Security protocols for low latency execution of program code

• US 10,552,193 B2
• Filed: 08/14/2017
• Issued: 02/04/2020
• Est. Priority Date: 02/04/2015
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Wagner, Timothy Allen, Thomas, Dylan Chandler, Nair, Ajay
• Primary Examiner(s): Kim, Dong U
• Application Number:
  US15/676,777
• Publication Number:
  US 20180203717A1
• Time in Patent Office: 904 Days
• CPC Class Codes: G06F 2009/4557 Distribution of virtual machine instances; Migration and load balancing
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects

Abstract

A system for providing security mechanisms for secure execution of program code is described. The system may be configured to maintain a plurality of virtual machine instances. The system may be further configured to receive a request to execute a program code and allocate computing resources for executing the program code on one of the virtual machine instances. One mechanism involves executing program code according to a user-specified security policy. Another mechanism involves executing program code that may be configured to communicate or interface with an auxiliary service. Another mechanism involves splitting and executing program code in a plurality of portions, where some portions of the program code are executed in association with a first level of trust and some portions of the program code are executed with different levels of trust.

Claims

1. A system, comprising:

one or more processors; and

one or more memories, the one or more memories having stored thereon instructions, which, when executed by the one or more processors, configure the one or more processors to;

receive a request to execute a program code, the request including data usable to modify a policy according to which the program code is to be executed;

identify a container created on one of a plurality of virtual machine instances implemented on one or more physical computing devices, wherein the container is usable to execute the program code;

determine that the identified container satisfies one or more criteria defined by the data included in the request, wherein the container is on a first virtual machine instance of the plurality of virtual machine instances; and

cause the program code to be executed in the container on the first virtual machine instance according to the policy modified based on the data included in the request.

2. The system of claim 1, wherein the instructions, when executed by the one or more processors, further configure the one or more processors to identify the container based at least on a determination that the container has the program code loaded thereon at the time of receiving the request to execute the program code and is configured according to the modified policy.

3. The system of claim 1, wherein the data included in the request specify an execution duration within which the execution of the program code is to be completed, the instructions, when executed by the one or more processors, further configuring the one or more processors to acquire the container for at least the execution duration.

4. The system of claim 1, wherein the data included in the request specify a resource usage limit, the instructions, when executed by the one or more processors, further configuring the one or more processors to cause, based at least on the resource usage limit, the program code to be executed using an amount of computing resource that is less than or equal to the resource usage limit.

5. The system of claim 1, wherein the data included in the request specify access information associated with an auxiliary service, the instructions, when executed by the one or more processors, further configuring the one or more processors to cause, based at least on the access information, the program code to communicate with the auxiliary service during the execution of the program code.

6. The system of claim 1, wherein the data included in the request specify container communication information usable to enable inter-container communication, the instructions, when executed by the one or more processors, further configuring the one or more processors to cause, based at least on the container communication information, the container to communicate with another container on the first virtual machine instance.

7. The system of claim 1, wherein the data included in the request specify container communication information usable to enable inter-container communication, the instructions, when executed by the one or more processors, further configuring the one or more processors to cause, based at least on the container communication information, the container to communicate with another container on a second virtual machine instance of the plurality of virtual machine instances that is different from the first virtual machine instance.

8. A computer-implemented method comprising:

as implemented by one or more computing devices configured with specific executable instructions,

receiving a request to execute a program code, the request including data usable to modify a policy according to which the program code is to be executed;

identifying a container created on one of a plurality of virtual machine instances implemented on one or more physical computing devices, wherein the container is usable to execute the program code;

determining that the identified container satisfies one or more criteria defined by the data included in the request, wherein the container is on a first virtual machine instance of the plurality of virtual machine instances; and

executing the program code in the container on the first virtual machine instance according to the policy modified based on the data included in the request.

9. The computer-implemented method of claim 8, further comprising:

determining that the request is associated with a user account in a first group of user accounts, wherein the user accounts in the first group share a set of execution parameters; and

in response to determining that the request is associated with the user account in the first group, determining one or more additional execution parameters associated with the request based at least on the set of execution parameters shared by the first group.

10. The computer-implemented method of claim 8, wherein the data included in the request specify a trusted credential usable to execute the program code, the method further comprising executing a first portion of the program code without using the trusted credential and executing a second portion of the program code using the trusted credential.

11. The computer-implemented method of claim 8, further comprising modifying the policy based on the data included in the request.

12. The computer-implemented method of claim 8, further comprising receiving a request to register the program code different from the request to execute the program code.

13. The computer-implemented method of claim 8, further comprising:

determining that a first execution parameter having a first value is causing one or more security issues; and

outputting a suggestion to set the first execution parameter to a second value different from the first value.

14. The computer-implemented method of claim 8, wherein the data included in the request specify that the program code is permitted to establish a transmission control protocol (“

TCP”

) socket connection, the method further comprising identifying the container that allows the program code to establish a TCP socket connection.

15. The computer-implemented method of claim 8, wherein the data included in the request specify connection information usable to establish a transmission control protocol (“

TCP”

) socket connection, the method further comprising establishing, based at least on the connection information, a TCP socket connection during the execution of the program code.

16. Non-transitory physical computer storage storing instructions that, when executed by one or more computing devices having one or more processors, configure the one or more computing devices to:

receive a request to execute a program code, the request including data usable to modify a policy according to which the program code is to be executed;

identify a container created on one of a plurality of virtual machine instances implemented on one or more physical computing devices, wherein the container is usable to execute the program code;

determine that the identified container satisfies one or more criteria defined by the data included in the request, wherein the container is on a first virtual machine instance of the plurality of virtual machine instances; and

cause the program code to be executed in the container on the first virtual machine instance according to the policy modified based on the data included in the request.

17. The non-transitory physical computer storage of claim 16, wherein the data included in the request specify mode information indicative of a mode in which the program code is to be executed, the instructions, when executed by the one or more computing devices, further configuring the one or more computing devices to generate, based at least on the mode information, a log associated with the execution of the program code.

18. The non-transitory physical computer storage of claim 16, wherein the instructions, when executed by the one or more computing devices, further configure the one or more computing devices to interface with a logging service to log security-related activity performed during the execution of the program code.

19. The non-transitory physical computer storage of claim 18, wherein the security-related activity comprises one or more of inbound or outbound network connections established by the program code, external services contacted by the program code, or trusted credentials utilized by the program code.

20. The non-transitory physical computer storage of claim 19, wherein the instructions, when executed by the one or more computing devices, further configure the one or more computing devices to:

determine that at least some of the security-related activity is unauthorized; and

output an indication that the at least some of the security-related activity is unauthorized.