the tenant later enables the sub-service. In other words, memory is already occupied before the sub-service is configured, making this memory unusable after device startup. If the sub-service remains unconfigured, this memory is wasted, impacting data flow forwarding and concurrency performance due to memory being occupied even when tenants haven't enabled the sub-service's configuration. Summary of the Invention

[0005] In view of this, this application provides a memory management method and apparatus for a multi-tenant environment to reduce memory waste.

[0006] Specifically, this application is implemented through the following technical solution:

[0007] According to a first aspect of this application, a memory management method for a multi-tenant environment is provided, applied to a network security device, the network security device including user-mode processes and memory, the network security device supporting multiple sub-services, the method comprising:

[0008] If the user-mode process detects that the first tenant is configuring the first sub-service, and the first sub-service is being configured for the first time, it requests the first storage space of the memory for the first sub-service, stores the global hash table of the first sub-service in the first storage space, and stores the configuration of the first tenant for the first sub-service in the first storage space.

[0009] If the first sub-service is not being configured for the first time, the configuration of the first tenant for the first sub-service will be stored in the second storage space already requested by the first sub-service.

[0010] According to a second aspect of this application, a memory management device for a multi-tenant environment is provided, applied in a network security device, the network security device including user-mode processes and memory, the network security device supporting multiple sub-services, the device comprising:

[0011] The judgment unit is used to determine whether the first sub-service is being configured for the first time if the user-mode process detects that the first tenant is configuring the first sub-service.

[0012] The application unit is used to apply for the first storage space of the memory for the first sub-service when the judgment result of the judgment unit is that the first sub-service is being configured for the first time.

[0013] The storage unit is used to store the global hash table of the first sub-service in the first storage space, and to store the configuration of the first tenant for the first sub-service in the first storage space.

[0014] The storage unit is further configured to, when the determination result of the determination unit is that the first sub-service is not being configured for the first time, store the configuration of the first tenant for the first sub-service in the second storage space already applied for by the first sub-service.

[0015] According to a third aspect of this application, an electronic device is provided, including a processor and a machine-readable storage medium storing a computer program executable by the processor, the processor being prompted by the computer program to perform the method provided in the first aspect of the embodiments of this application.

[0016] According to a fourth aspect of this application, a machine-readable storage medium is provided, which stores a computer program that, when invoked and executed by a processor, causes the processor to perform the method provided in the first aspect of the embodiments of this application.

[0017] The beneficial effects of the embodiments of this application are as follows:

[0018] In the memory management method and apparatus for a multi-tenant environment provided in this application embodiment, if a user-space process detects that a first tenant is configuring a first sub-service, and if the first sub-service is being configured for the first time, a first storage space of memory is requested for the first sub-service, the global hash table of the first sub-service is stored in the first storage space, and the configuration of the first tenant for the first sub-service is also stored in the first storage space; if the first sub-service is not being configured for the first time, the configuration of the first tenant for the first sub-service is stored in the second storage space already requested by the first sub-service. Since this application only requests memory for a sub-service to store its global hash bucket when the sub-service is configured for the first time, instead of requesting memory in advance for each sub-service, the problem of wasted memory resources caused by requesting memory for each sub-service in advance is solved. In other words, more memory supports the forwarding and concurrency of data flows, thus not affecting the forwarding and concurrency performance of data flows in network security devices. Attached Figure Description

[0019] Figure 1 This is a flowchart illustrating a memory management method for a multi-tenant environment provided in an embodiment of this application;

[0020] Figure 2 This is a flowchart illustrating another memory management method for a multi-tenant environment provided in this application embodiment;

[0021] Figure 3 This is a schematic diagram of the structure of a memory management device for a multi-tenant environment provided in an embodiment of this application;

[0022] Figure 4 This is a schematic diagram of the hardware structure of an electronic device that implements a message processing method according to an embodiment of this application. Detailed Implementation

[0023] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application.

[0024] The terminology used in this application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The singular forms “a,” “the,” and “the” used herein are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any and all possible combinations of one or more of the corresponding listed items.

