Multi-process architecture for implementing a secure internet service

A method in an internet server for implementing internet service, the method including exclusively binding a first socket handle object of a first process with a first port. The method also includes generating a first child process from the first process and creating a first duplicate socket handle of the first socket handle object in a first file, the first file being associated with an id of the first child process. The method further includes forming, using the first child process, a first child socket handle object from the first duplicate socket handle in the first file, thereby causing the first child socket handle object to be associated with the first port.

BACKGROUND OF THE INVENTION

The growing popularity of the Internet has given rise to a wide variety of Internet services. These Internet services enable Internet users, through their Internet browsers, to access data and/or execute applications that are maintained by and/or provided on a remotely located server. Examples of these Internet services include email relay, Internet shopping, gaming, database access, data processing, data acquisition, etc.

In an internet server environment, for example, an application executing on an internet server may service multiple remotely located users who connect to the internet server through the Internet. In this example, the application executing on the server is commonly referred to as a process, and such process may spawn a plurality of threads on the internet server computer to service the plurality of remotely located users through their respective browsers.

To facilitate discussion,FIG. 1shows an example prior art Internet service environment102. In the example ofFIG. 1, a plurality of users104a,104b, and104care utilizing respective web browsers106a,106b, and106cto access an Internet service, such as catalog shopping, that is provided by an internet server108. These web browsers, such as Internet Explorer™ (Microsoft Corp. of Redmond, Wash.) or Firefox™ (www.mozilla.org), may be executed on individual Internet-enabled computers that are connected to the Internet110. These browsers may make individual socket connections116a,116b, and116cto a port126on internet server108to access the Internet service offered by internet server108.

An application on internet server108is shown as a process120executing in a user space122of internet server108. Process120has a socket handle object124that binds with a port126(for example port80in kernel space128of internet server108). A plurality of threads130a,130b, and130c, which are spawned by process120for servicing the needs of users104a,104b, and104c, listen to activities on socket handle object124. Since socket handle object124binds with port126, activities on port126are accessible to the threads monitoring socket handle object124. When one of users104a,104b, and104cissues a request for data via one of browsers106a,106b, and106c, for example, this request is received by a respective thread via port126and socket handle object124.

Access to socket handle object124and port126by a thread is typically controlled by some sort of arbitration mechanism, such as locking for example. When one of threads130a,103b, or130cobtains the lock, it can exchange data with a respective one of browsers106a,106b, and106c. Once that thread is finished, it releases the lock to allow other threads to service their respective users. In this manner, a single process120may be able to service a large number of remotely connected users.

If the Internet service involves sensitive data, such as credit card numbers, passwords, etc., security is a serious concern. If the data exchanged between one of users104a-104cand one of threads130a-130ccan be intercepted by a third party130, for example, the intercepted data may be employed to perpetrate fraud upon the user. Concerns regarding identity theft and loss of confidential data have caused many users to shun certain websites and/or refuse to utilize certain Internet services altogether.

The Internet service described earlier may be made secure by allowing only process120to bind, in an exclusive manner, with port126. That is, the binding between socket handle object124may be requested by process120to be exclusive (via the Windows socket option SO_EXCLUSIVEADDRUSE for example), thereby preventing another process140from binding with port126. In this manner, data traversing port126between users104a-104cand their respective threads130a-130cin internet server108is secure against unauthorized access by process140.

However, the exclusive binding approach of the current art has at least one deficiency. Since only one process120can bind to port126, if that process120hangs, corrupts or terminates due to erroneous or malicious actions by one of users104a-104c(or another user), all the threads spawned by that process (e.g., threads130a,130b, and130c) may terminate. When all threads associated with the single process120terminate, the Internet service offered by internet server108is unavailable to all users until process120can be brought up again.

