Service Proxy for LPC Call Interception and Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computer system administrators face challenges in collecting and analyzing data related to system resource usage due to the unobservability of Local Procedure Call (LPC) interfaces, which reside entirely in userspace and can mask client identities by making kernel system calls on their behalf, resulting in an incomplete picture of system resource utilization.
Innovation Solution
A service proxy operates on host computing devices, acting as a transparent intermediary between clients and LPC services, capturing and modifying communications, and potentially invoking kernel-level actions to intercept and log LPC calls, thereby providing a comprehensive view of system resource usage while maintaining functional indistinguishability from the original service.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If LPC interfaces reside entirely in userspace to provide service functionality, then service operation flexibility is improved, but observability of system resource usage deteriorates
Solution Approach 1:
The patent introduces a service proxy as an intermediary component that sits between the client and the LPC service. The service proxy intercepts LPC calls made to the service, logs the call information including client identity and system resource usage, and then forwards the call to the actual service. This mediator approach allows the LPC interface to remain in userspace while enabling observability through the proxy's logging capability.
2Ease of operation
If LPC interface makes kernel system calls on behalf of client to provide service, then service functionality is improved, but client identity masking occurs
Solution Approach 1:
The service proxy acts as an intermediary that captures the client's original identity information before the LPC call is made. Even though the kernel system call is made on behalf of the client (masking the client identity), the service proxy has already logged the true client identity and call details. This allows the system to maintain service functionality while preserving client identity information through the proxy's records.
Solution Approach 2:
The service proxy performs preliminary action by logging the client identity and call information before the actual LPC call is executed. This preliminary logging ensures that even though the subsequent kernel system call may mask the client identity, the information has already been captured and preserved for later analysis.
3Measurement precision
If traditional kernel observer is used to collect system call data, then system resource monitoring is improved, but LPC calls remain uncollected
Solution Approach 1:
The patent segments the monitoring function into two parts: the traditional kernel observer continues to monitor kernel system calls, while the service proxy in userspace monitors LPC calls. This segmentation allows both monitoring mechanisms to operate independently and complement each other, ensuring that kernel system calls are captured by the kernel observer and LPC calls are captured by the service proxy, thereby collecting complete system resource usage information.
Solution Approach 2:
The service proxy serves as an intermediary monitoring layer in userspace that complements the kernel observer. While the kernel observer monitors at the kernel level, the service proxy intercepts and logs LPC calls at the userspace level, creating a multi-layered monitoring approach that captures both kernel system calls and userspace LPC calls without interfering with each other's functionality.
Data Source
AI summary
A service proxy is described herein. The service proxy is configured to act as an intermediary between a client and a service. The service proxy may observe communications, modify communications, log communications, or the like, particularly so as to enhance the security and reliability of the host device. In some implementations, the service proxy may cooperate with an operating system to take over a named port object. In some implementations, the service proxy may receive messages as an intermediary between the client and the server. In some implementations, the service proxy may attach to a shared memory to intercept communications. In some implementations, the service proxy may be injected into a client process to appear to be the client itself.