Serverless Function Management Platform Tenant Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Serverless architectures face security risks due to weak container isolation in multi-tenant shared service resource pools, where function executors of different tenants are run in a shared environment.
Innovation Solution
A function management platform is introduced, featuring a function scheduler and executor manager that isolates function executors by creating and managing them within tenant-specific resource pools, ensuring that each tenant's function executors run in isolated resource pools, with a gateway acting as an intermediary to manage function calls and resource allocation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If function executors of different tenants are run in a shared service resource pool, then resource utilization is improved, but system security deteriorates due to weak container isolation
Solution Approach 1:
The patent divides the shared service resource pool into multiple isolated tenant resource pools, where each tenant's function executors are run in their own dedicated resource pool. This segmentation ensures that while resources are still shared across the platform, each tenant's execution environment is isolated from others, preventing security breaches between tenants while maintaining efficient resource utilization.
2Reliability
If function executors are isolated in tenant-specific resource pools, then system security is improved, but resource sharing efficiency deteriorates
Solution Approach 1:
The patent creates a multi-functional resource pool management system where the same infrastructure resources (computing, storage, networking) serve multiple tenants through virtualization and isolation mechanisms. Each tenant resource pool can independently allocate and manage its resources while the underlying physical infrastructure remains shared and dynamically allocable across different tenants based on demand.
3Ease of operation
If a function management platform is introduced to manage function executors, then execution control is improved, but platform complexity increases
Solution Approach 1:
The patent introduces a function management platform that acts as an intermediary layer between the tenant applications and the underlying service resource pools. This platform provides standardized interfaces for function deployment, execution management, and resource allocation, simplifying the control process for tenants while abstracting the underlying complexity of resource pool management and isolation mechanisms.
Data Source
AI summary
In a service deployment method performed by a function management platform that includes a function scheduler and a function executor manager, the function scheduler receives a function call request that carries a function identifier, selects an available host based on resource pool information of a tenant, and sends a function instance creation request to the function executor manager. The function executor manager receives the function instance creation request, selects the host corresponding to the host identifier from the resource pool of the tenant, and creates a function executor corresponding to the function identifier on the host.