A data access control process freezing and recovery method based on CRIU

Abstract

The present invention discloses a data access control process freezing and recovery method based on CRIU, which relates to the fields of data access strategy and container technology, and comprises the following steps: S1: a user accesses data to a database, the database matches the data accessed by the user and encrypts and verifies the data, and sends the verified data to a cloud server; S2: the source code of CRIU is expanded and modified, and the node of the socket and the file identifier of the socket are saved through a dump operation; S3: the UI interface of CRIU is called to obtain the service list of the local data access control policy-related process and the process control symbol and socket data of the system data access control policy-related process; S4: the corresponding data is frozen and restored, and a broadcast reminder is executed; the freezing and recovery functions of the data access control policy process are realized, so that the user can restore according to needs, and effectively cope with the shortage of system resources or the need for system maintenance.

Description

[0001] Methodology

[0002] The present invention relates to the field of data access strategy and container technology, and in particular to a data access control process freezing and recovery method based on CRIU.

[0003] Background Methods

[0004] With the rapid development of cloud computing and microservice architecture, high availability and flexibility of services have become crucial. In this context, process state management has become one of the key technologies.

[0005] In the prior art, for example, CN111090500B discloses a storage process management method and device. After extracting memory fragmentation characteristics and cache mapping characteristics from storage process data, the target storage process running node of the current distributed storage node is determined, and the virtual process domain and corresponding virtual process interface of the virtual memory page of the storage process category corresponding to the target storage process running node are determined. After performing a virtual process access to the storage process address corresponding to the current storage process status information in the virtual process domain according to the virtual process interface, the storage process status information is updated in the virtual process domain. By combining the memory fragmentation characteristics and cache mapping characteristics to perform storage process status management, it is possible to facilitate subsequent targeted storage performance optimization, reduce the probability of storage process anomalies, and thus ensure the normal operation of storage services.

[0006] However, memory fragmentation will lead to a reduction in available memory space, which in turn affects the creation and execution of processes. At the same time, cache mapping involves mapping data blocks in main memory to cache. This process will cause data inconsistency between different levels and make it impossible to synchronize operations, which increases the complexity of the system and reduces its flexibility.

[0007] Therefore, a data access control process freezing and recovery method based on CRIU is provided to solve the above problems. Summary of the Invention

[0008] The purpose of the present invention is to provide a data access control process freezing and recovery method based on CRIU, which ensures that users can save the current service status without interfering with service operation and restore it when needed. While retaining the original service status, it ensures that debugging can be carried out normally after recovery, thereby improving the flexibility and maintainability of the system. At the same time, it ensures data consistency before performing important operations, avoids unauthorized access or data corruption, supports process recovery in different environments or conditions, and adapts to dynamically changing computing environments.

[0009] To achieve the above objectives, the present invention provides a data access control process freezing and recovery method based on CRIU, comprising the following steps:

[0010] S1: The user accesses data in the database. The database matches the data accessed by the user, encrypts and verifies the data, and sends the verified data to the cloud server.

[0011] S2: Expand and modify the source code of CRIU, and save the node node of the socket and the file identifier fd of the socket through the dump operation;

[0012] S3: Call the CRIU UI interface to obtain the service list of the local data access control policy-related processes and the process control symbol PID and socket data of the system data access control policy-related processes;

[0013] S4: Enable root privileges, obtain processes related to the data access control policy through the process control symbol pid and socket data, freeze and restore processes related to the data access control policy, and when a user accesses a frozen process, the system broadcasts a warning.

[0014] Preferably, step S2 specifically includes the following steps:

[0015] S21: Call the dump_unix_opts function, open the socket through the file identifier fd of the socket, and store the socket in the pointer corresponding to the UnixOptsEntry structure;

[0016] S22: Initialize an integer variable to 0, and store the return value of the dump_unix_opts function in the initialized integer variable;

[0017] S23: Call the dump_opt function to obtain four socket data and store the four socket data in four socket options respectively;

[0018] S24: converting the socket data in the socket option into a Boolean value, and storing the Boolean value in the flag bits corresponding to the socket option;

[0019] S25: Call the restore_unix_opts function to verify the existence and adjustability of the socket options.

[0020] Preferably, in step S23, the four socket options are SO_REUSEADDR, SO_KEEPALIVE, SO_TYPE and SO_REUSEPORT, wherein SO_REUSEADDR reuses the local address, SO_KEEPALIVE enables the keep-alive mechanism, SO_TYPE obtains the socket type, and SO_REUSEPORT binds multiple sockets to the same port.

