Collaborative processing system, computer that can use protected areas, program, and collaborative processing method

Abstract

A cooperative processing system (10) comprises protected-area-available computers (100) and general computers (200). Each protected-area-available computer (100) is provided with: a storage unit that has a protected area capable of protecting data in use and a normal area different from the protected area; a protected area usage processing unit that executes a protected area usage process to be performed in the protected area; a normal area usage processing unit that executes a normal area usage process to be performed in the normal area; and a cooperative processing unit that requests the normal area usage processing unit or a general computer (200) to process a service. If there is a protected area usage process among the processes constituting the service processing, the normal area usage processing unit requests the protected area usage processing unit to perform the process. If there is a protected area usage process among the processes, the general computer (200) requests, via the cooperative processing unit, the protected area usage processing unit to perform the process.

Description

[Technical Field]

[0001] The present invention relates to a cooperative processing system, a protected area-usable computer, a program, and a cooperative processing method for cooperation between a general computer and a protected area-usable computer having a protected area, which is a memory area with restricted access. [Background technology]

[0002] As one of the countermeasures against attacks on computer environments, a part of the storage area (main memory, memory) is set as a protected area, and a function of the CPU (Central Processing Unit) is provided that performs calculations (computation processing, processing) in this protected area (see Non-Patent Document 1). The computational processes that can access this protected area are limited, and even the OS (Operating System) cannot access the protected area. In the future, it is expected that the number of network services that use such protected areas will increase. The size of the protected area is limited by the CPU, and the protected area does not increase even if the storage area is increased. Therefore, by configuring computers that can use the protected area (computers that can use the protected area) in a cluster configuration, it is thought that it will be possible to respond even if service usage increases.

[0003] In providing a service, the computational process using the protected area is a part of the overall process, and computational process using the normal area, which is a storage area other than the protected area, is also executed. In general, when a service request is received, it is assumed that computational process using the normal area is executed, and computational process using the protected area is executed as needed. [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] Enhanced Security Features for Confidential Computing, [online], Intel, [Retrieved June 3, 2022], Internet<URL: https: / / cdrdv2.intel.com / v1 / dl / getContent / 723693> Summary of the Invention [Problem to be solved by the invention]

[0005] To provide a service, a protected area and a normal area of ​​the size necessary to execute the process that provides the service are required. For example, if there is a sufficient protected area but not enough normal area, the service cannot be provided. The present invention has been made in view of the above background, and an object of the present invention is to enable efficient memory utilization in processing for providing a service that uses a protected area. [Means for solving the problem]

[0006] In order to solve the above-mentioned problems, the collaborative processing system of the present invention is a collaborative processing system comprising a protected area-usable computer and a general computer, wherein the protected area-usable computer comprises a memory unit having a protected area capable of protecting data in use and a normal area different from the protected area, a protected area usage processing unit that executes protected area usage processing to be processed in the protected area, a normal area usage processing unit that executes normal area usage processing to be processed in the normal area, a service reception unit that accepts service requests, and a collaborative processing unit that requests the processing of the service from the normal area usage processing unit or the general computer, wherein the general computer comprises a collaborative unit that accepts the request for the processing of the service, executes the normal area usage processing among the processes that constitute the processing of the service, and returns the processing results, and if the protected area usage processing is among the processes that constitute the processing of the service, the normal area usage processing unit requests the protected area usage processing unit to execute it, and if the protected area usage processing is among the processes that constitute the processing of the service, the collaborative unit requests the collaborative processing unit to execute it, [Effects of the Invention]

[0007] According to the present invention, it is possible to enable efficient memory utilization in the process of providing a service that uses a protected area. [Brief explanation of the drawings]

[0008] [Figure 1] 1 is an overall configuration diagram of a cooperative processing system according to a first embodiment. [Figure 2] FIG. 2 is a functional block diagram of a protected area available computer according to the first embodiment. [Figure 3] FIG. 3 is a data configuration diagram of a memory status database according to the first embodiment. [Figure 4] FIG. 3 is a data configuration diagram of memory usage prediction data according to the first embodiment. [Figure 5] FIG. 2 is a data configuration diagram of a general computer database according to the first embodiment. [Figure 6] FIG. 3 is a data configuration diagram of a service processing management database according to the first embodiment. [Figure 7] FIG. 1 is a functional block diagram of a general computer according to a first embodiment. [Figure 8] 10 is a first flowchart of the cooperation process according to the first embodiment. [Figure 9] 10 is a second flowchart of the cooperation process according to the first embodiment. [Figure 10] FIG. 11 is a data configuration diagram of a service processing management database according to the second embodiment. [Figure 11] FIG. 10 is a first sequence diagram illustrating the cooperative processing according to the second embodiment. [Figure 12] FIG. 10 is a second sequence diagram illustrating the cooperative processing according to the second embodiment. [Figure 13] FIG. 10 is a diagram illustrating the overall configuration of a cooperative processing system according to a third embodiment. [Figure 14] FIG. 11 is a functional block diagram of a cluster management server according to the third embodiment. [Figure 15] FIG. 13 is a functional block diagram of a cluster management server according to the fourth embodiment. [Figure 16] FIG. 13 is a data configuration diagram of a normal area use process management database according to the fourth embodiment. [Figure 17] FIG. 13 is a sequence diagram illustrating a cooperation process according to the fourth embodiment. [Figure 18] FIG. 10 is a hardware configuration diagram illustrating an example of a computer that realizes the functions of a protected area usable computer according to the embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0009] <<Outline of the Collaborative Processing System>> A cooperative processing system in a mode (embodiment) for carrying out the present invention will be described below. The cooperative processing system is configured to include a protected area-available computer that can use a protected area, and a general computer that can use a normal area. When a request for a service that uses a protected area is received, the protected area-available computer executes the processing itself if there is free normal area available for processing the service. If there is no free normal area available, the protected area-available computer executes the processing that uses the protected area (protected area usage processing) itself, and requests (requests) the general computer to execute the processing that uses the normal area (normal area usage processing). By adopting this processing mode, it becomes possible to provide services even if the protected area available computer does not have sufficient free space in the normal area. Although a general computer may have a protected area, the following embodiment will be described assuming that the protected area of ​​a general computer is not used.

