JP3657755B2 - Composite computer system and resource protection method between computer systems - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention provides a plurality of computer systems connected to each other via an inter-system communication mechanism having a LAN, an inter-system shared memory, and the like that are protected from unauthorized access from a computer system used by an unspecified third party. When a single or multiple jobs are executed using a computer resource that is not under direct management, the computer system is protected from unauthorized access to the computer resource. The present invention relates to a composite computer system that can be used.
[0002]
[Prior art]
In a conventional composite computer system composed of a plurality of computer systems connected to each other via an inter-system communication mechanism having a LAN, an inter-system shared memory, etc., each computer system is under the control of another computer system As a general access method for executing a job using computer resources, for example, there is an access method using a remote access mechanism represented by a network file system (NFS).
[0003]
As shown in FIG. 5, for example, a conventional composite computer system includes a client-side first computer system 101 having a remote access mechanism 104, a server-side second computer system 102 having a remote access mechanism 105, and It is composed of computer resources 106 under the control of the second computer system and is connected by an intersystem communication mechanism such as a LAN. The composite computer system of FIG. 5 includes the first computer system 101 and the second computer system 102 for convenience of explanation, but the number of computer systems constituting the composite computer system is not limited to this. Absent.
[0004]
When the job 103 of the first computer system 101 uses the computer resource 106 under the management of the second computer system 102 in the composite computer system configured as shown in FIG. 5, the first computer system 101 is the same access method as the access method for the computer resources managed by the first computer system 101, or an access request from the job 103 requested by the access method dedicated to the remote access mechanism 104. To the second computer system 102 via the LAN.
[0005]
Receiving the access request from the first computer system 101, the remote access mechanism 105 of the second computer system 102 gives the job 103 access to the computer resource 106 by the same access method as other jobs on the computer system. The job is executed instead, and the result is notified again to the access request source job 103 via the LAN.
[0006]
Further, the remote access mechanism 105 executes protection of the computer resource 106 to be accessed instead of the job 103 by the same protection method as other jobs on the second computer system 102. The same protection method as that for other jobs on the second computer system 102 is, for example, that a write is prohibited by adding an attribute “readable / not writable” to the computer resource 106 and data is changed. This is a protection method set in advance on the second computer system 102, such as preventing the occurrence of a failure.
[0007]
In addition to the access request from the job 103, the conventional composite computer system can also notify the individual attribute (information such as readability, read / write availability) regarding the computer resource protection that the job 103 has, Accordingly, the remote access mechanism 105 can protect the computer resource 106 with the individual attribute related to the computer resource protection from the job 3, and the job 103 operates in the resource protection state as being executed in the second computer system 102. . Furthermore, in the conventional complex computer system, the first computer system 101 is added to the remote access 104 by adding an attribute (information such as read permission, read / write permission) that restricts the type of access request from the job 103. The computer resource 106 can also be protected on the side.
[0008]
[Problems to be solved by the invention]
However, in the conventional composite computer system, when the operating systems between the computer systems are different, the protection method for the computer resources is different between the computer systems. Therefore, the job of one computer system is the resource protection method of the other computer system. It is necessary to execute a process for accessing computer resources under the management of the computer system, or to prepare a mechanism for absorbing differences in operating systems in the remote access mechanism.
[0009]
In the case of a conventional composite computer system, when the resource protection method of the computer system is different, the remote access mechanism of one of the computer systems provides a protection procedure for the computer resource under the management of the computer system and the resource protection necessary for the procedure. In addition to information processing, it is necessary to execute a protection procedure for computer resources under the management of the computer system to be accessed, and a processing for resource protection information necessary for the procedure.
[0010]
Further, in the conventional composite computer system, as the size of the composite computer system increases, that is, as the number of computer systems and the number of connection paths increase, the protection procedure for the computer resources and the resources necessary for the procedure are increased. Since the processing of protection information becomes complicated and the load of the inter-system communication mechanism increases, it is impossible to protect computer resources in fine units by each computer system.
[0011]
Further, in the conventional computer resource protection method using a composite computer system, the access request source computer system and the access request destination computer system must correspond one-to-one, and therefore there are a plurality of computer resources corresponding to the access processing. If it exists, the computer resource protection procedure and the processing of the resource protection information necessary for the procedure are executed for all computer systems that manage the computer resource. Job control processing becomes complicated.
[0012]
The present invention absorbs operating system differences between computer systems when each computer system executes a single job or a plurality of jobs using computer resources that are not under direct management, and further protects computer resources. And a resource protection method between the computer systems and a computer system capable of realizing protection of the computer resources from unauthorized access by facilitating processing of the resource protection information necessary for the procedure. .
