Edge Server Event-Triggered Computation with Process Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current content delivery networks (CDNs) lack the ability to execute customer-specific functions at edge servers in a secure and customizable manner, limiting their capacity to provide tailored content delivery and management of metadata in distributed systems.
Innovation Solution
Implementing customizable event-triggered computation at edge servers, where customer-specified functions can be executed in a secure environment, using process isolation and a replicated read-only data store to generate and deliver content, allowing for modifications to content requests, responses, and error handling.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If customer-specific functions are executed at edge servers, then content delivery customization is improved, but system security and stability may deteriorate due to uncontrolled code execution
Solution Approach 1:
The system segments function execution into isolated containers, each running customer-specific functions independently. This containment prevents malicious code in one function from affecting other functions or the core system, thus enabling customization while maintaining stability through isolation.
Solution Approach 2:
A sandbox environment acts as an intermediary between customer functions and the core system. The sandbox provides a controlled execution space that allows custom functions to run with limited privileges, preventing direct access to critical system resources while still enabling the desired customization capabilities.
2Adaptability or versatility
If multiple functions are executed at edge servers, then service functionality is improved, but device complexity increases due to managing multiple execution environments
Solution Approach 1:
The containerization framework provides a universal execution platform that can host multiple different customer functions simultaneously. The same container management infrastructure handles diverse function types (content transformation, routing, security), eliminating the need for separate management systems for each function type.
Solution Approach 2:
Each customer function is packaged as an independent container image that can be replicated and deployed consistently across multiple edge servers. This copying approach simplifies management by using identical deployment procedures and infrastructure across all functions, reducing operational complexity despite serving multiple purposes.
3Productivity
If edge servers execute customer functions, then content delivery performance is improved, but harmful factors increase due to potential security vulnerabilities in user code
Solution Approach 1:
The system implements security measures before function execution begins by validating and scanning customer-provided code for malicious content. This preemptive security checking prevents harmful code from entering the execution environment, cushioning the system against potential attacks while still allowing legitimate functions to execute for optimized content delivery.
Solution Approach 2:
The sandbox creates an inert execution environment with restricted permissions that isolates customer functions from critical system resources. Even if malicious code executes within the sandbox, it cannot access or modify core system files, networks, or other containers, thus protecting the overall system while enabling performance optimization functions.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Methods, systems, and computer-readable media for customizable event-triggered computation at edge locations are disclosed. A request for content is received at an edge server from a client device. The content is sought from a content cache at the edge server or from an origin server coupled to the edge server. Processing of the request is initiated, comprising encountering an event. The event is associated with a function specified by a customer. The function associated with the event is executed at the edge server using process isolation. The content is generated based at least in part on execution of the function. The content is sent from the edge server to the client device.