Kernel Access Interface Using NVMe Buckets for Secure Program Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computational devices lack a standardized method for users to access and control the execution of programs on computational resources, leading to security risks and complexity in offloading processing tasks.
Innovation Solution
A programming interface is implemented to allow users to access the kernel of an operating system on computational devices, enabling controlled execution of programs by specifying computational resources through kernel buckets, reducing security risks and simplifying the process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If users directly access the kernel to execute programs on computational resources, then program execution control is achieved, but security risks increase and system complexity grows
Solution Approach 1:
The patent introduces a programming interface as an intermediary layer between users and the kernel. This interface accepts user programs and parameters, validates them, and then invokes the kernel's program execution function. The intermediary absorbs the complexity of direct kernel access while maintaining security boundaries, thus enabling ease of operation without compromising reliability.
2Ease of operation
If users directly access the kernel to execute programs, then program execution is possible, but system complexity increases
Solution Approach 1:
The programming interface serves as a simplified mediator that handles program execution without exposing users to kernel complexity. It manages parameter validation, resource allocation, and kernel invocation internally, presenting a clean abstraction to users while containing the complexity within the interface layer itself.
Solution Approach 2:
The system is segmented into distinct layers: the user-space programming interface, the kernel's program execution function, and the computational resources. This segmentation isolates complexity to specific layers while keeping the user interface simple and manageable.
3Reliability
If a programming interface is introduced to access the kernel, then security risks are reduced, but interface complexity increases
Solution Approach 1:
The programming interface is designed as a universal mechanism that handles multiple operations (program execution, parameter passing, resource allocation) through a consistent interface paradigm. This multi-functionality reduces the need for multiple specialized interfaces, thereby limiting the increase in complexity while maintaining comprehensive security control.
4Ease of operation
If direct kernel access is used, then program execution is straightforward, but user protection from system details is reduced
Solution Approach 1:
The programming interface acts as a protective intermediary that shields users from kernel implementation details. Users interact only with high-level abstractions (program names, parameters, resources) while the interface handles the complex kernel communication underneath, thus protecting users from system complexity while maintaining ease of operation.
Data Source
AI summary
A method may include receiving, at a computational device, a command, accessing, based on the command, using a programming interface, a kernel of an operating system operating on a computational circuit of the computational device, and performing, by the operating system, an operation based on the accessing. The accessing may include writing to one or more buckets using the programming interface. The one or more buckets may include one or more files. The accessing may include reading from one or more buckets using the programming interface. The method may further include performing, based on the accessing, a function call using the kernel. The receiving the command may include receiving, by a protocol, the command. The protocol may include a storage protocol. The storage protocol may include Nonvolatile Memory Express (NVMe). The receiving the command may include receiving, by command logic at the computational device, the command.