Server-free computing-oriented multi-thread execution and resource security sharing cloud computing system

Abstract

The invention discloses a server-free computing-oriented multi-thread execution and resource security sharing cloud computing system, and relates to the field of server-free computing. The invention provides a multi-thread resource sharing parallel security execution model which is composed of a multi-thread efficient parallel execution module and a multi-thread resource security sharing module. According to the multi-thread efficient parallel execution, a thread-level resource management mechanism aiming at a function single instance is provided, accurate control over resource allocation of each thread is allowed, and meanwhile a sequential execution mechanism in a container is designed; in the multi-thread resource security sharing module, an MPK protection mechanism is a core component of thread memory security, the MPK provides memory protection for each thread, and a memory isolation area is allowed to be created among different threads, so that the data security is enhanced. According to the method, not only is the sequence of task execution ensured, but also the running efficiency and the resource utilization rate of the container are improved through resource recovery and sharing.

Description

Technical Field

[0001] The present invention relates to the field of serverless computing, and in particular to a cloud computing system for multi-threaded execution and secure resource sharing for serverless computing. Background Art

[0002] Serverless computing is a cloud computing model in which users can write and run code directly without having to manage the underlying server infrastructure. In the serverless model, applications are typically deployed in containers that can run in any computing environment and are able to automatically start as needed. After developers upload their code to the cloud platform, the cloud service provider is responsible for configuration, scaling, and server resource management. Serverless applications are event-driven, and they respond to specific events or triggers, such as web requests, database updates, or queue messages. When these events occur, the serverless platform automatically allocates resources to the code and releases the resources immediately after execution. In this model, the management, scaling, and maintenance of servers are automatically handled by cloud service providers (such as AWS, Alibaba Cloud). Serverless computing automatically scales on demand and charges based on actual resource usage rather than prepaid fixed capacity.

[0003] Serverless computing platforms are currently in a rapid development stage. AWS Lambda is one of Amazon's serverless computing platforms. Lambda functions can be triggered by a variety of events, such as API Gateway, S3 file uploads, DynamoDB database changes, etc. Lambda supports multiple programming languages, including Python, Node.js, Go, Java, etc. AWS Lambda supports concurrent execution of multiple requests. It provides the function of preserving concurrency to ensure that specific Lambda functions can reserve resources for sudden loads. In addition, AWS Lambda can handle high-concurrency requests through automatic expansion, allowing thousands of requests to be processed simultaneously. Alibaba Cloud's serverless computing platform is called Function Compute. It allows users to write code and trigger function execution through events such as HTTP requests, object storage (OSS), and message services, and supports multiple programming languages ​​(Python, Node.js, Java, PHP, etc.). Alibaba Cloud Function Compute also supports high concurrency. Function Compute automatically expands according to the number of requests and allocates corresponding resources. Through configuration, it can ensure that multiple function instances run simultaneously to handle a large number of concurrent requests.

[0004] Serverless computing is currently facing various challenges. On the one hand, serverless computing faces the problem of container cold start. Typically, when a serverless function has not been called for a period of time, the provider will shut it down to save energy and avoid over-configuration. The next time a user runs an application that calls the function, the serverless provider will have to restart and start hosting the function again. This startup time adds a significant delay, which is called a "cold start". Once the function is up and running, it will get faster service speeds (hot start) in subsequent requests, but if it is not requested again for a period of time, it will go back to sleep. This means that the next user who requests the function will experience a cold start. When a cold start occurs, the Serverless platform needs to perform a series of operations such as instance scheduling, image distribution, instance creation, resource configuration, operating environment initialization, and code loading. The delay caused by this process can usually be several times the actual execution time of the request, which affects the user experience, especially in applications that rely on low latency. Secondly, the parallel execution of serverless functions still has the problem of low memory resource utilization. If a serverless function needs to process multiple events or requests from users at the same time, the platform may need to allocate independent resources for each event. For example, when a cloud service provider handles execution requests for multiple machine learning inference tasks from different users, multiple containers will be enabled for execution. In order to execute the same function, call the same code and use the same environment, each container will load the libraries and models required for this machine learning inference task during the initialization process. These pre-loaded libraries cannot be shared between calls between containers, which will result in reduced memory resource utilization.

