Function management method and related device

Abstract

Provided in the present application is a function management method. The method comprises: receiving a function call trigger event triggered by a user for a target function; on the basis of a function identifier of the target function, acquiring functionality classification information of the target function; on the basis of the functionality classification information of the target function and a mapping relationship between a function functionality and a container type, determining a target container type matching the functionality classification information of the target function; allocating, from a container resource pool, a container of the target container type to the target function; and loading, in the container, a code package of the target function, so as to execute a corresponding system call behavior. In the method, isolation technology for matching differentiated containers for functions according to requirements is provided, the functions are classified from a security dimension, and the functionalities of containers are separated, such that the functions of different security types are operated in different types of containers, and thus the calculation and data security of the functions themselves are achieved, and the security guarantee for a serverless platform is realized, thereby preventing a malicious function from performing container escaping to destroy an operation environment of the serverless platform.

Description

A function management method and related equipment

[0001] This application claims priority to the Chinese patent application filed with the State Intellectual Property Office on October 13, 2023, with application number 202311334036.9 and invention name “A function processing method and related equipment”, and claims priority to the Chinese patent application filed with the State Intellectual Property Office on January 25, 2024, with application number 202410108713.3 and invention name “A function management method and related equipment”, the entire contents of which are incorporated by reference into this application. Technical Field

[0002] The present application relates to the field of cloud computing technology, and in particular to a function management method, a function management platform, a computing device cluster, a computer-readable storage medium, and a computer program product. Background Art

[0003] Serverless is a new application model for cloud computing. It offers a high level of abstraction for applications. In this model, users only need to focus on functions used to express business logic and do not need to be aware of cloud computing resources or application operations and maintenance. This significantly reduces the cost of application development and operations.

[0004] While serverless reduces user operations and maintenance workload, its high degree of application abstraction also presents complex security challenges for the serverless platform. For example, function execution typically involves the serverless platform freely allocating containers from pooled resources to perform specific function calculations and returning the results upon completion. During execution, malicious functions can easily escape from containers and infiltrate other tenants' containers or the serverless platform, severely damaging its functionality.

[0005] Currently, serverless platforms prevent management-side containers from escaping by implementing security hardening measures. These include, but are not limited to, restricting containers from mounting external file systems. However, these security hardening measures are not applicable to tenant-side containers, as they may impact tenant-side business functions.

[0006] Summary of the Invention

[0007] This application provides a function management method, which provides an isolation technology for matching differentiated containers (such as differentiated sandboxes) to functions on demand, classifies functions from a security perspective, and separates container functions, thereby enabling functions of different security types to operate in different container types. On the one hand, this can ensure the computing and data security of the function itself, and on the other hand, it can achieve security protection for the serverless platform, preventing malicious functions from escaping the container and destroying the computing environment of the serverless platform.

[0008] In a first aspect, the present application provides a function management method. The method can be applied to a function management platform. The function management platform is used to allocate containers corresponding to function functions to functions. Among them, the function management platform can be a software system, the software system can be an independent software system, or integrated into other software systems in the form of plug-ins, etc., the software system can be provided to users in the form of a software package, or provided to users through cloud services. The software system can be deployed in a computing device cluster, and the computing device cluster executes the program code of the software system, thereby executing the function management method of the present application. In some possible implementations, the function management platform can also be a hardware system, such as a computing device cluster with function management capabilities such as function scheduling. When the function management platform is running, the function management method of the present application can be executed.

[0009] Specifically, the function management platform can receive a function call trigger event triggered by a user for a target function. The function call trigger event includes a function identifier of the target function requested to be called. Then, the function management platform can obtain the function classification information of the target function based on the function identifier of the target function. The function classification information is used to indicate the behavior type of the target function. Then, based on the function classification information of the target function and the mapping relationship between the function function and the container type, the target container type that matches the function classification information of the target function is determined, and a container with the target container type is allocated to the target function from the container resource pool. The code package of the target function is loaded in the container to execute the system call behavior of the target function.

[0010] This method provides an isolation technology that matches differentiated containers (such as differentiated sandboxes) to functions on demand, classifies functions from a security perspective, and separates containers from a functional perspective. Code packages of functions of different security types can be loaded into containers of different types for operation. On the one hand, this can ensure the computing and data security of the function itself, and on the other hand, it can achieve security protection for the serverless platform, preventing malicious functions from escaping the container and destroying the computing environment of the serverless platform.

[0011] In some possible implementations, the function management platform may also receive functional classification information annotated by the user on the target function through the upload interface or registration interface. Alternatively, the function management platform may provide function annotation capabilities. Specifically, the function management platform may perform static and / or dynamic analysis on the target function's code package or the image corresponding to the code package to obtain the functional classification information of the target function.

[0012] This approach provides multiple ways to categorize functions, laying the foundation for matching functions with differentiated containers on demand. Furthermore, by offering manual labeling or automatic labeling based on dynamic and static analysis, this approach can meet the needs of different businesses.

[0013] In some possible implementations, the function management platform can analyze the capabilities and / or security policies required for the system call behavior of the target function based on the code package of the target function or the image corresponding to the code package, and then the function management platform can obtain the functional classification information of the target function based on the capabilities and / or security policies required for the system call behavior of the target function.

[0014] By analyzing the capabilities and / or security policies required by the system call behavior of the target function, this method can classify functions from a security perspective, so as to schedule functions of different security types to containers of different container types for execution.

[0015] In some possible implementations, the function management platform can construct containers of different types based on differentiated capabilities or security policies. This meets the need for on-demand matching of differentiated containers. By matching functions to customized differentiated containers, the computing and data security of the functions themselves can be guaranteed, while also ensuring the security of the serverless platform, preventing malicious functions from escaping the container and disrupting the serverless platform's computing environment.

[0016] In some possible implementations, the container type of the container in the container resource pool includes one or more of a computing container class, a network interaction container class, a mounted file system container class, or a common container class.

[0017] Computing container classes can include pure computing container classes, which provide only pure computing capabilities and lack any input / output (IO) capabilities, including disk read / write and network IO. All function computations occur exclusively within the container and do not interact with the outside world. Computing container classes provide high-intensity isolation of the runtime environment, ensuring the security of function computations. Network interaction container classes allow network interaction and restrict other system call behaviors, minimizing permissions when functions with network interaction are satisfied. Mounting file system container classes are similar to network interaction container classes, allowing file system mounting and restricting other system calls to minimize permissions and, in turn, minimize risks. Ordinary container classes are containers without any constraints and typically use the default security policy.

[0018] This method can achieve container differentiation and meet the needs of different functions by providing the above-mentioned multiple types of containers.

[0019] In some possible implementations, the function management platform can formulate differentiated security policies as the basis for container classification, and then enable the corresponding security policies for each type of container resource through the container security policy universal enablement mechanism, thereby obtaining containers of different container types. Among them, the security policy can be a seccomp policy. Differentiated security policies can include control over different permissions, thereby implementing differentiated seccomp policies. In some examples, differentiated seccomp policies can include the following four policies:

[0020] Strategy 1: Remove read, write, socket, and mount from the allowed system calls to restrict the above access;

[0021] Strategy 2: Include sockets in the allowed system calls, but restrict other system calls;

[0022] Strategy 3: Include mount among the allowed system calls, but restrict other system calls;

[0023] Policy 4: Default seccomp policy.