[0025] It should be understood that although the terms first, second, third, etc., may be used in this application to describe various information, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to determination."

[0026] The memory management method for the multi-tenant environment provided in this application will be described in detail below.

[0027] See Figure 1 , Figure 1 This is a flowchart illustrating a memory management method for a multi-tenant environment provided in this application. This method can be applied to network security devices, which include user-mode processes, memory, and support multiple sub-services. When implementing the above method, the network security device may include the following steps:

[0028] Step 101: If the user-space process detects that the first tenant is configuring the first sub-service, determine whether the first sub-service is being configured for the first time. If the first sub-service is being configured for the first time, proceed to step 102. If the first sub-service is not being configured for the first time, proceed to step 103.

[0029] In this step, multiple sub-services within the network security device can be sub-services of the Deep Packet Inspection (DPI) service, including but not limited to Intrusion Prevention System (IPS), URL filtering, data filtering, file filtering, antivirus, URL reputation, domain reputation, IP reputation, WAF, IoT device security management, etc. The aforementioned network security device supports multi-tenant environments.

[0030] To facilitate memory management of network security devices, this embodiment proposes that the aforementioned multiple sub-services share a single user-space process, which monitors whether each sub-service is configured. For example, when the first tenant configures (can be understood as forward configuration) any one of the multiple sub-services, it can enter the tenant view, select the sub-service to be configured, and then send a configuration message for the first sub-service to the user-space process. This configuration message can carry the tenant information of the first tenant and the service ID of the first sub-service; the tenant information is different for different tenants. In this way, after receiving the configuration message, the user-space process can determine which tenant is configuring which sub-service based on the configuration message.

[0031] Step 102: Apply for the first storage space of the memory for the first sub-service, store the global hash table of the first sub-service in the first storage space, and store the configuration of the first tenant for the first sub-service in the first storage space.

[0032] Specifically, since each sub-service has a global hash table used to store the feature database data and global configuration (configuration shared by all tenants for the sub-service), when the user-space process discovers that the first tenant has configured the first sub-service, it will determine whether the first sub-service is being configured for the first time. If the result is yes, it indicates that the first sub-service has not been configured by any tenant before, which also means that the global hash table corresponding to the first sub-service has not been written into memory. Based on this, this embodiment proposes that the user-space process can apply for a storage space from the memory of the network security device, denoted as the first storage space, and record the correspondence between the first sub-service and the first storage space, so that the first storage space can store the global hash table of the first sub-service and the configuration made by the first tenant for the first sub-service.

[0033] Specifically, the user-space process can send an initialization message to the kernel of the first sub-service to instruct the kernel to initialize the global hash bucket required by the first sub-service. This maps the feature library data (shared by multiple tenants) and global configuration of the first sub-service to the global hash bucket, and then stores the global hash bucket in the first storage space. Simultaneously, the configuration of the first tenant for the first sub-service is also stored in the first storage space. In other words, this application does not pre-allocate memory for the first sub-service when it is customized. Instead, it allocates memory for the first sub-service and stores the corresponding global hash bucket and the tenant's configuration for that sub-service only when the first sub-service is first configured by the tenant. This solves the problem of wasted memory resources caused by pre-allocating memory for each sub-service, meaning there is more memory to support the forwarding and concurrency of data flows, thus not affecting the forwarding and concurrency performance of network security devices.

[0034] In addition, in a multi-tenant device environment, each sub-service has its own separate initialization interface. Tenants initiate the configuration of each sub-service through their respective initialization interfaces. Based on this, user-space processes identify which sub-service is currently being configured through their respective initialization interfaces.

[0035] In addition, the number of tenants that network security devices can support can be, but is not limited to, 4095. Each tenant can be assigned a unique tenant ID, and based on this, the correspondence between tenant information and network ID can be maintained.

[0036] Step 103: If the first sub-service is not being configured for the first time, store the configuration of the first tenant for the first sub-service in the second storage space already requested by the first sub-service.

