Edge Cache Node Application Isolation via Nested Sandboxes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Content delivery networks face challenges in isolating applications at the edge, leading to interference between customer applications, unauthorized data access, and potential server downtime, as existing solutions like virtual machines fail to effectively isolate processing requests.
Innovation Solution
A cache node in a content delivery network identifies and manages requests for shared applications by determining customer permissions and initiating isolation instances using a reserved set of isolation resources, such as virtual machines or containers, to execute customer applications securely and independently.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If virtual machines are used to isolate customer applications, then application isolation between customers is improved, but request processing isolation within the same customer's application is not achieved
Solution Approach 1:
The patent segments the application execution environment into two levels: customer-level virtual machines for inter-application isolation, and request-level isolation instances (sandboxes) for intra-application request isolation. This multi-level segmentation resolves the contradiction by providing both customer application isolation and request processing isolation simultaneously.
Solution Approach 2:
The patent implements a nested isolation structure where isolation instances (sandboxes) are nested within virtual machines. Each virtual machine contains multiple isolation instances that handle individual requests, creating a nested isolation hierarchy that provides both customer-level and request-level isolation.
2Productivity
If applications are shared among multiple customers, then resource utilization is improved, but application interference and unauthorized data access increase
Solution Approach 1:
The patent segments the shared application execution into isolated request-handling sandboxes within virtual machines. Each sandbox is isolated from others, preventing application interference while allowing multiple customers to share the same application code, thus maintaining high resource utilization.
Solution Approach 2:
The isolation instance acts as an intermediary between the shared application code and individual request processing. It mediates the execution environment, allowing multiple customers to access the same application while preventing them from interfering with each other or accessing unauthorized data.
3Device complexity
If applications execute without effective isolation, then system simplicity is maintained, but cascading failures and server downtime increase
Solution Approach 1:
The patent segments the system into isolated virtual machines and isolation instances, containing potential failures within specific sandboxes. This segmentation prevents cascading failures from propagating across the entire system, improving reliability while maintaining manageable complexity through standardized isolation templates.
Solution Approach 2:
The isolation instances are designed as pre-configured sandboxes that contain failure containment mechanisms before execution begins. This beforehand cushioning ensures that even if an application crashes or misbehaves, the isolation mechanism prevents system-wide failures, thereby improving stability.
4Speed
If customer applications run at the edge, then processing speed and customization are improved, but security risks and data access control become more difficult to manage
Solution Approach 1:
The isolation instance serves as a security intermediary between the customer's application code and the host system. It mediates all data access and system calls, enabling fast edge processing while providing granular control and detection of data access attempts, thus resolving the contradiction between speed and security monitoring.
Solution Approach 2:
The isolation mechanism incorporates feedback loops that monitor and detect data access patterns, allowing the system to track and control what data applications can access. This feedback mechanism enables real-time security monitoring without slowing down the high-speed edge processing.
Data Source
AI summary
Disclosed herein are enhancements for deploying applications in an edge system of a communication network. In one implementation, a cache node in a content delivery network identifies a request for an application that is shared by a plurality of customers. In response to the request, the cache node determines whether the customer associated with the request is permitted to execute the application and, if permitted, initiates the application as an isolation instance. The cache node further, in response to completing the application, returns control to a source operation associated with the request.