Agent Server Isolation for Secure Custom Module Execution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face security vulnerabilities and performance degradation due to the direct execution of custom modules on a backend server shared by multiple users, which can lead to malicious code affecting all clients and reduced performance for heavy operations.
Innovation Solution
A custom module executing method that involves a backend server transmitting custom module IDs and input values to an agent server for execution, where the agent server installs and executes the modules as needed, ensuring security and performance are isolated from the backend server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the backend server directly executes custom modules, then the system can process user requests, but security vulnerabilities arise as malicious code can affect all clients
Solution Approach 1:
The system segments the execution environment by introducing agent servers that act as isolated intermediaries between the backend server and custom modules. Each agent server runs in a separate process or container, creating security boundaries that prevent malicious code from affecting other clients or the core backend server.
Solution Approach 2:
Agent servers serve as intermediary components between the backend server and custom module execution. The backend server sends execution requests to agent servers, which then load and execute the custom modules in isolation. This intermediary layer protects the backend server from direct exposure to potentially harmful code while maintaining system functionality.
2Productivity
If the backend server executes heavy operations, then custom modules can be processed, but performance degradation occurs due to shared resources
Solution Approach 1:
The system divides the backend server's processing workload by delegating heavy operations to separate agent servers. Each agent server handles specific custom module executions independently, preventing resource contention and performance degradation on the main backend server. This segmentation allows parallel processing of multiple heavy operations.
Solution Approach 2:
The system transitions from a single-threaded backend server model to a multi-dimensional architecture where agent servers operate in parallel dimensions. Multiple agent servers can simultaneously execute heavy operations without interfering with each other or the backend server, effectively adding computational capacity in a new dimensional space.
3Adaptability or versatility
If the backend server shares resources among multiple users, then system utilization is improved, but security isolation is compromised
Solution Approach 1:
The system creates segmented execution environments through agent servers that maintain resource sharing while enforcing security isolation. Each agent server acts as an independent execution context that can serve multiple users but prevents cross-contamination between user sessions. This allows the system to maintain high adaptability for multi-user support while ensuring reliable security isolation.
Solution Approach 2:
Agent servers function as intermediary layers that enable multi-user resource sharing while maintaining security boundaries. The backend server manages resource allocation across multiple users through agent servers, which mediate between user requests and actual module execution. This intermediary structure preserves both the adaptability of resource sharing and the reliability of security isolation.
Data Source
AI summary
A custom module executing method according to the present disclosure includes: (a) receiving, by a backend server, from a client terminal, a custom module ID identifying a custom module, an agent server ID identifying an agent server on which the custom module is to be executed, and an input value required for executing the custom module; (b) transmitting, by the backend server, the custom module ID and the input value to an agent server identified by the agent server ID; and (c) executing, by the agent server, the custom module identified by the custom module ID by using the input value. According to the present disclosure, even if a malicious code exists in a custom module executed by one agent server, all client terminals using the backend server are not affected by the malicious code, thereby significantly improving security of a system.