[0037] In this step, if the user-space process finds that the first sub-service is not being configured for the first time—meaning other tenants have already performed configuration operations on it—it indicates that the global hash bucket for the first sub-service is already in memory. Therefore, in this case, only the configuration performed by the first tenant on the first sub-service needs to be stored. For example, if the second storage space is used to store the global hash bucket after the first sub-service is configured for the first time, then the configuration performed by the first tenant on the first sub-service this time should also be stored in the second storage space.

[0038] In the memory management method for a multi-tenant environment provided in this application, if a user-space process detects that a first tenant is configuring a first sub-service, and if the first sub-service is being configured for the first time, a first storage space of memory is allocated for the first sub-service. The global hash table of the first sub-service is stored in the first storage space, as are the configurations of the first tenant for the first sub-service. If the first sub-service is not being configured for the first time, the configurations of the first tenant for the first sub-service are stored in the second storage space already allocated for the first sub-service. Since this application only allocates memory for a sub-service to store its global hash bucket when the sub-service is configured for the first time, instead of pre-allocating memory for each sub-service, it solves the problem of wasted memory resources caused by pre-allocating memory for each sub-service. In other words, more memory supports the forwarding and concurrency of data flows, thus not affecting the forwarding and concurrency performance of network security devices.

[0039] Optionally, in one embodiment, the process of determining whether the first sub-service is configured for the first time can be as follows: query whether the data of the first sub-service exists in the DBM data, or query whether the data of the user-space storage includes the data of the first sub-service; if neither exists, it is determined that the first sub-service is configured for the first time; otherwise, it is determined that the first sub-service is not configured for the first time.

[0040] Optionally, based on the above embodiments, this embodiment proposes a method for determining whether the first sub-service is being configured for the first time: obtaining the first bitmap corresponding to the first sub-service; if the first bitmap meets the set conditions, then determining that the first sub-service is being configured for the first time; if the first bitmap does not meet the set conditions, then determining that the first sub-service is not being configured for the first time.

[0041] Specifically, to facilitate the management of various sub-services by user-space processes, this embodiment proposes maintaining a bitmap for each sub-service. This bitmap identifies the configuration status of each sub-service by a tenant. Specifically, each bit in the bitmap of each sub-service represents whether a tenant has configured the sub-service. Different tenants correspond to different bits, but which bit corresponds to which tenant can be determined based on whether the tenant initiated the configuration. If a sub-service has not been configured by any tenant, its bitmap is empty. When a tenant configures the sub-service, the unmarked bits in the corresponding bitmap can be marked, such as by marking the selected bit with the tenant's identifier and setting its value to 1. Thus, the configuration status of the corresponding sub-service can be determined through the bitmap.

[0042] Based on this, this embodiment proposes that a bitmap can be used to identify whether a sub-service is being configured for the first time. For example, the bitmap of the first sub-service is obtained, and to distinguish it from the bitmaps of other sub-services, the bitmap of the first sub-service is designated as the first bitmap. Based on this, the aforementioned setting condition can be that the first bitmap is empty; that is, if the first bitmap is empty, it is determined that the aforementioned setting condition is met, indicating that no tenant has yet configured the first sub-service. Based on this, the user-space process can determine that the first sub-service is being configured for the first time. If any bit in the first bitmap is marked, it indicates that the aforementioned setting condition is not met, that is, a tenant has already configured the first sub-service, and in this case, it can be determined that the first sub-service is not being configured for the first time.

[0043] Furthermore, this embodiment also proposes the following process: when the first tenant is configuring the first sub-service for the first time, the bit position corresponding to the first tenant in the first bitmap is set to 1; when the first tenant is not configuring the first sub-service for the first time, the value of the bit position corresponding to the first tenant in the first bitmap remains unchanged.

