Object Storage Data Manipulation via User Code Execution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing object storage services lack the ability to dynamically control data access and enforce data manipulations within the I/O path without modifying the service interface, leading to inefficiencies and security concerns, as well as limitations in integrating serverless code execution and customizing execution environments.
Innovation Solution
The integration of an on-demand code execution system with object storage services allows for the insertion of user-submitted code into the I/O path, using input and output handles to simplify data manipulation and enhance security, while enabling dynamic data access control and customized execution environments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If user-submitted code is executed within the I/O path of object storage service, then data manipulation capability and access control are improved, but system complexity and security risks increase
Solution Approach 1:
The patent introduces a code execution environment as an intermediary layer between the object storage service and user-submitted code. This mediator isolates the code execution from the core storage service, allowing flexible data manipulation while maintaining system stability and security. The execution environment acts as a buffer that handles the complexity of code interpretation and enforcement, preventing direct contamination of the storage service logic.
2Adaptability or versatility
If user-submitted code is executed within the I/O path of object storage service, then data manipulation capability and access control are improved, but security risks increase
Solution Approach 1:
The patent applies preliminary anti-action by implementing security measures before code execution occurs. The system pre-validates user-submitted code against security policies, establishes isolated execution environments with restricted permissions, and pre-defines access control rules. These preventive measures are put in place before any code runs, blocking potential security threats in advance rather than reacting to them after execution.
Solution Approach 2:
The execution environment serves as a secure intermediary that mediates between user code and the storage service. It enforces security policies, validates code intentions, and controls the interaction between submitted code and stored data, thereby reducing security risks while maintaining access control flexibility.
3Adaptability or versatility
If code execution environment is customized, then code execution flexibility is improved, but configuration complexity increases
Solution Approach 1:
The system performs preliminary action by pre-configuring execution environments with common settings, security policies, and resource allocations. Standard execution contexts are prepared in advance with default configurations that can be selectively modified. This allows users to obtain flexible code execution with minimal configuration effort, as the heavy lifting of environment setup is already completed beforehand.
Data Source
AI summary
Systems and methods are described for modifying input and output (I/O) to an object storage service by implementing one or more owner-specified functions to I/O requests. Different data manipulation functions can be placed in different I/O paths depending on the request method or user access level. For example, a user having full access may be returned the unaltered version of the object, whereas a user having modified or reduced access may be returned a modified or redacted version of the object. In this manner, owners of the object collection are provided with greater control over how the object collection is accessed.