[0005] On the other hand, serverless computing also has security issues. Although container technology brings many advantages in providing a lightweight and portable application deployment environment, containers also face some unique security issues compared to virtual machines. Since containers share the operating system kernel on the same host, this may lead to weaker isolation compared to virtual machines. If attackers can successfully cross the container boundary, they may be able to affect applications running on other containers and hosts, which is one of the security risks. Serverless computing adopts a multi-tenant model. Functions in serverless services usually run on shared infrastructure that runs code for multiple customers. When sensitive data is involved, there may be a possibility of sensitive data leakage between users. At the same time, cloud service providers may retain users' sensitive data for commercial purposes, making sensitive data unprotected. The image is the basic building block of the container, which contains the application and all the file system layers it depends on. If an unverified or unupdated image is used, there may be potential vulnerabilities, thereby introducing security risks.

[0006] Therefore, technicians in this field are committed to developing a multi-threaded resource sharing parallel safe execution model, which is a multi-threaded parallel execution architecture that uses the multi-threaded execution performance of functions to improve parallelism, reduce response time, ensure that computing resources can be effectively used under high concurrent loads, and improve system throughput. It consists of multi-threaded efficient parallel execution and multi-threaded resource safe sharing modules. Summary of the invention

[0007] In view of the above-mentioned defects of the prior art, the technical problem to be solved by the present invention is how to perform efficiently and safely.

[0008] To achieve the above-mentioned purpose, the present invention provides a cloud computing system with multi-threaded execution and resource security sharing for serverless computing, characterized in that the present invention proposes a multi-threaded resource sharing parallel security execution model, which is composed of a multi-threaded efficient parallel execution and a multi-threaded resource security sharing module; the multi-threaded efficient parallel execution proposes a thread-level resource management mechanism for a single instance of a function, allowing precise control of resource allocation for each thread, and designs a sequential execution mechanism within the container; in the multi-threaded resource security sharing module, the MPK protection mechanism is the core component of thread memory security, and MPK provides per-thread memory protection, allowing the creation of memory isolation areas between different threads, thereby enhancing data security.

[0009] Furthermore, the multi-threaded efficient parallel execution utilizes the lightweight characteristics of threads, so that multiple threads can be run in parallel in the same process, and each thread is responsible for processing a part of the task.

[0010] Furthermore, the thread-level resource management mechanism intercepts the system call of the process in the container through ptrace to implement system call injection, namely systeminject, so that the container environment is restored after the task is executed, ensuring that the container can return to the state after initialization when a new task is started.

[0011] Furthermore, the implementation of the thread-level resource management mechanism includes the following steps:

[0012] Step 1. Use the PTRACE_ATTACH command of ptrace to attach to the target process.

[0013] Step 2: Use the PTRACE_SYSCALL command to pause the process before and after each system call so that intervention can be made.

[0014] Step 3: After the task is executed, use the ability to read and write memory and registers provided by ptrace to restore the container environment to the initialization state and prepare for the execution of the next task.

[0015] Furthermore, the thread-level resource management mechanism can be executed in multiple threads.

[0016] Furthermore, in the multi-threaded resource security sharing mode, the user sends a request through an http trigger, which is received by the API server, and then enters the corresponding container and starts the corresponding thread for processing.

[0017] Furthermore, the functions involved in the multi-threaded resource security sharing mode include thread management, CPU resource scheduling and virtual memory management.

[0018] Furthermore, the thread management requires that the function instance ensure the correctness and reliability of shared resources when multiple threads are executed in parallel, and protect the user's sensitive data from being leaked between threads. The present invention adopts the mpk protection mode to protect thread safety.

[0019] Furthermore, the virtual memory management parses the code through cppparser and generates a corresponding abstract syntax tree, determines the dependencies between variables, protects the private variables of each thread, and shares the shared variables between functions as shared resources, effectively improving memory utilization and saving memory resources.

[0020] Furthermore, the relationship between the variables in the abstract syntax tree is represented in the form of a graph. Starting from the input of data, the graph traversal algorithm is used to find all variables related to the input and protect them as private states. Content not related to user input is shared by multiple threads as shared states. After automatic classification, the private state of each parallel thread is isolated and protected using mpk.