[0044] Specifically, the first bit in the diagram represents the tenant configuration information for the first sub-service. Therefore, to avoid duplicate recording, this embodiment proposes that after the user-space process receives the configuration message from the first tenant, it obtains the tenant ID of the first tenant based on the configuration message. It can then determine whether the tenant ID marked in the first bit diagram is the first tenant's tenant ID. If the first tenant's tenant ID is present, it indicates that the first tenant has not configured the first sub-service for the first time; the current configuration might be a reconfiguration, etc. In this case, the value of the bit corresponding to the first tenant in the first bit diagram remains unchanged. If the first tenant's tenant ID is not present, it indicates that the first tenant has not yet configured the first sub-service. Based on this, a bit can be selected to mark the tenant ID of the first tenant, and the value of this bit can be set to 1. This signifies that the first tenant has configured the first sub-service.

[0045] Specifically, when obtaining a tenant ID, the configuration-level context information of the first tenant can be obtained, the tenant information can be extracted from the context information, and a unique tenant ID can be assigned to it.

[0046] It should be noted that this embodiment can be implemented before or after determining whether the first sub-service is being configured for the first time. This embodiment does not limit this to either step.

[0047] It should be noted that when it is determined that the first tenant is configuring the first sub-service for the first time, and the bit corresponding to the first tenant in the first bit diagram is set to 1, the following process can be used to determine whether the first bit diagram meets the set conditions: If only the bit of the tenant ID of the first tenant is set to 1 in the first bit diagram, it indicates that no other tenant has issued configurations for the first sub-service before the first tenant configured it. Based on this, it can be determined that the set conditions are met, and thus the first sub-service is determined to be configured for the first time. If other bits are also set to 1, it indicates that the set conditions are not met, meaning that other tenants have already configured the first sub-service before the first tenant configured it. This indicates that the global hash table that the kernel needs to initialize in memory has been completed, and thus the first sub-service is determined not to be configured for the first time. When the first tenant is not configuring the first sub-service for the first time, the bit corresponding to the first tenant in the first bit diagram remains unchanged, and it can be directly determined that the first sub-service is not configured for the first time.

[0048] When setting the value of the bit corresponding to the first tenant in the first bit map to 1, it can be done as follows: Based on the mapping relationship between the bit and the tenant ID, set the value of the bit corresponding to the tenant ID of the first tenant to 1. To better understand this embodiment, the following example is used for illustration: Assume that the maximum number of tenants is 80, the tenant IDs are 0-79, the bit map size is 10 bytes, and each byte has 10 bits. Then, select 80 bits from the bit map. These 80 bits are numbered sequentially as 0, 1, 2, 3, ..., 79. These 80 bits correspond one-to-one with the 80 tenants. Thus, if the current tenant ID is 10, then the value of the tenth bit in these 80 bits can be set to 1, that is, the value of the 10%8+1th bit in the 10 / 8th byte of the bit map is set to 1.

[0049] Therefore, in this embodiment, when the network security device starts up, it no longer directly requests memory for storing feature database data or global hash table used to store global configuration (shared by multiple tenants). Instead, it only needs to send a message to notify the service kernel to request the memory required for storing the global hash table and to configure the global hash table and the sub-service according to the actual configuration situation, that is, when the sub-service is configured for the first time.

[0050] Based on any of the above embodiments, the multi-tenant memory management method provided in this embodiment may further include: Figure 2 The following process is shown:

[0051] Step 201: If, through the user-mode process, it is found that a second tenant has deleted the configuration of the second sub-service, then the configuration of the second tenant for the second sub-service is deleted from the third storage space corresponding to the second sub-service in the memory.

[0052] Specifically, in practical applications, there may be situations where tenants delete configurations (i.e., reverse configuration). For ease of description, we will take the deletion of a second sub-service by a second tenant as an example. The second tenant can be any tenant, and the second sub-service can be any sub-service supported by the network security device. When a second tenant wants to delete the previous configuration for the second sub-service, it can initiate a deletion instruction. Upon receiving this instruction, the user-space process can locate the storage space corresponding to the second sub-service, such as the third storage space, and then delete the previous configuration made by the second tenant for the second sub-service from the third storage space. For example, the user-space process can record the location information of the configurations made by each tenant for the second sub-service in the third storage space; then, based on the recorded location information, it can find the location information of the configuration made by the second tenant and then delete it.

