Cloud computing platform that executes third-party code in a distributed cloud computing network

• US 10,331,462 B1
• Filed: 11/06/2018
• Issued: 06/25/2019
• Est. Priority Date: 11/06/2018
• Status: Active Grant

• Current Assignee: CloudFlare Incorporated
• Original Assignee: CloudFlare Incorporated
• Inventors: Varda, Kenton Taylor, Bloom, Zachary Aaron, Majkowski, Marek Przemyslaw, Stepanyan, Ingvar, Kloepper, Kyle, Knecht, Dane Orion, Graham-Cumming, John, Grant, Dani
• Primary Examiner(s): Jacobs, Lashonda T
• Application Number:
  US16/182,522
• Time in Patent Office: 231 Days
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 9/4484 Executing subprograms
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 41/50 Network service management, e.g. ensuring proper service fulfilment according to agreements
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 67/53 using third party service providers
• CPC Class Codes: H04L 67/63 Routing a service request depending on the request content or context
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A compute server receives a request from a client device that triggers execution of a third-party code piece. The compute server is one of multiple compute servers that are part of a distributed cloud computing network. The request may be an HTTP request and directed to a zone. A single process at the compute server executes the third-party code piece in an isolated execution environment. The single process is also executing other third-party code pieces in other isolated execution environments respectively. A response is generated to the request based at least in part on the executed third-party code piece, and the generated response is transmitted to the client device.

Claims

1. A method, comprising:

receiving, at a first one of a plurality of compute servers from a client device, a request that triggers execution of a first one of a plurality of third-party code pieces, wherein the first compute server is one of the plurality of compute servers that are part of a distributed cloud computing network, and wherein the request is an HTTP request and directed to a zone;

executing, by a single process at the first one of the plurality of compute servers, the first one of the plurality of third-party code pieces, wherein the first one of the plurality of third-party code pieces is run in a first one of a plurality of isolated execution environments, wherein each of the other plurality of third-party code pieces are run in the other plurality of isolated execution environments respectively and executed by the single process;

generating a response to the request based at least in part on the executed first one of the plurality of third-party code pieces; and

transmitting the generated response to the client device.

2. The method of claim 1, wherein executing the first one of the plurality of third-party code pieces causes a subrequest to be generated and transmitted to an origin server of the zone.

3. The method of claim 1, wherein generating the response is performed without transmitting a request to an origin server of the zone.

4. The method of claim 1, further comprising:

determining the request triggers execution of the first one of the plurality of third-party code pieces by matching the zone to a predetermined matching pattern that associates the first one of the plurality of third-party code pieces to the predetermined matching pattern.

5. The method of claim 1, wherein each of the plurality of compute servers are anycasted to a same IP address, and wherein the first one of the plurality of compute servers receives the request because it is closest one of the plurality of compute servers to the client device as determined by an anycast implementation.

6. The method of claim 1, wherein the first one of the plurality of third-party code pieces is provided by an owner or operator of the zone.

7. The method of claim 1, further comprising:

wherein executing the first one of the plurality of third-party code pieces causes a subrequest to be generated that triggers execution of a second one of the plurality of third-party code pieces;

executing, by the single process at the first one of the plurality of compute servers, the second one of the plurality of third-party code pieces; and

wherein the response to the request is further generated at least in part on the executed second one of the plurality of third-party code pieces.

8. The method of claim 1, wherein each of the plurality of compute servers include the plurality of third-party code pieces.

9. A non-transitory machine-readable storage medium of a first one of a plurality of compute servers that provides instructions that, when executed by a processor, cause the processor to perform operations comprising:

receiving, at the first one of a plurality of compute servers from a client device, a request that triggers execution of a first one of a plurality of third-party code pieces, wherein the first compute server is one of the plurality of compute servers that are part of a distributed cloud computing network, and wherein the request is an HTTP request and directed to a zone;

executing, by a single process at the first one of the plurality of compute servers, the first one of the plurality of third-party code pieces, wherein the first one of the plurality of third-party code pieces is run in a first one of a plurality of isolated execution environments, wherein each of the other plurality of third-party code pieces are run in the other plurality of isolated execution environments respectively and executed by the single process;

generating a response to the request based at least in part on the executed first one of the plurality of third-party code pieces; and

transmitting the generated response to the client device.

