A network resource management method and device

Abstract

The present application belongs to the field of computer technology, and specifically discloses a network resource management method and device, the method comprising: when creating a network resource for a certain network namespace, if the same type of network resources exist in all network namespaces, the network resource is directly created; otherwise, a global linked list, a mapping table and the network resource are created; a new network resource is marked, and a first pointer is assigned to it according to its resource type, and the first pointer is inserted into the global linked list; the first pointer and the second pointer pointing to the location of the newly created network resource are inserted into the mapping table; wherein, when the network resource is accessed by a process, a page fault handler is triggered through the first pointer as the only entry to access the network resource, and the access is responded to in combination with the mapping table and the identifier; the identifier is used to verify whether the network namespace where the current access process is located matches the network namespace to which the network resource belongs. Through this application, the isolation and security of network resources are ensured.

Description

Technical Field

[0001] The present application belongs to the field of computer technology, and more specifically, to a network resource management method and device. Background Art

[0002] With the widespread application of virtualization technology and cloud computing, network namespace has become one of the core technologies for network resource management in operating systems. Network namespace can create an isolated network environment. Each namespace has an independent network stack, including routing tables, network cards, firewalls, and protocol stacks, ensuring network isolation between virtual machines or containers. This mechanism plays an important role in the process of realizing network virtualization, especially in multi-tenant cloud computing and containerized applications.

[0003] The isolation of network namespaces allows different containers or virtual machines to run independently on the same physical host without interfering with each other's network resources. However, with the popularization of containerization technology, the management and isolation of network resources are also facing new challenges. The complexity of modern applications has increased the demand for network resources. Different namespaces usually need to access different types of network resources, which leads to decentralized management of resources. In this case, how to effectively manage and isolate these resources to prevent cross-use or improper access of resources has become a problem that needs to be solved.

[0004] Although the current network namespace mechanism can achieve the isolation of network resources, there are still certain security risks in actual use. Because sometimes there is a lack of judgment on the network namespace to which the resource belongs, processes in different network namespaces may accidentally access network resources in other network namespaces, resulting in information leakage. This security risk is particularly prominent in multi-tenant environments or sensitive data processing scenarios. Summary of the invention

[0005] In view of the defects of the prior art, the purpose of this application is to provide a network resource management method and device, aiming to solve the problem that network resources in the existing network namespace cannot be effectively isolated, resulting in network resource information leakage.

[0006] To achieve the above objectives, in a first aspect, the present application provides a network resource management method, comprising:

[0007] When creating a network resource for a network namespace, if the same type of network resource exists in all network namespaces, the network resource is created directly; otherwise, a global linked list, a mapping table, and the network resource are created;

[0008] Setting an identifier (tag) for the newly created network resource, assigning a first pointer to it according to its resource type, and inserting the first pointer into a global linked list; the identifier is associated with the network namespace to which the network resource belongs; a global linked list is used to store the first pointers of network resources of the same resource type belonging to different network namespaces, so as to realize global management of network resources;

[0009] The first pointer and the second pointer pointing to the location of the newly created network resource are inserted into the mapping table; wherein, when the network resource is accessed by a process, a page fault handler is triggered through the first pointer as the only entry to access the network resource, and responds to the process access in combination with the mapping table and the identifier; the identifier is used to verify whether the network namespace where the current accessing process is located matches the network namespace to which the network resource belongs.

[0010] It should be noted that when accessing network resources, the present application captures the first pointer access through the page handler to realize the unique entrance for accessing network resources; then, it determines whether the accessed network resource is in the correct network namespace through the identification of the network resource, thereby avoiding resource conflicts and information leakage across namespaces, improving the security and resource utilization of the system, and ensuring the isolation and security of resources.

[0011] It can be understood that compared with the prior art solution of directly implementing network resource access through the second pointer, the present application adds a first pointer, and manages the first pointer and the second pointer through a global linked list and a mapping table, thereby realizing global management of network resources within the network namespace, and being able to achieve effective isolation and secure access to network resources.

[0012] In a possible implementation, when the network resource is accessed by a process, the following steps are included:

[0013] When the network resource is accessed by the process, a page fault handling program is triggered through the first pointer;

[0014] In the page fault processing program, determining a resource type of the network resource according to the virtual address segment corresponding to the first pointer, and determining a corresponding mapping table according to the resource type;

[0015] Based on the mapping table, the second pointer corresponding to the first pointer is searched to determine whether the network namespace of the current process is consistent with the network namespace corresponding to the identifier of the network resource pointed to by the second pointer; if they are consistent, access is allowed; otherwise, access is denied.