[0010] <Configuration of the Collaboration Processing System> 1 is an overall configuration diagram of a collaboration processing system 10 according to the first embodiment. The collaboration processing system 10 includes a load balancer 530, one or more protected area-available computers 100, and one or more general computers 200. The load balancer 530 distributes service requests sent from a user terminal 510 via a network 520 to the protected area-available computers 100. The protected area-available computers 100 and the general computers 200 each constitute a layer (first layer, second layer).

[0011] The requested service is processed using the protected area. In more detail, the process of executing the service consists of a series of processes (calculation processes, operations), some of which are processed using the protected area (processing using the protected area), and other processes which are processed using only the normal area without using the protected area (processing using the normal area). For example, the process of executing the service begins with processing using the normal area, continues with processing using the protected area, processing using the normal area, and processing using the protected area, and ends with processing using the normal area.

[0012] <Configuration of computers that can use protected areas> 2 is a functional block diagram of the protected area available computer 100 according to the first embodiment. The protected area available computer 100 includes a control unit 110, a storage unit 120, and a communication unit 180. The communication unit 180 includes a communication device, and transmits and receives communication data to and from the load balancer 530 and the general computer 200.

[0013] The storage unit 120 includes storage devices such as a read-only memory (ROM), a random access memory (RAM), and a solid-state drive (SSD). The storage unit 120 includes a memory status database 130 (see FIG. 3, described later), memory usage prediction data 140 (see FIG. 4, described later), a general computer database 150 (see FIG. 5, described later), a service processing management database 160 (see FIG. 6, described later), a protected area 121, a normal area 122, and a program 128. The program 128 includes a description of the processing procedure of the protected-area-usable computer 100 in the cooperative processing (see FIGS. 8 and 9, described later). The description of the processing procedure includes data, and the data and the description of the processing procedure stored in the protected area 121 may be encrypted.

[0014] The protected area 121 is an area on the main memory of the protected area-usable computer 100, where data in use can be protected and is used only by specific authorized computation processes (e.g., functions, modules). The protected area 121 stores programs and data for authorized computation processes. The protected area 121 is encrypted, for example, and cannot be accessed even by the OS. The normal area 122 is an area on the main memory that is not the protected area 121. The normal area 122 stores programs and data for computation processes other than the above-mentioned permitted computation processes.

[0015] <Memory section: Memory status database> 3 is a data configuration diagram of the memory status database 130 according to the first embodiment. The memory status database 130 is, for example, data in a table format, with one row (record) indicating the free space (free capacity, remaining amount) of the main memory of the protected area available computer 100 itself or the general computer 200. The record includes columns (attributes) for the computer, the remaining protected area amount, the remaining normal area amount, and the update date and time.

[0016] The computer attributes store identification information of the protected area available computer 100 or the general computer 200. In this specification, an IP address is used as the identification information, but the present invention is not limited to this. The attribute of the remaining protected area capacity stores the free space in the protected area 121, and the attribute of the remaining normal area capacity stores the free space in the normal area 122. The attribute of the update date and time stores the update date and time of the record. Note that in Figure 3, the attribute of the update date and time does not include the update date, but only the update time.

[0017] In the record on the first line in Figure 3, the computer attribute "127.0.0.1" indicates the protected area available computer 100 itself, and the free space (remaining capacity) of the protected area 121 is 8 GB, and the free space of the normal area 122 is 24 GB. The other records indicate the free space of the general computer 200. Since the general computer 200 does not have a protected area 121, the remaining protected area capacity is 0, and the remaining normal area capacity indicates the free space of the normal area 222 (see Figure 7 described below).

[0018] <<Storage section: Data for predicting memory usage>> 4 is a data configuration diagram of memory usage estimation data 140 according to the first embodiment. Memory usage estimation data 140 is, for example, data in a table format, with each row (record) indicating a formula (calculation procedure) for calculating the capacity of protected area 121 and normal area 122 required for processing a service. The record includes columns (attributes) for service, protected area usage, and normal area usage, and stores service identification information, a calculation formula for the usage of protected area 121 used by the service, and a calculation formula for the usage of normal area 122 used by the service, respectively. The unit of usage is, for example, MB. For example, when a request for service B with an input character string length of 100 is made, 51,200 MB of the protected area 121 and 100,000 MB of the normal area 122 are used to process this request.

[0019] <<Storage section: general computer database>> 5 is a data configuration diagram of the general computer database 150 according to the first embodiment. The general computer database 150 is, for example, data in a table format, with each row (record) containing information related to the general computer 200. The record contains columns (attributes) for the computer, normal area remaining amount acquisition interface, normal area usage process, and normal area usage process interface. Note that in FIG. 5, the interface is referred to as "I / F" (interface).

[0020] The computer attribute stores identification information of the general computer 200. The normal area remaining capacity acquisition interface attribute stores information indicating an interface (API: Application Programming Interface) for acquiring the free space of the normal area 222 (see FIG. 7 described later). The normal area usage process attribute stores identification information of a process that uses the normal area 222 executed by the general computer 200. The normal area usage process interface attribute stores information indicating an interface (API) that requests (demands) the process.

[0021] <<Storage section: service processing management database>> 6 is a data configuration diagram of the service processing management database 160 according to the first embodiment. The service processing management database 160 is, for example, data in a table format, with each row (record) containing information related to the processing of a requested service. The record contains columns (attributes) for user, service, collaboration partner, session, and update date and time.

[0022] The user attribute stores the identification information of the user or user terminal 510 (see Figure 1) that requested the service. The service attribute stores the identification information of the requested service. The linked computer attribute stores the identification information of the general computer 200 when a request is made to the general computer 200 to perform a process that uses the normal area when processing the service. When the protected area usable computer 100 itself performs a process that uses the normal area, the linked computer becomes "127.0.0.1". The session attribute stores identification information (session identification information) for identifying the process that uses the requested normal area. The update date and time attribute stores the date and time when the record was updated. Note that in Figure 6, the update date and time attribute does not include the update date, but only the update time.

[0023] <<Control unit: Protected area usage service reception unit>> 2, the control unit 110 will be described. The control unit 110 is configured to include a CPU, and has a protected area use service reception unit 111, a cooperation processing unit 112, a protected area use processing unit 113, a normal area use processing unit 114, and a general computer cooperation unit 115. The protected area use service receiving unit 111 receives a request for a service that uses the protected area 121 from the user terminal 510 .

