Persistent distributed capabilities

• US 6,049,838 A
• Filed: 07/01/1996
• Issued: 04/11/2000
• Est. Priority Date: 07/01/1996
• Status: Expired due to Fees

• Current Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Miller, Mark S., Tribble, E. Dean, Hibbert, Christopher T., Hill, Eric C., Hardy, Norman
• Primary Examiner(s): Oberley, Alvin E.
• Assistant Examiner(s): STECHER, PETER S
• Application Number:
  US08/673,058
• Time in Patent Office: 1,380 Days
• Field of Search: 395/680, 395/682, 395/683, 709/300, 709/302, 709/303, 709/229, 380/23, 380/24, 380/25, 380/49
• US Class Current: 719/315
• CPC Class Codes: G06F 9/465 Distributed object oriented systems remote method invocation [RMI] G06F9/548

Abstract

A system and method is disclosed that provides persistent capabilities for distributed, object-oriented applications running on generally available hardware. The disclosed system and method operate in a transparent distributed object system where inter-process messaging between the program objects is effected by paired transport managers, proxies and matched in-table and out-table slots. Each object needing to communicate with an object in another address space does so by transparently issuing messages to that object'"'"'s local proxy. Each process provides a registrar that includes a secret code table wherein an object is registered with a unique, practically unguessable secret code. Anticipating the need to re-establish object-proxy links following a inter-process communications fault, proxies are made revivable, meaning that their links with corresponding remote objects can be revived following a communications interruption. This is accomplished by a makeRevivable method that stores a revivable proxy'"'"'s expiration date (the date beyond which the proxy is not revivable) and its corresponding remote object'"'"'s secret code into the proxy'"'"'s out-table slot. Upon the occurrence of a communications fault, all transport managers and tables are nulled out and then, when the communications fault is corrected, rebuilt by the transport managers. Sometime after the restoration of communications, a revived method is invoked that restores the links between, registered objects and proxies. The objects and proxies are brought back in a consistent state based on limited checkpointed data stored by the distributed program for the registered objects.

Claims

1. A system providing persistent capabilities for distributed systems, comprising:

a plurality of processes;

programs executing in at least a subset of said processes;

objects allocated in said subset of said processes;

communications channels between those of said plurality of processes that are in communication;

a pair of transports allocated to each pair of said processes for which inter-process communications are available, wherein a first transport of the pair of transports is located in a first process of the pair of processes and a second transport of the pair of transports is located in a second process of the pair of processes, each transport including;

an in-table with indexed in-table slots;

an out-table with indexed out-table slots; and

a data structure for storing an encryption key, agreed upon with the other transport of the pair of transport;

respective ones of said out-table slots of the first transport of said pair of transports and said in-table slots of the second transport of said pair of transports being linked;

a plurality of proxies, each resident in a respective one of the processes and linked to a respective object that is resident in a different process via one of said linked slots, said proxies and pairs of transports enabling a first object in a first process to communicate transparently with a second object in a second process via a corresponding proxy in said first process linked to said second object;

wherein the communications between the first and second objects are communications encrypted using the encryption key stored in the pair of transports allocated to the pair of processes comprising the first and second processes;

said programs being configured, upon detecting a problem communicating with any of said remote processes via said communications channels, to disable the proxies of said plurality proxies that are no longer able to communicate with their respective objects due to the communication problem and to delete the encryption key stored in each pair of the transports corresponding to the disabled proxies and their respective objects, and when said communications problem is remedied so that communications with said affected remote processes are restored, to revive said disabled proxies and to establish and store a new encryption key in each of the corresponding pairs of transports.

2. The system of claim 1, further comprising:

a registrar in each of said processes that maintains a record for each of said proxies in said registrar'"'"'s process that is revivable, each said record uniquely designating its associated proxy and including for said associated proxy;

an expiration date; and

a secret code;

said secret code for said associated revivable proxy being derived from a remote secret code associated with a remote object linked to said revivable proxy;

such that, upon a communication fault occurring between first and second processes linked by first and second transports, said processes are configured to rebuild said first and second transports, assigning new slot indices to objects and proxies which were formerly communicating across said interface and which were revivable, said processes re-establishing slot linkages between corresponding objects and proxies by matching secret codes of said linked objects and proxies.

3. The system of claim 2, wherein said communication faults comprise at least one of:

network partition;

failure of at least one of said computers; and

failure of at least one of said processes.

4. The system of claim 2, further comprising:

a ref doctor in each of said processes, said ref doctor holding a reference to said registrar in same process, said ref doctor being configured to;

request that a subset of said proxies in said same process be made revivable; and

request revival of a subset of said proxies in said same process;

said ref doctor inhibiting confined objects from accessing said registrar in same process.

