Data access control process freezing and recovering method based on CRIU

Abstract

The invention discloses a CRIU-based data access control process freezing and recovering method, and relates to the technical field of data access strategies and containers, and the method comprises the following steps: S1, a user performs data access on a database, the database matches the data accessed by the user, encrypts and verifies the data, and sends the verified data to a cloud server; s2, expanding and modifying the source code of the CRIU, and storing the node of the socket and the file identifier of the socket through dump operation; s3, calling a UI interface of the CRIU, and obtaining a service list of a local data access control strategy related process and process control characters and socket data of a system data access control strategy related process; s4, freezing and recovering the corresponding data, and executing broadcast reminding; freezing and restoring functions of the data access control strategy process are achieved, a user can restore the data access control strategy process according to needs, and the requirement for system resource shortage or system maintenance is effectively met.

Description

[0001] Methodology Area

[0002] The present invention relates to the field of data access strategy and container technology, and in particular to a CRIU-based data access control process freezing and recovery method.

[0003] Background Methods

[0004] With the rapid development of cloud computing and microservice architecture, high availability and flexibility of services have become crucial. In this context, process state management has become one of the key technologies.

[0005] In the prior art, for example, CN111090500B discloses a storage process management method and device, which, after extracting memory fragmentation characteristics and cache mapping characteristics from storage process data, determines the target storage process running node of the current distributed storage node, and determines the virtual process domain of the virtual memory page of the storage process category corresponding to the target storage process running node and the corresponding virtual process interface, and after performing a virtual process access to the storage process address corresponding to the current storage process status information in the virtual process domain according to the virtual process interface, updates the storage process status information in the virtual process domain, and performs storage process status management by combining memory fragmentation characteristics and cache mapping characteristics, which can facilitate subsequent targeted storage performance optimization, reduce the probability of abnormal storage process, and thus ensure the normal operation of storage services;

[0006] However, memory fragmentation will lead to a reduction in available memory space, which in turn affects the creation and execution of processes. At the same time, cache mapping involves mapping data blocks in main memory to cache. This process will cause data inconsistencies between different levels and make it impossible to synchronize operations, which increases the complexity of the system and reduces its flexibility.

[0007] Therefore, a CRIU-based data access control process freezing and recovery method is provided to solve the above problems. Summary of the invention

[0008] The purpose of the present invention is to provide a data access control process freezing and recovery method based on CRIU, which ensures that users can save the current service status without interfering with the service operation and restore it when needed. While retaining the original service status, it ensures that debugging can be carried out normally after recovery, thereby improving the flexibility and maintainability of the system. At the same time, it ensures data consistency before performing important operations, avoids unauthorized access or data corruption, supports process recovery under different environments or conditions, and adapts to dynamically changing computing environments.

[0009] To achieve the above object, the present invention provides a method for freezing and restoring a data access control process based on CRIU, comprising the following steps: S1: The user accesses the database, the database matches the data accessed by the user, encrypts and verifies the data, and sends the verified data to the cloud server; S2: Expand and modify the source code of CRIU, and save the node node of the socket and the file identifier fd of the socket through the dump operation; S3: Call the UI interface of CRIU to obtain the service list of the processes related to the local data access control policy and the process control symbol pid and socket data of the processes related to the system data access control policy; S4: Enable root privileges, obtain processes related to the data access control policy through the process control symbol pid and socket data, freeze and restore processes related to the data access control policy, and when a user accesses a frozen process, the system broadcasts a warning.

[0010] Preferably, step S2 specifically includes the following steps: S21: Call dump_unix_opts function, open the socket through the file identifier fd of the socket, and store the socket in the pointer corresponding to the UnixOptsEntry structure; S22: Initialize an integer variable to 0, and store the return value of the dump_unix_opts function in the initialized integer variable; S23: calling the dump_opt function to obtain four socket data, and storing the four socket data in four socket options respectively; S24: converting the socket data in the socket option into a Boolean value, and storing the Boolean value in the flag bits corresponding to the socket option; S25: Call the restore_unix_opts function to verify the existence and adjustability of the socket options.

[0011] Preferably, in step S23, the four socket options are SO_REUSEADDR, SO_KEEPALIVE, SO_TYPE and SO_REUSEPORT, wherein SO_REUSEADDR reuses the local address, SO_KEEPALIVE enables the keep-alive mechanism, SO_TYPE obtains the type of the socket, and SO_REUSEPORT binds multiple sockets to the same port.

