System and method for allocating server resources

• US 20050177635A1
• Filed: 12/18/2003
• Published: 08/11/2005
• Est. Priority Date: 12/18/2003
• Status: Abandoned Application

• Current Assignee: Contec Innovations, Inc.
• Original Assignee: Contec Innovations, Inc.
• Inventors: Schmidt, Roland, Lam, Bobby Cheuk-Yuen, Tian, Xiaomei, Belton, Jim
• Application Number:
  US10/742,618
• Publication Number:
  US 20050177635A1
• Time in Patent Office: Days
• US Class Current: 709/226
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 9/52 Program synchronisation; Mutual exclusion, e.g. by means of semaphores
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/10015 Access to distributed or replicated servers, e.g. using brokers
• CPC Class Codes: H04L 67/1008 based on parameters of servers, e.g. available memory or workload monitoring of computer activity G06F11/30
• CPC Class Codes: H04L 67/1023 based on a hash applied to IP addresses or costs
• CPC Class Codes: H04L 67/142 Managing session states for stateless protocols; Signalling session states; State transitions; Keeping-state mechanisms
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

A system and method for allowing web-based applications to run in a controlled environment. In particular, a method allocates server resources among applications running in a sandbox environment on a web server. Applications which attempt to exceed limits specified in templates associated with the application may be denied access to a resource.

Claims

1. A web server system, comprising:

a server computer having installed thereon a web server and a plurality of applications that interoperate with the web server to service requests from web browsers;

a plurality of templates, each template being associated with one or more of the applications, and specifying resource usage restrictions for the execution of such applications, such that different resource usage restrictions are placed on different applications;

an application framework that runs on the server computer in association with the web server and enforces the resource usage restrictions specified by the templates; and

an application management interface that provides functionality for an administrator to edit the plurality of templates, and to create new templates, to control execution of the plurality of applications on the server computer.

2. The web server system of claim 1, wherein the application framework enforces the resource usage restrictions, at least in part, by intercepting function calls made to the web server by the applications.

3. The web server system of claim 1, wherein the application framework enforces the resource usage restrictions in aggregate within a cluster of server computers.

4. The web server system of claim 1, wherein the templates specify resource quantity limits for the applications, and the application framework monitors resource usage by the applications over time to enforce the resource quantity limits.

5. The web server system of claim 1, wherein the application framework additionally prevents an application from accessing resources that have been allocated to another application.

6. The web server system of claim 1, wherein the application framework controls functional resource usage by the applications to enforce defined application functional access limits.

7. The web server system of claim 1, wherein the application framework controls network bandwidth usage by the applications to enforce defined bandwidth allocations.

8. The web server system of claim 1, wherein the application framework makes calls to the web server on behalf of the applications.

9. The web server system of claim 1, wherein the application framework monitors resource usage of the applications at least in part by maintaining token counts for an application, wherein each token represents a quantity of server resources that may be used by the application.

10. The web server system of claim 1, wherein the application framework is responsive to a web server request that invokes an application by loading at least one template associated by that application.

12. The method of claim 1, further comprising:

terminating the application and returning an error to the client when the limit is exceeded.

13. The method of claim 1, further comprising:

returning an exception to the application when the limit is exceeded.

14. The method of claim 1, wherein the dynamic content comprises information from a database.

11. A method for allocating resources in a server computer comprising:

receiving a web server request from a client for dynamic content, wherein the web server request comprises a URL;

identifying an application for generating the dynamic content, wherein the application is identified based, at least in part, on the URL;

identifying a template for the application, wherein the template associates at least one resource with a limit; and

executing the application in a virtual machine configured to allow resource accessing function calls to be intercepted;

intercepting resource accessing function calls;

granting access to the resource if the limit is not exceeded; and

tracking resource usage.

15. A method for allocating resources in a server computer comprising:

receiving a request from a client;

identifying an application based, at least in part, on the request;

identifying at least one association of a resource with a limit specific to the application; and

executing the application in a virtual machine configured to limit access to the resource as specified by the limit.