[0021] The present invention has the following technical effects:

[0022] 1. Technical advantages: Multi-threaded parallel execution solves the cold start strategy. MPK provides per-thread memory protection. By setting access rights in page table entries, fine-grained memory access control is achieved, which enhances data security and reduces potential data competition issues. At the same time, MPK has a high efficiency in switching permissions, requiring only about 20 CPU instruction cycles, which helps maintain the high performance of the system.

[0023] 2. Performance indicators: Multi-threaded parallel execution can significantly reduce latency. Parallel execution can improve the system's processing power, allowing more requests to be processed per unit time. By distinguishing between shared memory areas and private memory areas, the system can use memory resources more efficiently and reduce redundant memory allocation and release. It utilizes multi-threaded processing of concurrent requests within an already started container to avoid triggering a cold start for each request. Each request can share the resources of the same container, avoiding the duplication of loading the same resources for each request and improving the utilization of memory and CPU resources. Reduced memory consumption for each function call by 30% to 98%, while reducing overall memory utilization by 25% and reducing the total number of cold starts by 62%

[0024] 3. Production implementation: The design of multi-threaded resource sharing and parallel safe execution of functions makes it have good scalability and compatibility, and can be easily deployed on various serverless computing platforms. Multi-threaded parallel execution can significantly reduce latency. Parallel execution can improve the processing capacity of the system, so that more requests can be processed per unit time.

[0025] The concept, specific structure and technical effects of the present invention will be further described below in conjunction with the accompanying drawings to fully understand the purpose, characteristics and effects of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 It is a system architecture diagram of a multi-threaded resource sharing parallel security execution model of a preferred embodiment of the present invention. DETAILED DESCRIPTION

[0027] The following describes several preferred embodiments of the present invention with reference to the drawings in the specification, so that the technical content is clearer and easier to understand. The present invention can be embodied in many different forms of embodiments, and the protection scope of the present invention is not limited to the embodiments mentioned in the text.

[0028] In the drawings, components with the same structure are indicated by the same numerical reference numerals, and components with similar structures or functions are indicated by similar numerical reference numerals. The size and thickness of each component shown in the drawings are arbitrarily shown, and the present invention does not limit the size and thickness of each component. In order to make the illustration clearer, the thickness of the components is appropriately exaggerated in some places in the drawings.

[0029] This patent proposes a cloud computing system for serverless computing with multi-threaded efficient parallel execution and secure resource sharing. It uses the multi-threaded execution performance of functions to improve parallelism, reduce response time, ensure effective use of computing resources under high concurrent loads, and improve system throughput. It is mainly composed of a multi-threaded efficient parallel execution architecture and multi-threaded resource secure sharing. The workflow of the system is as follows: Figure 1As shown. First, the user will send a request through http trigger and it will be received by the API server. Then it will enter the corresponding container and start the corresponding thread for processing. The main functions involved here are thread control, cpu resource scheduling and virtual memory management. For thread management. It is necessary to ensure the correctness and reliability of shared resources when the function instance is executed in parallel by multiple threads, and protect the user's sensitive data from being leaked between threads. We adopt the protection mode of mpk to protect thread safety. For virtual memory management, cppparser is used to parse the code and generate the corresponding abstract syntax tree, determine the dependencies between variables, protect the private variables of each thread, and share shared variables as shared resources between functions, effectively improving memory utilization and saving memory resources. In terms of sequential execution, Ptrace is used to perform systeminject to complete the restore of threads in the container, so that when a task is completed, the new task can be restored to the environment after the container is initialized. Allow a process (tracer) to control another process (traced). Through Ptrace, we can achieve fine control of thread execution in the container, ensure that tasks are executed in a specific order, and perform effective resource recovery and sharing between tasks. The following is a specific embodiment:

