18 results about "Process isolation" patented technology

The invention relates to an electric power mobile application security protection method based on a swan gap microkernel, which comprises the following steps of: S1, establishing a hardware trust root, and storing a device root key and a certificate chain by utilizing a non-tampering storage area built in a chip; s2, establishing a complete trusted boot chain based on a hardware root of trust, and verifying the integrity and credibility of the next layer by each layer from Bootloader to a swan microkernel and then to an application program; s3, constructing a triple authentication system based on user identity, equipment identity and biological characteristics, and performing user authentication; s4, according to a user authentication result, realizing fine-grained authority control based on an RBAC model and ABAC, and ensuring that authority check can be executed during resource access every time by utilizing an IPC security mechanism of a swan micro kernel; and S5, creating an independent execution environment for each power application according to the process isolation capability of the swan microkernel, and ensuring that memories among the applications cannot be mutually accessed through virtual address space isolation. The reliability of power mobile application safety protection is effectively improved.

The invention discloses a method and a system for realizing a security acquisition software plug-in with dynamic characteristics for an electric power monitoring system, and aims to solve the problems of difficulty in function extension, insufficient security and poor resource isolation of a traditional electric power monitoring system. According to the system, through a plug-in architecture design, a plug-in function module is realized in a dynamic library form, and dynamic loading, unloading and security isolation operation are supported. The plug-in is started through the sub-process, the main program ensures the legality of the plug-in through SM2 certificate verification, and efficient interaction between the main program and the plug-in is achieved through a callback function mechanism. The plug-in supports dynamic memory allocation, and potential safety hazards caused by predefined field length are avoided. Core rights points of the method comprise plug-in expansion capability, sub-process isolation, SM2 certificate verification, a transparent transmission mechanism and dynamic memory management, and the function expansibility, the safety and the operation stability of the power monitoring system can be remarkably improved.

Process isolation for a PIM device through exclusive locking includes receiving, from a process, a call requesting ownership of a PIM device. The request includes one or more PIM configuration parameters. The exclusive locking technique also includes granting the process ownership of the PIM device responsive to determining that ownership is available. The PIM device is configured according to the PIM configuration parameters.

Methods, systems, and devices for data management are described. A data management system (DMS) may support backup and recovery of a filesystem. The DMS may, as part of the backup, obtain a snapshot of the filesystem. The DMS may mount the snapshot within a user space of a node of the DMS. The user space may be isolated from other processes that execute on the node of the DMS. The DMS may generate, within the user space based on the mounted snapshot, index files that index the filesystem. In response to a subsequent request to access one or more files, the DMS may retrieve the one or more files from the snapshot mounted in the user space based on the index files.

The invention relates to the technical field of embedded software, in particular to a Linux process wrapper calling method suitable for a mine control system and the mine control system. A Linux process wrapper calling method of a mine control system realizes isolated deployment of functional modules through a master-slave process architecture, and specifically comprises the following steps: constructing a management and control system of a master process and a wrapper process to form a fault isolation boundary; packaging the function module into a dynamic link library, and independently loading and running by a wrapper process; defining a standardized interface; an RPC mechanism is adopted to realize inter-process communication, and a host process serves as a client to control a wrapper process through remote calling; and dynamically creating / destroying the process instance to realize hot plug management of the functional module. According to the method, through process isolation and interface standardization, the development complexity is reduced while the system stability is guaranteed, and the method is particularly suitable for underground high-reliability scenes.

This invention discloses a microscopic interactive teaching terminal and its control method based on dual-process isolation, specifically relating to the fields of educational informatization and embedded systems technology. It includes a hardware layer and a software layer: the hardware layer includes a main control chip, an image sensor, a display screen, a wireless communication module, a storage module, and a power management module. The main control chip is configured as a Hisilicon Hi3516DV300 / 500. This invention completely decouples display and upload processes, resulting in high system stability. The two processes run independently; the crash of one process does not affect the other, and the daemon process can automatically recover, ensuring continuous system availability. This invention features rapid switching response, optimized network resources, and an independent upload process that can be flexibly scheduled according to teacher instructions, supporting multi-channel concurrency without affecting the reception and display of broadcast streams. This invention has strong applicability and can be widely applied to various interactive teaching terminals based on embedded platforms, especially suitable for microscopic teaching scenarios with high real-time requirements.

