Orchestration system, server device, client device, orchestration method, and orchestration program

Abstract

The manifest synthesis unit 222 creates a synthesized manifest in which the resource settings of the system manifest 284 are defined as pre-settings that prioritize securing hardware resources and the resource settings of the user manifest 285 are defined as post-settings that use the remaining hardware resources. The manifest distribution unit 223 transmits the synthesized manifest to the client device 300.

Description

[Technical Field]

[0001] The present disclosure relates to a technology that enables the allocation of required resources for resource definitions in a container execution environment. [Background technology]

[0002] The distribution chain for virtual PLC servers is such that the system software, such as the OS, is provided by the equipment manufacturer, and application development is carried out by another company. PLC is an abbreviation for Programmable Logic Controller. OS is an abbreviation for Operating System.

[0003] Equipment manufacturers will introduce container execution environments. The application is executed under the container execution environment and the orchestrator. The hardware resources used by an application's container execution environment are defined in the orchestrator's manifest. The contents of the manifest could be arbitrarily defined by the application developer. On the other hand, in order to guarantee the minimum performance of the equipment provided by the equipment manufacturer, it was necessary to impose restrictions on the editing of the manifest. However, restrictions on editing the manifest are not acceptable as product specifications because they impair the design freedom of application developers. Therefore, a mechanism was needed that would allow application developers to design the hardware resources to be used in containers while ensuring that the hardware resources for the system software defined by the device manufacturer were secured.

[0004] Patent Document 1 relates to an industrial process control system that is a data center for a software-defined industrial process plant. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Japanese Patent Publication No. 2022-192052 Summary of the Invention [Problem to be solved by the invention]

[0006] The present disclosure aims to allow application developers to arbitrarily set hardware resources while ensuring that the minimum hardware resources required for device manufacturers' system software are secured. [Means for solving the problem]

[0007] The orchestration system of the present disclosure comprises: This is a system that allows a client device to secure the hardware resources necessary to build a container execution environment, and also allows the client device to secure the hardware resources to be used to execute a container in the container execution environment from the remaining hardware resources. The orchestration system A server device and the client device, The server device a manifest synthesis unit that uses a system manifest that defines resource settings of hardware resources required to build the container execution environment and a user manifest that defines resource settings of hardware resources used to execute the container in the container execution environment to create a synthesized manifest in which the resource settings of the system manifest are defined as pre-settings that prioritize securing hardware resources and the resource settings of the user manifest are defined as post-settings that use the remaining hardware resources; a manifest distribution unit that transmits the composite manifest to the client device; Equipped with. [Effects of the Invention]

[0008] According to the present disclosure, application developers can arbitrarily set hardware resources, while ensuring that the minimum hardware resources required for the system software of device manufacturers are secured. [Brief explanation of the drawings]

[0009] [Figure 1] FIG. 1 is a configuration diagram of an orchestration system 100 according to a first embodiment. [Figure 2] FIG. 1 is a configuration diagram of an orchestration system 100 according to a first embodiment. [Figure 3] FIG. 2 is a configuration diagram of a server device 200 according to the first embodiment. [Figure 4] FIG. 2 is a configuration diagram of a client device 300 according to the first embodiment. [Figure 5] 4 is a flowchart of the server device 200 according to the first embodiment. [Figure 6] 10 is a flowchart of step S210 in the first embodiment. [Figure 7] 4 is a flowchart of the client device 300 according to the first embodiment. [Figure 8] 10 is a flowchart of step S310 in the first embodiment. [Figure 9] FIG. 10 is a diagram for supplementing the orchestration method according to the first embodiment. [Figure 10] FIG. 10 is a diagram for supplementing the orchestration method according to the first embodiment. [Figure 11] FIG. 2 is a hardware configuration diagram of the server device 200 according to the first embodiment. [Figure 12] FIG. 2 is a hardware configuration diagram of a client device 300 according to the first embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0010] In the embodiments and drawings, the same or corresponding elements are denoted by the same reference numerals. The description of elements denoted by the same reference numerals as those already described will be omitted or simplified as appropriate. Arrows in the drawings primarily indicate the flow of data or the flow of processing.

[0011] Embodiment 1 The orchestration system 100 will be described with reference to FIGS.