10. The non-transitory machine-readable storage medium of claim 9, wherein executing the first one of the plurality of third-party code pieces causes a subrequest to be generated and transmitted to an origin server of the zone.

11. The non-transitory machine-readable storage medium of claim 9, wherein generating the response is performed without transmitting a request to an origin server of the zone.

12. The non-transitory machine-readable storage medium of claim 9, wherein the operations further comprise:

determining the request triggers execution of the first one of the plurality of third-party code pieces by matching the zone to a predetermined matching pattern that associates the first one of the plurality of third-party code pieces to the predetermined matching pattern.

13. The non-transitory machine-readable storage medium of claim 9, wherein each of the plurality of compute servers are anycasted to a same IP address, and wherein the first one of the plurality of compute servers receives the request because it is closest one of the plurality of compute servers to the client device as determined by an anycast implementation.

14. The non-transitory machine-readable storage medium of claim 9, wherein the first one of the plurality of third-party code pieces is provided by an owner or operator of the zone.

15. The non-transitory machine-readable storage medium of claim 9, wherein the operations further comprise:

wherein executing the first one of the plurality of third-party code pieces causes a subrequest to be generated that triggers execution of a second one of the plurality of third-party code pieces;

executing, by the single process at the first one of the plurality of compute servers, the second one of the plurality of third-party code pieces; and

wherein the response to the request is further generated at least in part on the executed second one of the plurality of third-party code pieces.

16. The non-transitory machine-readable storage medium of claim 9, wherein each of the plurality of compute servers include the plurality of third-party code pieces.

17. A first compute server, comprising:

a set of one or more processors; and

a non-transitory machine-readable storage medium that provides instructions that, when executed by the set of processors, cause the set of processors to perform the following operations;

receive, at the first one of a plurality of compute servers from a client device, a request that triggers execution of a first one of a plurality of third-party code pieces, wherein the first compute server is one of the plurality of compute servers that are part of a distributed cloud computing network, and wherein the request is an HTTP request and directed to a zone;

execute, by a single process at the first one of the plurality of compute servers, the first one of the plurality of third-party code pieces, wherein the first one of the plurality of third-party code pieces is run in a first one of a plurality of isolated execution environments, wherein each of the other plurality of third-party code pieces are run in the other plurality of isolated execution environments respectively and executed by the single process;

generate a response to the request based at least in part on the executed first one of the plurality of third-party code pieces; and

transmit the generated response to the client device.

18. The first compute server of claim 17, wherein execution of the first one of the plurality of third-party code pieces causes a subrequest to be generated and transmitted to an origin server of the zone.

19. The first compute server of claim 17, wherein generation of the response is to be performed without transmitting a request to an origin server of the zone.

20. The first compute server of claim 17, wherein the operations further include:

determine the request triggers execution of the first one of the plurality of third-party code pieces by matching the zone to a predetermined matching pattern that associates the first one of the plurality of third-party code pieces to the predetermined matching pattern.

21. The first compute server of claim 17, wherein each of the plurality of compute servers are to be anycasted to a same IP address, and wherein the first one of the plurality of compute servers is to receive the request because it is closest one of the plurality of compute servers to the client device as determined by an anycast implementation.

22. The first compute server of claim 17, wherein the first one of the plurality of third-party code pieces is to be provided by an owner or operator of the zone.

23. The first compute server of claim 17, wherein the operations further include:

wherein execution of the first one of the plurality of third-party code pieces causes a subrequest to be generated that triggers execution of a second one of the plurality of third-party code pieces;

execute, by the single process at the first one of the plurality of compute servers, the second one of the plurality of third-party code pieces; and

wherein the response to the request is further to be generated at least in part on the executed second one of the plurality of third-party code pieces.

24. The first compute server of claim 17, wherein each of the plurality of compute servers is to include the plurality of third-party code pieces.