[0024] This allows for customized, differentiated containers based on business needs, with higher availability.

[0025] In some possible implementations, the function management platform may also configure container classification information for containers of different container types, and then construct a mapping relationship between function functions and container types based on the function classification information of at least one function and the container classification information of the container corresponding to at least one function.

[0026] Among them, the function management platform builds a mapping relationship between function functions and container types through function function classification information and container classification information, laying the foundation for on-demand matching of differentiated containers.

[0027] In some possible implementations, the function management platform can also receive function call trigger events configured by the user for a target function and publish the target function. This allows for awareness of function calls and, based on the function call trigger events, execution of the corresponding function calls to meet business needs.

[0028] In a second aspect, the present application provides a function management platform. The function management platform is used to allocate containers corresponding to the function functions to the functions, and the function management platform includes:

[0029] An interaction module, configured to receive a function call triggering event for a target function triggered by a user, wherein the function call triggering event includes a function identifier of the target function requested to be called;

[0030] an acquisition module, configured to acquire function classification information of the objective function according to a function identifier of the objective function, wherein the function classification information is used to indicate a behavior type of the objective function;

[0031] a matching module, configured to determine a target container type that matches the function classification information of the function according to the function classification information of the target function and a mapping relationship between function functions and container types;

[0032] A scheduling module, configured to allocate a container of the target container type to the target function from a container resource pool;

[0033] A loading module is used to load the code package of the target function in the container to execute the system call behavior of the target function.

[0034] In some possible implementations, the function management platform further includes a function classification module, which is specifically configured to:

[0035] receiving function classification information marked by the user on the target function through an upload interface or a registration interface; or

[0036] Static analysis and / or dynamic analysis is performed on the code package of the target function or the image corresponding to the code package to obtain functional classification information of the target function.

[0037] In some possible implementations, the acquisition module is specifically configured to:

[0038] Analyzing the capabilities and / or security policies required for the system call behavior of the target function based on the code package of the target function or the image corresponding to the code package;

[0039] Function classification information of the target function is obtained according to the capability and / or security policy required by the system call behavior of the target function.

[0040] In some possible implementations, the container management platform further includes:

[0041] The construction module is used to construct containers of different container types based on differentiated capabilities or security policies.

[0042] In some possible implementations, the container type of the container in the container resource pool includes one or more of a computing container class, a network interaction container class, a mounted file system container class, or a common container class.

[0043] In some possible implementations, the function management platform further includes:

[0044] A container configuration module, configured to configure container classification information for containers of different container types;

[0045] The mapping management module is used to construct a mapping relationship between the function function and the container type according to the function classification information of at least one function and the container classification information of the container corresponding to the at least one function.

[0046] In some possible implementations, the function management platform further includes:

[0047] A publishing module is used to receive the function call trigger event configured by the user and publish the function.

[0048] In a third aspect, the present application provides a computing device cluster. The computing device cluster includes at least one computing device, each of which includes at least one processor and at least one memory. The at least one processor and the at least one memory communicate with each other. The at least one processor is configured to execute instructions stored in the at least one memory, causing the computing device or computing device cluster to perform the function management method described in the first aspect or any implementation of the first aspect.

[0049] In a fourth aspect, the present application provides a computer-readable storage medium storing instructions, wherein the instructions instruct a computing device or a computing device cluster to execute the function management method described in the first aspect or any implementation of the first aspect.

[0050] In a fifth aspect, the present application provides a computer program product comprising instructions, which, when executed on a computing device or a computing device cluster, enables the computing device or computing device cluster to execute the function management method described in the first aspect or any one of the implementations of the first aspect.

[0051] Based on the implementation methods provided in the above aspects, this application can also be further combined to provide more implementation methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the technical methods of the embodiments of the present application, the following briefly introduces the drawings required for use in the embodiments.

[0053] FIG1 is a schematic diagram of the system architecture of a function management platform provided by this application;

[0054] FIG2 is a flow chart of a function management method provided by the present application;

[0055] FIG3 is a schematic diagram of an application scenario of a function management method provided by this application;

[0056] FIG4 is a flowchart of a function classification label matching container based on functions and traditional function scheduling provided by the present application;

[0057] FIG5 is a schematic diagram of the structure of a function management platform provided by the present application;

[0058] FIG6 is a schematic diagram of the structure of a computing device provided by the present application;

[0059] FIG7 is a schematic diagram of the structure of a computing device cluster provided by the present application;

[0060] FIG8 is a schematic diagram of the structure of another computing device cluster provided by the present application;

[0061] FIG9 is a schematic diagram of the structure of another computing device cluster provided in this application. DETAILED DESCRIPTION

[0062] The terms "first" and "second" in the embodiments of this application are used for descriptive purposes only and should not be understood to indicate or imply relative importance or implicitly specify the number of technical features indicated. Therefore, features specified as "first" or "second" may explicitly or implicitly include one or more of the features.

[0063] First, some technical terms involved in the embodiments of this application are introduced.

[0064] Cloud computing refers to on-demand access to computing resources via the Internet, including but not limited to applications, servers (physical and virtual), data storage, development tools, network functions, etc. These resources are hosted in remote data centers managed by cloud service providers.

[0065] Serverless computing, also known as serverless computing, is an architecture that directly provides computing services. In a serverless architecture, developers simply write and upload their code, and the cloud platform (such as a serverless platform) automatically prepares the corresponding computing resources, completes the calculations, and outputs the results, significantly simplifying the development and operations process.

[0066] From a hierarchical perspective, serverless adds a function layer to the application layer of the traditional Software as a Service (SaaS) architecture. This function layer provides finer granularity and can more flexibly meet user computing power needs. Therefore, the serverless architecture can be viewed as a design that uses Function as a Service (FaaS) and Backend as a Service (BaaS) to solve problems. Function as a Service is a function that runs as a service, can be written in any language, hosted directly on the cloud platform, and triggered by events. Backend services are integrated backend components provided by the cloud platform. Developers do not need to develop and maintain backend services. Instead, they can access capabilities such as data storage, message push, and account management by calling application programming interfaces (APIs) or software development kits (SDKs).

[0067] Function execution can be performed by the serverless platform, which freely allocates containers from pooled resources to perform specific function calculations and returns the results after the function is executed. However, during execution, malicious functions can easily escape the container and infiltrate other tenants' containers or the serverless platform, causing significant damage to the platform's functionality. Operating system (OS) kernel vulnerabilities are particularly vulnerable to container escape. For example, the kernel vulnerability identified as CVE-2023-1892, disclosed in the Common Vulnerabilities and Exposures (CVE) database, affects all OS versions. Containers on serverless platforms are particularly vulnerable to this vulnerability, potentially allowing container escape. Because tenant-side containers on serverless platforms cannot determine the function being executed within a container, universal container security hardening cannot be implemented. Furthermore, tenants are concerned about the security of their own function execution, such as whether data could be stolen by other tenants during execution.