[0012] ***Configuration Description*** The configuration of the orchestration system 100 will be described with reference to FIGS. The orchestration system 100 is the following system. The orchestration system 100 causes the client device 300 to reserve the hardware resources required to build a container execution environment 370 (see FIG. 2). The orchestration system 100 causes the client device 300 to reserve hardware resources to be used for executing the container 371 in the container execution environment 370 from the remaining hardware resources.

[0013] The orchestration system 100 includes a server device 200 and a client device 300 . The server device 200 and the client device 300 communicate with each other.

[0014] FIG. 1 shows the functional configuration of the server device 200. The program loader 210 functions as a key reading unit 211 and a verification unit 212 . The orchestrator controller 220 functions as a manifest reader 221 , a manifest synthesizer 222 , a manifest distributor 223 , and a resource setting display unit 224 . Each element of the server device 200 will be described below.

[0015] FIG. 2 shows the functional configuration of the client device 300. The program loader 310 functions as a key reading unit 311 and a verification unit 312 . The orchestrator agent 320 functions as a manifest receiving unit 321 , a manifest applying unit 322 , an execution environment creating unit 323 , a container executing unit 324 , and a resource setting presenting unit 325 . Each element of the client device 300 will be described below.

[0016] The configuration of the server device 200 will be described with reference to FIG. The server device 200 is a computer that includes hardware such as a processor 201, a memory 202, a communication device 203, an input / output interface 204, a ROM 205, a storage 280, and a secure storage 290. These pieces of hardware are connected to each other via signal lines.

[0017] The processor 201 is a processor of the server device 200 . A processor is an integrated circuit (IC) that performs computational processing and controls other hardware. For example, the processor may be a CPU, a DSP, a GPU, or a combination of these. IC is an abbreviation for Integrated Circuit. CPU is an abbreviation for Central Processing Unit. DSP is an abbreviation for Digital Signal Processor. GPU is an abbreviation for Graphics Processing Unit.

[0018] The memory 202 is a memory of the server device 200 . The memory may be a volatile or non-volatile storage device. The memory may also be called a primary storage device or a main memory. For example, the memory may be a RAM. The data stored in the memory 202 may be saved in the storage 280 as needed. RAM is an abbreviation for Random Access Memory.

[0019] The communication device 203 is a communication device of the server device 200 . The communication device is a receiver and a transmitter. For example, the communication device is a communication chip or a NIC. The communication of the server device 200 is performed using the communication device 203. NIC is an abbreviation for Network Interface Card.

[0020] The input / output interface 204 is an input / output interface of the server device 200 . The input / output interface is a port to which an input device and an output device are connected. For example, the input / output interface is a USB terminal, the input device is a keyboard and a mouse, and the output device is a display. Input and output to and from the server device 200 are performed via the input / output interface 204. USB is an abbreviation for Universal Serial Bus.

[0021] The ROM 205 is the ROM of the server device 200 . The ROM 205 is a non-volatile storage device. The program loader 210 is implemented using the ROM 205. ROM is an abbreviation for Read Only Memory.

[0022] The storage 280 is a storage of the server device 200 . The storage 280 is a non-volatile storage device. For example, the storage may be a ROM, a HDD, a flash memory, or a combination thereof. The data stored in the storage 280 is loaded into the memory 202 as needed. HDD is an abbreviation for Hard Disk Drive.

[0023] The secure storage 290 is a secure storage of the server device 200 . Secure storage is a non-volatile storage device that ensures security.

[0024] The server device 200 includes components such as a program loader 210 and an orchestrator controller 220. These components are realized by software.

[0025] The storage 280 stores a server program for causing a computer to function as the program loader 210 and the orchestrator controller 220. The server program is loaded into the memory 202 and executed by the processor 201. The processor 201 executes a server program while running an operating system (OS).

[0026] The data (input data, output data, etc.) of the server program is stored in a storage device (storage unit) such as memory 202, storage 280, a register in processor 201, and a cache memory in processor 301.

[0027] The server program can be recorded (stored) in a computer-readable manner on a non-volatile recording medium such as an optical disk or flash memory.

[0028] The configuration of the client device 300 will be described with reference to FIG. The client device 300 is a computer that includes hardware such as a processor 301, a memory 302, a communication device 303, an input / output interface 304, a ROM 305, a storage 380, and a secure storage 390. These pieces of hardware are connected to each other via signal lines.