[0016] In a possible implementation, the method further includes:

[0017] When a certain network resource is no longer used, the network resource is accessed by a recycling process, and at this time, a page fault handling program is triggered through the first pointer;

[0018] In the page fault processing program, determining a resource type of the network resource according to the virtual address segment corresponding to the first pointer, and determining a corresponding mapping table according to the resource type;

[0019] Based on the mapping table, the second pointer corresponding to the first pointer is searched to determine whether the network namespace of the current recycling process is consistent with the network namespace corresponding to the identifier of the network resource pointed to by the second pointer; if they are consistent, recycling is executed; otherwise, recycling is rejected; the recycling execution includes: deleting the first pointer of the network resource from the global linked list corresponding to the resource type, removing the corresponding relationship between the first pointer and the second pointer in the mapping table, and releasing the network resource.

[0020] It is understandable that the present application uses a resource recovery mechanism to automatically recover and release resources through a page fault handler when resources are no longer in use, thereby preventing leakage and abuse of system resources. In addition, the resource recovery process is seamlessly integrated into the system's life cycle management to ensure that resources can be dynamically allocated and released.

[0021] In a possible implementation, allocating a first pointer to a network resource according to a resource type includes:

[0022] Each network resource of the same resource type is assigned an address within a virtual address segment as the first pointer of the network resource.

[0023] In a possible implementation, whether a network resource is used is determined in the following manner: when the number of times a network resource is referenced is 0, the network resource is no longer used.

[0024] In a possible implementation, the first pointer is an illegal pointer; and / or

[0025] The second pointer is a correct pointer.

[0026] In a second aspect, the present application provides a network resource management device, including:

[0027] A resource creation unit is used to create a network resource for a certain network namespace. If the same type of network resources exist in all network namespaces, the network resource is directly created; otherwise, a global linked list, a mapping table and the network resource are created; an identifier is set for the newly created network resource, and a first pointer is assigned to it according to its resource type, and the first pointer is inserted into the global linked list; the identifier is associated with the network namespace to which the network resource belongs; a global linked list is used to store first pointers to network resources of the same resource type belonging to different network namespaces, so as to achieve global management of network resources; and the first pointer and a second pointer pointing to the location of the newly created network resource are inserted into the mapping table; wherein, when the network resource is accessed by a process, a page fault handler is triggered through the first pointer as the only entry to access the network resource, and the process access is responded to in combination with the mapping table and the identifier; the identifier is used to verify whether the network namespace where the current accessing process is located matches the network namespace to which the network resource belongs.

[0028] In a possible implementation, the device further includes:

[0029] A resource management unit is used to trigger a page error handler through the first pointer when a network resource is accessed by a process; in the page error handler, determine the resource type of the network resource according to the virtual address segment corresponding to the first pointer, and determine the corresponding mapping table according to the resource type; and search for the second pointer corresponding to the first pointer based on the mapping table to determine whether the network namespace of the current process is consistent with the network namespace corresponding to the identifier of the network resource pointed to by the second pointer; if they are consistent, allow access; otherwise deny access.

[0030] In a possible implementation, the device further includes:

[0031] A resource recovery unit, used for triggering a page error handler through the first pointer when a certain network resource is no longer in use and the network resource is accessed by a recovery process; in the page error handler, determining the resource type of the network resource according to the virtual address segment corresponding to the first pointer, and determining the corresponding mapping table according to the resource type; and searching the second pointer corresponding to the first pointer based on the mapping table to determine whether the network namespace of the current recovery process is consistent with the network namespace corresponding to the identifier of the network resource pointed to by the second pointer; if they are consistent, executing recovery; otherwise refusing recovery; executing recovery, including: deleting the first pointer of the network resource from the global linked list corresponding to the resource type, removing the correspondence between the first pointer and the second pointer in the mapping table, and releasing the network resource.

[0032] In a third aspect, the present application provides an electronic device comprising: at least one memory for storing programs; and at least one processor for executing the programs stored in the memory. When the program stored in the memory is executed, the processor is used to execute the method described in the first aspect or any possible implementation of the first aspect.

[0033] In a fourth aspect, the present application provides a computer-readable storage medium, which stores a computer program. When the computer program runs on a processor, the processor executes the method described in the first aspect or any possible implementation of the first aspect.

[0034] In a fifth aspect, the present application provides a computer program product. When the computer program product runs on a processor, the processor executes the method described in the first aspect or any possible implementation of the first aspect.