[0068] Currently, for containers on the management side, the serverless platform can use container security hardening specifications to troubleshoot container security issues and perform container security hardening according to recommended practices. Specifically, to address public container vulnerabilities, you can adapt to a secure and reliable system kernel and keep security patches updated, as well as use the latest Docker and keep security patches updated. To address Docker Deamon configuration issues, you can restrict network communication between containers. To address Docker Container configuration issues, you can restrict container privileges, such as restricting containers from mounting external file systems, restricting containers from binding to insecure ports, and restricting containers to using seccomp files. To address Kubernetes issues, ETCD enables authentication and Hypertext Transfer Protocol Secure (https), the API Server enables https access, and Kubelet performs access restrictions and isolation.

[0069] In the aforementioned security hardening solutions, aside from patches for public vulnerabilities, all other security hardening measures are targeted at specific applications. Because function execution typically involves the serverless platform freely allocating containers from pooled resources to perform specific function calculations and return the results, the serverless platform cannot precisely implement security hardening based on the business, and currently does not provide universal platform capabilities to prevent tenant-side container escapes. Using a similar solution to the management-side container security hardening approach could affect the operating environments of different functions, leading to function execution failures and, consequently, impacting tenant-side business functionality.

[0070] In view of this, the present application provides a function management method. The method can be applied to a function management platform. The function management platform is used to allocate containers corresponding to function functions to functions. The function management platform can be a software system, which can be an independent software system, or integrated into other software systems in the form of plug-ins, etc. The software system can be provided to users in the form of a software package, or provided to users through cloud services (such as applications or microservices of a cloud platform). The software system can be deployed in a computing device cluster, and the computing device cluster executes the program code of the software system, thereby executing the function management method of the present application. In some possible implementations, the function management platform can also be a hardware system, such as a computing device cluster with function management capabilities such as function scheduling. When the function management platform is running, the function management method of the present application can be executed.

[0071] Specifically, the function management platform can receive a function call trigger event triggered by a user for a target function. The function call trigger event may include the function identifier of the target function requested to be called. Then, the function management platform can obtain the functional classification information of the target function based on the function identifier of the target function. Then, the function management platform determines the target container type that matches the functional classification information of the target function based on the functional classification information of the function and the mapping relationship between the function function and the container type, allocates a container with the target container type to the target function from the container resource pool, and loads the code package of the target function in the container to execute the system call behavior of the above-mentioned target function.

[0072] This method provides an isolation technology that matches differentiated containers (such as differentiated sandboxes) to functions on demand, classifies functions from a security perspective, and separates containers from a functional perspective. Code packages of functions of different security types can be loaded into containers of different types for operation. On the one hand, this can ensure the computing and data security of the function itself, and on the other hand, it can achieve security protection for the serverless platform, preventing malicious functions from escaping the container and destroying the computing environment of the serverless platform.

[0073] In order to make the technical solution of this application clearer and easier to understand, the system architecture of the function management platform is introduced below with reference to the accompanying drawings.

[0074] Referring to Figure 1, a system architecture diagram of a function management platform, function management platform 100 is a tool that provides function management capabilities, including but not limited to function registration, publishing, scheduling, and execution. For example, function management platform 100 can be a function graph (FG) service or tool.

[0075] Specifically, the function management platform 100 includes a function registration and release management subsystem 102 and a function operation management subsystem 104. The function registration and release management subsystem 102 is used to receive the code package of the function uploaded by the user, and perform the registration and release of the function. Among them, the function registration and release management subsystem 102 is also used to obtain the functional classification information of the function. Among them, the functional classification information of the function is used to indicate the behavior type of the function. The functional classification information of the function can be represented by a label, such as a functional classification label. For example, the functional classification label of the function can be calculation, indicating that the function is a calculation type function (such as a pure calculation type function). For another example, the functional classification label of the function can be network interaction, indicating that the function is a function with network interaction.

[0076] The function management platform 100 can obtain the functional classification information of a function in a variety of ways. The following provides examples of different ways.

[0077] In some possible implementations, the function registration and release management subsystem 102 is used to receive the function classification information of the function marked by the user through the upload interface or the registration interface. As shown in Figure 1, the function registration and release management subsystem 102 can receive the function compression package (for example, a function zip package) uploaded by the user, and the function zip package can include a function list file (for example, function Fx 1...Fx N) and the function classification information of the function. Among them, the function list file includes the code package of the function, and the code package of the function can be saved in the function code warehouse, for example, the function repo. As shown in Figure 1, the code package of the function can be saved in the function code warehouse through the data storage subsystem 103.

[0078] In other possible implementations, the function registration and release management subsystem 102 can also provide type annotation capabilities for tenant functions, eliminating the need for users to upload function classification information. Specifically, the function registration and release management subsystem 102 is configured to perform static and / or dynamic analysis on the function's code package or the image corresponding to the code package to obtain the function's function classification information.

[0079] The function execution management subsystem 104 is used to allocate a container corresponding to the function function to the function, thereby realizing the container scheduling of the function. Specifically, the function execution management subsystem 104 is used to receive a function call trigger event triggered by a user for a target function, wherein the function call trigger event includes a function identifier of the target function requested to be called, and then obtain the function classification information of the target function according to the function identifier of the target function, for example, according to the function identifier of the target function, obtain the function classification information of the target function from the function classification information of at least one function stored in the data storage subsystem 103. Next, the function execution management subsystem 104 is used to determine the target container type that matches the function classification information of the target function according to the function classification information of the target function and the mapping relationship between the function function and the container type, allocate a container of the target container type to the target function from the container resource pool, and load the code package of the target function in the container to execute the system call behavior of the target function.

[0080] The function management platform 100 also includes a container resource pooling and management subsystem 106, which provides the ability to customize container classification based on capacity or security policy. The function execution management subsystem 104 provides the ability to schedule containers based on function classification information.

[0081] As shown in Figure 1, the container resource pooling and management subsystem 106 is used to construct different types of containers based on capabilities and security policies. The security policy may be a secure computing (Seccomp) policy. Container types may include computing containers, network interaction containers, file system mount containers, or general containers.

[0082] A computing container class, such as a pure computing container class, means that the container only provides pure computing capabilities and has no input and output (IO) capabilities, including disk reading and writing and network IO. That is, all function computing occurs only within the container and does not interact with the outside world. The computing container class provides a high-intensity operating environment isolation capability, ensuring the security of function computing, that is, data cannot be stolen, and also ensuring that the serverless platform will not be destroyed by malicious functions to achieve container escape. For this type of container, the container resource pooling and management subsystem 106 can remove read, write, socket, and mount from the default seccomp allowed process to perform corresponding system call behavior (SCMP_ACT_ALLOW), thereby obtaining a pure computing container class.