As can be appreciated by those skilled in the art, the prior art exclusive binding approach offers security at the expense of reliability and robustness. In other words, although the data may be secure from unauthorized intercepts, the user's experience may be marred by undesirably frequent service interruptions, particularly when the process spawns hundreds or thousands of threads, and a fault due to any of the threads may cause the process and all its threads to terminate.

SUMMARY OF INVENTION

The invention relates, in an embodiment, to a method in an internet server for implementing internet service, the method including exclusively binding a first socket handle object of a first process with a first port. The method also includes generating a first child process from the first process and creating a first duplicate socket handle of the first socket handle object in a first file, the first file being associated with an id of the first child process. The method further includes forming, using the first child process, a first child socket handle object from the first duplicate socket handle in the first file, thereby causing the first child socket handle object to be associated with the first port.

In another embodiment, the invention relates an article of manufacture comprising a program storage medium having computer readable code embodied therein, the computer readable code being configured to implement internet service in an internet server. The article of manufacture further includes computer readable code for exclusively binding a first socket handle object of a first process with a first port. The article of manufacture also includes computer readable code for generating a first child process from the first process, and computer readable code for creating a first duplicate socket handle of the first socket handle object in a first file, the first file being associated with an id of the first child process. The article of manufacture additionally includes computer readable code for forming, using the first child process, a first child socket handle object from the first duplicate socket handle in the first file, thereby causing the first child socket handle object to be associated with the first port.

In yet another embodiment, the invention relates to a method in an internet server for implementing internet service for a plurality of remote users. The method includes exclusively binding a first socket handle object of a first process with a first port. The method also includes iteratively activating a plurality of child processes by performing the following steps (a) through (e). Step (a) includes generating a child process; step (b) includes suspending the child process after the generating the child process; step (c) includes creating a duplicate socket handle of the first socket handle object in a file, the file being associated with an id of the child process of step (a) while the child process is suspended. Step (d) includes waking up the child process from the suspending, step (e) includes forming, using the child process after the waking, a child socket handle object from the duplicate socket handle in the file, thereby causing the child socket handle object to be associated with the first port, wherein the steps (a) through (e) are performed to activate each child process of the plurality of child processes until the plurality of child processes are activated, and wherein the plurality of child process, not the first process, are responsible for executing threads that provide the internet service to the plurality of remote users.

DETAILED DESCRIPTION OF EMBODIMENTS

Various embodiments are described herein below, including methods and techniques. It should be kept in mind that the invention might also cover articles of manufacture that includes a computer readable medium on which computer-readable instructions for carrying out embodiments of the inventive technique are stored. The computer readable medium may include, for example, semiconductor, magnetic, opto-magnetic, optical, or other forms of computer readable medium for storing computer readable code. Further, the invention may also cover apparatuses for practicing embodiments of the invention. Such apparatus may include circuits, dedicated and/or programmable, to carry out tasks pertaining to embodiments of the invention. Examples of such apparatus include a general-purpose computer and/or a dedicated computing device when appropriately programmed and may include a combination of a computer/computing device and dedicated/programmable circuits adapted for the various tasks pertaining to embodiments of the invention.

The invention relates, in an embodiment, to improved arrangements and techniques for providing internet service in an internet server. As the term is employed herein, an internet server represents any server or computer that is employed to provide an internet service. The improved arrangements and techniques are not only secure but are also highly reliable and robust. In an embodiment, a multi-process architecture is provided wherein the parent process exclusively binds its socket handle object to the internet server port to ensure security. Reliability is improved by the creation of a plurality of child processes having socket handle objects created from socket handles that are duplicates of the socket handle of the parent process. Since the child processes employ the duplicate socket handles to create their own socket handle objects, these child processes bind to the same port as the parent process and can receive and service requests from a plurality of remotely connected users in a secure manner.

In an embodiment, the remotely connected users are serviced by a plurality of threads executed by a plurality of child processes in parallel. This is in contrast to the prior art approach where the threads that service the remote users are typically associated with a single process running on the internet server. By allowing the child processes to parallely execute the threads that provide the internet service to the plurality of remotely connected users, with the parent process acting in a supervisory role for the child processes, reliability is improved.