[0024] <Control unit: Collaboration processing unit> The cooperative processing unit 112 distributes a series of processes (computation processes) constituting the requested service to the protected area use processing unit 113, the normal area use processing unit 114, and the general computer 200, which will be described later. To explain in more detail, the cooperative processing unit 112 requests (requests) the protected area use processing unit 113 to perform a process (protected area use process) that uses the protected area 121 among the series of processes. The cooperative processing unit 112 also requests (requests) the normal area use processing unit 114 or the general computer 200 to perform a process (normal area use process) that uses the normal area 122 but does not use a protected area.

[0025] The cooperative processing unit 112 calculates the usage of the normal area 122 based on the input (parameters) included in the service request, using the calculation formula shown for the normal area usage in the memory usage prediction data 140 (see FIG. 4). If there is free space in the normal area 122 (see the remaining normal area in the memory status database 130 (see FIG. 3)) that is equal to or greater than the usage amount, the cooperative processing unit 112 requests the normal area usage processing unit 114 to perform normal area usage processing. If there is no free space, the cooperative processing unit 112 requests the normal area usage processing from a general computer 200 that has free space.

[0026] The collaboration processor 112 also updates the memory status database 130 at a predetermined timing (for example, periodically). More specifically, the collaboration processor 112 acquires the free space in the protected area 121 and normal area 122 of the protected area-available computer 100 itself, and updates its own record (the record in which the computer is "127.0.0.1") in the memory status database 130. The collaboration processor 112 also acquires the free space in the normal area 222 (see FIG. 7, described later) of the general computer 200 via an interface indicated in the normal area remaining space acquisition interface of the general computer database 150 (see FIG. 5), and stores it in the attribute of the normal area remaining space of the general computer 200.

[0027] <<Control unit: Protected area usage processing unit, Normal area usage processing unit, General computer cooperation unit>> The protected area usage processing unit 113 executes the protected area usage processing using the protected area 121. The normal area usage processing unit 114 executes the normal area usage processing using the normal area 122. The general computer cooperation unit 115 mediates requests for normal area usage processing to the general computer 200, requests for protected area usage processing from the general computer 200 to the protected area use computer 100, and notifications (responses) of the processing results. The general computer cooperation unit 115 cooperates with a protected area use computer cooperation unit 211 (see FIG. 7 ) described below to establish a secure communication path between the protected area use computer 100 and the general computer 200, and then mediates requests for normal area usage processing, requests for protected area usage processing from the general computer 200 to the protected area use computer 100, and notifications of the processing results.

[0028] <General Computer Configuration> 7 is a functional block diagram of a general computer 200 according to the first embodiment. The general computer 200 includes a control unit 210, a storage unit 220, and a communication unit 280. The communication unit 280 includes a communication device, and transmits and receives communication data to and from the protected area available computer 100.

[0029] <General Computer: Memory> The storage unit 220 is configured to include a normal area 222 and a program 228. The program 228 includes a description of the processing procedures of the general computer 200 in the cooperative processing (see FIGS. 8 and 9 described below). The normal area 222 is an area on the main memory that executes the normal area usage processing upon receiving a request from the protected area-usable computer 100. Note that the storage unit 220 of the general computer 200 may include a protected area, but in this specification it is assumed that it does not include or use a protected area.

[0030] <General Computer: Control Unit> The control unit 210 includes a CPU, and is provided with a protected area use computer cooperation unit 211 , a cooperation processing unit 212 , and a normal area use processing unit 213 . The protected area usable computer inter-collaboration unit 211 mediates requests for normal area use processing from the protected area usable computer 100, requests for protected area use processing from the general computer 200 itself to the protected area usable computer 100, and notifications (responses) of processing results.

[0031] The protected area usable computer inter-cooperation unit 211 also cooperates with the general computer inter-cooperation unit 115 (see FIG. 2) to establish a secure communication path between the protected area usable computer 100 and the general computer 200, and then mediates requests for normal area use processing, requests for protected area use processing from the general computer 200 to the protected area usable computer 100, and notifications of processing results. The protected area usable computer inter-cooperation unit 211 also responds to inquiries about the free space (unused storage space capacity) of the normal area 222.

[0032] The cooperative processing unit 212 receives a request for normal area use processing from the protected area use-enabled computer 100, and requests the normal area use processing from the normal area use processing unit 213 (described later). The normal area use processing unit 213 executes the requested normal area use processing using the normal area 222.

[0033] <<Linkage Processing>> FIG. 8 is a flowchart of the cooperation process according to the first embodiment. FIG. 9 is a flowchart of the cooperation process according to the first embodiment. With reference to FIGS. 8 and 9, the process of providing a service through cooperation between the protected area available computer 100 and the general computer 200 will be described. In the figures referred to below, including FIGS. 8 and 9, the general computer-to-computer cooperation unit 115 and the protected area available computer-to-computer cooperation unit 211 are also referred to as the "general C cooperation unit" and the "protected area available C cooperation unit," respectively. Session identification information is also referred to as the "session ID."

[0034] In step S 11 , the protected area use service receiving unit 111 receives a service request from the user terminal 510 . In step S12, the protected area usage service reception unit 111 requests the processing of the requested service from the cooperation processing unit 112. This request includes parameters (input parameters) transmitted from the user terminal 510 and identification information of the user who uses the user terminal 510 that requested the service. In step S13, the cooperative processing unit 112 generates session identification information, which is then stored in the service processing management database 160 (see FIG. 6) together with the user's identification information and the like.

[0035] In step S14, the collaboration processor 112 identifies the destination of the request for the normal area utilization process. More specifically, the collaboration processor 112 calculates the capacity (usage) of the normal area 122 to be used based on the parameters included in the request in step S12 (see the normal area usage in the memory usage prediction data 140 in FIG. 4). Next, if the normal area 122 of the protected area-available computer 100 itself has free space equal to or greater than the usage (see the remaining normal area in the memory status database 130 in FIG. 3), the collaboration processor 112 designates the normal area utilization processor 114 as the request destination. If there is no free space in the normal area 122, the collaboration processor 112 designates the general computer 200 having free space equal to or greater than the usage in the normal area 222 (see the remaining normal area in the memory status database 130 in FIG. 3). The collaboration processor 112 stores the request destination in the collaboration destination attribute of the service processing management database 160 (see FIG. 6).