[0013]
[Means for Solving the Problems]
[0017]
The composite computer system of the present invention As described in claim 1, in a complex computer system that includes a plurality of computer systems and an inter-system communication mechanism that connects each computer system, and a job performs access processing to computer resources under the management of other computer systems. The computer system includes resource protection information management means for managing resource protection information for protecting computer resources of its own computer system and resource protection information for protecting computer resources under the management of other computer systems (examples described later). Resource protection information management mechanism 4 and resource protection information management mechanism 8), and access processing to the computer resources under the management of the own computer system based on the resource protection information managed by the resource protection information management means, and others Resource access means for accessing computer resources under the management of computer systems ( Resource access mechanism 5 and resource access mechanism 9 in the embodiment described later), and by absorbing the difference in access processing between computer systems by the resource access means, Execute resource protection during access processing for computer resources in the same way as access processing for computer resources managed by the local computer system. When a job performs access processing for a computer resource under the management of a plurality of other computer systems, the resource access means sends means for sending an access request for the computer resource in parallel (resource access mechanism 5 of the embodiment described later, Resource access mechanism 9), and when there is at least one computer resource for which the access request is denied, the computer resource is based on predetermined information preset in the computer system of the access request source. It is characterized in that an access process is executed with respect to any other than the above, or all access processes are stopped.
[0018]
Therefore, the composite computer system of the present invention absorbs the difference in the access method and the number of computer resources by the resource access means, so that a plurality of jobs in one computer system can be used as virtual computer resources in the computer system. It becomes possible to access the computer resources.
Furthermore, the composite computer system of the present invention has a resource protection information management unit that has resource protection information of computer resources of other computer systems, so that the computer system can manage computer resources under the management of a plurality of computer systems. It is possible to protect against unauthorized jobs executed in the network.
[0019]
The composite computer system of the present invention is also claimed. 2 As described in In a complex computer system that is composed of a plurality of computer systems and an inter-system communication mechanism that connects each computer system, and a job performs access processing to computer resources under the management of other computer systems, the computer system is a computer of its own computer system. Resource protection information for managing resource protection information for protecting resources and resource protection information for protecting computer resources under the management of other computer systems, and resource protection managed by the resource protection information management means Based on the information, resource access means for performing access processing for the computer resources under the management of the own computer system and access processing for the computer resources under the management of other computer systems, between the computer systems by the resource access means Other computer system management by absorbing differences in access processing Computer resource protection during access processing for resources, and execute the same processing as the process of accessing computer resources under its own computer system management, When a job performs an access process for a computer resource under the management of a plurality of other computer systems, the resource access means sequentially sends an access request for the computer resource according to a preset order (in the embodiment described later). Resource access mechanism 5 and resource access mechanism 9), and there is a computer resource for which the access request is denied, based on predetermined information preset in the computer system of the access request source, It is characterized in that the access processing for the computer resource is skipped or all access processing is stopped.
[0020]
Therefore, the composite computer system of the present invention absorbs the difference in the access method and the number of computer resources by the resource access means, so that a plurality of jobs in one computer system can be used as virtual computer resources in the computer system. It becomes possible to access the computer resources.
Furthermore, the composite computer system of the present invention has a resource protection information management unit that has resource protection information of computer resources of other computer systems, so that the computer system can manage computer resources under the management of a plurality of computer systems. It is possible to protect against unauthorized jobs executed in the network.
[0025]
Further, the resource protection method between computer systems in the compound computer system of the present invention is as follows. 3 As described in In a resource protection method between computer systems in a decryption-type computer system in which a job in a computer system performs access processing to a computer resource under the management of another computer system, the computer system protects the computer resource of its own computer system. Resource protection information management step for managing resource protection information and resource protection information for protecting computer resources under the management of other computer systems (S3, S4, S9, S10, S23, S24, S43 in the embodiments described later) S47), and based on the resource protection information managed in the resource protection information management step, an access process for the computer resource under the management of the own computer system and an access process for the computer resource under the management of another computer system are performed. Resource access step (S6, S7, S11, S in the embodiment described later) 8 and S44), and by absorbing the difference in access processing between computer systems in the resource access step, resource protection during access processing for computer resources under the management of other computer systems Execute in the same process as the access process to the computer resources under the management of the computer system, When a job performs an access process for a computer resource under the management of a plurality of other computer systems, the resource access step includes a step of sending an access request for the computer resource in parallel (corresponding to S21 and S27 in the embodiments described later). If there is at least one computer resource for which the access request is denied, access processing for other than the computer resource is executed based on predetermined information preset in the access request source computer system Or stop all access processing.
[0026]
Therefore, in the resource protection method between computer systems of the present invention, the difference in the access method and the number of computer resources is absorbed in the resource access step, so that a job of one computer system can be executed by a virtual computer in the computer system. A plurality of computer resources can be accessed as resources.
Furthermore, in the resource protection method between computer systems of the present invention, the computer system protects the computer resources of other computer systems in the resource protection information management step, so that the computer resources under the management of a plurality of computer systems are stored in the computer system. It is possible to protect against unauthorized jobs executed in
[0027]
Further, the resource protection method between computer systems in the compound computer system of the present invention is as follows. 4 As described in In a resource protection method between computer systems in a decryption-type computer system in which a job in a computer system performs access processing to a computer resource under the management of another computer system, the computer system protects the computer resource of its own computer system. Based on the resource protection information and the resource protection information management step for managing the resource protection information for protecting the computer resources under the management of other computer systems, and the resource protection information managed at the resource protection information management step, A resource access step for performing an access process for a computer resource under the management of a computer system and an access process for a computer resource under the management of another computer system, and absorbing the difference in the access process between the computer systems in the resource access step By using the Resource protection during access processing for machine resources, perform the same processing as the process of accessing computer resources under its own computer system management, When a job performs access processing for a computer resource under the management of a plurality of other computer systems, the resource access step sequentially sends an access request for the computer resource according to a preset order (in the embodiment described later). And the access request for the access request is skipped based on predetermined information preset in the access request source computer system. Or all access processing is aborted.