[0012] Preferably, in step S3, obtaining a service list of processes related to the local data access control policy specifically includes the following steps: S31: Start an external process through Qprocess in the Qt framework; S32: The external process sends a message to the data access control policy related process through the command line tool dbus-send, and the external process interacts with the data access control policy related process through the session bus; S33: specifying the service name of the process related to the data access control policy through DBus, and calling the interface position of the corresponding process related to the data access control policy; S34: Return the name list of the processes related to the registered data access control policy through the ListNames operation; S35: Segment the name list of the registered data access control policy related processes returned in step S34 by means of regular expressions, and classify the segmented name list.

[0013] Preferably, the session bus in step S32 is set as a dedicated connection for the user session.

[0014] Preferably, in step S3, the process control symbol pid and socket data of the process related to the system data access control policy are obtained by using a library acquisition method or a process name acquisition method.

[0015] Preferably, the library acquisition method specifically includes the following steps: Step 1: Initialize the glibc library and socket-API library of the system data access control policy related processes; Step 2: Call the method for obtaining the process control symbol pid in the glibc library, and obtain the control symbol pid according to the returned method. At the same time, call the method for obtaining the socket data in the socket-API library, and obtain the socket data according to the returned method. Step 3: Use the lsof command to obtain the node node of the socket data in step 2.

[0016] Preferably, step S4 specifically includes the following steps: S41: Use the pkexec command to enable root privileges. After the user enters the password in the graphical interface, the graphical interface program is executed as a special identity. S42: Initialize request options and set service address; S43: Open the specified directory file_address and obtain the file identifier fd corresponding to the specified directory file_address, and store the dumped image in the specified directory file_address; S44: Setting the file identifier fd of the image directory through the set_images_dir_fd function, and storing the dumped file in the image directory; S45: Establish an external TCP connection. CRIU connects to the external TCP through the Unix domain socket unix_id_char. S46: Send desktop notifications in Linux desktop environment through the command line tool notify-send.

[0017] Therefore, the present invention adopts a CRIU-based data access control process freezing and recovery method of the above structure, which has the following beneficial effects: (1) It not only preserves the original service status, but also ensures that debugging can be performed normally after recovery, thus improving the flexibility and maintainability of the system; (2) By freezing the process, data consistency can be ensured before performing important operations, avoiding unauthorized access or data corruption; (3) It has a wide range of applications and supports process recovery in different environments or under different conditions, while adapting to dynamically changing computing environments.

[0018] The method scheme of the present invention is further described in detail below through the drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 A flowchart of a method for freezing and restoring a data access control process based on CRIU according to the present invention; Figure 2 The present invention is a technical design flow chart of a user interaction interface of a CRIU-based data access control process freezing and recovery method. DETAILED DESCRIPTION

[0020] The method scheme of the present invention is further described below through drawings and embodiments.

[0021] Unless otherwise defined, method terms or scientific terms used in the present invention shall have the common meanings understood by one of ordinary skill in the art to which the present invention belongs.