[0036] In step S15, if the identified request destination is itself (normal area use processing unit 114) (step S15→YES), the cooperative processing unit 112 proceeds to step S16, and if not itself (step S15→NO), the cooperative processing unit 112 proceeds to step S24 shown in FIG. In step S16, the cooperative processing unit 112 requests the normal area usage processing unit 114 to process the requested service. This request includes the parameters transmitted from the user terminal 510 and the session identification information generated in step S13.

[0037] In step S17, the normal area utilization processing unit 114 executes the normal area utilization process. In step S18, when the normal area use processing unit 114 shifts from the normal area use processing to the protected area use processing, it requests (requests) the protected area use processing unit 113 to execute the protected area use processing. This request (request) includes parameters required for the protected area use processing. In step S19, the protected area use processing unit 113 executes the requested (requested) protected area use process. In step S20, the protected area use processing unit 113 returns a response including the processing result of the protected area use processing to the normal area use processing unit 114. Note that steps S17 to S20 may be executed repeatedly.

[0038] In step S21, when the normal area utilization processing unit 114 has completed the normal area utilization processing, it returns a processing completion notice including the processing result and the session identification information to the cooperative processing unit 112. In step S22, the cooperative processing unit 112 returns a processing completion notice including the processing result to the protected area use service receiving unit 111. In step S23, the protected area use service accepting unit 111 returns the processing result to the user terminal 510.

[0039] Turning to FIG. 9, the process when a request for normal area use processing is made to the general computer 200 (step S15→NO) will be described. In step S24, the cooperation processing unit 112 instructs the general computer cooperation unit 115 to establish an encrypted communication path between itself (protected area available computer 100) and the requested general computer 200. This instruction includes the identification information of the requested general computer 200 identified in step S14.

[0040] In step S25, the general computer cooperation unit 115 cooperates with the protected area available computer cooperation unit 211 of the requesting general computer 200 to establish an encrypted communication path. Data exchanged between the protected area available computer 100 and the general computer 200 thereafter is sent and received via this encrypted communication path. In step S26, the general computer cooperation unit 115 returns a notification to the cooperation processing unit 112 that the establishment of the encrypted communication path has been completed.

[0041] In step S27, the cooperation processing unit 112 requests the general computer 200 to process the requested service via the general computer cooperation unit 115. This request includes the parameters transmitted from the user terminal 510 and the session identification information generated in step S13. This request is transferred from the general computer cooperation unit 115 to the protected area usage computer cooperation unit 211 of the general computer 200, and further to the cooperation processing unit 212 (not shown in FIG. 9, see FIG. 7) and the normal area usage processing unit 213.

[0042] In step S28, the normal area utilization processing unit 213 executes the normal area utilization process. In step S29, when the normal area usage processing unit 213 shifts from the normal area usage processing to the protected area usage processing, it requests (asks) the protected area use computer 100 to execute the protected area usage processing. The request is sent to the cooperation processing unit 212 in the opposite direction to the processing request (see step S27), and is then transferred to the protected area use computer cooperation unit 211, the general computer cooperation unit 115 of the protected area use computer 100, and the cooperation processing unit 112. This request includes parameters and session identification information required for the protected area usage processing.

[0043] In step S30, the cooperative processing unit 112 requests (requests) execution of the protected area use processing to the protected area use processing unit 113. This request includes parameters necessary for the protected area use processing. In step S31, the protected area use processing unit 113 executes the requested protected area use process. In step S32, the protected area use processing unit 113 returns a response including the processing result of the protected area use processing to the cooperative processing unit 112.

[0044] In step S33, the cooperative processing unit 112 returns the processing result of the protected area use processing together with the session identification information to the normal area use processing unit 213. Note that steps S28 to S33 may be executed repeatedly. In step S34, when the normal area utilization processing unit 213 has completed the normal area utilization processing, it returns a processing completion notice including the processing result and the session identification information to the cooperative processing unit 112. Steps S35 and S36 are similar to steps S22 and S23.

[0045] <Features of Collaboration Processing> If the protected area-usable computer 100 has free space in the normal area 122 required for processing the service, it executes the processing itself. If there is no free space in the normal area 122, the protected area-usable computer 100 executes the processing that uses the protected area 121 itself and requests the general computer 200 to execute the processing that uses the normal area. By adopting this processing mode, it becomes possible to provide services even if the protected area usable computer 100 does not have sufficient free space in the normal area 122. In other words, it becomes possible to use memory efficiently in the process of providing a service that uses a protected area.

[0046] The data stored in the protected area is highly confidential data such as encryption keys and authentication information, and the protected area usage process is considered to be a process related to such data. The proportion of the protected area usage process in the overall process of executing a service is generally low, and it is assumed that the majority of the process is normal area usage process. In the collaborative processing system 10, when there is free space in the normal area 122 of the protected area-usable computer 100, the service processing is completed within the computer itself, allowing for high-speed processing. When there is no free space in the normal area 122, most of the processing can be processed by the existing normal computer 200, enabling efficient service processing.

[0047] <<Variation: Sharing of encrypted communication channel>> In the above embodiment, an encrypted communication path is established each time a normal area use process is requested from the general computer 200 (steps S24 to S26). When normal area use processes related to multiple services (service requests) are requested from the same general computer 200, the processing requests and responses for the normal area use process and the protected area use process may be sent via the same encrypted communication path. The processing requests and responses for the normal area use process and the protected area use process (see steps S27, S29, S33, and S34) include session identification information, making it possible to identify which normal area use process / protected area use process is related to which service request processing. This reduces the processing load associated with establishing an encrypted communication path.

[0048] Second Embodiment In the first embodiment described above, the protected area available computer 100 responds to the user terminal 510 after the service processing is completed (see steps S22 and S23 in FIG. 8 and steps S35 and S36 in FIG. 9). In contrast, the protected area available computer 100A (not shown) provided in the cooperative processing system 10A (not shown) according to the second embodiment returns a response without waiting for the processing to be completed. After receiving the response, the user terminal 510 requests and obtains the processing results from the protected area available computer 100A. The differences from the first embodiment are explained below.