[0028]
Therefore, in the resource protection method between computer systems of the present invention, the difference in the access method and the number of computer resources is absorbed in the resource access step, so that a job of one computer system can be executed by a virtual computer in the computer system. A plurality of computer resources can be accessed as resources.
Furthermore, in the resource protection method between computer systems of the present invention, the computer system protects the computer resources of other computer systems in the resource protection information management step, so that the computer resources under the management of a plurality of computer systems are stored in the computer system. It is possible to protect against unauthorized jobs executed in the network.
[0029]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, implementation of the composite computer system of the present invention composed of a plurality of computer systems connected to each other via an inter-system communication mechanism having a LAN, an inter-system shared memory, etc., and a resource protection method between the computer systems An example will be described with reference to the drawings.
[0030]
FIG. 1 shows a configuration diagram of a composite computer system of the present invention.
1, the composite computer system of the present invention comprises a computer system 1 and a computer system 2 as a plurality of computer systems, and an inter-system communication mechanism 3 such as a LAN for connecting the computer systems. Each job (equivalent to job 6 and job 10) uses a computer resource (equivalent to computer resource 7 and computer resource 11) under the control of another computer system via the inter-system communication mechanism 3 and executes the process. To do. Specifically, the job 6 of the computer system 1 executes processing using the computer resource 11 under the management of the computer system 2. Further, the job 10 of the computer system 2 executes processing using the computer resource 7 under the management of the computer system 1. 1 is composed of the computer system 1 and the computer system 2 for convenience of explanation, the number of computer systems constituting the composite computer system is not limited to this.
[0031]
The computer system 1 constituting the composite computer system of FIG. 1 includes a resource protection information management mechanism 4, a resource access mechanism 5, and a computer resource 7. A job 6 performs processing using the computer resource and the computer resource 11. Running.
The resource protection information management mechanism 4 manages resource protection information for accessing the computer resources under the management of each other computer system constituting the composite computer system as virtual computer resources existing in the computer system 1, Further, by controlling the resource protection information, a function of concealing the difference in computer resource protection between the own computer system 1 and each other computer system and processing various requests for resource protection information from the resource access mechanism 5 described later Have
[0032]
In addition, the resource protection information management mechanism 4 includes a self-system resource protection information management unit 4b that manages resource protection information for the computer resources 7 under management of the computer system 1, and computer resources under management of the computer system 2 and other computer systems. The other system resource protection information management unit 4a for managing resource protection information for handling virtual machines as virtual computer resources existing in the computer system 1.
[0033]
The resource access mechanism 5 controls the processing of the computer resources of other computer systems as virtual computer resources existing in the computer system 1 and accesses the computer resources under the management of the own computer system 1 and other computer systems. It has a function to conceal the difference in method and the corresponding number of computer resources.
Further, the resource access mechanism 5 sends a request from the job 6 to the computer resource 7 under the management of the computer system 1, a request from the job 6 to access to the computer resource under the management of the other computer system, and a notification from the job of the other computer system. The resource protection information in the resource protection information management mechanism 4 corresponding to each access request of the access request to the computer resource 7 managed by the computer system 1 is confirmed, and the resource protection information of the computer system of each access request source If it is within the access authority range, it has a function of executing processing for the access request. The resource access mechanism 5 also includes a local computer resource access unit 5b that executes an access process for the computer resource 7, and a virtual computer existing in the computer system 1 for the computer system 2 and other computer system managed computers. As a resource, another computer resource access unit 5a that executes an access process equivalent to the computer resource 7 is provided. That is, the other computer resource access unit 5a has a function of changing an access request from a job in the own computer system to a computer resource managed by another computer system to an access request form of the other computer system. It has a function of changing an access request from a job to a computer resource under management of the own computer system to an access request form of the own computer system, and a function of changing an access request to an intermediate processing form that can be processed by both computer systems.
[0034]
The computer resource 7 has a function of storing data necessary for job 6 processing.
A computer system 2 constituting the composite computer system of FIG. 1 includes a resource protection information management mechanism 8, a resource access mechanism 9, and a computer resource 11, and has the same functions as the computer system 1. The resource protection information management mechanism 8 of the computer system 2 corresponds to the resource protection information management mechanism 4, the resource access mechanism 9 corresponds to the resource access mechanism 5, and the computer resource 11 corresponds to the computer resource 7. Further, the other system resource protection information management unit 8a in the resource protection information management mechanism 8 corresponds to the other system resource protection information management unit 4a, and the own system resource protection information management unit 8b corresponds to the own system resource protection information management unit 4b. The other computer resource access unit 9a in the resource access mechanism 9 corresponds to the other computer resource access unit 5a, and the own computer resource access unit 9b corresponds to the own computer resource access unit 5b.
[0035]
The inter-system communication mechanism 3 performs communication between computer systems using a LAN or the like protected from unauthorized access from an unspecified third party, that is, transmission / reception of computer resources between resource access mechanisms. And a function for transmitting / receiving resource protection information access requests and access result information between resource protection information management mechanisms.