[0029] The processor 301 is the processor of the client device 300 . The memory 302 is a memory of the client device 300. The data stored in the memory 302 is saved in the storage 380 as needed. The communication device 303 is a communication device of the client device 300. The communication of the client device 300 is performed using the communication device 303. The input / output interface 304 is an input / output interface for the client device 300. The input / output interface 304 is used for input and output of the client device 300. The ROM 305 is the ROM of the client device 300. The program loader 310 is executed using the ROM 305. The storage 380 is a storage of the client device 300. The data stored in the storage 380 is loaded into the memory 302 as needed. The secure storage 390 is a secure storage of the client device 300 .

[0030] The client device 300 includes components such as a program loader 310 and an orchestrator agent 320. These components are realized in software.

[0031] The storage 380 stores a client program for causing a computer to function as the program loader 310 and the orchestrator agent 320. The client program is loaded into the memory 302 and executed by the processor 301. The processor 301 executes a client program while running an operating system (OS).

[0032] The data of the client program is stored in a storage device (storage unit) such as the memory 302, the storage 380, a register in the processor 301, or a cache memory in the processor 301.

[0033] The client program can be recorded (stored) in a computer-readable manner on a non-volatile recording medium such as an optical disk or flash memory.

[0034] ***Explanation of Operation*** The operation procedure of the orchestration system 100 corresponds to an orchestration method, and also corresponds to a processing procedure by an orchestration program. The orchestration program includes a server program and a client program.

[0035] The operation of the server device 200 will be described with reference to FIG. The processor 201 executes a program loader 210 .

[0036] In step S210, the verification unit 212 verifies the signature data 281, the operating system 282, the orchestrator controller 283, and the system manifest 284.

[0037] Step S210 will be described in detail with reference to FIG. In step S211, the key reading unit 211 reads the verification key 291 from the secure storage 290 into the memory 202.

[0038] The verification key 291 indicates a hash value of the signature data 281 . The verification key 291 is stored in advance in the secure storage 290 .

[0039] In step S212, the verification unit 212 verifies the signature data 281 using the verification key 291 to confirm that the signature data 281 has not been tampered with.

[0040] The signature data 281 includes a signature for the operating system, a signature for the orchestrator controller, and a signature for the system manifest. The operating system signature is a digital signature of the operating system 282 and indicates the hash value of the operating system 282 . The orchestrator controller signature is a digital signature of the orchestrator controller 283 and indicates the hash value of the orchestrator controller 283. The system manifest signature is a digital signature of the system manifest 284 and indicates the hash value of the system manifest 284 .

[0041] The signature data 281 is verified as follows. First, the verification unit 212 reads the signature data 281 from the storage 280 into the memory 202 . Next, the verification unit 212 calculates a hash value of the signature data 281 using a hash function. Then, the verification unit 212 compares the hash value of the signature data 281 with the verification key 291 . If the hash value of the signature data 281 matches the verification key 291, the signature data 281 has not been tampered with.

[0042] If the signature data 281 has not been tampered with, the process proceeds to step S213.

[0043] If the signature data 281 has been tampered with, the process of step S210 ends, and the processes from step S220 onwards are not executed.

[0044] In step S213, the verification unit 212 verifies the operating system 282 using the operating system signature to confirm that the operating system 282 has not been tampered with.

[0045] Operating system 282 is the executable binary of an operating system (OS).

[0046] The operating system 282 is verified as follows. First, the verification unit 212 reads the operating system 282 from the storage 280 into the memory 202 . Next, the verification unit 212 calculates a hash value of the operating system 282 using a hash function. Then, the verification unit 212 compares the hash value of the operating system 282 with the operating system signature in the signature data 281 . If the hash value of the operating system 282 matches the signature for the operating system, the operating system 282 has not been tampered with.

[0047] If the operating system 282 has not been tampered with, the processor 201 executes the operating system (OS), and the process proceeds to step S214.

[0048] If the operating system 282 has been tampered with, the process of step S210 ends, and the processes from step S220 onwards are not executed.

