Secure User-Defined Function Execution in Database Sandboxes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing database systems lack adequate security mechanisms in sandbox environments, making them vulnerable to breaches during execution of user-defined functions (UDFs), which can compromise system integrity and memory/data security.
Innovation Solution
Implementing a multi-layer sandbox environment with a sandbox process and security manager to execute UDFs, utilizing a sandbox policy and security manager policy to enforce strict access controls and resource restrictions, ensuring secure execution of UDFs in a network-based database system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If user-defined functions are executed in a traditional database system without sandbox isolation, then execution flexibility and functionality are improved, but system security and integrity deteriorate due to vulnerability to breaches and malicious code
Solution Approach 1:
The system divides the execution environment into isolated sandbox instances for each user-defined function. Each sandbox is a separate process with its own memory space and system resource access controls, preventing malicious code from affecting the core database system or other user functions. This segmentation enables flexible execution of diverse user code while maintaining system security through physical isolation boundaries.
Solution Approach 2:
A sandbox manager acts as an intermediary between the database system and user-defined functions. The manager creates, configures, and monitors sandbox processes, enforcing security policies and resource limits. This intermediary layer allows the database to execute flexible user code while the manager ensures security constraints are maintained, resolving the contradiction between execution flexibility and system security.
2Reliability
If a sandbox environment is implemented to secure UDF execution, then system security is improved, but device complexity increases due to additional sandbox processes and management overhead
Solution Approach 1:
The sandbox manager is designed as a universal component that handles multiple functions: creating sandboxes, configuring security policies, allocating resources, monitoring execution, and cleaning up resources. By consolidating these diverse functions into a single multi-functional manager, the system improves security without proportionally increasing complexity, as the manager reuses the same infrastructure for multiple security-related tasks.
Solution Approach 2:
The system manages sandbox complexity by dynamically adjusting parameters such as resource limits (CPU time, memory allocation), security policy configurations, and isolation levels based on the specific requirements of each user-defined function. This parameter-based control allows the sandbox manager to adapt security constraints without requiring complex custom configurations for each sandbox, simplifying overall management while maintaining robust security.
3Reliability
If strict sandbox isolation is enforced to prevent breaches, then system integrity is improved, but productivity decreases due to resource access restrictions and execution overhead
Solution Approach 1:
The sandbox isolation parameters are made dynamic rather than static. The system adjusts resource limits, security policies, and access restrictions in real-time based on the behavior and requirements of each user-defined function. Well-behaved functions that adhere to security policies receive optimized resource allocation and fewer restrictions, while maintaining system integrity through adaptive monitoring and constraint enforcement only when necessary.
Solution Approach 2:
The system applies sandbox isolation selectively rather than uniformly to all user-defined functions. For trusted or system-approved functions, the sandbox constraints are relaxed or partially removed to improve execution efficiency. Full isolation and strict security controls are applied only when needed based on risk assessment, allowing the system to maintain integrity while minimizing productivity impact on benign functions.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The subject technology receives, in a first computing process, a user defined function, the user defined function including code related to at least one operation to be performed. The subject technology sends a request based on the at least one operation to a second computing process to perform, the second computing process being different than the first computing process and comprising a sandbox for executing the at least one operation. The subject technology receives, by the second computing process, the request. The subject technology determines, using at least a security policy, whether performing the at least one operation is permitted. The subject technology performs, in the second computing process, the least one operation. The subject technology sends, by the second computing process, a result of the at least one operation to the first computing process.