[0021] Preferably, in step S3, obtaining a service list of processes related to the local data access control policy specifically includes the following steps:

[0022] S31: Start an external process through Qprocess in the Qt framework;

[0023] S32: The external process sends a message to the data access control policy-related process through the command line tool dbus-send. The external process interacts with the data access control policy-related process through the session bus.

[0024] S33: specifying the service name of the process related to the data access control policy through DBus, and calling the interface location of the corresponding process related to the data access control policy;

[0025] S34: Return the name list of processes related to the registered data access control policy through the ListNames operation;

[0026] S35: Segment the name list of the registered data access control policy related processes returned in step S34 by means of regular expressions, and classify the segmented name list.

[0027] Preferably, the session bus in step S32 is set as a dedicated connection for the user session.

[0028] Preferably, in step S3, the process control symbol pid and socket data of the process related to the system data access control policy are obtained by using a library acquisition method or a process name acquisition method.

[0029] Preferably, the library acquisition method specifically includes the following steps:

[0030] Step 1: Initialize the glibc library and socket-API library of the system data access control policy related processes;

[0031] Step 2: Call the method to obtain the process control symbol pid in the glibc library, and obtain the control symbol pid according to the returned method. At the same time, call the method to obtain the socket data in the socket-API library, and obtain the socket data according to the returned method.

[0032] Step 3: Use the lsof command to obtain the node node of the socket data in step 2.

[0033] Preferably, step S4 specifically includes the following steps:

[0034] S41: Use the pkexec command to enable root privileges. After the user enters the password in the graphical interface, the graphical interface program is executed as a special identity.

[0035] S42: Initialize request options and set service address;

[0036] S43: Open the specified directory file_address and obtain the file identifier fd corresponding to the specified directory file_address, and store the dumped image in the specified directory file_address;

[0037] S44: Set the file identifier fd of the image directory through the set_images_dir_fd function, and store the dumped file in the image directory;

[0038] S45: Establish an external TCP connection. CRIU connects to the external TCP via the Unix domain socket unix_id_char.

[0039] S46: Send desktop notifications in the Linux desktop environment through the command line tool notify-send.

[0040] Therefore, the present invention adopts a CRIU-based data access control process freezing and recovery method of the above structure, which has the following beneficial effects:

[0041] (1) It not only preserves the original service status but also ensures normal debugging after recovery, thus improving the flexibility and maintainability of the system;

[0042] (2) By freezing the process, data consistency can be ensured before performing important operations, avoiding unauthorized access or data corruption;

[0043] (3) It has a wide range of applications and supports process recovery in different environments or under different conditions, while adapting to dynamically changing computing environments.

[0044] The method scheme of the present invention is further described in detail below through the drawings and examples. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 This is a flow chart of a method for freezing and restoring a data access control process based on CRIU according to the present invention;

[0046] Figure 2 This is a technical design flow chart of the user interaction interface of a CRIU-based data access control process freezing and recovery method of the present invention. DETAILED DESCRIPTION

[0047] The method scheme of the present invention is further described below through the drawings and examples.

[0048] Unless otherwise defined, technical terms or scientific terms used in the present invention shall have the same meaning as commonly understood by one of ordinary skill in the art to which the present invention belongs.

[0049] The words “include” or “comprising” and similar words used in the present invention mean that the elements before the word include the elements listed after the word, and do not exclude the possibility of also including other elements. The orientation or position relationship indicated by the terms “inside”, “outside”, “upper”, “lower”, etc. is based on the orientation or position relationship shown in the accompanying drawings. It is only for the convenience of describing the present invention and simplifying the description, and does not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation. Therefore, it cannot be understood as a limitation of the present invention. When the absolute position of the described object changes, the relative position relationship may also change accordingly. In the present invention, unless otherwise clearly stipulated and limited, the terms such as “attachment” should be understood in a broad sense. For example, it can be a fixed connection, a detachable connection, or an integral whole; it can be directly connected or indirectly connected through an intermediate medium, and it can be the internal connection of two elements or the interaction relationship between two elements. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to the specific circumstances.

[0050] Example

[0051] like Figure 1 and Figure 2 As shown, the present invention provides a data access control process freezing and recovery method based on CRIU, comprising the following steps:

[0052] S1: The user accesses data in the database. The database matches the data accessed by the user, encrypts and verifies the data, and sends the verified data to the cloud server.

[0053] S2: Expand and modify the source code of CRIU. The dump operation "dump" saves the socket node and the socket file identifier "fd" to improve the integrity of the process during recovery. The dump operation also adds processing for the file identifier "fd" to ensure that the socket state and related metadata are saved together when the checkpoint is created. This allows CRIU to correctly call data when resuming the process, and allows applications related to the socket to be seamlessly restored to their pre-freeze state.