[0035] It can be understood that the beneficial effects of the second to fifth aspects mentioned above can be found in the relevant description of the first aspect mentioned above, and will not be repeated here.

[0036] In general, the above technical solutions conceived by the present application have at least the following beneficial effects compared with the prior art:

[0037] The present application provides a network resource management method and device, which realizes resource isolation of different network namespaces by creating a global linked list for network resources and using illegal pointers and page error handlers for unified management. Resources are identified through a tagging mechanism to ensure clear resource ownership, avoid resource conflicts and information leakage across namespaces, and improve system security and resource utilization.

[0038] The present application provides a network resource management method and device. Through illegal pointer and page fault handlers, the present application allocates a specific illegal virtual address segment for each resource. The system captures and handles illegal pointer access through the page fault handler, thus realizing a unique entry for resource access. This mechanism not only simplifies resource management, but also ensures resource isolation and security.

[0039] The present application provides a network resource management method and device, which automatically recycles and releases resources when they are no longer used through a reasonable resource recycling mechanism, thereby preventing leakage and abuse of system resources. In addition, the resource recycling process is seamlessly integrated into the system life cycle management to ensure that resources can be dynamically allocated and released. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the technical solutions in the present application or related technologies, the following is a brief introduction to the drawings required for use in the embodiments or related technical descriptions. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0041] Figure 1 is a flow chart of a network resource management method provided by an embodiment of the present application;

[0042] Figure 2 It is a detailed flowchart of network resource creation provided by an embodiment of the present application;

[0043] Figure 3 is a detailed flow chart of network resource management provided by an embodiment of the present application;

[0044] Figure 4 It is a detailed flow chart of network resource recovery provided by an embodiment of the present application;

[0045] Figure 5 This is a diagram of the network resource management device architecture provided by an embodiment of the present application;

[0046] Figure 6 It is an architectural diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0048] The term "and / or" in this article is a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. The symbol " / " in this article indicates that the associated objects are in an or relationship, for example, A / B means A or B.

[0049] The terms "first" and "second" in the specification and claims herein are used to distinguish different objects rather than to describe a specific order of objects. For example, a first pointer and a second pointer are used to distinguish different pointers rather than to describe a specific order of pointers.

[0050] In the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0051] First, the technical terms involved in the embodiments of the present application are introduced.

[0052] (1) Illegal pointer

[0053] A pointer is a variable that stores the address of a variable. Illegal pointers include: uninitialized pointers, wild pointers, out-of-bounds pointers, dangling pointers, and pointers of mismatched types.

[0054] (2) Correct pointer

[0055] Correct pointers include: initialized pointers, effective memory allocation, bounds checking, type-safe pointers, handling of dangling pointers, and resource management.

[0056] (3) Page fault handler

[0057] The page fault handler is a program in the operating system that triggers an interrupt when the CPU tries to access a virtual memory page but the page is not in physical memory. This process is called a "page fault". The handler is responsible for managing this error and ensuring that the system can continue to run without crashing.

[0058] Next, the technical solutions provided in the embodiments of the present application are introduced.

[0059] Figure 1 is a flow chart of the network resource management method provided by the embodiment of the present application, such as Figure 1 As shown, the following steps are included:

[0060] Step S101, when creating a network resource for a certain network namespace, if the same type of network resources exist in all network namespaces, the network resource is directly created; otherwise, a global linked list, a mapping table and the network resource are created;

[0061] Step S102, setting an identifier for the newly created network resource, and assigning a first pointer to it according to its resource type, and inserting the first pointer into a global linked list; the above identifier is associated with the network namespace to which the network resource belongs; a global linked list is used to store first pointers of network resources of the same resource type belonging to different network namespaces, so as to realize global management of network resources;

[0062] Step S103, inserting a first pointer and a second pointer pointing to the location of the newly created network resource into the mapping table; wherein, when the network resource is accessed by a process, the page error handler is triggered through the first pointer as the only entry to access the above network resource, and responds to the process access in combination with the above mapping table and the identifier; the above identifier is used to verify whether the network namespace where the current accessing process is located matches the network namespace to which the network resource belongs.