5. The system of claim 2, further comprising:

a set of location services, each said location service including at least one process location listing, each of which includes;

an authenticatable identity of a particular process, and

network location of said particular process;

wherein;

each said process further includes;

a location service list listing a first subset of said location services wherein said process is registered;

each said process is further configured to register its network location and authenticatable identity with said first subset of said location services anytime said process has bee re-located; and

each said transport includes;

a search path identifying a second subset of said set of location services wherein said transport'"'"'s paired process is registered, and

a representation of said authenticatable identity of said paired process;

said transport being configured to find said paired process when said paired process has been re-located by issuing a locate request to location services designated in said search path, said locate request including said representation of said authenticatable identity of said paired process.

6. The system of claim 2, wherein said authenticatable identity comprises:

a fingerprint of a particular process;

wherein;

each said process further includes;

a unique fingerprint;

each said process is further configured to register its network location and fingerprint with said first subset of said location services anytime said process has bee re-located; and

each said transport includes;

a search path identifying a second subset of said set of location services wherein said transport'"'"'s paired process is registered, and

said fingerprint of said paired process;

said transport being configured to find said paired process when said paired process has been re-located by issuing a locate request to location services designated in said search path, said locate request including said fingerprint of said paired process.

7. The system of claim 6, wherein:

said fingerprint comprises the hash of a public key associated with said process.

8. The system of claim 7, wherein:

said process is configured to transmit securely said fingerprint and network location to each of said location services via Diffie-Helman key encryption wherein a different agreed key is negotiated between each of said location services in said second subset and said process.

9. The system of claim 2, further comprising:

a makeRevivable method associated with each of said registrars;

said makeRevivable method of a first registrar in a first process being invoked by a program executing in said first process with a makeRevivable message designating a first process proxy to be made revivable, said first proxy being linked to a remote object;

said makeRevivable method being configured to obtain a secret code of said remote object and return to said first registrar said secret code of said remote object, so that, following execution of said makeRevivable message, said registrar has stored in entry of said first proxy said secret code of said remote object.

10. The system of claim 9, further comprising:

a revived method associated with each of said registrars, said revived method of said first registrar being invoked by said program following said communications fault with a revived message designating said first proxy as a proxy to be revived;

said revived method in said first process being configured to use said secret code to lookup said remote object and re-establish transport links between said remote object and said first proxy.

11. The system of claim 10, wherein said second transport is configured, upon receiving a revived message and determining that said communications have not yet been restored following said communications fault, to restore said communications.

12. The system of claim 10, further comprising:

a rebuildCom method associated with each of said transports, said rebuildCom method in a second transport being invoked following said communications fault by said computer program;

such that, in response to said communications fault, said second transport restores its communications with its corresponding remote transport.

13. The system of claim 2, wherein said programs are configured to rebuild said new remote references in response to a demand for a proxy whose link with a remote object was severed due to said communications fault.

14. The system of claim 2, wherein said programs are configured to rebuild said new remote references as soon as possible after said existing remote references are disabled.

15. The system of claim 2, wherein said secret code is a secret number.

16. A method of providing persistent capabilities for distributed systems, comprising the steps of:

executing programs in a plurality of processes;

allocating objects in the processes;

communications channels between those of the plurality of processes that are in communication;

establishing a pair of transports for each pair of the processes for which inter-process communications are available, wherein a first transport of the pair of transports is located in a first process of the pair of processes and a second transport of the pair of transports is located in a second process of the pair of processes, each transport including;

an in-table with indexed in-table slots;

an out-table with indexed out-table slots; and

a data structure for storing an encryption key, agreed upon with the other transport of the pair of transport;

respective ones of the out-table slots of the first transport of the pair of transports and the in-table slots of the second transport of the pair of transports being linked;

establishing a plurality of proxies, each resident in a respective one of the processes and linked to a respective object that is resident in a different process via one of the linked slots, the proxies and pairs of transports enabling a first object in a first process to communicate transparently with a second object in a second process via a corresponding proxy in the first process linked to the second object;

wherein the communications between the first and second objects are communications encrypted using the encryption key stored in the pair of transports allocated to the pair of processes comprising the first and second processes;

upon detecting a problem communicating with any of the remote processes via the communications channels, disabling the proxies of the plurality proxies that are no longer able to communicate with their respective objects due to the communication problem and to delete the encryption key stored in each pair of the transports corresponding to the disabled proxies and their respective objects, and

when the communications problem is remedied so that communications with the affected remote processes are restored, reviving the disabled proxies and establishing and storing a new encryption key in each of the corresponding pairs of transports.

17. The method of claim 16, further including establishing a registrar in each of the processes that maintains a record for each of the proxies in the registrar'"'"'s process that is revivable, each record uniquely designating its associated proxy and including for the associated proxy:

an expiration date; and

a secret code;

the secret code for the associated revivable proxy being derived from a remote secret code associated with a remote object linked to the revivable proxy;

such that, upon a communication fault occurring between first and second processes linked by first and second transports, the processes are configured to rebuild the first and second transports, assigning new slot indices to objects and proxies which were formerly communicating across the first and second transports and which were revivable, the processes re-establishing slot linkages between corresponding objects and proxies by matching secret codes of the linked objects and proxies.

18. The method of claim 17, wherein the communication fault comprises at least one of:

a network partition;

a failure of at least one of the computers; and

a failure of at least one of the processes.