[0053] Step 202: If all tenants' configurations for the second sub-service have been deleted, then the global hash table of the second sub-service is cleared from the third storage space.

[0054] In this step, after deleting the configuration corresponding to the second tenant, there may be cases where the configurations of other tenants have also been deleted. Therefore, in order to free up more memory, the user-space process will further determine whether the configurations of each tenant for the second sub-service have been completely deleted. If it is found that all have been deleted, it means that the global hash table of the second sub-service is currently useless. Based on this, to save memory, the user-space process can send a deletion instruction to the kernel corresponding to the sub-service, instructing the kernel to delete the global hash table recorded in the third storage space, thereby freeing up the third storage space and saving memory. If there are still configurations of other tenants, only the configuration of the second tenant for the second sub-service needs to be deleted, and the other contents in the third storage space remain unchanged.

[0055] Furthermore, after deleting the second tenant's configuration for the second sub-service in the third storage space corresponding to the second sub-service in memory, the process further includes setting the value of the bit corresponding to the tenant in the second bitmap corresponding to the second sub-service to 0.

[0056] Specifically, to facilitate the monitoring and processing of each sub-service, the bitmap of the sub-service will be updated periodically. Specifically, when the second tenant performs configuration deletion processing on the second sub-service, the value of the bit corresponding to the tenant ID of the second tenant in the second bitmap can be set to 0 to indicate that the second tenant has deleted the configuration related to the second sub-service.

[0057] Based on this, it can be determined that the configurations for the second sub-service of each tenant have been deleted using the following method: if the value of each bit in the second bitmap of the second sub-service is 0, then it is determined that the configurations for the second sub-service of each tenant have been deleted.

[0058] Specifically, since the second bitmap is used to represent the configuration of each tenant for the second sub-service, it can be used to identify whether all tenants have deleted the configuration of the second sub-service. That is, when the values ​​of the bits corresponding to each tenant in the second bitmap are all empty, it indicates that each tenant has deleted the configuration of the second sub-service, and thus the storage space occupied by the global hash table corresponding to the second sub-service in memory can be released.

[0059] Optionally, based on any of the above embodiments, the memory management method for a multi-tenant environment provided in this embodiment may further include: through a user-space process, when the network security device is detected to be restarted, restoring the configurations of the third sub-service that were configured before the restart, so as to store the configurations of the third sub-service and the global hash table corresponding to the third sub-service in the memory; the third sub-service is at least one of the plurality of sub-services.

[0060] Specifically, in practical applications, network security devices may restart. After a restart, memory and bitmap cleanup are required. Therefore, a configuration recovery process must be executed after a restart, which includes both user-mode and kernel-mode configuration recovery. Specifically, user-mode configuration recovery is performed first, where user-mode processes restore the configurations of each tenant for each sub-service. Once the configurations for each sub-service are restored, the user-mode configuration recovery is complete. Then, kernel-mode configuration recovery is performed. This involves iterating through each sub-service. For the currently encountered third sub-service (any one of the sub-services), if a tenant has configured it, a storage instruction is sent to the kernel of the third sub-service, instructing the kernel to store the global hash table corresponding to the third sub-service and the tenant's configuration in memory. If no tenant has configured the third sub-service, the process ends, meaning no more memory is allocated for the third sub-service, and therefore, the global hash table of the third sub-service does not need to be stored in memory.

[0061] Furthermore, in this embodiment, the above method may further include: setting the value of the bit corresponding to the tenant of each configuration to 1 in the third bitmap corresponding to the third sub-service.

[0062] Specifically, for the third sub-service, if it is detected that a tenant has configured the third sub-service before restarting, in order to facilitate the subsequent monitoring and processing of the third sub-service, the third bitmap of the third sub-service will be obtained, and the value of the bit corresponding to the tenant who has configured the third sub-service will be set to 1 to indicate that the tenant has configured the third sub-service.