In the compound computer system configured as described above, each computer system (computer system 1, 2) uses a LAN or the like that is protected from unauthorized access from a computer system used by an unspecified third party. Through the inter-system communication, each resource access mechanism (resource access mechanism 5, 9) and each resource protection information management mechanism (resource protection information management mechanism 4, 8) are connected so that each computer system can be identified. .
[0036]
More specifically, the resource protection information management mechanism 4 uses the own system resource protection information management unit 4b and the other system resource protection information management unit 4a to provide resource protection information for access processing to the computer resource 7 and the computer resource 11, respectively. I manage. Note that the resource protection information for the computer resource 11 set by the other system resource protection information management unit 4a is the case where the computer resource 11 to be protected by the resource protection information does not exist in the computer system 1. The computer resource 11 is set so that it can be processed as existing in the computer system 1. Further, the resource protection information for the computer resource 7 set by the own system resource protection information management unit 4b is not only the resource protection information for protecting from the job 6, but also the resource protection for protecting from the jobs of other computer systems. Information is set.
[0037]
Further, in the resource protection information management mechanism 8, as with the resource protection information management mechanism 4, the own system resource protection information management unit 8b and the other system resource protection information management unit 8a perform access processing for the computer resource 11 and the computer resource 7, respectively. The above resource protection information is managed. Note that the resource protection information for the computer resource 7 set by the other system resource protection information management unit 8a is the case where the computer resource 7 to be protected by the resource protection information does not exist in the computer system 2. The computer resource 7 is set so as to be processed as existing in the computer system 2. Further, the resource protection information for the computer resource 11 set by the own system resource protection information management unit 8b includes resource protection information for protecting from jobs of other computer systems in addition to the resource protection information for protecting from the job 10. Information is set.
[0038]
Therefore, in the composite computer system of the present invention, each computer system job can execute the access process to the own computer resource and the access process to the computer resource under the management of other computer systems with the same control.
Further, for example, when the computer resource 7 under the management of the computer system 1 needs to be protected from a job access request, the computer resource 7 can receive the access request from the job 6 of the own computer system 1 and the other computer system 2. Regardless of the difference in access requests from the job 10, resource protection information for protecting the computer resource 7 is registered in the resource protection information management mechanism 4 in advance. Further, when there is an access request for the computer resource 7 from another computer system, the computer for the entire other computer system, for each group of other computer systems capable of equivalent access requests, or for each other computer system. The access processing range and authority for the resource 7 are registered in advance in the resource protection information management mechanism 4 and the resource protection information management mechanism 8.
[0039]
In this state, when the job 6 operating in the computer system 1 of the composite computer system shown in FIG. 1 executes an access process for the computer resource, the resource access mechanism 5 uses the resource protection information management mechanism 4 according to the method shown in FIG. The control process for is executed. Hereinafter, the processing of FIG. 2 when the job 6 executes the access processing to the computer resource will be described. Note that the same process is executed when the job 10 executes an access process to a computer resource, and thus the description thereof is omitted.
[0040]
When the resource access mechanism 5 of the computer system 1 receives an access processing request to the computer resource from the job 6 (S1), it reads the resource protection information managed by the resource protection information management mechanism 4 and transfers it to the computer resource. As the access right range, for example, processing for confirming information such as readable / writable and readable / writable is executed (S2).
[0041]
When the requested access process is out of the access right range, for example, when an access request for a write process is received when it is set to be readable / writable (S3, NO), the resource protection information management mechanism 4 An access request error is notified to the mechanism 5 based on the resource protection information (S4), and the resource access mechanism 5 notifies the access processing requesting job 6 to that effect (S12).
[0042]
If the requested access processing is within the access right range (S3, YES), the resource access mechanism 5 determines whether the access processing request is a request for the computer resource 7 under the management of the computer system 1 or other computer system management. It is confirmed whether the request is for a lower computer resource (in this case, the computer resource 11 managed by the computer system 2 is indicated) (S5).
[0043]
For example, in the case of an access request to the computer resource 7 under the management of the computer system 1 (S5, NO), the resource access mechanism 5 executes an access process for the computer resource 7 in its own computer resource access unit 5b, and further the access process When the result is received (S6), the fact is notified to the access processing request source job 6 (S12).
[0044]
On the other hand, in the case of an access request to the computer resource 11 under the management of the computer system 2 (S5, YES), the resource access mechanism 5 sends a job 6 to the computer system 2 having the computer resource 11 in the other computer resource access unit 5a. The access processing request from is notified (S7). At this time, an access request to the computer resource 11 under the management of the computer system 2 from the job 6 is an access request to the computer resource 7 described above as an access request to a computer resource virtually existing in the computer system 1. It is done in a similar way.
[0045]
In the computer system 2 that is notified of the access processing request from the job 6 executed in the computer system 1, the computer resource access unit 9 a receives the access processing request in the resource access mechanism 9.
After receiving the access processing request, the resource access mechanism 9 reads the resource protection information corresponding to the computer system 1 from the resource protection information management mechanism 8 and sets the access right range to the computer resource 11 as, for example, readable / writable. Then, a process of confirming information such as read / write is executed (S8).
