Application-Specific BRE for Embedded System Resource Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Embedded systems, particularly IoT devices, face challenges in managing and isolating system resources for third-party applications, as existing container technology is lightweight and not designed to handle resource sharing, leading to security and management issues when coexisting with existing vendor applications.
Innovation Solution
An application-specific basic runtime environment (BRE) is introduced to manage workload resources by receiving requirements from applications, negotiating with the operating system using features like control groups, namespaces, and capabilities, and providing necessary resources for execution, thereby isolating and securing third-party applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If lightweight container technology is used for resource management, then device complexity is reduced, but security and resource isolation are insufficient
Solution Approach 1:
The patent introduces a runtime environment as an intermediary layer between the operating system and third-party applications. This runtime environment acts as a mediator that provides enhanced security and resource isolation mechanisms while maintaining compatibility with lightweight container technology, thus resolving the contradiction between simplicity and security.
Solution Approach 2:
The patent combines multiple resource management approaches into a composite solution: it integrates traditional container technology with a specialized runtime environment that provides additional security layers. This composite approach leverages the simplicity of containers while adding the reliability of a controlled runtime environment.
2Adaptability or versatility
If third-party applications are allowed to coexist with vendor applications, then adaptability is improved, but resource management and isolation become problematic
Solution Approach 1:
The patent segments the system into distinct layers: the operating system layer, the runtime environment layer, and the application layer. This segmentation allows multiple third-party applications to coexist with vendor applications by providing each application with its own isolated runtime environment, thus managing resource allocation and isolation without increasing overall system complexity.
Solution Approach 2:
The runtime environment is designed as a universal platform that can host multiple different types of applications (both vendor and third-party) with different resource requirements. It provides multi-functional resource management capabilities that adapt to various application needs without requiring separate management systems for each application type.
3Ease of operation
If existing container technology is used for resource sharing, then ease of operation is improved, but security and management control are insufficient
Solution Approach 1:
The runtime environment serves as an intermediary that enhances existing container technology by adding security and management control layers. It maintains the ease of operation of container-based resource sharing while introducing stronger security mechanisms and management controls through its controlled execution environment.
Data Source
AI summary
A computer implemented method for providing workload resource management to applications in an embedded system. The method includes receiving, by an application-specific basic runtime environment (BRE), workload resource requirements of an application installed on the embedded system. The method includes obtaining, by the application-specific BRE, the workload resource requirements from an operating system of the embedded system. The method includes providing, by the application-specific BRE, the workload resource requirements to the application. The method includes initiating, by the application-specific BRE, the execution of the application on the embedded system.