[0049] In step S214, the OS functions as the verification unit 212. The verification unit 212 verifies the orchestrator controller 283 using the signature for the orchestrator controller, and confirms that the orchestrator controller 283 has not been tampered with.

[0050] Orchestrator controller 283 is an execution binary of orchestrator controller 220.

[0051] The orchestrator controller 283 is verified as follows: First, the verification unit 212 reads the orchestrator controller 283 from the storage 280 into the memory 202 . Next, the verification unit 212 calculates a hash value of the orchestrator controller 283 using a hash function. Then, the verification unit 212 compares the hash value of the orchestrator controller 283 with the signature for the orchestrator controller in the signature data 281. If the hash value of the orchestrator controller 283 matches the signature for the orchestrator controller, the orchestrator controller 283 has not been tampered with.

[0052] If the orchestrator controller 283 has not been tampered with, the processor 201 executes the orchestrator controller 220. Then, the process proceeds to step S215.

[0053] If the orchestrator controller 283 has been tampered with, the process of step S210 ends, and the processes from step S220 onwards are not executed.

[0054] In step S215, the orchestrator controller 220 functions as the verification unit 212. The verification unit 212 verifies the system manifest 284 using the system manifest signature to confirm that the system manifest 284 has not been tampered with.

[0055] The system manifest 284 is data that defines resource settings for hardware resources required to build the container execution environment 370 . The system manifest 284 is created, for example, by the device manufacturer.

[0056] The system manifest 284 is validated as follows: First, the verification unit 212 reads the system manifest 284 from the storage 280 into the memory 202 . Next, the verification unit 212 calculates a hash value of the system manifest 284 using a hash function. Then, the verification unit 212 compares the hash value of the system manifest 284 with the signature for the system manifest in the signature data 281 . If the hash value of the system manifest 284 matches the signature for the system manifest, the system manifest 284 has not been tampered with.

[0057] If the system manifest 284 has not been tampered with, the process of step S210 ends and the process proceeds to step S220.

[0058] If the system manifest 284 has been tampered with, the process of step S210 ends, and the processes from step S220 onwards are not executed.

[0059] Returning to FIG. 5, the description continues from step S220. In step S220, the manifest synthesis unit 222 creates the synthesized manifest 384.

[0060] The composite manifest 384 is data in which the resource settings of the system manifest 284 are defined as pre-settings and the resource settings of the user manifest 285 are defined as post-settings. The pre-setting is a setting that prioritizes securing hardware resources. Post-configuration is a configuration that uses the remaining hardware resources after pre-configuration.

[0061] The user manifest 285 is data that defines resource settings for hardware resources used to execute the container 371 in the container execution environment 370. The user manifest 285 is created, for example, by an application developer (user).

[0062] The composite manifest 384 is created as follows: First, the manifest reading unit 221 reads the user manifest 285 from the storage 280 into the memory 202 . Then, the manifest synthesis unit 222 synthesizes the system manifest 284 and the user manifest 285. As a result, a synthesized manifest 384 is created.

[0063] In step S230, the manifest distribution unit 223 transmits the composite manifest 384 to the client device 300.

[0064] In step S240, the resource setting display unit 224 transmits a request for resource setting information to the client device 300 and receives the resource setting information from the client device 300. As a result, the resource setting information is acquired. Then, the resource setting display unit 224 displays the resource setting information on the display.

[0065] The resource setting information is data indicating the resource setting applied to the container execution environment 370 .

[0066] The operation of the client device 300 will be described with reference to FIG. The processor 301 executes a program loader 310 .

[0067] In step S310, the verification unit 312 verifies the signature data 381, the operating system 382, ​​and the orchestrator agent 383.

[0068] Step S310 will be described in detail with reference to FIG. In step S311 , the key reading unit 311 reads the verification key 391 from the secure storage 390 into the memory 302 .

[0069] The verification key 391 indicates a hash value of the signature data 381 . The verification key 391 is stored in advance in the secure storage 390 .

[0070] In step S312, the verification unit 312 verifies the signature data 381 using the verification key 391 to confirm that the signature data 381 has not been tampered with.

[0071] The signature data 381 includes a signature for the operating system and a signature for the orchestrator agent. The operating system signature is a digital signature of the operating system 382 and indicates the hash value of the operating system 382 . The orchestrator agent signature is a digital signature of the orchestrator agent 383 and indicates the hash value of the orchestrator agent 383.