[0054] Step S2 specifically includes the following steps:

[0055] S21: Call the dump_unix_opts function, open the socket through the file identifier fd of the socket, and store the socket in the pointer corresponding to the UnixOptsEntry structure;

[0056] S22: Initialize an integer variable to 0, and store the return value of the dump_unix_opts function in the initialized integer variable;

[0057] S23: Call the dump_opt function to obtain four socket data and store the four socket data in four socket options respectively;

[0058] In step S23, the four socket options are SO_REUSEADDR, SO_KEEPALIVE, SO_TYPE and SO_REUSEPORT, where SO_REUSEADDR reuses the local address, SO_KEEPALIVE enables the keep-alive mechanism, SO_TYPE obtains the socket type, and SO_REUSEPORT binds multiple sockets to the same port;

[0059] S24: converting the socket data in the socket option into a Boolean value, and storing the Boolean value in the flag bits corresponding to the socket option, to ensure that the previously saved options can be restored before the connection is made, and that the socket configuration can be correctly applied when the connection is established;

[0060] S25: Call the restore_unix_opts function. The restore_unix_opts function can restore the relevant options of the socket data from the UnixOptsEntry structure. By checking the existence and adjustability of the socket options, it ensures that the socket can be set correctly during the recovery process.

[0061] S3: Call the CRIU UI to obtain the service list of processes related to the local data access control policy and the process control symbol PID and socket data of processes related to the system data access control policy, ultimately realizing process service monitoring and management;

[0062] In step S3, the process control symbol PID and socket data of the process related to the system data access control policy are obtained by using a library acquisition method or a process name acquisition method, and the process list in the system is queried through a system call or an API interface so that the user can easily locate the target process;

[0063] The library acquisition method specifically includes the following steps:

[0064] Step 1: Initialize the glibc library and socket-API library of the system data access control policy related processes;

[0065] Step 2: Call the method to obtain the process control symbol pid in the glibc library, and obtain the control symbol pid according to the returned method. At the same time, call the method to obtain the socket data in the socket-API library, and obtain the socket data according to the returned method.

[0066] Step 3: Use the lsof command to obtain the node node of the socket data in step 2, and obtain the node connected to the socket associated with the target process. Usually, the system API is used to collect network information. The API provided by the system process is used to design the corresponding message format to facilitate sending requests or obtaining process status. The operation results are presented through a graphical interface. The monitor is used to obtain the access status of the process service. In the background, the CRIU API is called to load the process checkpoint file and restore the process status. The CRIU UI interface will provide clear status feedback.

[0067] In step S3, a service list of processes related to the local data access control policy is obtained, which specifically includes the following steps:

[0068] S31: Start an external process through Qprocess in the Qt framework;

[0069] S32: The external process sends a message to the data access control policy-related process through the command line tool dbus-send. The external process interacts with the data access control policy-related process through the session bus, not the system bus. The parameter print-reply in the command line tool dbus-send is used to instruct dbus-send to wait for a reply to the message and output the reply to the standard output.

[0070] The session bus in step S32 is set as a dedicated connection for the user session;

[0071] S33: specifying the service name of the process related to the data access control policy through DBus, and calling the interface location of the process related to the data access control policy. The service name of the process related to the data access control policy is specified through dest=org.freedesktop.DBus, and the object path to be called is specified through / org / freedesktop / DBus. The specified object path to be called is the interface location of the process related to the data access control policy.

[0072] S34: Return the name list of processes related to the registered data access control policy through the ListNames operation;

[0073] S35: Segment the name list of processes related to the registered data access control policy returned in step S34 by using regular expressions, and classify the segmented name list;

[0074] S4: Enable root privileges and obtain processes related to the data access control policy through the process control symbol pid and socket data. Use CRIU API calls to implement CRIU's freezing and recovery operations on processes related to the data access control policy in the UI. When a user accesses a frozen process, the system issues a warning.

[0075] Step S4 specifically includes the following steps:

[0076] S41: Use the pkexec command to enable root privileges. After the user enters the password in the graphical interface, the graphical interface program is executed as a special identity.

[0077] S42: Initialize request options and set service addresses to facilitate dumping and restoring related processes;

[0078] S43: Open the specified directory file_address and obtain the file identifier fd corresponding to the specified directory file_address, and store the dumped image in the specified directory file_address;

[0079] S44: Set the file identifier fd of the image directory through the set_images_dir_fd function, and store the dumped file in the image directory;

[0080] S45: Establish an external TCP connection. CRIU connects to the external TCP via the Unix domain socket unix_id_char. This allows CRIU to maintain a connection with the external process during the dump process.