[0046]
When the requested access processing is outside the access right range, for example, when a write processing access request is received when the read access is set / not possible (S9, NO), the resource protection information management mechanism 8 An access request error is notified to the mechanism 9 based on the resource protection information, and in the resource access mechanism 9, the other computer resource access unit 9a informs the other computer resource access of the computer system 1 of the access processing request source. This is notified to the unit 5a (S10). In the computer system 1 that has received the access request error, the resource access mechanism 5 notifies the job 6 of the access processing request source to that effect (S12).
[0047]
When the requested access processing is within the access right range (S9, YES), in the resource access mechanism 9, the own computer resource access unit 9b executes access processing to the computer resource 11 in accordance with the access processing request, The result is notified to the computer system 1 (S11).
In the computer system 1 that has been notified of the access result for the computer resource 11, the resource access mechanism 5 notifies the job 6 of the access processing request source to that effect (S12).
[0048]
Therefore, in the composite computer system of the present invention, the job 6 of the computer system 1 that uses the computer resource 11 is transferred to the computer system 1 by the resource access mechanism 5 absorbing the difference in the access method and the number of computer resources. It becomes possible to access the computer resource 11 as a virtual computer resource.
Furthermore, in the composite computer system of the present invention, since the resource protection information management mechanism 4 has the resource protection information of the computer resource 11, the computer resource 11 managed by the computer system 2 is illegally executed in the computer system 1. It is possible to protect against a difficult job.
[0049]
In the compound computer system of the present invention, when a job 6 executed in the computer system 1 accesses the computer resource 11 under the management of the computer system 2, the range accessible by the resource protection information management mechanism 4 of the own computer system. After confirming the above, since the accessible range is confirmed by the resource protection information management mechanism 8 of the computer system 2, the computer system 11 that manages the computer resource 11 can protect the computer resource 11 from an unauthorized job.
[0050]
In addition, when the job executed in the computer system 1 accesses the computer resource 11 under the management of the computer system 2, the composite computer system of the present invention can be accessed in advance by the resource protection information management mechanism 4 of the own computer system. Since the access request to the other computer system is notified only when it is within the accessible range, it is not necessary to notify all access requests as in the conventional remote access, and the load on the inter-system communication mechanism can be reduced. .
[0051]
When the job 6 operating in the computer system 1 of the composite computer system shown in FIG. 1 executes access processing for a plurality of other computer system managed resources, the resource access mechanism 5 is a part of FIG. Control processing for the resource protection information management mechanism 4 is executed by a method in which A is replaced with FIG. 3 or FIG.
Hereinafter, when the job 6 executes an access process for a plurality of computer resources, a process for executing an access request in parallel with respect to another computer system will be described with reference to FIGS. Note that the same processing is executed when the job 10 and a job in another computer system execute the access processing to the computer resource, and thus the description thereof is omitted.
[0052]
When the resource access mechanism 5 of the computer system 1 receives an access processing request to the computer resource from the job 6 (S1), it reads the resource protection information managed by the resource protection information management mechanism 4 and transfers it to the computer resource. As the access right range, for example, processing for confirming information such as readable / writable and readable / writable is executed (S2).
[0053]
When the requested access process is out of the access right range, for example, when an access request for a write process is received when it is set to be readable / writable (S3, NO), the resource protection information management mechanism 4 An access request error is notified to the mechanism 5 based on the resource protection information (S4), and the resource access mechanism 5 notifies the access processing requesting job 6 to that effect (S12).
[0054]
If the requested access processing is within the access right range (S3, YES), the resource access mechanism 5 determines whether the access processing request is a request for the computer resource 7 under the management of the computer system 1 or other computer system management. It is confirmed whether the request is for a lower computer resource (in this case, the computer resource 11 managed by the computer system 2 and other computer resources managed by a plurality of computer systems are indicated) (S5).
[0055]
For example, in the case of an access request to the computer resource 7 under the management of the computer system 1 (S5, NO), the resource access mechanism 5 executes an access process for the computer resource 7 in its own computer resource access unit 5b, and further the access process When the result is received (S6), the fact is notified to the access processing request source job 6 (S12).
[0056]
On the other hand, in the case of an access request for the computer resource 11 under the management of the computer system 2 and other computer resources under the management of the plurality of computer systems (S5, YES), the resource access mechanism 5 uses the other computer resource access unit 5a as the computer resource. 11 and other computer systems having a plurality of other computer resources are requested to perform processing for confirming the access right corresponding to the access processing request from the job 6 (FIG. 3, S21). At this time, an access request from the job 6 to the computer resource 11 under the management of the computer system 2 and the computer resource under the management of another computer system is an access request to a computer resource that virtually exists in the computer system 1. This is performed in the same manner as the access request to the computer resource 7 described above.
[0057]
In the computer system 2 and other computer systems that have been notified of the request for confirming the access right from the computer system 1, the other computer resource access unit of each resource access mechanism receives the request for confirming the access right.
After receiving the request for confirming the access right, for example, the resource access mechanism 9 of the computer system 2 reads out the resource protection information corresponding to the computer system 1 from the resource protection information management mechanism 8, and the access right range to the computer resource 11 For example, a process of confirming information such as readable / writable and readable / writable is executed (S22).