[0083] The network interaction container class is assigned to functions that require network interaction, minimizing risk. For this type of container, the container resource pooling and management subsystem 106 includes the socket in the seccomp system call behavior (SCMP_ACT_ALLOW) that allows processes to make the corresponding calls. It should be noted that the container resource pooling and management subsystem 106 can restrict other system calls. This allows the network interaction container class to be obtained. Furthermore, privilege minimization is achieved for functions that require network interaction.

[0084] The mountable file system container class supports mounting file systems. Allocating this container class to the small number of functions that require file system mounting can also minimize risk. For this type of container, the container resource pooling and management subsystem 106 includes "mount" in the default seccomp system call behavior (SCMP_ACT_ALLOW) that allows processes to make the corresponding calls. Similar to the network interaction container class, the container resource pooling and management subsystem 106 can restrict other system calls to obtain the mountable file system container class.

[0085] Common containers are containers without any constraints. Compared to other container classes, common containers offer the weakest security isolation. For these containers, the default seccomp security policy is typically used.

[0086] It should be noted that the above container classes are merely examples of container types in the container resource pool. Other possible implementations of the present application may include more container classes. For example, for a function that requires both network interaction and file system mounting, a container class can be constructed that supports both network interaction and file system mounting, but restricts other system calls.

[0087] In the example of Figure 1, the function registration and release management subsystem 102 is an optional subsystem of the function management platform 100, and the function management platform 100 may also not include the above-mentioned function registration and release management subsystem 102. For example, when triggering a function call, the user may also carry the function's functional classification information or specify the container type corresponding to the function. Accordingly, the function execution management subsystem 104 can directly obtain the function's functional classification information and then determine the container type corresponding to the function's functional classification information, or the function execution management subsystem 104 can directly obtain the container type, thereby realizing container scheduling. Similarly, the function management platform 100 may also not include the above-mentioned data storage subsystem 103 and container resource pooling and management subsystem 106.

[0088] Based on the function management platform 100 shown in Figure 1, the present application further provides a function management method. The function management method of the present application is introduced below in conjunction with an embodiment.

[0089] Referring to the flowchart of a function management method shown in FIG2 , the method includes the following steps:

[0090] S201: The function management platform 100 receives a function call trigger event for a target function triggered by a user.

[0091] A function call trigger event refers to an event that triggers a function call, and may also be referred to as a function call event. The function call trigger event may vary depending on the function being called. The function call trigger event may include the function identifier of the function being called. For example, a function call request for a target function may include the function identifier of the target function being called. The function identifier may include a function name, a function signature, or other unique identifier that can uniquely identify the function.

[0092] The function call trigger event may be an API-based function call trigger event or a graphical user interface (GUI)-based function call trigger event. For ease of description, a GUI-based function call trigger event is used as an example. The GUI may carry at least one control, such as control A and control B. The function of control A may be to trigger a query, and the function of control B may be to trigger encryption. Control A may be bound to a function trigger call event for a query function, and control B may be bound to a function trigger call event for an encryption function. When a user clicks control A, the function management platform 100 may receive a function trigger call event for the query function. When a user clicks control B, the function management platform 100 may receive a function trigger call event for the encryption function.

[0093] This function call trigger event can be preconfigured, for example, during the function registration phase. Specifically, the function management platform 100 can receive the user-configured function call trigger event and publish the function. In this way, during the subsequent container scheduling process, the function management platform 100 can detect the function call trigger event for the target function and, upon detecting the function call trigger event for the target function, trigger a scheduling mechanism that matches the function with a container based on the function's functional classification information.

[0094] S202: The function management platform 100 obtains functional classification information of the target function according to the function identifier of the target function.

[0095] Functions can be the decomposition units of an application. Functions are typically written in a programming language and hosted on a cloud platform, running as services. Function calls can be triggered by events. Events that trigger function calls are also called function call trigger events. Function classification information refers to information categorized by function, such as function classification tags, function category tags, or function tags.

[0096] For registered functions, the function management platform 100 can store the metadata of the function. The metadata of the function can include the function classification information of the function. The function classification information can be stored in the form of key-value (KV) pairs, for example, the key can be the function identifier, and the value can be the function classification information of the function. Furthermore, the value can also include other metadata of the function, which is not limited in this embodiment. Accordingly, the function management platform 100 can perform a metadata query based on the function identifier of the target function to obtain the function classification information of the target function.

[0097] In some possible implementations, the function management platform 100 may also obtain the functional classification information of the target function in real time. The method by which the function management platform 100 obtains the functional classification information of the target function in real time is similar to the method by which the functional classification information of the target function is obtained during the registration phase. The following example illustrates the function management platform 100 obtaining the functional classification information of the target function during the registration phase.

[0098] During the registration phase, the function management platform 100 can obtain the functional classification information of the target function through various implementation methods, which are described below.

[0099] In some possible implementations, the function management platform 100 can receive the functional classification information that the user has marked on the target function through the upload interface or the registration interface. For example, the function management platform 100 can receive a compressed package of the target function, which can be in zip format. Based on this, the compressed package of the target function can be a function zip package, which includes the code package of the target function and the functional classification information of the target function. The functional classification information can be pre-marked. For another example, the function management platform 100 can also support users to mark the functional classification information of the target function in real time. Specifically, the function management platform 100 can configure a marking control on the upload interface or the registration interface. When the user triggers the upload operation on the upload interface, or when the user triggers the registration operation on the registration interface, the user can also mark the functional classification information of the target function through the marking control.

[0100] In some other possible implementations, the function management platform 100 provides the ability to annotate function functions. Specifically, the function management platform 100 can perform static analysis and / or dynamic analysis on the code package of the target function or the image corresponding to the code package to obtain the functional classification information of the target function. Among them, static analysis is also called static program analysis, static code analysis, and program static analysis. It is a method of performing program analysis without running the program. Static analysis can usually be performed by analyzing the code (such as source code) from dimensions such as lexical, grammatical, and semantic. Dynamic analysis, also known as dynamic program analysis or program dynamic analysis, is a method of tracking the behavior of the program when the program is running, thereby realizing the analysis of the program. In this example, static analysis and dynamic analysis are mainly performed by inferring the behavior of the function from dimensions such as lexical, grammatical or semantic, or directly tracking the behavior of the function when the function is running, to determine the function of the target function and obtain the functional classification information of the target function.

[0101] Specifically, the function management platform 100 can analyze the capabilities and / or security policies required for the system call behavior of the target function based on the code package of the target function or the image corresponding to the code package, and then obtain the functional classification information of the target function based on the capabilities and / or security policies required for the system call behavior of the target function. Analyzing the capabilities or security policies required for the system call behavior of the target function based on the code package of the target function or the image corresponding to the code package can be achieved by adopting static analysis or dynamic analysis. Taking static analysis as an example, the function management platform 100 can preset a static analysis algorithm, analyze the capabilities and / or security policies required for the system call behavior of the function through the static analysis algorithm, and obtain the functional classification information of the target function based on the static analysis results.

[0102] Considering that the target function may be called separately by different users, or multiple times by the same user, the function management platform 100 can store the target function's functional classification information. For example, the function management platform 100 can store the target function's functional classification label. This allows the target function to be directly retrieved based on the functional classification label stored during the registration phase when the target function needs to be called, without requiring real-time annotation by the user or real-time analysis by the function management platform 100.