[0081] S46: Send desktop notifications in the Linux desktop environment through the command line tool notify-send to remind users of the freezing and recovery operations of process services related to the data access control policy.

[0082] Therefore, the present invention adopts the above-mentioned CRIU-based data access control process freezing and recovery method, so that users can save the current service status without interfering with service operation and restore it when needed. It not only retains the original service status, but also ensures that debugging can be carried out normally after recovery, thereby improving the flexibility and maintainability of the system.

[0083] Finally, it should be noted that the above embodiments are only used to illustrate the method scheme of the present invention and not to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, ordinary method personnel in this field should understand that they can still modify or replace the method scheme of the present invention with equivalents, and these modifications or equivalent replacements cannot cause the modified method scheme to deviate from the spirit and scope of the method scheme of the present invention.

Claims

1. A data access control process freezing and recovery method based on CRIU, characterized by: The following steps are involved: S1: The user accesses data in the database. The database matches the data accessed by the user, encrypts and verifies the data, and sends the verified data to the cloud server. S2: Expand and modify the source code of CRIU, and save the node node of the socket and the file identifier fd of the socket through the dump operation; Step S2 specifically includes the following steps: S21: Call the dump_unix_opts function, open the socket through the file identifier fd of the socket, and store the socket in the pointer corresponding to the UnixOptsEntry structure; S22: Initialize an integer variable to 0, and store the return value of the dump_unix_opts function in the initialized integer variable; S23: Call the dump_opt function to obtain four socket data and store the four socket data in four socket options respectively; S24: converting the socket data in the socket option into a Boolean value, and storing the Boolean value in the flag bits corresponding to the socket option; S25: Call the restore_unix_opts function to verify the existence and adjustability of the socket options; S3: Call the CRIU UI interface to obtain the service list of the local data access control policy-related processes and the process control symbol PID and socket data of the system data access control policy-related processes; In step S3, a service list of processes related to the local data access control policy is obtained, which specifically includes the following steps: S31: Start an external process through Qprocess in the Qt framework; S32: The external process sends a message to the data access control policy-related process through the command line tool dbus-send. The external process interacts with the data access control policy-related process through the session bus. S33: specifying the service name of the process related to the data access control policy through DBus, and calling the interface location of the corresponding process related to the data access control policy; S34: Return the name list of processes related to the registered data access control policy through the ListNames operation; S35: Segment the name list of processes related to the registered data access control policy returned in step S34 by using regular expressions, and classify the segmented name list; S4: Enable root privileges, obtain processes related to the data access control policy through the process control symbol pid and socket data, freeze and restore processes related to the data access control policy, and when a user accesses a frozen process, the system broadcasts a warning.

2. The CRIU-based data access control process freezing and recovery method according to claim 1, characterized in that: In step S23, the four socket options are SO_REUSEADDR, SO_KEEPALIVE, SO_TYPE and SO_REUSEPORT, where SO_REUSEADDR reuses the local address, SO_KEEPALIVE enables the keep-alive mechanism, SO_TYPE obtains the socket type, and SO_REUSEPORT binds multiple sockets to the same port.

3. The CRIU-based data access control process freezing and recovery method according to claim 2, characterized in that: The session bus in step S32 is set as a dedicated connection for the user session.

4. The CRIU-based data access control process freezing and recovery method according to claim 1, characterized in that: In step S3, the process control symbol pid and socket data of the process related to the system data access control policy are obtained by using a library acquisition method or a process name acquisition method.

5. The CRIU-based data access control process freezing and recovery method according to claim 4, characterized in that: The library acquisition method specifically includes the following steps: Step 1: Initialize the glibc library and socket-API library of the system data access control policy related processes; Step 2: Call the method to obtain the process control symbol pid in the glibc library, and obtain the control symbol pid according to the returned method. At the same time, call the method to obtain the socket data in the socket-API library, and obtain the socket data according to the returned method. Step 3: Use the lsof command to obtain the node node of the socket data in step 2.

6. The CRIU-based data access control process freezing and recovery method according to claim 1, characterized in that: Step S4 specifically includes the following steps: S41: Use the pkexec command to enable root privileges. After the user enters the password in the graphical interface, the graphical interface program is executed as a special identity. S42: Initialize request options and set service address; S43: Open the specified directory file_address and obtain the file identifier fd corresponding to the specified directory file_address, and store the dumped image in the specified directory file_address; S44: Set the file identifier fd of the image directory through the set_images_dir_fd function, and store the dumped file in the image directory; S45: Establish an external TCP connection. CRIU connects to the external TCP via the Unix domain socket unix_id_char. S46: Send desktop notifications in the Linux desktop environment through the command line tool notify-send.

Images