[0058]
When the access processing to the computer resource 11 is outside the access right range, for example, when the access request for the write processing is received when the read / write is not possible (S23, NO), the resource protection information management mechanism 8 The resource access mechanism 9 is notified of an access request error based on the resource protection information (S24), and the resource access mechanism 9 notifies the request source computer system 1 of the result (S25). If the access processing to the computer resource 11 is within the access right range (S23, YES), the resource access mechanism 9 notifies the request source computer system 1 of the result (S25).
[0059]
Similarly, the other computer systems that have received the request for confirming the access right from the computer 1 also execute the processing from step 22 to step 24 and notify the requesting computer system 1 of the result (S25).
The computer system 1 that has received the processing results from all the computer systems that have notified the request for confirming the access right checks whether there is a computer resource that cannot be accessed in the results (S26).
[0060]
As a result of the confirmation, there is a computer resource that becomes inaccessible (S26, YES), and in the computer system 1, when it is confirmed that there is a computer resource that becomes inaccessible, all access processing is set to be stopped. If it is determined (S29, YES), the computer system 1 stops the access process for all the computer systems as a continuation error (S30).
[0061]
In addition, as a result of the confirmation, there is a computer resource that cannot be accessed (S26, YES), and in the computer system 1, the computer system that is permitted to access when the existence of the computer resource that cannot be accessed is confirmed. Is set to execute the access process (S29, NO), or when there is no computer resource that cannot be accessed (S26, NO), the resource access mechanism 5 of the computer system 1 Then, the access processing request from the job 6 is notified to the computer system having the computer resource whose access request is permitted by the other computer resource access unit 5a (S27).
[0062]
For example, when the computer system 2 receives an access processing request, in the resource access mechanism 9, the own computer resource access unit 9 b executes the access processing for the computer resource 11 in accordance with the access processing request and notifies the computer system 1 of the result. (S28). Similarly, other computer systems that have received the access processing request from the computer system 1 also execute the processing of step 28, and notify the requesting computer system 1 of the result (S28).
[0063]
In the computer system 1 that is notified of the access results for all the computer resources, the resource access mechanism 5 notifies the access processing request source job 6 (S12).
Therefore, in the composite computer system of the present invention, the resource access mechanism 5 absorbs the difference in the access method and the number of computer resources, so that a plurality of jobs 6 of the computer system 1 are used as virtual computer resources in the computer system 1. It becomes possible to access the computer resources.
[0064]
Furthermore, in the compound computer system of the present invention, the resource protection information management mechanism 4 has the resource protection information of the computer resources of other computer systems, so that the computer resources managed by a plurality of computer systems are executed in the computer system 1. It is possible to protect against unauthorized jobs.
In the complex computer system of the present invention, when a job 6 executed in the computer system 1 accesses a plurality of computer resources managed by another computer system, it is accessed by the resource protection information management mechanism 4 of the own computer system. After confirming the possible range, the accessible range is confirmed by the resource protection information management mechanism of another computer system, so that it becomes possible to protect the computer resource from an unauthorized job by the computer system that manages the computer resource.
[0065]
In addition, when the job 6 executed in the computer system 1 accesses a plurality of computer resources managed by another computer system, the composite computer system of the present invention uses the resource protection information management mechanism 4 of the own computer system in advance. Since the access range is confirmed and access requests to other computer systems are notified only within the accessible range, it is not necessary to notify all computer systems of access requests as in the case of conventional remote access, and inter-system communication The load on the mechanism can be reduced.
[0066]
Next, when the job 6 executes access processing for a plurality of computer resources, processing for sequentially executing access requests to other computer systems will be described with reference to FIGS. Note that the same processing is executed when the job 10 and a job in another computer system execute the access processing to the computer resource, and thus the description thereof is omitted.
[0067]
When the resource access mechanism 5 of the computer system 1 receives an access processing request to the computer resource from the job 6 (S1), it reads the resource protection information managed by the resource protection information management mechanism 4 and transfers it to the computer resource. As the access right range, for example, processing for confirming information such as readable / writable and readable / writable is executed (S2).
[0068]
When the requested access process is out of the access right range, for example, when an access request for a write process is received when it is set to be readable / writable (S3, NO), the resource protection information management mechanism 4 An access request error is notified to the mechanism 5 based on the resource protection information (S4), and the resource access mechanism 5 notifies the access processing requesting job 6 to that effect (S12).
[0069]
If the requested access processing is within the access right range (S3, YES), the resource access mechanism 5 determines whether the access processing request is a request for the computer resource 7 under the management of the computer system 1 or other computer system management. It is confirmed whether the request is for a lower computer resource (in this case, the computer resource 11 managed by the computer system 2 and other computer resources managed by a plurality of computer systems are indicated) (S5).
[0070]
For example, in the case of an access request to the computer resource 7 under the management of the computer system 1 (S5, NO), the resource access mechanism 5 executes an access process for the computer resource 7 in its own computer resource access unit 5b, and further the access process When the result is received (S6), the fact is notified to the access processing request source job 6 (S12).
[0071]
On the other hand, in the case of an access request to the computer resource 11 managed by the computer system 2 and other computer resources managed by a plurality of computer systems (S5, YES), the resource access mechanism 5 uses, for example, the other computer resource access unit 5a. The access processing request from the job 6 is notified to the computer system 2 having the computer resource 11. (FIG. 4, S41). At this time, an access request to the computer resource 11 under the management of the computer system 2 from the job 6 is an access request to the computer resource 7 described above as an access request to a computer resource virtually existing in the computer system 1. It is done in a similar way.