[0103] In the present application, the functional classification information of a function is mainly used to match a suitable container for the function for isolation. To this end, the function management platform 100 can obtain the functional classification information of the function when it senses a function call trigger event (or a function run trigger event). Specifically, the function management platform 100 can detect a function call trigger event. The function call trigger event includes a function identifier of the function requested to be called, such as a function name. When a function call trigger event is detected, the function management platform 100 can obtain the functional classification information of the function in response to the function call trigger event.

[0104] S204 : The function management platform 100 determines a target container type that matches the function classification information of the target function according to the function classification information of the target function and the mapping relationship between function functions and container types.

[0105] For containers of different container types (differentiated containers), the function management platform 100 can configure container classification information. Specifically, the function management platform 100 can define container classification information based on container type. Similar to the functional classification information of a function, the container classification information of a container can also be characterized by tags. Based on this, the container classification information can include container classification tags. In specific implementations, container classification tags can include, but are not limited to, computing container classes (such as pure computing container classes), network interaction container classes, mounted file system container classes, or general container classes.

[0106] Accordingly, the mapping relationship between function capabilities and container types can be expressed as a mapping relationship between a function's functional classification label and a container classification label. This mapping relationship can be represented by a mapping rule, a mapping model, or a mapping table. The mapping relationship between function capabilities and container types is used to match containers (resources) to functions using rules, models, or mapping tables.

[0107] Specifically, the function management platform 100 can query the mapping relationship between the function function and the container type based on the function classification information (such as the function classification label), for example, by querying a mapping table of the function function and the container type, to obtain a target container type that matches the function classification information. For example, when the function classification label of the function is calculation, the target container type that matches the function classification label of the function can be a calculation container class. For another example, when the function classification label of the function is network interaction, the target container type that matches the function classification label of the function can be a network interaction container class.

[0108] S206 : The function management platform 100 allocates a container of the target container type to the target function from the container resource pool.

[0109] The container resource pool includes containers of different container types. These containers can be constructed by the function management platform 100 based on differentiated capabilities or security policies. In some possible implementations, the container types of the containers in the container resource pool include one or more of a computing container class, a network interaction container class, a mounted file system container class, or a common container class. Each container type can correspond to one or more container classification tags.

[0110] Accordingly, the function management platform 100 can determine from the container resource pool a container whose container classification label corresponds to the target container type, and assign a container of the target container type to the target function. The function management platform 100 can randomly select a container whose container classification label corresponds to the target container type and assign that container to the target function, or the function management platform 100 can first determine a container whose container classification label corresponds to the target container type, then select a container through load balancing and assign that container to the target function.

[0111] S208 : The function management platform 100 loads the code package of the target function in the container to execute the system call behavior of the target function.

[0112] The function management platform 100 can obtain the target function's code package from the function code repository, and then load the target function's code package into a container to execute the target function's system call behavior. Depending on the target function's functional classification information, the system call behavior can be different. For example, if the target function's functional classification information is network interaction, the system call behavior can include socket; for another example, if the target function's functional classification information is mounting a file system, the system call behavior can include mount. This allows the target function to be run in a container that applies customized capabilities or security policies.

[0113] It should be noted that when the function management platform 100 loads the target function's code package into a container, it can load the code package or an image of the code package. Taking the example of loading a code package image, an operating environment can be configured for the container based on the image. Based on the configured operating environment, a process can be started in the container to execute the system call behavior of the target function.

[0114] Based on the above description, the function management method provided in this application classifies function functions and constructs containers that match the classification, have capabilities (capacity), and security policies to minimize permissions for different classifications. In the process of container resource pooling management and scheduling of container allocation to functions, the target function is assigned to a container that matches the functional classification information according to the functional classification information of the target function. This can achieve environmental security for function execution, especially environmental security for function execution on the tenant side, and prevent the function execution container on the tenant side of the serverless platform from escaping.

[0115] Next, the function management method of this application is introduced in detail in combination with a specific application scenario.

[0116] Referring to the flow chart of a function management method shown in Figure 3, the method can be executed by a function management platform 100, which includes a function registration and release management subsystem 102 and a function operation management subsystem 104. Furthermore, the function management platform 100 can also include a data storage subsystem 103 and a container resource pooling and management subsystem 106.

[0117] The function registration and release management subsystem 102 is used to register and annotate functions, and stores function data and metadata through the data storage subsystem 103. The function execution management subsystem 104 is used to implement function calls and container scheduling. The container resource pooling and management subsystem 106 is used to construct differentiated containers, thereby providing support for the function execution management subsystem 104.

[0118] The function registration and annotation scheme can include the following steps:

[0119] Step 1: The user uploads a function zip package. The function registration and release management subsystem 102 registers the function in response to the user's file upload operation and classifies the function based on the function classification label selected by the user.

[0120] Among them, when the function registration and release management subsystem 102 has the function labeling (or function classification) capability, it can also analyze the function zip package uploaded by the user, for example, performing dynamic and static analysis on the code of the function in the function zip package, so as to obtain the function classification label.

[0121] Step 2: The function registration and release management subsystem 102 manages the function and its metadata and completes storage.

[0122] Function metadata may include a function identifier and a function classification label (referred to as a classification label in FIG3 ). The function classification label is newly added metadata. Managing functions and their metadata may include persistently storing the functions and their metadata. For example, the function registration and release management subsystem 102 may store the function code and its metadata.

[0123] Step 3: The user configures the function call trigger event and triggers the operation of publishing the function.

[0124] Step 4: The function registration and release management subsystem 102 releases the function and stores the function release information.

[0125] The function release information may include at least one of release time, publisher, and release version number.

[0126] In this solution, function registration refers to registering a function so that users can call it. Function publishing refers to making the registered function public, for example, by making a calling interface public so that users can call the function by calling the interface.

[0127] The solution for function calling and container scheduling can include the following steps:

[0128] Step 1: The user triggers a function call to trigger an event.

[0129] The user who uploads the function zip package and the user who triggers the function call can be different users. This embodiment does not restrict the user who triggers function registration and function call.

[0130] Step 2: The function execution management subsystem 104 matches the function call trigger event to the function call request.

[0131] A function call triggering event may trigger one or more function calls, and accordingly, the function call triggering event may match one or more function call requests. Specifically, the function execution management subsystem 104 may match the function call triggering event to one or more function call requests through event request distribution.

[0132] Step 3: The function execution management subsystem 104 distributes the function call request.

[0133] The function call request is used to request the container to start distribution, and the function call request may carry function information, such as a function identifier of the function.

[0134] Step 4: The function execution management subsystem 104 queries the function classification label of the function, and obtains the container type that matches the function classification label of the function according to the mapping relationship between the function function and the container type.

[0135] In specific implementation, the function execution management subsystem 104 may obtain the container type that matches the function classification label of the function through container scheduling management.

[0136] Step 5: The function execution management subsystem 104 requests to schedule a container of a container type that matches the function classification label of the function.