[0063] It can be understood that the present application realizes unified management and storage of network resources by creating a global linked list for each network resource. An identifier is attached to each network resource to identify the network namespace to which it belongs. The present application uses illegal pointers and page fault handlers as unified entry points to access network resources. Different types of network resources are assigned to specific illegal virtual address segments (such as 0x0000700000000000, 0x0000701000000000, etc.) to distinguish resource types. When a process accesses a network resource, an illegal pointer triggers a page fault, and the system determines the type of resource through a page fault handler and performs corresponding management operations. At the same time, the system associates the illegal pointer with the correct network resource pointer through a mapping table, obtains the correct network resource, and verifies whether the network namespace of the accessing process matches the network namespace of the resource to ensure correct access and secure isolation of resources. It is mainly divided into three stages: resource creation stage, resource management stage, and resource recovery stage.

[0064] In a specific embodiment, Figure 2 As shown in the figure, during the resource creation phase, the system creates network resources for each network namespace and inserts these resources into the global management structure. The specific steps are as follows:

[0065] 1) Determine whether the resource already exists: The system first checks the resource count of the currently requested resource in the network namespace. If the resource count is 0, it means that the network namespace does not have such resources yet, and jumps to the resource initialization process; if the count is not 0, skip resource initialization and directly update the resource count.

[0066] 2) Resource initialization and mapping table creation: The system will create the corresponding global linked list and initialize the variables in the linked list. At the same time, it will create a corresponding mapping table to store the mapping relationship between illegal pointers and correct resource pointers, and initialize the mapping table.

[0067] Among them, in all network namespaces, network resources of the same resource type are configured with a global linked list and a mapping table, that is, different types of network resources are configured with different global linked lists and different mapping tables for management and maintenance to achieve effective isolation of network resources.

[0068] 3) Update resource count: The system adds 1 to the resource count of the current network namespace, indicating that the corresponding global resource list has been created.

[0069] 4) Resource tagging and illegal pointer generation: Tag the newly created network resource. The tag is associated with the namespace to which the network resource belongs, and is used to distinguish resources in different namespaces in the subsequent stages. At the same time, specific illegal virtual address segments are allocated to different types of resources as illegal pointers, and the illegal pointers are inserted into the global linked list.

[0070] 5) Maintain the mapping relationship: Insert the illegal pointer and the correct network resource pointer into the mapping table to ensure that the system can find the correct resource based on the illegal pointer in the subsequent resource access or management stage.

[0071] Furthermore, in another specific embodiment, Figure 3 As shown in Figure 1, the task of the resource management phase is to ensure secure access and effective management of network resources through illegal pointer and page fault handlers. Whenever a process attempts to access a resource, the system triggers the page fault handler and performs correct access control based on the type and ownership of the resource. The specific steps are as follows:

[0072] 1) Capture illegal pointer access: When a process attempts to access network resources, the system triggers the page fault handler through illegal pointers and enters the resource management process.

[0073] 2) Determine resource type and process: The system determines the resource type based on the illegal virtual address segment corresponding to the illegal pointer and performs corresponding resource management operations, such as accessing the network interface, socket or routing table.

[0074] Among them, the above-mentioned corresponding resource management operations specifically refer to determining the type of network resources to be accessed according to the illegal virtual address segment corresponding to the illegal pointer, and then determining the corresponding mapping table according to the network resource type. The above-mentioned mapping table can specifically be: network interface, socket or routing table, etc.

[0075] 3) Verify resource ownership and access rights: Use the mapping table to find the correct network resource pointer corresponding to the illegal pointer, and verify whether the network namespace of the current process is consistent with the network namespace (tag) of the resource. If they are consistent, access to the resource is allowed; otherwise, access is denied.

[0076] Furthermore, in another specific embodiment, Figure 4 As shown, the task of the resource recovery phase is to safely recover resources and release system memory and other resources through illegal pointer and page error handlers when network resources are no longer used. The specific steps are as follows:

[0077] 1) Detect resource recycling conditions: The system checks the current resource usage. When the resource is no longer in use (for example, the number of resource reference pointers is 0, that is, the number of references is 0), the page error handler is triggered and the resource recycling process begins.

[0078] 2) Determine resource type and pointer search: Determine the type of resource that needs to be recycled through the value of the illegal pointer, and find the corresponding correct resource pointer from the mapping table.

[0079] 3) Verify resource ownership and execute recycling: Determine whether the network namespace to which the recycling requesting process belongs is consistent with the network namespace of the resource to be recycled. If they are consistent, continue the resource recycling process; otherwise, reject the recycling request.

[0080] 4) Deleting resources and illegal pointers: The system deletes illegal pointers from the global linked list, removes the correspondence between illegal pointers and correct pointers in the mapping table, and releases the corresponding network resources.