The application provides a virtual file construction method and system for a microkernel architecture, comprising the following steps: S1, using process isolation abstraction, placing file system instances in different processes, and interacting through an inter-process communication mechanism to isolate each element of the file system from each other; S2, hierarchizing and modularizing code according to file system semantics; S3, modifying the way that musl-libc adapts to the microkernel, so that programs that dynamically link libc do not need to be modified and can be used in the system; and S4, starting the file system instance in a lazy manner. The application analyzes the support of the file system in the existing microkernel and their shortcomings, adopts a new technical means, and proposes a brand-new microkernel file system architecture; the system application program is binary compatible in the file system interface, and has good scalability and security characteristics.

Process isolation for a PIM device includes: receiving, from a process, a call to allocate a virtual address space where the process stores a PIM configuration context; allocating the virtual address space including mapping a physical address space including PIM device configuration registers to the virtual address space only if the physical address space is not mapped to another process's virtual address space; and programming the PIM device configuration space according to the configuration context. When a PIM command is executed, a translation mechanism determines whether there is a valid mapping of a virtual address of the PIM command to a physical address of a PIM resource, such as a LIS entry. If a valid mapping exists, the translation is completed and the resource is accessed, but if there is not a valid mapping, the translation fails and the process is blocked from accessing the PIM resource.

The application discloses a kind of digital target mechanism construction method and system, the method includes: for each digital target machine instance Independent root file system directory is assigned, the root directory of target machine running process is switched to directory, to realize file system level isolation;For each digital target machine instance Independent network namespace is assigned, and the network namespace of digital target machine instance is connected with the virtual network of target range by virtual Ethernet, to realize network isolation;Custom pseudo-terminal daemon process is started on host side, and is bound to specified communication interface, and the bidirectional forwarding of terminal input and output is carried out through pseudo-terminal daemon process, to realize process isolation;The life cycle of digital target machine instance is uniformly managed.This scheme is based on the kernel capability of host operating system, and the combination mode of process level isolation, file system isolation and network isolation is used to realize the high-density, multi-instance, low-resource consumption digital target machine instance running environment.

The present invention discloses a sandbox-based power intelligent body process isolation protection method and system, which relates to the field of power intelligent body process isolation protection technology, including the following steps: obtaining power system power frequency time series data, extracting frequency fluctuation curve to construct a first query sequence, using DTW algorithm to screen the sequence to obtain a reference sequence, and constructing a frequency feature vector for Fourier transform to generate a granularity matrix; inputting the granularity matrix into a multi-objective optimization function, using NSGA-III algorithm to evaluate memory allocation granularity; dividing the process memory space into several isolated areas according to the evaluation results, optimizing the memory capacity of each area with a quantum annealing algorithm to obtain the optimal capacity; deploying the optimal capacity to a memory protection unit to form an isolation barrier, and integrating it into a sandbox to achieve secure isolation. This method solves the problem of mismatch between memory allocation granularity and capacity in traditional process isolation, and avoids the problem of micro-granular memory attacks such as cross-area access and cache injection.

The invention discloses a plug-in management method and device, electronic equipment and a storage medium. The plug-in management method comprises the following steps: running a main program; a plug-in management thread is loaded in the main program; detecting a plug-in file through the plug-in management thread; and creating an independent plug-in process for each detected plug-in file in a process isolation mode. The independent process is created for the plug-in in a process isolation mode, the influence of the plug-in on the main program is avoided, and the plug-in expansion capacity and the thermal expansion capacity of the main program can be improved while stable operation of the main program is guaranteed.

