Capability Management in Microkernel Architectures

Solution Overview

Problem

Conventional microkernel architectures face challenges in ensuring deterministic latency during capability rejection due to uncertainty in whether a kernel object needs to be deleted, leading to potential memory leaks and inaccurate latency analysis.

Innovation Solution

A capability management method that introduces a data structure storing grant and granting information separately, allowing for centralized capability management, where the grant information indicates the granted capability and the granting capability, enabling direct deletion without uncertainty, thus ensuring deterministic latency.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If capability copying is used to share kernel objects, then capability granting is enabled, but deterministic latency cannot be ensured due to uncertainty in capability deletion requirements

Engineering Contradiction:

Improvecapability sharingVSAvoiddeterministic latency

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent segments the capability management into two independent parts: the capability node (stored in capability space) and the grant information (stored in the process's capability node). The capability node contains only the capability identifier and permission, while the grant information stores the relationship between grantor and grantee. This segmentation allows the kernel to manage capabilities without copying them, thereby ensuring deterministic latency while still enabling capability sharing.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces grant information as an intermediary data structure that mediates between the capability node and the process's capability node. This intermediary stores the relationship between grantor and grantee, allowing the kernel to track capability grants without actually copying the capability nodes. The intermediary enables capability sharing while avoiding the latency uncertainty caused by capability copying.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Adaptability or versatility

If capability copying is used to share kernel objects, then capability granting is enabled, but memory leaks may occur due to uncertainty in kernel object deletion

Engineering Contradiction:

Improvecapability sharingVSAvoidmemory leaks

Core Design Contradiction:

Adaptability or versatilityVSLoss of substance

Solution Approach 1:

The patent segments the capability management into two independent parts: the capability node (stored in capability space) and the grant information (stored in the process's capability node). The capability node contains only the capability identifier and permission, while the grant information stores the relationship between grantor and grantee. This segmentation allows the kernel to manage capabilities without copying them, thereby ensuring deterministic latency while still enabling capability sharing.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent uses a form of copying by creating grant information entries that reference the original capability node without actually copying the capability node itself. The grant information stores references to the capability identifier and permission, allowing multiple processes to access the same capability without duplicating the capability node, thus preventing memory leaks while enabling sharing.

Inventive Principle:

Principle #26Copying

3Adaptability or versatility

If conventional capability management is used, then capability granting and revocation are enabled, but complex algorithms are required leading to reduced operational efficiency

Engineering Contradiction:

Improvecapability management functionalityVSAvoidoperational efficiency

Core Design Contradiction:

Adaptability or versatilityVSProductivity

Solution Approach 1:

The patent segments the capability management into two independent parts: the capability node (stored in capability space) and the grant information (stored in the process's capability node). The capability node contains only the capability identifier and permission, while the grant information stores the relationship between grantor and grantee. This segmentation allows the kernel to manage capabilities without copying them, thereby ensuring deterministic latency while still enabling capability sharing.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent extracts the capability node from the process's capability node and stores it separately in capability space. Only the grant information remains in the process's capability node, significantly reducing the amount of data that needs to be managed and processed. This extraction simplifies the algorithms required for capability management and improves operational efficiency.

Inventive Principle:

Principle #2Taking out (Extraction)

Data Source

PatentUS12164675B2Capability management method and computer device

Publication Date: 2024.12.10 HUAWEI TECH CO LTD

AI summary

A capability management method and apparatus, a computer device, and the like relate to permission management of a kernel object in an operating system, for example, permission management of a kernel object in a microkernel architecture. In the method, two types of information are stored in a capability node of a capability owner: information used to indicate that a capability is granting and information used to indicate a granted capability. A capability association relationship between a grantor and a grantee is established by recording the two types of information, so that capability copying is avoided in a capability granting procedure, and capability deletion is avoided in a procedure of rejecting a capability by the grantee, thereby ensuring a deterministic latency while implementing capability revocation and granting. The method may be applied to a smartphone system, an unmanned driving system, or the like.