CDN Service Processing Using Restricted Namespace Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The impact of third-party service codes issued by CDN users on the safety and performance of CDN nodes is significant due to unauthorized actions during the node server process, which is not addressed by existing methods.
Innovation Solution
Implementing a service processing method that runs customized service logic in a restricted namespace on CDN nodes, isolating it from system files and key interfaces, thereby limiting its authority and reducing resource usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If third-party service codes are directly loaded to CDN node server process, then service flexibility and customization are improved, but safety and stability of CDN node deteriorate
Solution Approach 1:
The patent divides the service execution environment into separate processes: a server process that manages CDN nodes and a worker process that executes third-party service codes. This segmentation isolates the untrusted third-party codes from the core CDN node server process, preventing them from causing harm to the system while still allowing flexible service customization through the worker process interface.
Solution Approach 2:
The patent introduces a worker process as an intermediary between the third-party service codes and the CDN node server process. This intermediary layer receives service codes from users, executes them in an isolated environment, and handles their output through controlled interfaces, thereby enabling service flexibility while protecting the core system from direct exposure to untrusted code.
2Adaptability or versatility
If third-party service codes are directly loaded to CDN node server process, then service customization is improved, but resource consumption and CPU efficiency deteriorate
Solution Approach 1:
By segmenting the execution into separate server and worker processes, the system can more efficiently manage resources. The worker process is specifically designed to execute third-party codes with limited resource access, while the server process maintains control over core CDN resources. This segmentation prevents third-party codes from consuming excessive system resources and improves overall CPU efficiency by isolating their execution context.
3Adaptability or versatility
If service codes are executed with full system access, then service functionality is improved, but system security and stability deteriorate
Solution Approach 1:
The patent applies local quality by providing different access levels to different parts of the system. The worker process has full functionality to execute third-party service codes, but only limited access to system resources such as network sockets, file systems, and other processes. This localized access control enables necessary service functionality while preventing unauthorized actions that could harm system security and stability.
Data Source
Figure 1
Figure 2~3
Figure 4~5
AI summary
The embodiments of the present disclosure relate to the technical field of content delivery network, and disclose a service processing method. The service processing method includes: receiving a customized service logic issued by a CDN user, receiving a user request corresponding to the customized service logic, forwarding the customized service logic and the user request to an execution process of a restricted namespace, where restricted content of the restricted namespace includes accessing to CDN system files, calling of key system interfaces, and system resources that can be used, and processing and responding to the user request in the execution process according to the customized service logic.