[0072] The signature data 381 is verified as follows. First, the verification unit 312 reads the signature data 381 from the storage 380 into the memory 302 . Next, the verification unit 312 calculates a hash value of the signature data 381 using a hash function. Then, the verification unit 312 compares the hash value of the signature data 381 with the verification key 391 . If the hash value of the signature data 381 matches the verification key 391, the signature data 381 has not been tampered with.

[0073] If the signature data 381 has not been tampered with, the process proceeds to step S313.

[0074] If the signature data 381 has been tampered with, the process of step S310 ends, and the processes from step S320 onwards are not executed.

[0075] In step S313, the verification unit 312 verifies the operating system 382 using the operating system signature to confirm that the operating system 382 has not been tampered with.

[0076] Operating system 382 is the executable binary of the operating system (OS).

[0077] The operating system 382 is verified as follows. First, the verification unit 312 reads the operating system 382 from the storage 380 into the memory 302 . Next, the verification unit 312 calculates a hash value of the operating system 382 using a hash function. Then, the verification unit 312 compares the hash value of the operating system 382 with the operating system signature in the signature data 381 . If the hash value of the operating system 382 matches the signature for the operating system, the operating system 382 has not been tampered with.

[0078] If the operating system 382 has not been tampered with, the processor 301 executes the operating system (OS), and the process proceeds to step S314.

[0079] If the operating system 382 has been tampered with, the process of step S310 ends, and the processes from step S320 onwards are not executed.

[0080] In step S314, the OS functions as the verification unit 312. The verification unit 312 verifies the orchestrator agent 383 using the signature for the orchestrator agent, and confirms that the orchestrator agent 383 has not been tampered with.

[0081] Orchestrator agent 383 is an execution binary of orchestrator agent 320.

[0082] The orchestrator agent 383 is verified as follows. First, the verification unit 312 reads the orchestrator agent 383 from the storage 380 into the memory 302 . Next, the verification unit 212 calculates a hash value of the orchestrator agent 383 using a hash function. Then, the verification unit 212 compares the hash value of the orchestrator agent 383 with the signature for the orchestrator agent in the signature data 381 . If the hash value of the orchestrator agent 383 matches the signature for the orchestrator agent, the orchestrator agent 383 has not been tampered with.

[0083] If the orchestrator agent 383 has not been tampered with, the processor 301 executes the orchestrator agent 320. Then, the process of step S310 ends, and the process proceeds to step S320.

[0084] If the orchestrator agent 383 has been tampered with, the process of step S310 ends, and the processes from step S320 onwards are not executed.

[0085] Returning to FIG. 7, the description continues from step S320. In step S320, the manifest receiving unit 321 receives the composite manifest 384 from the server device 200.

[0086] In step S330, the manifest application unit 322 applies the composite manifest 384.

[0087] The composite manifest 384 is applied as follows: The manifest application unit 322 applies the pre-configuration of the composite manifest 384 to reserve hardware resources for the container execution environment 370 . The manifest application unit 322 applies the post-configuration of the composite manifest 384 to reserve hardware resources for the container 371 from the remaining hardware resources after the pre-configuration.

[0088] In step S340, the execution environment construction unit 323 constructs the container execution environment 370 using the hardware resources secured by applying the pre-settings.

[0089] In step S350, the container execution unit 324 executes the container 371 in the container execution environment 370 using the hardware resources secured by applying the post configuration.

[0090] In step S360, the resource setting presentation unit 325 receives the request for resource setting information from the server device 200 and transmits the resource setting information to the client device 300. As a result, the resource setting information is presented.

[0091] ***Features of the First Embodiment*** At the time of startup, the server device 200 uses a pre-created digital signature to verify that the orchestrator execution binary and the device manufacturer created manifest have not been tampered with. The server device 200 combines the device-maker-created manifest and the user-created manifest using the orchestrator execution binary and the device-maker-created manifest that have been confirmed to have not been tampered with. The server device 200 transfers the composite manifest to the client device 300 . The composite manifest prioritizes the resource settings defined in the device manufacturer-created manifest to secure resources, and allocates the remaining resources to the user-created manifest. The client device 300 applies the composite manifest to construct a container execution environment. This forces the system resources defined in the device manufacturer-created manifest to be reserved for the container execution environment.