[0137] Step 6: The function execution management subsystem 104 allocates a container of a specified type to the function from the container resource pool.

[0138] Step 7: The function execution management subsystem 104 completes the code download of the function, triggering the allocated container to complete the function loading and calling.

[0139] The differentiated container construction scheme is as follows:

[0140] 1. The container resource pooling and management subsystem 106 formulates differentiated security policies as a basis for container classification.

[0141] The security policy can be a seccomp policy. Differentiated security policies can include controlling different permissions, thereby implementing differentiated seccomp policies. As shown in Figure 3, differentiated seccomp policies can include the following four policies:

[0142] Strategy 1: Remove read, write, socket, and mount from the Seccomp1-SCMP_ACT_ALLOW syscalls to restrict these accesses.

[0143] Strategy 2: Include sockets in the syscalls of Seccomp2-SCMP_ACT_ALLOW, but restrict other system calls;

[0144] Strategy 3: Include mount in the syscalls set by Seccomp3-SCMP_ACT_ALLOW, but restrict other system calls.

[0145] Policy 4: Default seccomp policy.

[0146] 2. The container resource pooling and management subsystem 106 enables the corresponding seccomp policy for each type of container resource through the container seccomp policy universal enabling mechanism.

[0147] Specifically, the container resource pooling and management subsystem 106 enables the aforementioned differentiated security policies in different containers, resulting in different types of containers. As illustrated in Figure 3 , the container resource pooling and management subsystem 106 can enable the aforementioned differentiated security policies to produce four container types: Type 1, Type 2, Type 3, and Type 4.

[0148] Type 1 is a pure computing container class. Its Seccomp policy can be to exclude read, write, socket, and mount from the syscalls set in Seccomp1-SCMP_ACT_ALLOW, thereby restricting these accesses. Type 2 is a network interaction container class. Its Seccomp policy can include socket in the syscalls set in Seccomp2-SCMP_ACT_ALLOW, but restrict other system calls. Type 3 is a file system mounting container class. Its Seccomp policy can include mount in the syscalls set in Seccomp3-SCMP_ACT_ALLOW, but restrict other system calls. Type 4 is a general container class. Its Seccomp policy can use the default Seccomp policy.

[0149] It should be noted that Figure 3 illustrates the construction of four container types using four differentiated security policies. In other possible implementations of the present application, new container types can be constructed using other differentiated security policies. Alternatively, the aforementioned container types can be further subdivided or expanded. Furthermore, the present application also supports the construction of containers of different container types using differentiated capacities.

[0150] As shown in Figure 4, compared with traditional function management methods, this method provides an isolation technology that matches differentiated containers to functions on demand. Specifically, it classifies function functions and constructs matching Capabilities and Seccomp security policies for different classifications to minimize permissions. During the container resource pooling management and scheduling of function container allocation, functions are assigned to matching container resources based on function function classification labels.

[0151] For example, this solution assigns pure computing functions to pure computing containers, loads the function code in the pure computing container and runs it, and restricts the container from performing system calls such as read, write, socket, and mount. However, the traditional method does not perform the above-mentioned permission control on the function. In this way, the function management method of this application can protect the above-mentioned functions from attacks. Similarly, this solution assigns network interaction functions to network interaction containers, loads the function code in the network interaction container and runs it. The container runs network interaction during operation, but restricts disk reading and writing and file mounting, so as to prevent the container from being affected by certain vulnerabilities. It can be seen that this method achieves precise security reinforcement based on business by matching differentiated containers for functions on demand, provides a universal platform capability to prevent tenant-side container escape, and can effectively prevent function execution container escape.

[0152] Furthermore, the solution provides a method for functional classification of functions, specifically through empirical data or dynamic and static analysis methods for the function's code package or image. This method can classify the Capability and Seccomp security policies required for the function's system call behavior, and preset the classification rules to the function management platform 100. When users upload / register functions, users can select functional classifications for their functions, or the function management platform 100 can perform dynamic and static analysis on the function's code package (such as the source code in the code package) or image to obtain the Capability and Seccomp security policies required for the function's system call behavior, and match a functional classification for the function based on the Capability and Seccomp security policies. After determining the function classification, a functional classification label can be added to the function's metadata. Among them, by performing dynamic and static analysis on the function's code to obtain a functional classification label, and matching the container based on the functional classification label, the function can be automatically deployed.

[0153] This solution also provides methods for constructing different types of containers using Capabilities and Seccomp security policies. Furthermore, it supports defining container classification labels for each constructed container, and maintains a mapping between function classification labels and container classification labels. This mapping is used to match container resources to functions.

[0154] Based on the aforementioned function management method, the present application further provides a function management platform 100. The function management platform 100 is introduced below from the perspective of functional modularization.

[0155] 5 shows a schematic diagram of a function management platform. The function management platform 100 is used to allocate containers corresponding to the function functions to the functions. The function management platform 100 may include:

[0156] Interaction module 502, configured to receive a function call triggering event for a target function triggered by a user, wherein the function call triggering event includes a function identifier of the target function requested to be called;

[0157] An acquisition module 504 is configured to acquire function classification information of the target function according to the function identifier of the target function, wherein the function classification information is used to indicate a behavior type of the target function;

[0158] A matching module 506 is configured to determine a target container type that matches the function classification information of the function according to the function classification information of the target function and a mapping relationship between function functions and container types;

[0159] A scheduling module 508 is configured to allocate a container of the target container type to the target function from a container resource pool;

[0160] The loading module 510 is used to load the code package of the target function in the container to execute the system call behavior of the target function.

[0161] The interaction module 502, the acquisition module 504, the matching module 506, the scheduling module 508, and the loading module 510 may be functional modules in the function execution management subsystem 104 in FIG1 or FIG3. The interaction module 502, the acquisition module 504, the matching module 506, the scheduling module 508, and the loading module 510 may be implemented by hardware or by software.

[0162] When implemented via software, the interaction module 502, acquisition module 504, matching module 506, scheduling module 508, and loading module 510 can be applications running on a computing device, such as a computing engine. Applications can be provided in the form of virtualization services. Virtualization services can include virtual machine (VM) services, bare metal server (BMS) services, and container services. VM services can use virtualization technology to create a virtual machine resource pool on multiple physical hosts, providing users with VMs on demand. BMS services use virtualized BMS resource pools on multiple physical hosts, providing users with BMSs on demand. Container services use virtualized container resource pools on multiple physical hosts, providing users with containers on demand. A VM is a simulated virtual computer, or logically a single computer. BMS is a scalable, high-performance computing service with computing performance comparable to traditional physical machines and secure physical isolation. Containers are a kernel virtualization technology that provides lightweight virtualization to isolate user space, processes, and resources. It should be understood that the VM service, BMS service and container service in the above-mentioned virtualization services are only specific examples. In actual applications, virtualization services can also be other lightweight or heavyweight virtualization services, which are not specifically limited here.