[0049] Second Embodiment: Service Processing Management Database FIG. 10 is a data configuration diagram of a service processing management database 160A according to the second embodiment. Compared to the service processing management database 160 (see FIG. 6) according to the first embodiment, client session and processing result attributes have been added. The client session attribute stores session identification information (hereinafter referred to as client session identification information) sent to the user terminal 510 in response to a service request. The processing result attribute stores the processing result of the requested service. The processing result "N / A" is an abbreviation for "Not Applicable," and indicates that processing is in progress and the processing result has not yet been obtained.

[0050] Second Embodiment: Collaborative Processing Fig. 11 is a sequence diagram 1 for explaining the cooperative processing according to the second embodiment. Fig. 12 is a sequence diagram 2 for explaining the cooperative processing according to the second embodiment. Differences from the cooperative processing according to the first embodiment (see Figs. 8 and 9) will be described with reference to Figs. 11 and 12.

[0051] Steps S41 to S44 are the same as steps S11 to S14 (see FIG. 8). In step S45, the cooperative processing unit 112A generates client session identification information and stores it in the service processing management database 160A (see FIG. 10). In step S46, the cooperative processing unit 112A returns a response including the client session identification information to the protected area use service receiving unit 111. In step S47, the protected area use service acceptance unit 111 returns a response including the client session identification information to the user terminal 510.

[0052] The processing from step S15 onwards until the collaboration processing unit 112A receives a processing completion notification (see step S21 in FIG. 8 and step S34 in FIG. 9) is the same as in the first embodiment. Upon receiving the processing completion notification, the collaboration processing unit 112A stores the processing result included in the processing completion notification in the processing result attribute of the service processing management database 160A (see FIG. 10). The collaboration processing unit 112A does not send a processing completion notification to the protected area usage service reception unit 111 (see steps S22 and S35), and the protected area usage service reception unit 111 does not send the processing result to the user terminal 510 (see steps S23 and S36).

[0053] Turning to FIG. 12, the explanation of the linking process will continue. It is assumed that the protected area use service receiving unit 111 receives a processing result request including the client session identification information (see step S47) from the user terminal 510 in step S51. In step S52, the protected area use service reception unit 111 requests the processing result from the cooperation processing unit 112. This request includes the client session identification information.

[0054] In step S53, the cooperation processing unit 112A refers to the service processing management database 160A (see FIG. 10), acquires the processing result corresponding to the client session identification information, and returns a response including the processing result. Note that if there is no processing result ("N / A"), the cooperation processing unit 112 returns an error indicating that processing is in progress. In step S54, the protected area use service acceptance unit 111 returns the processing result or an error to the user terminal 510.

[0055] <Features of the second embodiment> A user terminal 510 using the cooperative processing system 10 according to the first embodiment must wait until it receives the processing results of the service after requesting a service. In contrast, a user terminal 510 according to the second embodiment can request the processing results (see step S51 in FIG. 12) and obtain them when they become necessary after requesting a service from the cooperative processing system 10A (see step S47 in FIG. 11).

[0056] Third Embodiment The protected area available computer 100 in the first embodiment knows the free space of the normal area 222 of the general computer 200 (see the memory status database 130 in FIG. 3), and the cooperation processing unit 112 identifies the general computer 200 that requests normal area use processing (see step S14 in FIG. 8). The cluster management server 300 (see FIGS. 13 and 14 described later) knows the free space of the normal area 222 of the general computer 200, and the protected area available computer 100B may inquire of the cluster management server about the general computer 200 that requests normal area use processing.

[0057] Third Embodiment: Configuration of Collaborative Processing System 13 is a diagram showing the overall configuration of a collaboration processing system 10B according to the third embodiment. Compared to the collaboration processing system 10 according to the first embodiment, a cluster management server 300 is added between the layer of the protected area available computers 100B and the layer of the general computers 200.

[0058] The protected area usable computer 100B according to the third embodiment differs from the protected area usable computer 100 according to the first embodiment in the cooperation processing unit 112B. When the cooperation processing unit 112 according to the first embodiment does not have any free space in the normal area 122, it refers to the memory status database 130 (see FIG. 3) to identify the general computer 200 that should request normal area use processing (see step S14 in FIG. 8). In contrast, when the cooperation processing unit 112B does not have any free space in the normal area 122, it inquires of the cluster management server 300 to identify the general computer 200 that should request normal area use processing.

[0059] Third Embodiment: Configuration of Cluster Management Server 14 is a functional block diagram of a cluster management server 300 according to the third embodiment. The cluster management server 300 is a computer and includes a control unit 310, a storage unit 320, and a communication unit 380. The communication unit 380 includes a communication device and transmits and receives communication data to and from the protected area available computer 100B and the general computer 200.

[0060] The storage unit 320 is configured to include storage devices such as ROM, RAM, and SSD. The storage unit 320 stores a memory status database 330, a general computer database 340, and a program 328. The memory status database 330 and the general computer database 340 have the same data configuration as the memory status database 130 (see FIG. 3) and the general computer database 150 (see FIG. 5), respectively, provided in the protected area available computer 100. The program 328 includes a description of the procedure related to the processing of the cluster management server 300 in the cooperation processing (see FIG. 15), which will be described later.

[0061] The control unit 310 is configured to include a CPU, and has a cluster management unit 311. The cluster management unit 311 updates the memory status database 330 at a predetermined timing (for example, periodically) in the same manner as the cooperation processing unit 112. In response to an inquiry including the size of the normal area to be used from the protected area available computer 100B, the cluster management unit 311 responds with identification information of the general computer 200 including the free space of that size.

[0062] <Features of the third embodiment> In the first embodiment, each protected area available computer 100 inquires of each general computer 200 about the free space in the normal area 222. In contrast, in the third embodiment, the cluster management server 300 makes the inquiry about the free space, thereby reducing the load on the protected area available computers 100 and the general computers 200.

[0063] Fourth Embodiment In the third embodiment, the cluster management server 300 mediates inquiries about the free space in the normal area 222 of the general computer 200. A protected area available computer 100C (not shown) in a cooperative processing system 10C (not shown) according to the fourth embodiment requests the general computer 200 to perform normal area utilization processing via the cluster management server 300C (see FIG. 15 described later).