[0063] Therefore, in a multi-tenant device environment, each sub-service is configured with its own bitmap for managing multi-tenancy and sub-services. The bitmap is used to mark whether the configuration of the corresponding sub-service has been issued in each tenant. By setting the bitmap to 1, clearing it to 0, and judging the bitmap in three scenarios—forward configuration, reverse configuration, and device restart—the timing of memory allocation for the kernel storage global hash table of the corresponding sub-service is controlled. This solves the problem of memory waste after device startup caused by the fact that network security devices have customized sub-services but have not enabled the configuration of the corresponding sub-services or have only enabled the configuration of some sub-service modules.

[0064] Based on the same inventive concept, this application also provides a memory management device for a multi-tenant environment corresponding to the memory management method for the multi-tenant environment described above. Specific implementation details of this memory management device for a multi-tenant environment can be found in the above description of the memory management method for a multi-tenant environment, and will not be elaborated upon here.

[0065] See Figure 3 , Figure 3 This application provides an exemplary embodiment of a memory management device for a multi-tenant environment, applied in a network security device. The network security device includes user-mode processes and memory, and supports multiple sub-services. The device includes:

[0066] The judgment unit 301 is used to determine whether the first sub-service is being configured for the first time if the user-mode process finds that the first tenant is configuring the first sub-service.

[0067] The application unit 302 is used to apply for the first storage space of the memory for the first sub-service when the judgment result of the judgment unit 301 is that the first sub-service is configured for the first time.

[0068] Storage unit 303 is used to store the global hash table of the first sub-service in the first storage space, and to store the configuration of the first tenant for the first sub-service in the first storage space.

[0069] The storage unit 303 is further configured to, when the judgment result of the judgment unit 301 is that the first sub-service is not being configured for the first time, store the configuration of the first tenant for the first sub-service in the second storage space already applied for by the first sub-service.

[0070] Since this application only allocates memory for a sub-service when it is first configured to store the global hash bucket of that sub-service, instead of allocating memory for the sub-service in advance when it is customized, it solves the problem of wasted memory resources caused by pre-allocating memory for each sub-service. In other words, there is more memory to support the forwarding and concurrency of data streams, and thus it will not affect the forwarding and concurrency performance of data streams of network security devices.

[0071] Optionally, in this embodiment, the determination unit 301 is specifically used to obtain the first bit map corresponding to the first sub-service; if the first bit map meets the set conditions, it is determined that the first sub-service is configured for the first time; if the first bit map does not meet the set conditions, it is determined that the first sub-service is not configured for the first time.

[0072] Furthermore, the above-mentioned device may also include:

[0073] The processing unit (not shown in the figure) is configured to set the bit position corresponding to the first tenant in the first bitmap to 1 when the first tenant is configuring the first sub-service for the first time; and to keep the value of the bit position corresponding to the first tenant in the first bitmap unchanged when the first tenant is not configuring the first sub-service for the first time.

[0074] Optionally, based on any of the above embodiments, in this embodiment, the above-mentioned device may further include:

[0075] The deletion unit (not shown in the figure) is used to delete the configuration of the second tenant for the second sub-service in the third storage space corresponding to the second sub-service in the memory if the user-mode process finds that the second tenant has deleted the configuration of the second sub-service.

[0076] The aforementioned deletion unit (not shown in the figure) is also used to clear the global hash table of the second sub-service from the third storage space if the configurations for the second sub-service for each tenant have been deleted.

[0077] Furthermore, the apparatus provided in this embodiment may further include:

[0078] The first setting unit (not shown in the figure) is used to set the value of the bit corresponding to the tenant in the second bit diagram corresponding to the second sub-service to 0 after the deletion unit deletes the configuration of the second tenant for the second sub-service in the third storage space corresponding to the second sub-service in the memory.

[0079] Based on this, the above-mentioned deletion unit is also used to determine that the configuration of each tenant for the second sub-service has been deleted according to the following method: if the value of each bit in the second bit diagram of the second sub-service is 0, then it is determined that the configuration of each tenant for the second sub-service has been deleted.