[0022] The words "include" or "comprises" and the like used in the present invention mean that the elements before the word include the elements listed after the word, and do not exclude the possibility of also including other elements. The orientation or position relationship indicated by the terms "inside", "outside", "upper", "lower", etc. is based on the orientation or position relationship shown in the drawings, which is only for the convenience of describing the present invention and simplifying the description, and does not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation. Therefore, it cannot be understood as a limitation of the present invention. When the absolute position of the described object changes, the relative position relationship may also change accordingly. In the present invention, unless otherwise clearly specified and limited, the terms "attachment" and the like should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral body; it can be directly connected, or indirectly connected through an intermediate medium, and it can be the internal connection of two elements or the interaction relationship between two elements. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0023] Example like Figure 1 and Figure 2 As shown, the present invention provides a method for freezing and restoring a data access control process based on CRIU, comprising the following steps: S1: The user accesses the database, the database matches the data accessed by the user, encrypts and verifies the data, and sends the verified data to the cloud server; S2: Expand and modify the source code of CRIU, save the node node of the socket and the file identifier fd of the socket through the dump operation dump, so as to improve the integrity of the process recovery, add the processing of the file identifier fd in the dump operation dump, ensure that the state of the socket and the related metadata are saved together when the checkpoint is created, so that CRIU can call the data correctly when restoring the process, and enable the application related to the socket to be seamlessly restored to the state before freezing; Step S2 specifically includes the following steps: S21: Call dump_unix_opts function, open the socket through the file identifier fd of the socket, and store the socket in the pointer corresponding to the UnixOptsEntry structure; S22: Initialize an integer variable to 0, and store the return value of the dump_unix_opts function in the initialized integer variable; S23: calling the dump_opt function to obtain four socket data, and storing the four socket data in four socket options respectively; In step S23, four socket options are SO_REUSEADDR, SO_KEEPALIVE, SO_TYPE and SO_REUSEPORT, where SO_REUSEADDR reuses the local address, SO_KEEPALIVE enables the keep-alive mechanism, SO_TYPE obtains the type of the socket, and SO_REUSEPORT binds multiple sockets to the same port; S24: converting the socket data in the socket option into a Boolean value, and storing the Boolean value in the flag bits corresponding to the socket option, respectively, to ensure that the previously saved options can be restored before the connection is made, and that the configuration of the socket can be correctly applied when the connection is established; S25: call the restore_unix_opts function, which can restore the relevant options of the socket data from the UnixOptsEntry structure, and ensure that the socket can be set correctly during the recovery process by checking the existence and adjustability of the socket options; S3: Call the UI interface of CRIU to obtain the service list of the processes related to the local data access control policy and the process control symbol pid and socket data of the processes related to the system data access control policy, and finally realize the monitoring and management of process services; In step S3, the process control symbol pid and socket data of the process related to the system data access control policy are obtained by using a library acquisition method or a process name acquisition method, and the process list in the system is queried through a system call or an API interface, so that the user can easily locate the target process; The library acquisition method specifically includes the following steps: Step 1: Initialize the glibc library and socket-API library of the system data access control policy related processes; Step 2: Call the method for obtaining the process control symbol pid in the glibc library, and obtain the control symbol pid according to the returned method. At the same time, call the method for obtaining the socket data in the socket-API library, and obtain the socket data according to the returned method. Step 3: Use the lsof command to obtain the node node of the socket data in step 2, and obtain the node connected to the socket associated with the target process. Usually, the system API is used to collect network information. The API provided by the system process is used to design the corresponding message format to facilitate sending requests or obtaining process status. The operation results are presented through a graphical interface. Monitor is used to obtain the access status of the process service. In the background, the CRIU API is called to load the process checkpoint file and restore the process status. The CRIU UI interface will provide clear status feedback. In step S3, a service list of processes related to the local data access control policy is obtained, which specifically includes the following steps: S31: Start an external process through Qprocess in the Qt framework; S32: The external process sends a message to the data access control policy related process through the command line tool dbus-send. The external process interacts with the data access control policy related process through the session bus, not the system bus. The parameter print-reply in the command line tool dbus-send is used to instruct dbus-send to wait for a reply to the message and output the reply to the standard output. The session bus in step S32 is set as a dedicated connection for the user session; S33: specify the service name of the process related to the data access control policy through DBus, and call the interface position of the corresponding process related to the data access control policy, specify the service name of the process related to the data access control policy through dest=org.freedesktop.DBus, and specify the object path to be called through / org / freedesktop / DBus. The specified object path to be called is the interface position of the corresponding process related to the data access control policy; S34: Return the name list of the processes related to the registered data access control policy through the ListNames operation; S35: segmenting the name list of the registered data access control policy related processes returned in step S34 by means of regular expressions, and classifying the segmented name list; S4: Open the root permission, obtain the process related to the data access control policy through the process control symbol pid and socket data, use the CRIU API call form, implement the CRIU freezing and recovery operations on the process related to the data access control policy in the UI interface, and when the user accesses the frozen process, the system will issue a warning; Step S4 specifically includes the following steps: S41: Use the pkexec command to enable root privileges. After the user enters the password in the graphical interface, the graphical interface program is executed as a special identity. S42: Initialize request options and set service addresses to facilitate dumping and restoring operations of related processes; S43: Open the specified directory file_address and obtain the file identifier fd corresponding to the specified directory file_address, and store the dumped image in the specified directory file_address; S44: Setting the file identifier fd of the image directory through the set_images_dir_fd function, and storing the dumped file in the image directory; S45: Establish an external TCP connection. CRIU connects to the external TCP through the Unix domain socket unix_id_char. This allows CRIU to maintain a connection with the external process during the dump process. S46: Send desktop notifications in the Linux desktop environment through the command line tool notify-send to remind freezing and restoring operations of process services related to the data access control policy.

[0024] Therefore, the present invention adopts the above-mentioned CRIU-based data access control process freezing and recovery method, so that users can save the current service status without interfering with the service operation, and restore it when needed. It not only retains the original service status, but also ensures that debugging can be carried out normally after recovery, thereby improving the flexibility and maintainability of the system.