16. The method of claim 15, wherein the request comprises a web request.

17. The method of claim 15, wherein the virtual machine is configured to execute a plurality of applications wherein at least two of the plurality of applications are identified with a different limit for the resource.

18. The method of claim 15, further comprising:

terminating the application and returning an error to the client when the limit is exceeded.

19. The method of claim 15, further comprising:

returning an exception to the application when the limit is exceeded.

20. The method of claim 15, wherein the dynamic content comprises information from a database.

21. The method of claim 15, further comprising:

defining the association of a resource with a limit through a web-based human-machine interface.

22. The method of claim 15, wherein the resource comprises a function performed by the server.

23. The method of claim 22, wherein the limit for a function represents whether the function may be accessed.

24. The method of claim 22, further comprising:

automatically determining the limit on the function if a limit has not been specified for an application.

25. The method of claim 24, wherein automatically determining the limit on the function if a limit has not been specified for an application comprises disabling new functions added to the runtime environment.

26. The method of claim 24, wherein automatically determining the limit on the function if a limit has not been specified for an application comprises enabling new functions added to the runtime environment.

27. The method of claim 22, wherein limiting a function is based on an application specific validation of parameters to the function.

28. The method of claim 15, wherein limiting access comprises enforcing a limit on a quantity of the resource.

29. The method of claim 28 wherein limiting access to a resource comprises:

monitoring the quantity of the resource that is consumed.

30. The method of claim 15, wherein the resource comprises processor time.

31. The method of claim 30, wherein the limit to processor time is cumulative across a plurality of requests to the application.

32. The method of claim 15, wherein the resource comprises bandwidth.

33. The method of claim 15, wherein the resource comprises the open files.

34. The method of claim 15, wherein the resource comprises the file space.

35. The method of claim 15, wherein the resource comprises the open database connections.

36. The method of claim 15, wherein the resource comprises memory.

37. The method of claim 15, wherein the resource comprises an amount of time to respond to the request.

38. The method of claim 15, wherein executing the application comprises:

intercepting a function call in the runtime environment associated with accessing of the resource; and

rerouting the function call based on the application resource limit.

39. The method of claim 38, wherein the resource is determined by a parameter of the function call.

40. The method of claim 15, wherein the virtual machine comprises a PHP interpreter.

41. A method for selecting a substitute resource template for an application, comprising:

identifying a template defining a limit on at least one resource in a first server associated with an application;

comparing the associated template to a set of available templates provided for a second server; and

selecting the available template that is a closest match to the associated template.

42. The method of claim 41, wherein the available template defines a limit that is no more limiting than the limit of the associated template.

43. The method of claim 41, selecting the available template having a closest match comprises calculating a least-squares measure of the available template to the associated template.

44. A system for allocating resources in a server computer comprising:

a virtual machine module configured to execute a computer application associated with a server request;

an application definitions module configured to identify a mapping of at least one resource template with the application;

a parameter template module configured to identify a template associated with the application, wherein the template associates at least one resource with a limit;

a framework module configured to intercept function calls of the application that are associated with the resource and to limit access to the resource as specified by the limit of the template.

45. The system of claim 44, wherein the application definitions module is configured to identify the mapping of at least one resource template with the application from a plurality of mappings of applications to templates, wherein at least a first application is mapped to a different template that at least a second application.

46. A system for allocating resources for processing of a client request to a server computer, comprising:

means for identifying an application based, at least in part, on the request;

means for identifying at least one association of a resource with a limit for the application;

means for executing the application; and

means for limiting access to the resource as specified by the limit.

47. A method for allocating resources in a server computer comprising:

receiving a signal to activate an application;

identifying an application based, at least in part, on the signal;

identifying at least one association of a resource with a limit specific to the application; and

executing the application in a virtual machine configured to limit access to the resource as specified by the limit.