[0080] Optionally, based on any of the above embodiments, in this embodiment, the above-mentioned device may further include:

[0081] The recovery unit (not shown in the figure) is used to restore the configurations of the third sub-service that were configured before the restart when the network security device is detected to be restarted through the user-mode process, so as to store the configurations of the third sub-service and the global hash table corresponding to the third sub-service in the memory; the third sub-service is at least one of the plurality of sub-services.

[0082] Furthermore, the apparatus provided in this embodiment may further include:

[0083] The second setting unit (not shown in the figure) is used to set the value of the bit corresponding to the tenant of each configuration to 1 in the third bit diagram corresponding to the third sub-service.

[0084] Based on the same inventive concept, embodiments of this application provide an electronic device, which can be the aforementioned network security device. For example... Figure 4 As shown, the electronic device includes a processor 401 and a machine-readable storage medium 402. The machine-readable storage medium 402 stores a computer program executable by the processor 401. The processor 401 is prompted by the computer program to execute the memory management method for a multi-tenant environment provided in any embodiment of this application. Furthermore, the electronic device also includes a communication interface 403 and a communication bus 404, wherein the processor 401, the communication interface 403, and the machine-readable storage medium 402 communicate with each other via the communication bus 404.

[0085] The communication bus mentioned in the above electronic devices can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, only one thick line is used to represent it in the diagram, but this does not mean that there is only one bus or one type of bus.

[0086] The communication interface is used for communication between the aforementioned electronic devices and other devices.

[0087] The machine-readable storage medium 402 described above can be a memory, which may include random access memory (RAM), DDR SRAM (Double Data Rate Synchronous Dynamic Random Access Memory), or non-volatile memory (NVM), such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0088] The processors mentioned above can be general-purpose processors, including central processing units (CPUs), network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0089] Furthermore, this embodiment also provides a machine-readable storage medium storing a computer program that, when invoked and executed by a processor, causes the processor to perform the method provided in any embodiment of this application.

[0090] For embodiments of electronic devices and machine-readable storage media, since the methods involved are basically similar to those described in the foregoing method embodiments, the description is relatively simple, and relevant details can be found in the descriptions of the method embodiments.

[0091] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0092] The specific implementation process of the functions and roles of each unit / module in the above device can be found in the implementation process of the corresponding steps in the above method, and will not be repeated here.

[0093] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The units / modules described as separate components may or may not be physically separate. The components shown as units / modules may or may not be physical units / modules, that is, they may be located in one place or distributed across multiple network units / modules. Some or all of the units / modules can be selected to achieve the purpose of this application according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0094] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A memory management method for a multi-tenant environment, characterized in that, Applied to a network security device, the network security device including user-space processes and memory, the network security device supporting multiple sub-services, the method includes: If the user-mode process detects that the first tenant is configuring the first sub-service, and the first sub-service is being configured for the first time, it requests the first storage space of the memory for the first sub-service, stores the global hash table of the first sub-service in the first storage space, and stores the configuration content of the first tenant for the first sub-service in the first storage space. If the first sub-service is not being configured for the first time, the configuration content of the first tenant for the first sub-service is stored in the second storage space already requested by the first sub-service.

2. The method according to claim 1, characterized in that, The method for determining whether the first sub-service is being configured for the first time is as follows: Obtain the first image corresponding to the first sub-service; If the first bitmap meets the set conditions, then the first sub-service is determined to be configured for the first time; If the first bitmap does not meet the set conditions, it is determined that the first sub-service is not being configured for the first time.

3. The method according to claim 2, characterized in that, The method further includes: When the first tenant is configuring the first sub-service for the first time, the bit position corresponding to the first tenant in the first bitmap is set to 1. If the first tenant is not configuring the first sub-service for the first time, the value of the bit corresponding to the first tenant in the first bitmap remains unchanged.

4. The method according to claim 1, characterized in that, Also includes: If the user-mode process detects that a second tenant has deleted the configuration of the second sub-service, it deletes the configuration of the second tenant for the second sub-service in the third storage space corresponding to the second sub-service in the memory. If all tenants have deleted their configurations for the second sub-service, then the global hash table for the second sub-service is cleared from the third storage space.