[0025] Finally, it should be noted that the above embodiments are only used to illustrate the method scheme of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, ordinary method personnel in the field should understand that they can still modify or replace the method scheme of the present invention with equivalents, and these modifications or equivalent replacements cannot cause the modified method scheme to deviate from the spirit and scope of the method scheme of the present invention.

Claims

1. A method for freezing and restoring a data access control process based on CRIU, characterized in that: The following steps are involved: S1: The user accesses the database, the database matches the data accessed by the user, encrypts and verifies the data, and sends the verified data to the cloud server; S2: Expand and modify the source code of CRIU, and save the node node of the socket and the file identifier fd of the socket through the dump operation; S3: Call the UI interface of CRIU to obtain the service list of the processes related to the local data access control policy and the process control symbol pid and socket data of the processes related to the system data access control policy; S4: Enable root privileges, obtain processes related to the data access control policy through the process control symbol pid and socket data, freeze and restore processes related to the data access control policy, and when a user accesses a frozen process, the system broadcasts a warning.

2. According to claim 1, a method for freezing and restoring a data access control process based on CRIU is characterized in that: Step S2 specifically includes the following steps: S21: Call dump_unix_opts function, open the socket through the file identifier fd of the socket, and store the socket in the pointer corresponding to the UnixOptsEntry structure; S22: Initialize an integer variable to 0, and store the return value of the dump_unix_opts function in the initialized integer variable; S23: calling the dump_opt function to obtain four socket data, and storing the four socket data in four socket options respectively; S24: converting the socket data in the socket option into a Boolean value, and storing the Boolean value in the flag bits corresponding to the socket option; S25: Call the restore_unix_opts function to verify the existence and adjustability of the socket options.

3. According to claim 2, a CRIU-based data access control process freezing and recovery method is characterized in that: In step S23, four socket options are SO_REUSEADDR, SO_KEEPALIVE, SO_TYPE and SO_REUSEPORT, wherein SO_REUSEADDR reuses the local address, SO_KEEPALIVE enables the keep-alive mechanism, SO_TYPE obtains the type of the socket, and SO_REUSEPORT binds multiple sockets to the same port.

4. According to a CRIU-based data access control process freezing and recovery method according to claim 1, it is characterized in that: In step S3, a service list of processes related to the local data access control policy is obtained, which specifically includes the following steps: S31: Start an external process through Qprocess in the Qt framework; S32: The external process sends a message to the data access control policy related process through the command line tool dbus-send, and the external process interacts with the data access control policy related process through the session bus; S33: specifying the service name of the process related to the data access control policy through DBus, and calling the interface position of the corresponding process related to the data access control policy; S34: Return the name list of the processes related to the registered data access control policy through the ListNames operation; S35: Segment the name list of the registered data access control policy related processes returned in step S34 by means of regular expressions, and classify the segmented name list.

5. According to claim 4, a CRIU-based data access control process freezing and recovery method is characterized in that: The session bus in step S32 is set as a dedicated connection for the user session.

6. The method for freezing and restoring a data access control process based on CRIU according to claim 1, characterized in that: In step S3, the process control symbol pid and socket data of the process related to the system data access control policy are obtained by using a library acquisition method or a process name acquisition method.

7. The method for freezing and restoring a data access control process based on CRIU according to claim 6, characterized in that: The library acquisition method specifically includes the following steps: Step 1: Initialize the glibc library and socket-API library of the system data access control policy related processes; Step 2: Call the method for obtaining the process control symbol pid in the glibc library, and obtain the control symbol pid according to the returned method. At the same time, call the method for obtaining the socket data in the socket-API library, and obtain the socket data according to the returned method. Step 3: Use the lsof command to obtain the node node of the socket data in step 2.

8. The method for freezing and restoring a data access control process based on CRIU according to claim 1, characterized in that: Step S4 specifically includes the following steps: S41: Use the pkexec command to enable root privileges. After the user enters the password in the graphical interface, the graphical interface program is executed as a special identity. S42: Initialize request options and set service address; S43: Open the specified directory file_address and obtain the file identifier fd corresponding to the specified directory file_address, and store the dumped image in the specified directory file_address; S44: Setting the file identifier fd of the image directory through the set_images_dir_fd function, and storing the dumped file in the image directory; S45: Establish an external TCP connection. CRIU connects to the external TCP through the Unix domain socket unix_id_char. S46: Send desktop notifications in Linux desktop environment through the command line tool notify-send.

Images