[0092] At startup, the client device 300 uses a pre-created digital signature to verify that the agent execution binary has not been tampered with. The client device 300 applies the composite manifest to construct a container execution environment using the agent execution binary that has been confirmed to have not been tampered with. This forces the system resources defined in the device manufacturer-created manifest to be reserved for the container execution environment.

[0093] The execution environment 504 deployed on the client device 300 is determined by a command from the client device 300 . Secure storage 290 and storage 280 are storage locations, not execution entities. The program loader 210 reads the verification key 291 from the secure storage 290 and checks the validity of the signature data 281 stored in the storage 280. Furthermore, the program loader 210 checks the validity of the operating system 282, the orchestrator controller 283, and the system manifest 284. After that, the operating system is started and the orchestrator controller 220 is executed. The orchestrator controller 220 reads the system manifest 284 and the user manifest 285 from the storage 280 and sends the composite manifest 384 to the orchestrator agent 320 . The orchestrator agent 320 receives the composite manifest 384 from the orchestrator controller 220 and creates the container execution environment 370 according to the composite manifest 384 .

[0094] In response to a request from the orchestrator execution binary, the server device 200 acquires and displays information on resource settings allocated to the container execution environment.

[0095] ***Effects of the First Embodiment*** The first embodiment is a form that enables the orchestrator to secure the necessary resources for the resource definition of the container execution environment. According to the first embodiment, application developers can arbitrarily set hardware resources, while device manufacturers can apply resource settings that ensure the minimum hardware resources required for their system software when creating a container execution environment.

[0096] ***Supplement to the first embodiment*** Based on Figure 9, we will provide additional information about the orchestration method. The control plane corresponds to the orchestrator controller 220, the worker node corresponds to the orchestrator agent 320, and the pod corresponds to the container execution environment 370. (1) The server acts as the control plane, and the client acts as a worker node. The server and client are a collection of executable programs, each of which is stored in storage. The control plane holds a configuration file (manufacturer-created manifest) that is not affected by user configuration. The manufacturer-created manifest is a configuration file that describes the allocation of hardware resources for worker nodes. The hardware resources of worker nodes are necessary for the hardware manufacturer to ensure performance. The contents of the server-side storage are signed in advance using public key cryptography. In addition, the verification key is stored in storage on the server that cannot be tampered with hardware-wise. (2) When the server boots, it performs a secure boot to verify the integrity and authenticity of the programs it executes. During the secure boot, it is verified that the control plane and manufacturer-created manifest are the same as those initially installed. (3) The control plane uses a read plugin to read the manifest created by the application developer (user-created manifest). The user-created manifest is called user configuration information. The configuration information defined in the manufacturer-created manifest created by the hardware manufacturer is called pre-configuration information. The control plane combines the user configuration information and pre-configuration information to generate new configuration information. The new configuration information is used to ensure that the hardware resources (CPU, memory) of the pre-configuration information are secured, and to allocate the hardware resources of the user configuration information by assuming that the remaining hardware resources are 100% resources. (4) The control plane notifies each worker node of the new configuration information. Each worker node uses the new configuration information to prepare a container execution environment (Pod) and run the container image.

[0097] Based on Figure 10, we will provide additional information about the orchestration method. The control plane corresponds to the orchestrator controller 220, the worker node corresponds to the orchestrator agent 320, and the vPLC (Pod) corresponds to the container execution environment 370. (1) The manifest created by the application developer (user-created manifest) is loaded by the loading plugin. (2) The import plugin combines the user-created manifest and the manufacturer-created manifest. The manufacturer-created manifest is created in advance by the device manufacturer. During the combination, existing algorithms (such as Kustomize) are used to merge simple differences. In the event of a hardware resource conflict, the resources specified in the manufacturer-created manifest are secured, and the remaining resources are allocated to the user-created manifest. (3) To prevent the load plugin from being tampered with, the file system in which the load plugin is stored is subject to secure boot. A key loaded at boot time is used to verify that the load plugin has not been tampered with.