[0081] Figure 5 is a diagram of the network resource management device architecture provided by the embodiment of the present application; Figure 5 As shown, including:

[0082] The resource creation unit 510 is used to create a network resource for a certain network namespace. If the same type of network resources exist in all network namespaces, the network resource is directly created; otherwise, a global linked list, a mapping table and the network resource are created; an identifier is set for the newly created network resource, and a first pointer is assigned to it according to its resource type, and the first pointer is inserted into the global linked list; the identifier is associated with the network namespace to which the network resource belongs; a global linked list is used to store first pointers to network resources of the same resource type belonging to different network namespaces, so as to achieve global management of network resources; and the first pointer and a second pointer pointing to the location of the newly created network resource are inserted into the mapping table; wherein, when the network resource is accessed by a process, a page fault handler is triggered through the first pointer as the only entry to access the network resource, and the process access is responded to in combination with the mapping table and the identifier; the identifier is used to verify whether the network namespace where the current accessing process is located matches the network namespace to which the network resource belongs.

[0083] The resource management unit 520 is used to trigger a page error handler through the first pointer when the network resource is accessed by the process; in the page error handler, the resource type of the network resource is determined according to the virtual address segment corresponding to the first pointer, and the corresponding mapping table is determined according to the resource type; and the second pointer corresponding to the first pointer is searched based on the mapping table to determine whether the network namespace of the current process is consistent with the network namespace corresponding to the identifier of the network resource pointed to by the second pointer; if they are consistent, access is allowed; otherwise, access is denied.

[0084] The resource recovery unit 530 is used to trigger a page error handler through the first pointer when a certain network resource is no longer used and the network resource is accessed by the recovery process; in the page error handler, the resource type of the network resource is determined according to the virtual address segment corresponding to the first pointer, and the corresponding mapping table is determined according to the resource type; and the second pointer corresponding to the first pointer is searched based on the mapping table to determine whether the network namespace of the current recovery process is consistent with the network namespace corresponding to the identifier of the network resource pointed to by the second pointer; if they are consistent, the recovery is executed; otherwise, the recovery is rejected; the execution of the recovery includes: deleting the first pointer of the network resource from the global linked list corresponding to the resource type, removing the correspondence between the first pointer and the second pointer in the mapping table, and releasing the network resource.

[0085] It should be understood that the above-mentioned device is used to execute the method in the above-mentioned embodiment, and the implementation principle and technical effect of the corresponding program unit in the device are similar to those described in the above-mentioned method. The working process of the device can refer to the corresponding process in the above-mentioned method, which will not be repeated here.

[0086] Based on the method in the above embodiment, the embodiment of the present application provides an electronic device, such as Figure 6 As shown, the electronic device may include: a processor 610, a communication interface 620, a memory 630 and a communication bus 640, wherein the processor 610, the communication interface 620 and the memory 630 communicate with each other via the communication bus 640. The processor 610 may call the logic instructions in the memory 630 to execute the method in the above embodiment.

[0087] In addition, the logic instructions in the above-mentioned memory 630 can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application.

[0088] Based on the method in the above embodiment, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program. When the computer program runs on a processor, the processor executes the method in the above embodiment.

[0089] Based on the method in the above embodiment, an embodiment of the present application provides a computer program product. When the computer program product runs on a processor, the processor executes the method in the above embodiment.

[0090] It is understandable that the processor in the embodiment of the present application may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. The general-purpose processor may be a microprocessor or any conventional processor.

[0091] The method steps in the embodiments of the present application can be implemented by hardware or by a processor executing software instructions. The software instructions can be composed of corresponding software modules, and the software modules can be stored in random access memory (RAM), flash memory, read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), registers, hard disks, mobile hard disks, CD-ROMs, or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be located in an ASIC.

[0092] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented by software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted through the computer-readable storage medium. The computer instructions may be transmitted from a website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid state disk (SSD)), etc.

[0093] It should be understood that the various numerical numbers involved in the embodiments of the present application are only used for the convenience of description and are not used to limit the scope of the embodiments of the present application.