[0064] <Fourth embodiment: cluster management server> 15 is a functional block diagram of a cluster management server 300C according to the fourth embodiment. Compared to the cluster management server 300 according to the third embodiment, a normal area usage process management database 350 is added to the storage unit 320, and a cluster management unit 311C is different. When the cluster management unit 311C receives a request for normal area utilization processing including the usage amount of the normal area 222, it identifies a general computer 200 that has free space in the usage amount (see the memory status database 330) and requests the normal area utilization processing.

[0065] 16 is a data configuration diagram of a normal area use process management database 350 according to the fourth embodiment. The normal area use process management database 350 is, for example, data in a table format, with one row (record) representing one normal area use process. The record includes columns (attributes) for the protected area available computer (shown as "Protected C" in FIG. 16), session, general computer (shown as "General C" in FIG. 16), and update date and time.

[0066] The protected area available computer attribute stores the identification information of the protected area available computer 100C that requested the normal area use process. The session attribute stores the session identification information related to the normal area use process. The general computer attribute stores the identification information of the general computer 200 that is the destination of the normal area use process. The update date and time attribute stores the update date and time of the record. Note that in Figure 16, the update date and time does not include the update date, and only the update time is stored.

[0067] Fourth Embodiment: Collaborative Processing Fig. 17 is a sequence diagram for explaining the cooperation processing according to the fourth embodiment. With reference to Fig. 17, differences from the first embodiment in the processing (see Fig. 9) when requesting normal area use processing from the general computer 200 according to the fourth embodiment will be explained. Note that in step S14 (see Fig. 8) of the first embodiment, the cooperation processing unit 112 identifies the general computer 200 requesting normal area use processing, but this is not specified in the fourth embodiment. More specifically, if there is no free space in its own normal area 122 (see step S15 → NO), the cooperation processing unit 112C proceeds to the processing of Fig. 17.

[0068] In step S61, the cooperation processing unit 112C instructs the general inter-computer cooperation unit 115 to establish an encrypted communication path between itself (protected area available computer 100C) and the cluster management server 300C. This instruction includes the session identification information generated in step S13 and the usage amount of the normal area 222 required for the requested normal area use process calculated in step S14. The general inter-computer cooperation unit 115 transmits the contents of this instruction to the cluster management server 300C.

[0069] In step S62, the cluster management unit 311C refers to the memory status database 330 and identifies a general computer 200 that has free space in the normal area 222 equal to or greater than the amount used and is to be the destination of a request for normal area use processing. In step S63, the general computer linking unit 115, the cluster management unit 311C, and the protected area available computer linking unit 211 of the general computer 200 that is the request destination link together to establish an encrypted communication path. In step S64, the general inter-computer cooperation unit 115 returns a notification of completion of establishment of the encrypted communication path to the cooperation processing unit 112C.

[0070] The subsequent processing is the same as in the first embodiment (steps S27 to S36 shown in FIG. 9). However, processing requests and responses for normal area use processing and protected area use processing are performed via the general computer cooperation unit 115, cluster management unit 311C, protected area usable computer cooperation unit 211 (see FIGS. 7 and 9), and cooperation processing unit 212. In other words, the cooperation processing unit 112C requests the cluster management server 300C to perform normal area use processing, and the cluster management unit 311C requests the general computer 200 to perform the normal area use processing.

[0071] Features of the Fourth Embodiment Compared to the first embodiment, in the protected area available computer 100C of the fourth embodiment, the cluster management server 300C executes the process of requesting the general computer 200 to use the normal area, thereby reducing the processing load.

[0072] <<Variation: Sharing of encrypted communication channel>> In the fourth embodiment described above, an encrypted communication path between the protected area available computer 100 and the cluster management server 300C, and an encrypted communication path between the cluster management server 300C and the general computer 200 are established each time a normal area usage process is requested of the general computer 200 (see steps S61 to S64 in FIG. 17). The cluster management server 300C may also be configured to have a single encrypted communication path with each of the protected area available computer 100 and the general computer 200.

[0073] Other variations Although several embodiments of the present invention have been described above, these embodiments are merely examples and do not limit the technical scope of the present invention. For example, although the normal area utilization processing unit 114 requests the protected area utilization processing directly from the protected area utilization processing unit 113, the request may be made via the cooperative processing unit 112.

[0074] For example, in the above embodiment, the protected area available computers 100, 100A, 100B, and 100C are the first to receive the service request processing, but it may also be the general computer 200. When the normal area usage processing shifts to the protected area usage processing, the protected area usage processing may be requested from the protected area available computers 100, 100A, 100B, and 100C.

[0075] The present invention can take on various other embodiments, and various modifications such as omissions and substitutions can be made without departing from the spirit of the present invention. These embodiments and modifications are included in the scope and spirit of the invention described in this specification, etc., and are also included in the invention described in the claims and their equivalents.

[0076] <Hardware configuration> The protected area available computer 100 according to the above embodiment is realized by a computer 900 having a configuration as shown in FIG. 18, for example. FIG. 18 is a hardware configuration diagram showing an example of the computer 900 that realizes the functions of the protected area available computers 100, 100A, 100B, and 100C according to the above embodiment. The computer 900 includes a CPU 901, a ROM 902, a RAM 903, an SSD 904, an input / output interface 905 (referred to as an input / output I / F in FIG. 18), a communication interface 906 (referred to as a communication I / F in FIG. 18), and a media interface 907 (referred to as a media I / F in FIG. 18). The computer 900 may include a hard disk drive (HDD) instead of the SSD 904, or may include a HDD in addition to the SSD 904.

[0077] The CPU 901 operates based on a program stored in the ROM 902 or the SSD 904, and performs control by the control unit 110 shown in Fig. 2. The ROM 902 stores a boot program executed by the CPU 901 when the computer 900 starts up, programs related to the hardware of the computer 900, and the like. The CPU 901 controls an input device 910 such as a mouse or keyboard, and an output device 911 such as a display or printer, via an input / output interface 905. The CPU 901 acquires data from the input device 910 via the input / output interface 905, and outputs generated data to the output device 911.

[0078] The SSD 904 stores programs executed by the CPU 901 and data used by the programs. The communication interface 906 receives data from other devices (not shown) (e.g., the load balancer 530 or the general computer 200) via a communication network and outputs the data to the CPU 901, and also transmits data generated by the CPU 901 to other devices via the communication network.