5. The method according to claim 4, characterized in that, After deleting the second tenant's configuration for the second sub-service within the third storage space corresponding to the second sub-service in the memory, the method further includes: Set the value of the bit corresponding to the tenant in the second bitmap corresponding to the second sub-service to 0; The following method was used to determine that all configurations for the second sub-service for each tenant had been deleted: If all bits in the second bitmap of the second sub-service are 0, then it is determined that the configurations for the second sub-service for each tenant have been deleted.

6. The method according to claim 1, characterized in that, Also includes: When the network security device restarts, the user-mode process restores the configurations of the third sub-service that were configured before the restart, and stores the configurations of the third sub-service and the global hash table corresponding to the third sub-service in the memory; the third sub-service is at least one of the plurality of sub-services.

7. The method according to claim 6, characterized in that, Also includes: In the third bitmap corresponding to the third sub-service, the value of the bit corresponding to the tenant for each configuration is set to 1.

8. A memory management device for a multi-tenant environment, characterized in that, Applied in network security devices, the network security devices include user-space processes and memory, and the network security devices support multiple sub-services. The device includes: The judgment unit is used to determine whether the first sub-service is being configured for the first time if the user-mode process detects that the first tenant is configuring the first sub-service. The application unit is used to apply for the first storage space of the memory for the first sub-service when the judgment result of the judgment unit is that the first sub-service is being configured for the first time. The storage unit is used to store the global hash table of the first sub-service in the first storage space, and to store the configuration content of the first tenant for the first sub-service in the first storage space. The storage unit is further configured to, when the determination result of the determination unit is that the first sub-service is not being configured for the first time, store the configuration content of the first tenant for the first sub-service in the second storage space already applied for by the first sub-service.

9. The apparatus according to claim 8, characterized in that, The determination unit is specifically used to obtain the first bit image corresponding to the first sub-service; if the first bit image meets the set conditions, it is determined that the first sub-service is configured for the first time; if the first bit image does not meet the set conditions, it is determined that the first sub-service is not configured for the first time.

10. The apparatus according to claim 9, characterized in that, The device further includes: The processing unit is configured to set the bit position corresponding to the first tenant in the first bitmap to 1 when the first tenant is configuring the first sub-service for the first time; and to keep the value of the bit position corresponding to the first tenant in the first bitmap unchanged when the first tenant is not configuring the first sub-service for the first time.

11. The apparatus according to claim 8, characterized in that, Also includes: The deletion unit is used to delete the configuration of the second tenant for the second sub-service in the third storage space corresponding to the second sub-service in memory if the user-mode process finds that a second tenant has deleted the configuration of the second sub-service. The deletion unit is further configured to clear the global hash table of the second sub-service from the third storage space if the configurations for the second sub-service for each tenant have been deleted.

12. The apparatus according to claim 11, characterized in that, Also includes: The first setting unit is used to set the value of the bit corresponding to the tenant in the second bitmap corresponding to the second sub-service to 0 after the deletion unit deletes the configuration of the second tenant for the second sub-service in the third storage space corresponding to the second sub-service in the memory. The deletion unit is further configured to determine that the configurations of each tenant for the second sub-service have been deleted according to the following method: if the value of each bit in the second bitmap of the second sub-service is 0, then it is determined that the configurations of each tenant for the second sub-service have been deleted.

13. The apparatus according to claim 8, characterized in that, Also includes: The recovery unit is used to restore the configurations of the third sub-service that were configured before the restart by the user-mode process after the network security device is detected to be restarted, so as to store the configurations of the third sub-service and the global hash table corresponding to the third sub-service in the memory; the third sub-service is at least one of the plurality of sub-services.

14. The apparatus according to claim 13, characterized in that, Also includes: The second setting unit is used to set the value of the bit corresponding to the tenant of each configuration to 1 in the third bit diagram corresponding to the third sub-service.

Images