[0098] The hardware configuration of the server device 200 will be described with reference to FIG. The server device 200 includes a processing circuit 209 . The processing circuitry 209 is hardware that implements the program loader 210 and the orchestrator controller 220 . The processing circuitry 209 may be dedicated hardware, or may be a processor 201 that executes a program stored in memory 202 .

[0099] When processing circuitry 209 is dedicated hardware, processing circuitry 209 may be, for example, a single circuit, a multiple circuit, a programmed processor, parallel programmed processors, an ASIC, an FPGA, or a combination thereof. ASIC is an abbreviation for Application Specific Integrated Circuit. FPGA is an abbreviation for Field Programmable Gate Array.

[0100] The server device 200 may include multiple processing circuits that replace the processing circuit 209 .

[0101] In the processing circuit 209, some functions may be realized by dedicated hardware, and the remaining functions may be realized by software or firmware.

[0102] Thus, the functions of the server device 200 can be realized by hardware, software, firmware, or a combination of these.

[0103] The hardware configuration of the client device 300 will be described with reference to FIG. The client device 300 includes a processing circuit 309 . The processing circuitry 309 is hardware that implements a program loader 310 and an orchestrator agent 320 . The processing circuitry 309 may be dedicated hardware or may be a processor 301 that executes a program stored in memory 302 .

[0104] When processing circuitry 309 is dedicated hardware, processing circuitry 309 may be, for example, a single circuit, a multiple circuit, a programmed processor, parallel programmed processors, an ASIC, an FPGA, or a combination thereof.

[0105] Client device 300 may include multiple processing circuits replacing processing circuit 309 .

[0106] In the processing circuit 309, some functions may be realized by dedicated hardware, and the remaining functions may be realized by software or firmware.

[0107] Thus, the functionality of client device 300 may be implemented in hardware, software, firmware, or a combination thereof.

[0108] The first embodiment is an example of a preferred embodiment and is not intended to limit the technical scope of the present disclosure. The first embodiment may be implemented in part or in combination with other embodiments. The procedures described using flowcharts, etc. may be modified as appropriate.

[0109] The "part" of each element of the orchestration system 100 may be read as a "process," a "step," a "circuit," or a "circuitry." [Explanation of symbols]

[0110] 100 Orchestration system, 200 Server device, 201 Processor, 202 Memory, 203 Communication device, 204 Input / output interface, 205 ROM, 209 Processing circuit, 210 Program loader, 211 Key reading unit, 212 Verification unit, 220 Orchestrator controller, 221 Manifest reading unit, 222 Manifest synthesis unit, 223 Manifest distribution unit, 224 Resource setting display unit, 280 Storage, 281 Signature data, 282 Operating system, 283 Orchestrator controller, 284 System manifest, 285 User manifest, 290 Secure storage, 291 Verification key, 300 Client device, 301 Processor, 302 Memory, 303 Communication device, 304 Input / output interface, 305 ROM, 309 Processing circuit, 310 Program loader, 311 Key reading unit, 312 Verification unit, 320 orchestrator agent, 321 manifest receiving unit, 322 manifest application unit, 323 execution environment construction unit, 324 container execution unit, 325 resource setting presentation unit, 370 container execution environment, 371 container, 380 storage, 381 signature data, 382 operating system, 383 orchestrator agent, 384 composite manifest, 390 secure storage, 391 verification key.

Claims

1. An orchestration system that causes a client device to secure hardware resources necessary for building a container execution environment and causes the client device to secure hardware resources used for executing a container in the container execution environment from remaining hardware resources, A server device and the client device, The server device a manifest synthesis unit that uses a system manifest that defines resource settings of hardware resources required to build the container execution environment and a user manifest that defines resource settings of hardware resources used to execute the container in the container execution environment to create a synthesized manifest in which the resource settings of the system manifest are defined as pre-settings that prioritize securing hardware resources and the resource settings of the user manifest are defined as post-settings that use the remaining hardware resources; a manifest distribution unit that transmits the composite manifest to the client device; Equipped with Orchestration system.

2. the server device includes a verification unit that verifies the system manifest using a digital signature of the system manifest to confirm that the system manifest has not been tampered with; The manifest synthesis unit creates the synthesized manifest if the system manifest has not been tampered with. The orchestration system of claim 1 .