[0163] When implemented through hardware, the interaction module 502, acquisition module 504, matching module 506, scheduling module 508, and loading module 510 may include at least one computing device, such as a server. Alternatively, the interaction module 502, acquisition module 504, matching module 506, scheduling module 508, and loading module 510 may be implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The PLD may be a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0164] In some possible implementations, the function management platform 100 further includes a function classification module 512. The function classification module 512 is specifically configured to:

[0165] receiving function classification information marked by the user on the target function through an upload interface or a registration interface; or

[0166] Static analysis and / or dynamic analysis is performed on the code package of the target function or the image corresponding to the code package to obtain functional classification information of the target function.

[0167] The function classification module 512 may be a function module in the function registration and release management subsystem 102. Similar to the interaction module 502, the acquisition module 504, the matching module 506, the scheduling module 508, and the loading module 510, the function classification module 512 may be implemented by hardware or software.

[0168] When implemented via software, the function classification module 512 can be an application running on a computing device, such as a computing engine. The application can be provided in the form of a virtualization service. Virtualization services can include VM services, BMS services, or container services. When implemented via hardware, the function classification module 512 can include at least one computing device, such as a server. Alternatively, the function classification module 512 can be a device implemented using an ASIC or a PLD.

[0169] It should be noted that the function execution management subsystem 104 can also support real-time acquisition of function classification information of the target function. Based on this, the function classification module 512 can be a module in the function execution management subsystem 104.

[0170] In some possible implementations, the obtaining module 504 is specifically configured to:

[0171] Analyzing the capabilities and / or security policies required for the system call behavior of the target function based on the code package of the target function or the image corresponding to the code package;

[0172] Function classification information of the target function is obtained according to the capability and / or security policy required by the system call behavior of the target function.

[0173] In some possible implementations, the container management platform 100 further includes:

[0174] The construction module 514 is configured to construct containers of different container types according to differentiated capabilities or security policies.

[0175] The construction module 514 may be a module in the container resource pooling and management subsystem 106. Similar to the interaction module 502, the acquisition module 504, the matching module 506, the scheduling module 508, the loading module 510, or the function classification module 512, the construction module 514 may be implemented by hardware or software.

[0176] When implemented via software, construction module 514 can be an application running on a computing device, such as a computing engine. The application can be provided as a virtualized service. Virtualized services can include VM services, BMS services, or container services. When implemented via hardware, construction module 514 can include at least one computing device, such as a server. Alternatively, construction module 514 can be a device implemented using an ASIC or a PLD.

[0177] In some possible implementations, the container type of the container in the container resource pool includes one or more of a computing container class, a network interaction container class, a mounted file system container class, or a common container class.

[0178] In some possible implementations, the function management platform 100 further includes:

[0179] A container configuration module 516 is configured to configure container classification information for containers of different container types;

[0180] The mapping management module 518 is configured to construct a mapping relationship between the function and the container type according to the function classification information of at least one function and the container classification information of the container corresponding to the at least one function.

[0181] The container configuration module 516 may be a module within the container resource pooling and management subsystem 106, and the mapping management module 518 may be a module within the function execution management subsystem 104. Similar to the aforementioned functional modules, the container configuration module 516 and the mapping management module 518 may be implemented via software or hardware.

[0182] When implemented via software, the container configuration module 516 and mapping management module 518 can be applications running on a computing device, such as a computing engine. Applications can be provided as virtualization services. Virtualization services can include VM services, BMS services, or container services. When implemented via hardware, the container configuration module 516 and mapping management module 518 can include at least one computing device, such as a server. Alternatively, the container configuration module 516 and mapping management module 518 can be devices implemented using an ASIC or a PLD.

[0183] In some possible implementations, the function management platform 100 further includes:

[0184] The publishing module 520 is configured to receive the function call triggering event configured by the user and publish the function.

[0185] The publishing module 520 may be a module in the function registration and publishing management subsystem 102. Similar to the aforementioned functional modules, the publishing module 520 may be implemented by software or hardware.

[0186] When implemented via software, publishing module 520 can be an application running on a computing device, such as a computing engine. The application can be provided as a virtualized service. Virtualized services can include VM services, BMS services, or container services. When implemented via hardware, publishing module 520 can include at least one computing device, such as a server. Alternatively, publishing module 520 can be implemented using an ASIC or a PLD.

[0187] This application also provides a computing device 600. As shown in Figure 6, computing device 600 includes a bus 602, a processor 604, a memory 606, and a communication interface 608. Processor 604, memory 606, and communication interface 608 communicate with each other via bus 602. Computing device 600 can be a server or a terminal device. It should be understood that this application does not limit the number of processors and memories in computing device 600.

[0188] Bus 602 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, among others. Buses may be classified as address buses, data buses, control buses, and the like. For ease of illustration, FIG6 shows a single bus line, but this does not imply a single bus or type of bus. Bus 602 may include a path for transmitting information between various components of computing device 600 (e.g., memory 606, processor 604, and communication interface 608).

[0189] The processor 604 may include any one or more processors such as a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0190] The memory 606 may include volatile memory, such as random access memory (RAM). The memory 606 may also include non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD) or solid state drive (SSD). The memory 606 stores executable program code, and the processor 604 executes the executable program code to implement the aforementioned function management method. Specifically, the memory 606 stores instructions for the function management platform 100 to execute the function management method.

[0191] The communication interface 608 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computing device 600 and other devices or a communication network.

[0192] Embodiments of the present application also provide a computing device cluster. The computing device cluster includes at least one computing device. The computing device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be a terminal device such as a desktop computer, a laptop computer, or a smartphone.

[0193] As shown in Figure 7, the computing device cluster includes at least one computing device 600. The memory 606 of one or more computing devices 600 in the computing device cluster may store the same function management platform 100 for executing instructions of the function management method.

[0194] In some possible implementations, one or more computing devices 600 in the computing device cluster can also be used to execute some of the instructions of the function management platform 100 for executing the function management method. In other words, a combination of one or more computing devices 600 can jointly execute the instructions of the function management platform 100 for executing the function management method.

[0195] It should be noted that the memory 606 in different computing devices 600 in the computing device cluster can store different instructions for executing part of the functions of the function management platform 100.

[0196] Figure 8 illustrates a possible implementation. As shown in Figure 8, two computing devices 600A and 600B are connected via a communication interface 608. The memory in computing device 600A stores instructions for executing the functions of the interaction module 502 and the acquisition module 504. The memory in computing device 600B stores instructions for executing the functions of the matching module 506, the scheduling module 508, and the loading module 510. In other words, the memories 606 of computing devices 600A and 600B jointly store instructions for the function management platform 100 to execute the function management method. Specifically, the memories 606 of computing devices 600A and 600B jointly store instructions for the function execution management subsystem 104 of the function management platform 100 to execute the function management method. In some possible implementations, the memories 606 of computing devices 600A and 600B may also store instructions for executing the functions of the function classification module 512, the construction module 514, the container configuration module 516, the mapping management module 518, or the publishing module 520.