The application discloses a beam plate storage full-process intelligent monitoring management system, which comprises a transaction request receiving module, an operation execution monitoring module, a transaction state judging module and a transaction compensation processing module. The application adopts the mode of combining the initial state snapshot with the asynchronous compensation workflow, automatically executes the rollback instruction when the operation fails, and effectively avoids the data state confusion problem. Through multi-source sensor data fusion and real-time comparison and judgment, the accurate monitoring and rapid response of the operation process are realized. Further, through the resource locking mechanism, the concurrent conflict is prevented, the automation level and the abnormal processing capability of the beam plate storage management are improved, and the problems of low operation efficiency and difficult state consistency guarantee caused by the process isolation, data update lag and insufficient abnormal response in the prior art are solved.

The application belongs to the technical field of computer system software, and particularly relates to a real-time container process isolation method, wherein the same identification marks are added to processes in the same process namespace, which are used for the processes to be visible to each other in an operating system and to be accessible to each other; meanwhile, different identification marks are added to processes in different process namespaces, which are used for identifying that the processes are invisible to each other in the operating system and are not accessible to each other. The application can be adapted to the existing real-time container process without destroying the process access mechanism of the original real-time operating system, and can achieve the function of the same isolation degree as the industry. The application has great value for computer system real-time container process isolation, and can have certain reference significance in other fields under similar scenarios.

The present application provides a scheduling method, apparatus, device and storage medium for computing resources. When a CPU core receives an interrupt request, it uses a preset user-mode instruction to obtain read and write permissions for a first memory area in a shared memory area, reads and executes a switching function from the first memory area, and schedules the computing resources of the CPU core from a first user-mode process to a target user-mode process. When the CPU core executes any user-mode process, it only has read and write permissions for a second memory area occupied by the user-mode process in the shared memory area. Since any user-mode process can only read and write the memory space occupied by itself, and the process of switching the user-mode process executed by the CPU core is all in the user-mode mode of the operating system, there is no need to enter the kernel mode of the operating system. This can reduce the computing resource overhead of process switching while ensuring process isolation, thereby improving the utilization of CPU computing resources.

The invention discloses a cross-application content display decoupling method and system based on Activity View, and relates to the technical field of computer software and mobile terminals.The method comprises the steps that an Activity View container is instantiated by a host application program, and virtual display equipment associated with a graph buffer area is created through a management subsystem; requesting to run an export component of the client application on the virtual display device; the window manager draws a client interface to a graph buffer area; the graphic synthesizer reads data in the buffer area and remaps and synthesizes the data to a container area of a physical screen, the host intercepts an input event, coordinate transformation is carried out based on the geometric mapping relation, and a target event is generated and injected into a client input channel. Through the virtual display and texture synthesis technology, process isolation and UI seamless integration of the host and the client are achieved, cross-process interaction and life cycle synchronization are supported, and the decoupling performance and safety of the system are improved.

The invention discloses an intelligent edge security threat real-time interception and early warning method, which relates to the technical field of edge computing, and comprises the following steps: collecting operation data of process behavior logs, network flow characteristics and hardware state parameters through a built-in lightweight sensor interface of edge equipment; redundant information is removed through feature screening, and the data scale is simplified through dimension compression; deploying a lightweight neural network model optimized by channel pruning and knowledge distillation at edge equipment, reasoning the preprocessed data in real time and outputting a threat probability value; differential response is realized based on at least two levels of threat judgment thresholds, high-risk threats trigger local process isolation, network blocking and other rapid interception, and suspicious threats start early warning and directionally upload data to a cloud; and the cloud collaboration system utilizes a high-precision deep neural network to secondarily verify suspicious data, generates a threat feature update package, encrypts and distributes the threat feature update package to each edge device through federal learning, and realizes incremental update of an edge model.

The invention provides a map service system for a vehicle, and the system comprises a UI layer application unit which operates in a first process and is configured to provide a map display and user interaction interface; the map service layer application unit runs in a second process independent of the first process and comprises a general service interface, and the general service interface is configured to package a plurality of different map engine services into a unified map business logic service; the UI layer application unit and the map service layer application unit carry out cross-process communication through an AIDL interface, so that the map service layer application unit provides the unified map business logic service for the UI layer application unit. The map service is divided into the UI layer application unit and the map service layer application unit, process isolation is achieved through the AIDL, decoupling of the user interface and the underlying map service is achieved, and a user does not need to perceive the difference of different map engines.