[0072]
For example, in the computer system 2 notified of the access processing request from the job 6 executed in the computer system 1, the computer resource access unit 9 a receives the access processing request in the resource access mechanism 9.
After receiving the access processing request, for example, the resource access mechanism 9 of the computer system 2 reads the resource protection information corresponding to the computer system 1 from the resource protection information management mechanism 8 and sets the access right range to the computer resource 11 as, for example, Then, a process of confirming information such as readable / writable and readable / writable is executed (S42).
[0073]
When the access process to the computer resource 11 is within the access right range (S43, YES), in the resource access mechanism 9, the own computer resource access unit 9b executes the access process to the computer resource 11 according to the access process request, and The result is notified to the computer system 1 (S44).
In the computer system 1 notified of the access result for the computer resource 11, the resource access mechanism 5 notifies the access processing request source job 6 of that fact (S45).
[0074]
When the job 6 executes an access process for a plurality of computer resources (S46, NO), the computer system 1 performs steps 41 to 45 until the access process for all the remaining computer resources corresponding to the virtual computer resource is completed. This process is repeated, and when the access process of all the computer resources is completed (S46, YES), the fact is notified to the access process request source job 6 (S12).
[0075]
On the other hand, as a result of the confirmation in step 43, when the access processing to the computer resource 11 is out of the access right range, for example, the read processing access request is received when it is set as readable / writable (S43, NO) The resource protection information management mechanism 8 notifies the resource access mechanism 9 of an access request error based on the resource protection information, and the resource access mechanism 9 notifies the request source computer system 1 of the result ( S47).
[0076]
For example, when the computer system 1 that has received the access request error is set to cancel the access processing to all subsequent computer systems when the access request error is received in advance (S48, YES), all the computers The access processing to the system is canceled as a continuation error (S49), and the resource access mechanism 5 notifies the job 6 of the access processing request source to that effect (S12).
[0077]
Further, for example, when the computer system 1 that has received the access request error is set to cancel the access processing to the computer system when the access request error is received in advance (S48, NO), the computer system 1 The resource access mechanism 5 notifies the access process request source job 6 of this fact (S45).
[0078]
When the job 6 executes an access process for a plurality of computer resources (S46, NO), the computer system 1 performs steps 41 to 49 until the access process for all the remaining computer resources corresponding to the virtual computer resource is completed. This process is repeated, and when the access process of all the computer resources is completed (S46, YES), the fact is notified to the access process request source job 6 (S12).
[0079]
Therefore, in the composite computer system of the present invention, the resource access mechanism 5 absorbs the difference in the access method and the number of computer resources, so that a plurality of jobs 6 of the computer system 1 are used as virtual computer resources in the computer system 1. It becomes possible to access the computer resources.
Furthermore, in the compound computer system of the present invention, the resource protection information management mechanism 4 has the resource protection information of the computer resources of other computer systems, so that the computer resources managed by a plurality of computer systems are executed in the computer system 1. It is possible to protect against unauthorized jobs.
[0080]
In the complex computer system of the present invention, when a job 6 executed in the computer system 1 accesses a plurality of computer resources managed by another computer system, it is accessed by the resource protection information management mechanism 4 of the own computer system. After confirming the possible range, the accessible range is confirmed by the resource protection information management mechanism of another computer system, so that it becomes possible to protect the computer resource from an unauthorized job by the computer system that manages the computer resource.
[0081]
In addition, when the job 6 executed in the computer system 1 accesses a plurality of computer resources managed by another computer system, the composite computer system of the present invention uses the resource protection information management mechanism 4 of the own computer system in advance. Since the access range is confirmed and access requests to other computer systems are notified only within the accessible range, it is not necessary to notify all computer systems of access requests as in the case of conventional remote access, and inter-system communication The load on the mechanism can be reduced.
[0082]
【The invention's effect】
As described above, according to the composite computer system of the present invention, even if the operating system of the computer system is different and the protection method for the computer resources is different between the computer systems, the mechanism that absorbs the difference of the operating system in the computer system. Therefore, a job of one computer system can execute access processing to a computer resource under the management of the computer system without being conscious of the other computer system.
[0083]
Further, according to the composite computer system of the present invention, each computer system manages the resource protection information of all the computer systems constituting the composite computer system even when the computer system resource protection method is different. Since the system has a similar resource protection environment, the computer system that is the access request source can execute access processing to the computer resource without being aware of the computer resource under the management of the computer system to be accessed.
[0084]
Further, according to the composite computer system of the present invention, even when the scale of the composite computer system becomes large, that is, when the number of computer systems and the number of connection paths increase, the access processing becomes complicated. Therefore, each computer system can give restriction or detailed protection processing designation to the resource protection information, and the computer resources can be protected in fine units.
[0085]
Further, according to the computer resource protection method using the composite computer system of the present invention, even when there are a plurality of computer resources corresponding to the access processing, it is possible to perform access processing on all the computer systems that manage the computer resources. It becomes.
Therefore, when each computer system executes a single job or a plurality of jobs using a computer resource that is not under direct management, the difference of the operating system between the computer systems is absorbed, and the protection procedure of the computer resource, and To provide a composite computer system capable of realizing protection of the computer resource from unauthorized access by facilitating processing of the resource protection information necessary for the procedure, and a resource protection method between the computer systems. it can.