[0094] It will be easily understood by those skilled in the art that the above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A network resource management method, characterized in that: include: When creating a network resource for a network namespace, if the same type of network resources exist in all network namespaces, the network resource is created directly; Otherwise, create a global linked list, a mapping table, and the network resource; An identifier is set for the newly created network resource, and a first pointer is assigned to it according to its resource type, and the first pointer is inserted into a global linked list; the identifier is associated with the network namespace to which the network resource belongs; a global linked list is used to store the first pointers of network resources of the same resource type belonging to different network namespaces, so as to realize global management of network resources; Inserting the first pointer and the second pointer pointing to the location of the newly created network resource into the mapping table; wherein, when the network resource is accessed by a process, a page fault handler is triggered through the first pointer as the only entry to access the network resource, and responds to the process access in combination with the mapping table and the identifier; in the page fault handler, determining the resource type of the network resource according to the virtual address segment corresponding to the first pointer, and determining the corresponding mapping table according to the resource type; Based on the mapping table, the second pointer corresponding to the first pointer is searched to determine whether the network namespace of the current process is consistent with the network namespace corresponding to the identifier of the network resource pointed to by the second pointer; if they are consistent, access is allowed; otherwise, access is denied; the identifier is used to verify whether the network namespace where the current access process is located matches the network namespace to which the network resource belongs.

2. The method according to claim 1, characterized in that Also includes: When a certain network resource is no longer used, the network resource is accessed by a recycling process, and at this time, a page fault handling program is triggered through the first pointer; In the page fault processing program, determining a resource type of the network resource according to the virtual address segment corresponding to the first pointer, and determining a corresponding mapping table according to the resource type; Searching the second pointer corresponding to the first pointer based on the mapping table, and determining whether the network namespace of the current recycling process is consistent with the network namespace corresponding to the identifier of the network resource pointed to by the second pointer; If they are consistent, recycling is executed; otherwise recycling is rejected; the recycling execution includes: deleting the first pointer of the network resource from the global linked list corresponding to the resource type, removing the corresponding relationship between the first pointer and the second pointer in the mapping table, and releasing the network resource.

3. The method according to claim 1 or 2, characterized in that: Allocating a first pointer to a network resource according to the resource type includes: Each network resource of the same resource type is assigned an address within a virtual address segment as the first pointer of the network resource.

4. The method according to claim 2, characterized in that: Whether a network resource is used is determined in the following manner: when the number of times a network resource is referenced is 0, the network resource is no longer used.

5. The method according to claim 1 or 2, characterized in that: The first pointer is an illegal pointer; and / or The second pointer is a correct pointer.

6. A network resource management device, characterized in that: include: A resource creation unit, used for creating a network resource for a certain network namespace, if the same type of network resources exist in all network namespaces, then the network resource is directly created; otherwise, a global linked list, a mapping table and the network resource are created; an identifier is set for the newly created network resource, and a first pointer is assigned to it according to its resource type, and the first pointer is inserted into the global linked list; the identifier is associated with the network namespace to which the network resource belongs; a global linked list is used to store first pointers to network resources of the same resource type belonging to different network namespaces, so as to achieve global management of network resources; and the first pointer and a second pointer pointing to the location of the newly created network resource are inserted into the mapping table; wherein, when the network resource is accessed by a process, a page fault handler is triggered through the first pointer as the only entry to access the network resource, and the process access is responded to in combination with the mapping table and the identifier; the identifier is used to verify whether the network namespace where the current accessing process is located matches the network namespace to which the network resource belongs; A resource management unit is used to trigger a page error handler through the first pointer when a network resource is accessed by a process; in the page error handler, determine the resource type of the network resource according to the virtual address segment corresponding to the first pointer, and determine the corresponding mapping table according to the resource type; and search for the second pointer corresponding to the first pointer based on the mapping table to determine whether the network namespace of the current process is consistent with the network namespace corresponding to the identifier of the network resource pointed to by the second pointer; if they are consistent, allow access; otherwise deny access.

7. The device according to claim 6, characterized in that Also includes: A resource recovery unit, configured to trigger a page fault handling program through the first pointer when a certain network resource is no longer used and the network resource is accessed by a recovery process; In the page fault handling program, the resource type of the network resource is determined according to the virtual address segment corresponding to the first pointer, and the corresponding mapping table is determined according to the resource type; and the second pointer corresponding to the first pointer is searched based on the mapping table to determine whether the network namespace of the current recycling process is consistent with the network namespace corresponding to the identifier of the network resource pointed to by the second pointer; If they are consistent, recycling is executed; otherwise recycling is rejected; the recycling execution includes: deleting the first pointer of the network resource from the global linked list corresponding to the resource type, removing the corresponding relationship between the first pointer and the second pointer in the mapping table, and releasing the network resource.

8. An electronic device, characterized in that: include: at least one memory for storing a computer program; At least one processor is used to execute the program stored in the memory. When the program stored in the memory is executed, the processor is used to execute the method according to any one of claims 1 to 5.

Images