[0030] Example 1: Multi-threaded efficient parallel execution architecture

[0031] In a cloud computing system for efficient multi-threaded parallel execution and secure resource sharing for serverless computing, a strategy for multi-threaded parallel execution of a single function instance is innovatively designed, and a thread-level resource management mechanism for a single function instance is proposed, which allows precise control of resource allocation for each thread to improve resource utilization. In terms of sequential execution, Ptrace is used to perform systeminject to complete the restore of threads in the container, so that after a task is completed, the new task can be restored to the environment after the container is initialized. Allow one process (tracer) to control another process (tracer). Through ptrace, we can achieve fine control of thread execution in the container, ensure that tasks are executed in a specific order, and effectively restore and share resources between tasks. Specifically, our solution intercepts the system calls of processes in the container through ptrace to implement system call injection (system inject), so that after the task is executed, the container environment is restored to ensure that the container can return to the state after initialization when a new task is started. This mechanism not only ensures the sequentiality of task execution, but also improves the operating efficiency and resource utilization of the container through resource recovery and sharing.

[0032] In terms of implementation, we first use ptrace's PTRACE_ATTACH command to attach to the target process, and then use the PTRACE_SYSCALL command to pause the process before and after each system call so that we can intervene. After the task is executed, we use the ability to read and write memory and registers provided by ptrace to restore the container environment to the initialized state and prepare for the execution of the next task. In addition, our solution also takes into account the need for parallel safe execution. By executing function instances in parallel in multiple threads, we can use computing resources more effectively and speed up task processing. This parallel execution mechanism, combined with ptrace's sequential control capabilities, enables the system to maintain good performance and stability when processing a large number of short-lived, highly concurrent requests.

[0033] Example 2: Multi-threaded resource security sharing mode

[0034] In multi-threaded resource security, the MPK protection mechanism is the core component of thread memory safety. MPK provides per-thread memory protection and allows the creation of memory isolation areas between different threads, thereby enhancing data security and reducing potential data competition issues.

[0035] First, the user sends a request through an http trigger and the request is received by the API server. Then the request enters the corresponding container and starts the corresponding thread for processing. The main functions involved here are thread control, CPU resource scheduling, and virtual memory management. For thread management, it is necessary to ensure the correctness and reliability of shared resources when the function instance is executed in parallel by multiple threads, and protect the user's sensitive data from being leaked between threads. We adopt the MPK protection mode to protect thread security. MPK provides independent memory access permission management for each core, and divides the memory into groups, up to 16 groups. The binary numbers of these 16 groups, 0b0000 to 0b1111, are called protection keys. Each core of the CPU has a 32-bit register (PKRU) to store the current core's access permission to each group. The PKRU register contains 16 bit pairs, corresponding to 16 page groups, and each pair contains two bits, representing R / W permissions respectively. The value of each pair corresponds to three possible permissions (0,0): read / write, (1,0): read-only, (x,1): no-access. Compared to the system mprotect call, updating PKRU does not require a system call and is much faster than mprotect (MPK requires a system call when marking a page). MPK protection is thread-local, and the access rights of different threads may be inconsistent, which is related to the corresponding PKRU, while mprotect will affect the entire process. For each thread started, we assign the corresponding protection key to this thread. The thread that obtains this protection can obtain access rights to each memory, thereby realizing the function of protecting the thread memory.

[0036] For many high-concurrency tasks, if we completely isolate the memory for all threads, it may cause resource waste. For example, the following common scenario: users currently send many identical task requests to the cloud platform to batch process images, where these images are processed using the same machine learning inference model for each thread task. The machine learning model is equivalent for each user, and there is no possibility of data privacy leakage. If we protect this part of the model memory through mpk for each thread, it will cause memory resource waste. In order to solve this problem and improve the utilization of memory resources in the container, by distinguishing between private variables and public variables in the thread, the part that can be shared by all threads is used as a shared region for all threads to access. For the part of the private variable that involves the privacy security of user data, this part is stored as a private region, thereby completing the distinction between private and shared memory and achieving high memory utilization in the container. In order to distinguish the privacy of variables, we designed cppparser, which statically scans the code to obtain the AST in which the file elements are arranged in a tree structure, supports the parsing of multi-file programs, and has minimal dependencies. The relationship between the variables in the abstract syntax tree is expressed in the form of a graph. Starting from the incoming data, the graph traversal algorithm (DFS, BFS) is used to traverse and find all variables related to the input, which are protected as private states. Content not related to user input is shared by multiple threads as shared states. After automatic classification, the private state of each parallel thread is isolated and protected using mpk.

