Object Storage I/O Path Code Execution Intermediary
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data storage systems face challenges in enforcing data manipulation functions and ensuring security, as they require complex network communication and rely on external enforcement, leading to difficulties in integrating serverless task executions with object storage services.
Innovation Solution
The integration of an on-demand code execution system with object storage services allows for the configuration of input and output streams, enabling data manipulation within an isolated environment without explicit network communication, thereby simplifying code execution and enhancing security by restricting network access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data manipulation functions are enforced through complex network communication and external enforcement, then data security and control are improved, but system complexity and integration difficulty increase
Solution Approach 1:
The patent introduces an intermediary component that sits between the object storage service and the data manipulation functions. This intermediary handles the integration and communication protocols, isolating the complexity from both the storage service and the manipulation functions. The intermediary translates and coordinates between different systems, enabling secure data manipulation without requiring the storage service itself to become complex.
2Adaptability or versatility
If serverless task executions are integrated with object storage services, then data manipulation capability is improved, but integration complexity increases
Solution Approach 1:
The patent segments the system into distinct modular components: the object storage service, the serverless task execution environment, and the data manipulation functions. Each component operates independently with well-defined interfaces. The serverless function is invoked only when specific events occur in the storage service, creating loose coupling that reduces integration complexity while maintaining versatile data manipulation capabilities.
3Adaptability or versatility
If network communication is allowed for data manipulation, then functionality is improved, but security risks increase
Solution Approach 1:
The patent creates an isolated execution environment for serverless functions that acts as an inert atmosphere - a controlled, restricted space where code executes with limited network access. The function operates in this isolated environment, manipulating data through defined interfaces without direct network communication. This approach enables versatile data manipulation functionality while mitigating security risks by containing potential threats within the isolated execution context.
Data Source
AI summary
Systems and methods are described for modifying input and output (I/O) to an object storage service by implementing one or more owner-specified functions to I/O requests. A function can implement a data manipulation, such as filtering out sensitive data before reading or writing the data. The functions can be applied prior to implementing a request method (e.g., GET or PUT) specified within the I/O request, such that the data to which the method is applied my not match the object specified within the request. For example, a user may request to obtain (e.g., GET) a data set. The data set may be passed to a function that filters sensitive data to the data set, and the GET request method may then be applied to the output of the function. In this manner, owners of objects on an object storage service are provided with greater control of objects stored or retrieved from the service.