Remote Plugin Isolation via Reverse Proxy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In virtualized computing environments, plugins installed and executed at the management server can cause resource consumption issues, security risks, and compatibility problems, including the potential to crash the core user interface or access sensitive information.
Innovation Solution
Plugins are installed and executed on a remote plugin server, with elements loaded into the web client's user interface through a reverse proxy, isolating them from the core user interface to prevent interference and ensure secure access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If plugins are installed and executed at the management server, then functionality customization is improved, but system stability deteriorates
Solution Approach 1:
The system is segmented into a management server and a separate plugin server. The management server hosts the core user interface, while the plugin server hosts plugin elements. This segmentation isolates plugins from the core system, allowing functionality customization through plugins without compromising the stability of the management server.
Solution Approach 2:
A reverse proxy is introduced as an intermediary component that receives requests from the web client and routes them to either the management server or the plugin server. This intermediary enables seamless integration of plugin functionality while maintaining isolation and preventing direct interference with the core user interface.
2Ease of operation
If plugins are installed at the management server, then ease of operation is improved, but security deteriorates
Solution Approach 1:
By separating plugin execution to a dedicated plugin server, the system maintains ease of plugin operation while improving security. The segmentation ensures that plugins run in an isolated environment, preventing them from accessing sensitive information or interfering with core management server operations.
Solution Approach 2:
The reverse proxy acts as a security intermediary that mediates all communication between the web client and the plugin server. It enforces access controls and routing policies, ensuring that plugins can be operated easily through the unified interface while security risks are mitigated through the proxy's protective mechanisms.
3Adaptability or versatility
If plugins are tightly integrated with the core user interface, then adaptability is improved, but device complexity deteriorates
Solution Approach 1:
The system architecture is segmented into distinct components: the management server for core functionality, the plugin server for extended functionality, and the reverse proxy for request routing. This segmentation achieves adaptability through plugins while managing complexity by organizing components into separate, well-defined units with clear interfaces.
Solution Approach 2:
The reverse proxy provides universal functionality by handling both core user interface requests and plugin requests through a single entry point. This multi-functionality simplifies the overall system architecture by consolidating request routing logic in one component, reducing the complexity that would otherwise arise from multiple integration points.
Data Source
AI summary
In an architecture of a virtualized computing system plugins are less tightly integrated with a core user interface of a management server. Rather than being installed and executed at the management server as local plugins, the plugins are served as remote plugins from a plugin server, and may be accessed by a web client through a reverse proxy at the management server. Plugin operations may be executed at the plugin server and/or invoked from a user device where the web client resides. Furthermore, a plugin sandbox and other isolation configurations are provided at the user device, so as to further control access capability and interaction of the plugins.