[0037] The preferred specific embodiments of the present invention are described in detail above. It should be understood that ordinary technicians in the field can make many modifications and changes based on the concept of the present invention without creative work. Therefore, all technical solutions that can be obtained by technicians in the technical field based on the concept of the present invention through logical analysis, reasoning or limited experiments on the basis of the prior art should be within the scope of protection determined by the claims.

Claims

1. A cloud computing system for multi-threaded execution and secure resource sharing for serverless computing, characterized in that: The present invention proposes a multi-threaded resource sharing parallel security execution model, which is composed of a multi-threaded efficient parallel execution and a multi-threaded resource security sharing module; the multi-threaded efficient parallel execution proposes a thread-level resource management mechanism for a single instance of a function, allowing precise control of resource allocation for each thread, and designs a sequential execution mechanism within a container; in the multi-threaded resource security sharing module, the MPK protection mechanism is a core component of thread memory security, and MPK provides per-thread memory protection, allowing the creation of memory isolation areas between different threads, thereby enhancing data security.

2. The cloud computing system for multi-threaded execution and secure resource sharing for serverless computing as claimed in claim 1, characterized in that: The multi-threaded efficient parallel execution utilizes the lightweight characteristics of threads, so that multiple threads can be run in parallel in the same process, and each thread is responsible for processing a part of the task.

3. The cloud computing system for multi-threaded execution and secure resource sharing for serverless computing as claimed in claim 2, characterized in that: The thread-level resource management mechanism intercepts the system calls of the process in the container through ptrace to implement system call injection, namely systeminject, so that the container environment is restored after the task is executed, ensuring that the container can return to the state after initialization when a new task is started.

4. The cloud computing system for multi-threaded execution and secure resource sharing for serverless computing as claimed in claim 3, characterized in that: The implementation of the thread-level resource management mechanism includes the following steps: Step 1. Use the PTRACE_ATTACH command of ptrace to attach to the target process. Step 2: Use the PTRACE_SYSCALL command to pause the process before and after each system call so that intervention can be made. Step 3: After the task is executed, use the ability to read and write memory and registers provided by ptrace to restore the container environment to the initialization state and prepare for the execution of the next task.

5. The cloud computing system for multi-threaded execution and secure resource sharing for serverless computing as claimed in claim 4, characterized in that: The thread-level resource management mechanism can be executed in multiple threads.

6. The cloud computing system for multi-threaded execution and secure resource sharing for serverless computing as claimed in claim 5, characterized in that: In the multi-threaded resource security sharing mode, the user sends a request through an http trigger, which is received by the API server, and then enters the corresponding container and starts the corresponding thread for processing.

7. The cloud computing system for multi-threaded execution and secure resource sharing for serverless computing as claimed in claim 6, characterized in that: The functions involved in the multi-thread resource security sharing mode include thread management, CPU resource scheduling and virtual memory management.

8. The cloud computing system for multi-threaded execution and secure resource sharing for serverless computing as claimed in claim 7, characterized in that: The thread management requires that the function instance ensure the correctness and reliability of shared resources when multiple threads are executed in parallel, and protect the user's sensitive data from being leaked between threads. The present invention adopts the MPK protection mode to protect thread safety.

9. The cloud computing system for multi-threaded execution and secure resource sharing for serverless computing as claimed in claim 8, characterized in that: The virtual memory management parses the code through cppparser and generates a corresponding abstract syntax tree, determines the dependencies between variables, protects the private variables of each thread, and shares shared variables between functions as shared resources, effectively improving memory utilization and saving memory resources.

10. The cloud computing system for multi-threaded execution and secure resource sharing for serverless computing as claimed in claim 9, characterized in that: The relationship between the variables in the obtained abstract syntax tree is expressed in the form of a graph. Starting from the input of data, the graph traversal algorithm is used to traverse and find all variables related to Input to protect them as privatestate. Content not related to user input is shared by multiple threads as shared state. After automatic classification, mpk is used to isolate and protect the private state of each parallel thread.

Images