[0197] The connection method between the computing device clusters shown in Figure 8 can be based on the fact that the function management method provided by this application requires more computing power for function demand matching and function scheduling. Therefore, it is considered to hand over the functions implemented by the matching module 506, the scheduling module 508, and the loading module 510 to the computing device 600B for execution. For similar reasons, when the function management platform 100 also includes a function classification module 512, a construction module 514, a container configuration module 516, a mapping management module 518 or a release module 520, the construction module 514 and the container configuration module 516 can be deployed on the computing device 600B.

[0198] It should be understood that the functionality of the computing device 600A shown in FIG8 may also be implemented by multiple computing devices 600. Similarly, the functionality of the computing device 600B may also be implemented by multiple computing devices 600.

[0199] In some possible implementations, one or more computing devices in a computing device cluster may be connected via a network. The network may be a wide area network (WAN) or a local area network (LAN), among others. FIG. 9 illustrates a possible implementation. As shown in FIG. 9 , two computing devices 600C and 600D are connected via a network. Specifically, the network is connected via a communication interface in each computing device. In this type of possible implementation, the memory 606 in the computing device 600C stores instructions for executing the functions of the interaction module 502 and the acquisition module 504. Simultaneously, the memory 606 in the computing device 600D stores instructions for executing the functions of the matching module 506, the scheduling module 508, and the loading module 510.

[0200] The connection method between the computing device clusters shown in Figure 9 can be considered to consider that the function management method provided by this application requires a lot of computing power for function demand matching and function scheduling. Therefore, it is considered to delegate the functions implemented by the matching module 506, scheduling module 508, and loading module 510 to computing device 600D for execution. Similarly, the functions of the function classification module 512, mapping management module 518, or publishing module 520 can be delegated to computing device 600C for execution, and the functions of the construction module 514 and container configuration module 516 can be delegated to computing device 600D for execution.

[0201] 9 may also be implemented by multiple computing devices 600. Similarly, the functionality of computing device 600D may also be implemented by multiple computing devices 600.

[0202] The embodiment of the present application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that can be stored by a computing device or a data storage device such as a data center that contains one or more available media. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive). The computer-readable storage medium includes instructions that instruct the computing device to execute the above-mentioned function management method applied to the function management platform 100.

[0203] Embodiments of the present application also provide a computer program product including instructions. The computer program product may be software or a program product including instructions that can be run on a computing device or stored on any available medium. When the computer program product is run on at least one computing device, the at least one computing device executes the function management method described above.

[0204] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the protection scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A function management method, characterized in that: Applied to a function management platform, the function management platform is used to allocate a container corresponding to the function function to the function, the method includes: Receiving a function call trigger event for a target function triggered by a user, wherein the function call trigger event includes a function identifier of the target function requested to be called; Acquire function classification information of the objective function according to the function identifier of the objective function, wherein the function classification information is used to indicate a behavior type of the objective function; Determine a target container type that matches the function classification information of the target function according to the function classification information of the target function and a mapping relationship between function functions and container types; Allocate a container of the target container type to the target function from a container resource pool; A code package of the target function is loaded into the container to execute a system call behavior of the target function.

2. The method according to claim 1, characterized in that The method further comprises: receiving function classification information annotated by the user on the target function through an upload interface or a registration interface; or, Static analysis and / or dynamic analysis is performed according to the code package of the target function or the image corresponding to the code package to obtain function classification information of the target function.

3. The method according to claim 2, characterized in that The performing static analysis and / or dynamic analysis according to the code package of the target function or the image corresponding to the code package to obtain the function classification information of the function includes: Analyzing the capabilities and / or security policies required for the system call behavior of the target function according to the code package of the target function or the image corresponding to the code package; Functional classification information of the target function is obtained according to the capability and / or security policy required by the system call behavior of the target function.

4. The method according to any one of claims 1 to 3, characterized in that: The method further comprises: Construct containers of different container types based on differentiated capabilities or security policies.

5. The method according to any one of claims 1 to 4, characterized in that: The container type of the container in the container resource pool includes one or more of a computing container class, a network interaction container class, a mounted file system container class or a common container class.

6. The method according to claim 4 or 5, characterized in that: The method further comprises: For containers of the different container types, configure container classification information; A mapping relationship between the function function and the container type is constructed according to the function classification information of at least one function and the container classification information of the container corresponding to the at least one function.

7. The method according to any one of claims 1 to 6, characterized in that: The method further comprises: The function call trigger event configured by the user for the target function is received, and the target function is published.

8. A function management platform, characterized in that: The function management platform is used to allocate a container corresponding to the function function to the function, and the function management platform includes: An interaction module, configured to receive a function call trigger event for a target function triggered by a user, wherein the function call trigger event includes a function identifier of the target function requested to be called; An acquisition module, used for acquiring function classification information of the objective function according to the function identifier of the objective function, wherein the function classification information is used for indicating the behavior type of the objective function; A matching module, used to determine a target container type that matches the function classification information of the function according to the function classification information of the target function and a mapping relationship between function functions and container types; A scheduling module, configured to allocate a container of the target container type to the target function from a container resource pool; A loading module is used to load the code package of the target function in the container to execute the system call behavior of the target function.

9. The function management platform according to claim 8, characterized in that: The function management platform further includes a function classification module, which is specifically used for: receiving function classification information annotated by the user on the target function through an upload interface or a registration interface; or, Static analysis and / or dynamic analysis is performed according to the code package of the target function or the image corresponding to the code package to obtain function classification information of the target function.

10. The function management platform according to claim 9, characterized in that: The acquisition module is specifically used for: Analyzing the capabilities and / or security policies required for the system call behavior of the function according to the code package of the target function or the image corresponding to the code package; Functional classification information of the target function is obtained according to the capability and / or security policy required by the system call behavior of the target function.

11. The function management platform according to any one of claims 8 to 10, characterized in that: The container management platform also includes: The construction module is used to construct containers of different container types according to differentiated capabilities or security policies.

12. The function management platform according to any one of claims 8 to 11, characterized in that: The container type of the container in the container resource pool includes one or more of a computing container class, a network interaction container class, a mounted file system container class or a common container class.

13. The function management platform according to claim 11 or 12, characterized in that: The function management platform also includes: A container configuration module, used for configuring container classification information for containers of different container types; The mapping management module is used to construct a mapping relationship between the function function and the container type according to the function classification information of at least one function and the container classification information of the container corresponding to the at least one function.

14. The function management platform according to any one of claims 8 to 13, characterized in that: The function management platform also includes: A publishing module is used to receive the function call trigger event configured by the user and publish the function.

15. A computing device cluster, characterized in that: The computing device cluster includes at least one computing device, and the at least one computing device includes at least one processor and at least one memory, wherein the at least one memory stores computer-readable instructions; the at least one processor executes the computer-readable instructions so that the computing device cluster executes the function management method as described in any one of claims 1 to 7.

16. A computer-readable storage medium, characterized in that: Comprising computer-readable instructions; the computer-readable instructions are used to implement the function management method described in any one of claims 1 to 7.

17. A computer program product, characterized in that Comprising computer-readable instructions; the computer-readable instructions are used to implement the function management method described in any one of claims 1 to 7.

Images