Virtual Machine Sandboxes for Secure Multi-Tenant Code Execution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud-based application servers face challenges in enforcing resource usage limits and ensuring security when executing custom code from multiple tenants, particularly with non-platform-specific languages like Java, which can lead to uneven resource distribution and data access issues across virtual machine sandboxes.
Innovation Solution
Implementing usage checks and instrumentation within the virtual machine to monitor and enforce CPU and heap memory limits, using bytecode rewriting to inject resource usage checks and a security manager to restrict access to sensitive functions, and maintaining a whitelist of allowed classes to ensure fair resource usage and secure multi-tenant operation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If users are allowed to run custom code at the application server, then the robustness of supported applications is improved, but the ability to enforce protections at the application server deteriorates
Solution Approach 1:
The patent divides the application server into multiple isolated sandboxes, each running custom code from different tenants in separate secure sub-environments. This segmentation prevents any single custom code execution from affecting the entire server or other tenants, resolving the contradiction by enabling custom code execution while maintaining enforcement capabilities through isolation.
Solution Approach 2:
The patent introduces a security manager as an intermediary layer between the custom code and the application server resources. This security manager enforces usage checks, monitors resource consumption, and controls access to sensitive functions, allowing custom code to run while preventing resource overuse and maintaining protections.
2Ease of operation
If custom code is executed without usage checks, then the ease of operation is improved, but the resource distribution fairness deteriorates
Solution Approach 1:
The patent implements usage checks that continuously monitor resource consumption by custom code and provide feedback to the security manager. When resource usage thresholds are approached or exceeded, the system can intervene to prevent unfair resource distribution, thus maintaining both ease of operation and resource fairness through automated monitoring and control.
3Adaptability or versatility
If non-platform-specific languages are supported, then the adaptability is improved, but the security control deteriorates
Solution Approach 1:
The patent applies different security measures to different parts of the system: the security manager enforces specific usage checks and access controls for each sandboxed execution environment. This localized security approach allows diverse language support while maintaining appropriate security controls for each execution context, preventing unauthorized data access even as adaptability increases.
Data Source
AI summary
A system may include an application server and one or more tenants served by the application server. The application server may host a virtual machine with multiple isolated sub-environments. Each tenant of the application server may request to run a program in a tenant-specific sub-environment of the virtual machine. The sub-environments may be configured so the execution of one tenant's code does not affect execution of another tenant's code or the hosting virtual machine, for example, by considering the resources used to execute the code. The application server may implement techniques to securely execute “untrusted” code, programmed using one or more different programming languages, in the sub-environments by enforcing resource restrictions and restricting the sub-environments from accessing the host's local file system. In this way, one tenant's code does not negatively impact execution of another tenant's code by using too many resources of the virtual machine.