3. The verification unit verifies signature data including the digital signature of the system manifest using a verification key stored in a secure storage to confirm that the signature data has not been tampered with, and if the signature data has not been tampered with, verifies the system manifest using the digital signature of the system manifest. The orchestration system of claim 2 .

4. the signature data includes a digital signature of an execution binary of an orchestrator controller that functions as the manifest synthesis unit and the manifest distribution unit; the verification unit, when the signature data has not been tampered with, verifies the execution binary of the orchestrator controller using the digital signature of the execution binary of the orchestrator controller to confirm that the execution binary of the orchestrator controller has not been tampered with; The orchestrator controller is executed if the execution binary of the orchestrator controller has not been tampered with. The orchestration system of claim 3 .

5. the server device includes a verification unit that verifies the execution binary of the orchestrator controller that functions as the manifest synthesis unit and the manifest distribution unit using a digital signature of the execution binary of the orchestrator controller to confirm that the execution binary of the orchestrator controller has not been tampered with; The orchestrator controller is executed if the execution binary of the orchestrator controller has not been tampered with. The orchestration system of claim 1 .

6. The verification unit verifies signature data including the digital signature of the execution binary of the orchestrator controller using a verification key stored in a secure storage to confirm that the signature data has not been tampered with, and if the signature data has not been tampered with, verifies the execution binary of the orchestrator controller using the digital signature of the execution binary of the orchestrator controller. The orchestration system of claim 5 .

7. The client device a manifest receiving unit that receives the composite manifest; a manifest application unit that applies the pre-configuration of the composite manifest to secure hardware resources for the container execution environment, and applies the post-configuration of the composite manifest to secure hardware resources for the container from remaining hardware resources; an execution environment construction unit that constructs the container execution environment using the hardware resources secured by applying the pre-settings; a container execution unit that executes the container in the container execution environment using the hardware resources secured by applying the post configuration; Equipped with The orchestration system of claim 1 .

8. the client device includes a verification unit that verifies the execution binary of the orchestrator agent functioning as the manifest receiving unit, the manifest application unit, the execution environment construction unit, and the container execution unit using a digital signature of the execution binary of the orchestrator agent to confirm that the execution binary of the orchestrator agent has not been tampered with; The orchestrator agent is executed if the execution binary of the orchestrator agent has not been tampered with. The orchestration system of claim 7.

9. The server device includes a resource setting display unit that acquires resource setting information indicating applied resource settings from the client device and displays the resource setting information. The orchestration system of claim 1 .

10. A server device for the orchestration system according to any one of claims 1 to 9.

11. A client device for an orchestration system according to any one of claims 1 to 9, comprising: receiving a composite manifest in which resource settings of hardware resources required for building a container execution environment are defined as pre-settings that prioritize reserving hardware resources and resource settings of hardware resources used for executing a container in the container execution environment are defined as post-settings that use the remaining hardware resources; Applying the pre-settings of the composite manifest to secure hardware resources necessary for building the container execution environment, and applying the post-settings of the composite manifest to secure hardware resources used to execute the container in the container execution environment from remaining hardware resources. Client device.

12. An orchestration method for causing a client device to secure hardware resources necessary for constructing a container execution environment and for causing the client device to secure hardware resources used for executing a container in the container execution environment from remaining hardware resources, Using a system manifest that defines resource settings for hardware resources required to build the container execution environment and a user manifest that defines resource settings for hardware resources used to execute the container in the container execution environment, a composite manifest is created in which the resource settings in the system manifest are defined as pre-settings that prioritize and secure hardware resources and the resource settings in the user manifest are defined as post-settings that use the remaining hardware resources; Sending the composite manifest to the client device Orchestration method.

13. an orchestration program for causing a client device to secure hardware resources necessary for constructing a container execution environment and for causing the client device to secure hardware resources used for executing a container in the container execution environment from remaining hardware resources; a manifest synthesis process that uses a system manifest that defines resource settings for hardware resources required to build the container execution environment and a user manifest that defines resource settings for hardware resources used to execute the container in the container execution environment to create a synthesized manifest in which the resource settings in the system manifest are defined as pre-settings that prioritize securing hardware resources and the resource settings in the user manifest are defined as post-settings that use the remaining hardware resources; a manifest distribution process that transmits the composite manifest to the client device; An orchestration program that causes a computer to execute the above.

Images