[Brief description of the drawings]
FIG. 1 is a configuration diagram of a composite computer system of the present invention.
FIG. 2 shows a resource protection method when an access request is made for a computer resource.
FIG. 3 is a resource protection method when an access request is made to computer resources of a plurality of systems.
FIG. 4 is a resource protection method when an access request is made for computer resources of a plurality of systems.
FIG. 5 shows a conventional composite computer system.
[Explanation of symbols]
1 Computer system
2 Computer system
3 Communication system between systems
4 Resource Protection Information Management Organization
4a Other System Resource Protection Information Management Department
4b Local System Resource Protection Information Management Department
5 Resource access mechanism
5a Other computer resource access section
5b Local computer resource access section
6 jobs
7 Computer resources
8 Resource Protection Information Management Organization
8a Other System Resource Protection Information Management Department
8b Own system resource protection information management department
9 Resource Access Mechanism
9a Other computer resource access section
9b Local computer resource access section
10 jobs
11 Computer resources
101 First computer system
102 Second computer system
103 jobs
104 Remote access mechanism
105 Remote access mechanism
106 Computer resources

Claims (4)

In a complex computer system that consists of a plurality of computer systems and inter-system communication mechanisms that connect each computer system, and a job performs access processing to computer resources under the management of other computer systems,
  The computer system includes resource protection information management means for managing resource protection information for protecting computer resources of its own computer system and resource protection information for protecting computer resources under the management of other computer systems, and the resource protection Based on the resource protection information managed by the information management means, resource access means for performing access processing to computer resources under the management of its own computer system and access processing to computer resources under management of other computer systems,
  By absorbing the difference in access processing between computer systems by the resource access means, resource protection during access processing for computer resources under the management of other computer systems can be achieved by Execute in the same process,
  When a job performs access processing for a computer resource under the management of a plurality of other computer systems, the resource access means has means for sending an access request for the computer resource in parallel.
  When there is at least one computer resource for which the access request is rejected, access processing for other than the computer resource is executed based on predetermined information set in advance in the access request source computer system, or all Cancel the access processing of
  A compound computer system characterized by this. In a complex computer system that consists of a plurality of computer systems and inter-system communication mechanisms that connect each computer system, and a job performs access processing to computer resources under the management of other computer systems,
  The computer system includes resource protection information management means for managing resource protection information for protecting computer resources of its own computer system and resource protection information for protecting computer resources under the management of other computer systems, and the resource protection Based on the resource protection information managed by the information management means, resource access means for performing access processing to computer resources under the management of its own computer system and access processing to computer resources under management of other computer systems,
  By absorbing the difference in access processing between computer systems by the resource access means, resource protection during access processing for computer resources under the management of other computer systems can be achieved by Execute in the same process,
  When a job performs access processing to a computer resource under the management of a plurality of other computer systems, the resource access means has means for sequentially sending access requests for the computer resource according to a preset order,
  When there is a computer resource for which the access request is denied, the access processing for the computer resource is skipped or all access processing is performed based on predetermined information set in advance in the access request source computer system. Discontinue,
  A compound computer system characterized by this. In a resource protection method between computer systems in a decryption type computer system in which a job in a computer system performs access processing to a computer resource managed by another computer system,
  The computer system includes a resource protection information management step for managing resource protection information for protecting computer resources of its own computer system and resource protection information for protecting computer resources under the management of other computer systems, and the resource protection Based on the resource protection information managed in the information management step, there is a resource access step for performing an access process for the computer resource under the management of the own computer system and an access process for the computer resource under the management of another computer system,
  By absorbing differences in access processing between computer systems in the resource access step, resource protection during access processing for computer resources under the management of other computer systems can be achieved with access processing for computer resources under management of the local computer system. Execute in the same process,
  When a job performs an access process for a computer resource managed by a plurality of other computer systems, the resource access step sends an access request for the computer resource in parallel. Steps
  When there is at least one computer resource for which the access request is rejected, access processing for other than the computer resource is executed based on predetermined information set in advance in the access request source computer system, or all Cancel the access processing of
  A resource protection method between computer systems. In a resource protection method between computer systems in a decryption type computer system in which a job in a computer system performs access processing to a computer resource managed by another computer system,
  The computer system includes a resource protection information management step for managing resource protection information for protecting computer resources of its own computer system and resource protection information for protecting computer resources under the management of other computer systems, and the resource protection Based on the resource protection information managed in the information management step, there is a resource access step for performing an access process for a computer resource under management of the own computer system and an access process for a computer resource under management of another computer system,
  By absorbing differences in access processing between computer systems in the resource access step, resource protection during access processing for computer resources under the management of other computer systems can be achieved with access processing for computer resources under management of the local computer system. Execute in the same process,
  When a job performs an access process to a computer resource under the management of a plurality of other computer systems, the resource access step includes a step of sequentially sending an access request for the computer resource according to a preset order,
  When there is a computer resource for which the access request is denied, the access processing for the computer resource is skipped or all access processing is performed based on predetermined information preset in the computer system of the access request source. Discontinue,
  A resource protection method between computer systems.

Images