For example, if a child process is in a fault state (due to, for example, erroneous or malicious user input), the threads associated with that child process may be terminated. However, other child processes can continue to execute their respective threads. If the faulted child process terminates, only the threads associated with that faulted child process terminate, and only the users serviced by those threads are affected. Other users that are provided the internet service through threads associated with non-faulted child processes may continue using the internet service.

As mentioned, the parent process now acts in a supervisor capacity, monitoring execution parameters associated with its child processes to ascertain if and when a process fault occurs. If a child process terminates (due to a fault condition, for example), the parent process may spawn a replacement child process and the newly spawned child process would bind to the same port as the port to which the parent process is exclusively bound.

In an embodiment, the parent process is not directly accessible by users of the internet service. For example, unlike the child processes, the parent process does not execute a thread that provides the internet service to the user. Since the parent process does not execute threads that service the remotely-connected users, the likelihood that the parent process can be brought down due to a user's erroneous and/or malicious input is greatly reduced.

The features and advantages of the present invention may be better understood with reference to the figures and discussions that follow.FIG. 2shows, in accordance with an embodiment of the present invention, an environment202for implementing an internet service. In the example ofFIG. 2, a plurality of users204a,204b, and204care utilizing respective web browsers206a,206b, and206cto access an Internet service, such as catalog shopping, that is provided by a Windows-based internet server208. These web browsers may be executed on individual Internet-enabled computers (not shown) that are connected to the Internet210. These browsers may make individual socket connections216a,216b, and216cto a port226on internet server208to access the Internet service offered by internet server208. Although only three users and three respective browsers/socket connections are shown, it should be understood that there may be as many users as bandwidth allows.

An application on internet server208is shown as a process220executing in a user space222of internet server208. Process220has a socket handle object224that binds exclusively with port226(for example port80in kernel space228of internet server208). The exclusive binding ensures that data traversing port226is secure from being accessed by an unauthorized process.

However, unlike the situation of prior artFIG. 1, process220does not by itself execute all the threads that provide the internet service to users204a,204b, and204c. Instead, process220acts as a parent process by spawning a plurality of child processes242a,242b,242c, and242d. These child processes execute in parallel, with each child process executing a plurality of treads to service a group of users. For example, child process242ais shown executing a plurality of threads244a,244b, and244c, while child process242bis shown executing a plurality of threads246a,246b,246cand246d. Similarly, child process242cis shown executing a plurality of threads248aand248b, while child process242dis shown executing a plurality of threads250a,250b,250c,250dand250e. The number of treads executed by each child process, as well as the number of child processes spawned by parent process220, may vary from implementation to implementation.

Furthermore, the child processes242a,242b,242c, and242dall bind to the same port226, thereby enabling threads associated with these child processes to receive and service requests from the remotely-connected users. To enable a child process to bind to the same port as the parent process220, parent process220first creates a child process (such as child process242a, for example). After child process242ais created, parent process220may, in an embodiment, suspend child process242a, i.e., put child process242ainto an inactive state. This inactive state prevents newly created child process242afrom unnecessarily consuming processing bandwidth trying to bind to a port on internet server208.

After child process242ais suspended, parent process220then creates a duplicate socket handle, which is essentially a duplicate of the socket handle associated with socket handle object224. This duplicate socket handle is then saved into a file that is specifically associated with the id of child process242a. The file containing the duplicate socket handle for child process242ais shown inFIG. 2as file270.

After file270is created, parent process220then wakes up child process242a. Upon waking up, code in child process242acauses child process242ato fetch the duplicate socket handle from file270(which is associated with the id of child process242a) and to create a socket handle object from this retrieved duplicate socket handle. Since the created socket handle object for child process242ais created from a duplicate socket handle that is essentially a duplicate of the socket handle associated with main socket handle object224, child process242aessentially binds to port226via its socket handle object as well. In an embodiment, after child process242aretrieves the duplicate socket handle, file270is no longer necessary and may be deleted.

