Container Compute Platform Isolation via Access Roles
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data platforms face challenges in protecting the intellectual property of provider users while enabling the execution of their applications within a consumer's environment without compromising security and privacy.
Innovation Solution
A data platform utilizes exclusive compute pools isolated from other services, managed through specific access roles, and automates deployment and configuration using setup scripts and service specification files, ensuring secure execution and interaction with external networks while adhering to security protocols.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If provider applications are executed within consumer environment, then application execution capability is improved, but security and privacy protection deteriorates
Solution Approach 1:
The system segments the compute environment into isolated compute pools, where each pool is dedicated to executing specific provider applications. This segmentation creates boundaries that prevent unauthorized access between different application environments while allowing execution within the designated pools.
Solution Approach 2:
Access roles serve as intermediaries between provider applications and consumer data. These roles mediate the interaction by granting selective permissions, allowing applications to access only the specific data they need through controlled interfaces rather than direct access.
2Adaptability or versatility
If provider code is exposed to consumer, then application execution is enabled, but intellectual property protection deteriorates
Solution Approach 1:
The system implements local quality by providing consumer users with access roles that have specific, limited permissions tailored to their needs. Each access role is configured with precise access controls that allow execution of provider applications while restricting access to consumer data only to the extent necessary for the application's intended function.
3Object-affected harmful factors
If compute pools are isolated from other services, then security is improved, but device complexity increases
Solution Approach 1:
Access roles are designed as universal security mechanisms that can be applied across different compute pools and application types. Rather than creating custom isolation mechanisms for each scenario, the system uses these multi-functional access roles to provide consistent security isolation, reducing overall system complexity.
Data Source
AI summary
A data platform for executing containers is provided. In some examples, the data platform receives an application from an application package of a provider account, the application including a setup script and a manifest of a service. The data platform activates access roles based on the manifest and creates the service and a compute pool using the setup script and a specification file accessed from the application package using an access role. The service is executed in the compute pool, accessing objects of the application package and of the data platform using the access roles.