[0079] The media interface 907 reads a program or data stored in the recording medium 912 and outputs it to the CPU 901 via the RAM 903. The CPU 901 loads the program from the recording medium 912 onto the RAM 903 via the media interface 907 and executes the loaded program. The recording medium 912 is an optical recording medium such as a DVD (Digital Versatile Disk), a magneto-optical recording medium such as an MO (Magneto Optical disk), a magnetic recording medium, a conductive memory tape medium, a semiconductor memory, or the like.

[0080] For example, when the computer 900 functions as the protected area available computer 100 according to the embodiment described above, the CPU 901 of the computer 900 executes the program 128 (see FIG. 2) loaded onto the RAM 903, thereby realizing the functions of the protected area available computer 100. The CPU 901 reads the program from the recording medium 912 and executes it. Alternatively, the CPU 901 may read the program from another device via a communication network, or may install the program 128 from the recording medium 912 onto the SSD 904 and execute it.

[0081] Effect The effects of the device will be explained below.

[0082] The collaborative processing system 10 includes a protected area available computer 100 and a general computer 200 . The protected area-enabled computer 100 includes a storage unit 120 having a protected area 121 capable of protecting data in use, and a normal area 122 different from the protected area 121 . The protected area usable computer 100 comprises a protected area usage processing unit 113 that executes the protected area usage processing to be processed in the protected area 121, a normal area usage processing unit 114 that executes the normal area usage processing to be processed in the normal area 122, a service reception unit (protected area usage service reception unit 111) that receives service requests, and a collaboration processing unit (see collaboration processing unit 112, general computer collaboration unit 115) that requests the normal area usage processing unit 114 or the general computer 200 to process the service. The general computer 200 has a collaboration unit (see the protected area usable computer collaboration unit 211, collaboration processing unit 212, and normal area utilization processing unit 213) that accepts a request for service processing, executes normal area utilization processing among the processes that constitute the processing of the service, and returns the processing results. If the processing that constitutes the processing of the service includes a protected area usage process, the normal area usage processing unit 114 requests the protected area usage processing unit 113 to execute the process. If the processing that constitutes the processing of the service includes a protected area use processing, the cooperation unit requests the cooperation processing unit to have the protected area use processing unit 113 execute the processing.

[0083] According to this cooperative processing system 10, even if the protected area available computer 100 does not have a sufficient free space in the normal area 122, it is possible to provide services.

[0084] The cooperation processing unit calculates the normal area usage, which is the capacity of the normal area required for processing the service, and if the unused storage capacity of the normal area 122 in the storage unit 120 is equal to or greater than the normal area usage, requests normal area utilization processing from the normal area utilization processing unit 114. If the unused storage capacity of the normal area in the storage unit 120 is less than the normal area usage, the cooperation processing unit requests the general computer 200 to perform normal area utilization processing.

[0085] According to such a cooperative processing system 10, if the protected area usable computer 100 has sufficient free space in the normal area 122, the protected area usable computer 100 itself performs normal area use processing, thereby enabling high-speed service processing.

[0086] The cooperative processing system 10B further includes a cluster management server 300. In response to the inquiry about the unused storage area capacity, the cooperation unit provided in the general computer 200 responds with the unused storage area capacity of the storage unit 220 provided in the general computer 200. The cluster management server 300 has a cluster management unit 311 that inquires about and obtains the unused storage capacity of a general computer 200, and in response to an inquiry including normal storage usage, which is the capacity of the normal storage required for processing a service, returns identification information for a general computer 200 that has unused storage capacity equal to or greater than the normal storage usage. The collaboration processing unit provided in the protected area usable computer 100B calculates the normal area usage, and if the unused memory space capacity of the normal area in the memory unit 120 provided in the protected area usable computer 100B is equal to or greater than the normal area usage, requests the normal area usage processing unit 114 to perform normal area usage processing. If the unused storage capacity of the normal area 122 of the memory unit 120 of the protected area usable computer 100B is less than the normal area usage, the collaboration processing unit provided in the protected area usable computer 100B makes an inquiry to the cluster management server 300 including the normal area usage amount to obtain identification information, and requests the general computer 200 corresponding to the identification information to perform normal area usage processing.

[0087] According to this cooperative processing system 10B, the cluster management server 300 inquires about free space on the general computer 200, and the load on the protected area available computer 100B and the general computer 200 is reduced.

[0088] The cooperative processing system 10C further includes a cluster management server 300C. In response to the inquiry about the unused storage area capacity, the cooperation unit provided in the general computer 200 responds with the unused storage area capacity of the storage unit 220 provided in the general computer 200. The cluster management server 300C has a cluster management unit 311C that inquires about and obtains the unused storage capacity of the general computer 200, and in response to a request for normal storage area utilization processing including a normal storage area usage amount, which is the capacity of the normal storage area 222 required for processing a service, requests the normal storage area utilization processing from a general computer 200 that has an unused storage area capacity equal to or greater than the normal storage area usage amount. The collaboration processing unit provided in the protected area usable computer 100C calculates the normal area usage, and if the unused memory space capacity of the normal area in the memory unit 120 provided in the protected area usable computer 100C is equal to or greater than the normal area usage, requests the normal area usage processing unit 114 to perform normal area usage processing. If the unused storage capacity of the normal area of ​​the storage unit 120 of the protected area available computer 100C is less than the normal area usage, the collaboration processing unit provided in the protected area available computer 100C requests the cluster management server 300C to perform normal area utilization processing including the normal area usage.

[0089] According to this cooperative processing system 10, the protected area available computer 100C delegates the process of requesting the general computer 200 to use the normal area to the cluster management server 300C, thereby reducing the processing load.

[0090] When the collaboration processing unit of the protected area use computer 100A receives a request for processing a service from the service reception unit (protected area use service reception unit 111), it generates session identification information, instructs the service reception unit to transmit the session identification information to the source of the service request (user terminal 510), and requests the normal area use processing unit 114 or the general computer 200 to process the service, and stores the processing results of the processing in association with the session identification information. The service reception unit receives a request for a processing result including session identification information. When the cooperation processing unit receives a request for processing the request from the service reception unit, the cooperation processing unit instructs the service reception unit to transmit the processing result corresponding to the session identification information to the source of the service request.