Child processes242b,242cand242dare activated in a similar manner, with each child process being activated in turn using the sequence discussed above in connection with child process242a. Once all child processes are activated, each child process may create and execute as many threads as necessary to service the remote users.

If one of the child processes enters a fault state (e.g., due to erroneous or malicious user input data or executable), that child process alone is in the fault state and other child processes may simply continue to execute their own threads. If the faulted child process terminates, only the threads executed by that child process is negatively impacted. All other threads associated with other child processes may continue servicing their respective threads. In this manner, only the group of users serviced by the threads of a faulted child process suffer any performance degradation. Since other child processes are not impacted, the users utilizing those other child processes may not even know that a problem has occurred with one of the child processes.

As mentioned, parent process220may take a supervisor role and monitor execution parameters pertaining to the child processes. If a child process (such as child process242b) enters a fault condition and terminates, parent process220may spawn another child process and activate that newly spawned child process as a replacement for the terminated child process.

FIG. 3is a flowchart illustrating, in accordance with an embodiment of the present invention, the steps taken by a parent process in implementing the internet service. From start step302, the parent process (such as process220ofFIG. 2) initiates in step304. After being initiated, the main socket object is created (306) and exclusively binds to the port (such as port226ofFIG. 2) in step308. Note that if any of steps304,306, or308fails, the implementing procedure fails to step324.

Steps314,316,318, and320are performed for each spawned child process, with one iteration being performed for each child process. Supposed there are N child processes to spawn (N=Maxchild_No as shown in block310). For each iteration, a child is first created (314). After being created, the parent process may temporarily suspend (316) the child process in an embodiment. While the child process is in a suspended state, a duplicate socket handle that is a duplicate of the socket handle associated with the parent object is created. This duplicate socket handle is put in a file that is specifically associated with the ID of the child process. In an embodiment, the duplicate socket handle is created by the Windows API (Application Programming Interface) WSADuplicateSocket( ).

After the duplicate socket handle is created in the file, the parent process may wake up the child process (320). Once all N child processes are activated, the parent process monitors execution parameters pertaining to the child processes and may replace any faulted child process by activating a substitute child process (312) so that the substitute child process may begin creating and executing threads to service the remotely connected users. Access by a thread to port226is governed by an appropriate arbitration mechanism such as a global lock.

FIG. 4is a flowchart illustrating, in accordance with an embodiment of the present invention, the steps taken by a child process in implementing the internet service. From start step402where the child was already in a suspended or sleep state, the child process wakes up (404). Once awaken, code in the child process causes the child process to seek out and obtain the duplicate socket handle from the file that is specifically associated with the ID of that child process (406). In step408, a child socket object is created using the retrieved duplicate socket handle. This cause the child socket object to bind to the same port as the port to which the parent process is exclusively binded. In a step410, the file that holds the duplicate socket handle for the child process may now be removed.

In step412and416, the child process iteratively creates threads for servicing the remotely connected users. If all threads are created, the child process enters into a monitoring mode to monitor thread execution (414). This monitoring continues until another child thread is needed or if an existing child thread is interrupted or faulted, at which time that existing child process enters into a fault state and possibly terminates if the fault is not remedied. Even if the child process (e.g., child process242a) terminates, other surviving child processes may continue to execute their threads to service other web-based customers.

As can be appreciated from the foregoing, embodiments of the invention implement a highly secure and reliable internet service. Security is provided by the exclusive binding mechanism that prevents an unauthorized process from binding to the same port to illegally intercept data. Reliability is provided by distributing the threads among multiple child processes, which child processes innovatively bind to the same port as the port to which the parent exclusively binds to. In this manner, if any one child process terminates, only users serviced by threads associated with the terminated child process are affected, and other users may continue to enjoy the internet service without interruption.