[0091] According to such a collaborative processing system 10, the requester of a service can request a processing result (see step S51 in FIG. 12) when it becomes necessary after requesting a service from the collaborative processing system 10A (see step S47 in FIG. 11). [Explanation of symbols]

[0092] 10, 10A, 10B, 10C Collaborative Processing System 100, 100A, 100B, 100C Protected area available computers 111 Protected Area Usage Service Reception Unit (Service Reception Unit) 112, 112A, 112B, 112C cooperation processing unit 113 Protected area utilization processing unit 114 Normal area utilization processing unit 115 General computer-to-computer cooperation unit (cooperation processing unit) 120 Storage section 121 Protected Area 122 Normal area 128 programs 200 General Computers 211 Protected Area Available Computer Cooperation Unit (Cooperation Unit) 212 Collaboration processing unit (collaboration unit) 213 Normal area usage processing unit (linkage unit) 300,300C Cluster management server 311,311C Cluster Management Department

Claims

1. A collaborative processing system including a protected area available computer and a general computer, The protected domain enabled computer includes: a storage unit having a protected area capable of protecting data in use and a normal area different from the protected area; a protection area utilization processing unit that executes a protection area utilization process to be processed in the protection area; a normal area utilization processing unit that executes a normal area utilization process to be processed in the normal area; a service reception unit that receives a request for a service; a cooperative processing unit that requests the normal area utilization processing unit or the general computer to process the service, The general computer is a linking unit that receives a request for processing the service, executes a normal area utilization process among the processes that constitute the processing of the service, and returns a processing result; If the normal area utilization processing unit includes the protected area utilization processing unit in the processing of the service, the normal area utilization processing unit requests the protected area utilization processing unit to execute the protected area utilization processing unit; If the protected area use process is included in the processes constituting the service process, the cooperation unit requests the cooperation processing unit to execute the protected area use process. Collaborative processing system.

2. The cooperation processing unit Calculating a normal area usage amount, which is the capacity of the normal area required for processing the service; If the unused storage area capacity of the normal area of ​​the storage unit is equal to or greater than the normal area usage amount, requesting the normal area utilization processing unit to perform the normal area utilization processing; If the unused storage area capacity of the normal area of ​​the storage unit is less than the normal area usage amount, Requesting the general computer to perform the normal area utilization process The cooperative processing system according to claim 1 .

3. further comprising a cluster management server; The linking unit provided in the general computer includes: In response to an inquiry about the unused storage capacity, the unused storage capacity of the storage unit provided in the general computer is responded to; The cluster management server Inquiring and obtaining the unused storage capacity of the general computer; a cluster management unit that, in response to an inquiry including a normal area usage amount that is the capacity of the normal area required for processing the service, returns identification information of a general computer having an unused storage area capacity equal to or greater than the normal area usage amount; The cooperation processing unit provided in the protected area available computer Calculating the normal area usage, If the unused storage area capacity of the normal area of ​​the storage unit provided in the protected area available computer is equal to or greater than the normal area usage amount, requesting the normal area utilization processing unit to perform the normal area utilization processing; If the unused storage capacity of the normal area of ​​the storage unit of the protected area available computer is less than the normal area usage amount, making an inquiry including the normal area usage amount to the cluster management server to acquire the identification information; A request for the normal area use process is made to the general computer corresponding to the identification information. The cooperative processing system according to claim 1 .

4. further comprising a cluster management server; The linking unit provided in the general computer includes: In response to an inquiry about the unused storage capacity, the unused storage capacity of the storage unit provided in the general computer is responded to; The cluster management server Inquiring and obtaining the unused storage capacity of the general computer; a cluster management unit that, in response to a request for normal area utilization processing including a normal area usage amount that is the capacity of the normal area required for processing the service, requests a general computer having an unused storage area capacity equal to or greater than the normal area usage amount to perform the normal area utilization processing; The cooperation processing unit provided in the protected area available computer Calculating the normal area usage, If the unused storage area capacity of the normal area of ​​the storage unit provided in the protected area available computer is equal to or greater than the normal area usage amount, requesting the normal area utilization processing unit to perform the normal area utilization processing; If the unused storage capacity of the normal area of ​​the storage unit of the protected area available computer is less than the normal area usage amount, A request for the normal area usage process including the normal area usage amount is sent to the cluster management server. The cooperative processing system according to claim 1 .

5. The cooperation processing unit When a request for processing the service is received from the service reception unit, session identification information is generated, and the session identification information is transmitted to the service reception unit instructing the service reception unit to transmit the session identification information to the requester of the service; requesting the normal area utilization processing unit or the general computer to process the service, and storing the processing result of the process in association with the session identification information; The service reception unit receiving a request for a processing result including the session identification information; The cooperation processing unit When a request for processing the request is received from the service reception unit, the service reception unit is instructed to transmit a processing result corresponding to the session identification information to the source of the service request. The cooperative processing system according to claim 1 .

6. A protected area available computer of a cooperative processing system including a protected area available computer and a general computer, a storage unit having a protected area capable of protecting data in use and a normal area different from the protected area; a protection area utilization processing unit that executes a protection area utilization process to be processed in the protection area; a normal area utilization processing unit that executes a normal area utilization process to be processed in the normal area; a service reception unit that receives a request for a service; a cooperative processing unit that requests the normal area utilization processing unit or the general computer to process the service, the normal area utilization processing unit, if there is a protected area utilization process among the processes constituting the service process, requests the protected area utilization processing unit to execute the process; When the cooperation processing unit receives the protected area use process from the general computer, the cooperation processing unit requests the protected area use processing unit to execute the protected area use process, and returns the processing result to the general computer. Protected Area Available Computers.

7. A program for causing a computer to function as the protected area available computer according to claim 6.

8. A cooperative processing method for a protected area available computer in a cooperative processing system including a protected area available computer and a general computer, comprising: The protected domain enabled computer includes: a storage unit having a protected area capable of protecting data in use and a normal area different from the protected area; accepting a request for a service; determining whether to process the service on the protected area available computer or to request the service from the general computer; If the service is processed on the protected area-enabled computer, executing a protected area utilization process that is processed in the protected area among processes that constitute the processing of the service; a step of executing a normal area utilization process that is processed in the normal area among the processes that constitute the processing of the service; When requesting the general computer, When the protected area use process among the processes constituting the service process is received from the general computer, a step of executing the protected area use process is executed. Collaboration processing method.

Images