CLOUD SERVICE CUSTOM EXECUTION ENVIRONMENT

• US 20150229645A1
• Filed: 09/17/2014
• Published: 08/13/2015
• Est. Priority Date: 02/07/2014
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Kilgore, William Bruce, Loo, Kaj van de, Keith, Michael
• Granted Patent: US 9,935,959 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 9/455 Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register
• CPC Class Codes: H04L 41/50 Network service management, e.g. ensuring proper service fulfilment according to agreements
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/086 using security domains

Abstract

Techniques are described for implementing a cloud computer system to provide access to a custom execution environment for execution of custom executable instructions. Users may be able to configure one or more different types of template execution environments, e.g., a virtual machine environment, each of which can be used to establish a type of custom execution environment. Users may configure the template execution environment with regard to settings, states, resources, permissions, or other criterion related to an execution environment. Upon request, a custom execution environment (e.g., a child execution environment) may be established for running one instance of a custom executable instruction. The custom execution environment may be based on the template execution environment. The custom execution environment may provide a secure, isolated environment for execution of a custom executable instruction. Access permissions for the custom execution environment may be configurable depending on a type of execution environment desired.

Claims

1. A method comprising:

executing, in a cloud computer system, a template execution environment, wherein the template execution environment is configured to establish child execution environments, each child execution environment configured to execute one or more custom executable instructions;

receiving, by the cloud computer system, a request to execute a custom executable instruction;

establishing, in the cloud computer system, a first child execution environment to execute the requested custom executable instruction, wherein the first child execution environment is established based on the template execution environment;

loading, by the cloud computer system, the requested custom executable instruction for execution in the first child execution environment; and

then

configuring, by the cloud computer system, an access permission for the first child execution environment; and

executing, by the cloud computer system, the requested custom executable instruction in the first child execution environment, wherein the requested custom executable instruction is executed after the access permission is configured.

2. The method of claim 1, wherein the template execution environment is a Java virtual machine (JVM) environment and wherein the first child execution environment is a child JVM environment.

3. The method of claim 1, wherein establishing the first child execution environment includes executing a fork command to create the first child execution environment from the template execution environment.

4. The method of claim 1, wherein the first child execution environment inherits a configuration of the template execution environment.

5. The method of claim 1, wherein configuring the access permission includes adjusting permission for access to a resource not located in the first child execution environment, and wherein the permission is adjusted to prevent the resource from being accessed from within the first child execution environment.

6. The method of claim 1, wherein the access permission is configured through a security model for the template execution environment.

7. The method of claim 1, wherein the template execution environment is configured based on at least one criterion for a tenant registered with the cloud computer system.

8. The method of claim 1, further comprising:

selecting the template execution environment from a plurality of template execution environments, wherein each template execution environment of the plurality of template execution environments establishes a child execution environment, and wherein each template execution environment of the plurality of template execution environments is configured to execute a different type of custom executable instruction.

9. The method of claim 8, further comprising:

classifying a type of custom executable instruction corresponding to the requested custom executable instruction, wherein the template execution environment is selected based on the classified type of custom executable instruction.

10. The method of claim 1, further comprising:

loading a resource for execution of the template execution environment;

wherein the request to execute the requested custom executable instruction is received after loading the resource for execution of the template execution environment.

11. The method of claim 1, further comprising:

configuring the template execution environment before executing the template execution environment.

12. The method of claim 11, wherein configuring the template execution environment includes initializing a setting for the template execution environment and initializing a state for the template execution environment.

13. The method of claim 1, further comprising:

establishing, in the cloud computer system, an additional child execution environment to execute an additional customer executable instruction, wherein the additional child execution environment is established based on the template execution environment;

loading the additional custom executable instruction for execution in the additional child execution environment;

setting access permission for the additional child execution environment; and

executing the additional custom executable instruction in the additional child execution environment.

14. The method of claim 1, further comprising:

loading the requested custom executable instruction for execution in the first child execution environment.

15. A computer system comprising:

one or more processors; and

one or more memory devices coupled to the one or more processors, the one or more memory devices containing instructions that, when executed on the one or more processors, cause the one or more processors to;

receive a criterion for configuring a template execution environment of a plurality of template execution environments, wherein each template execution environment of the plurality of template execution environments establishes a child execution environment, and wherein each template execution environment of the plurality of template execution environments is configured to execute a different type of custom executable instruction;

receive, from a computing device using a first communication protocol, a request to execute a custom executable instruction;

classify a type of custom executable instruction corresponding to the requested custom executable instruction;

select a first template execution environment from the plurality of template execution environments, wherein the first template execution environment is selected based on the classified type of custom executable instruction;

execute the first template execution environment;

establish a first child execution environment to execute the requested custom executable instruction, wherein the first child execution environment is established based on the first template execution environment;

load the requested custom executable instruction for execution in the first child execution environment; and

then

configure an access permission for the first child execution environment; and

execute the requested custom executable instruction in the first child execution environment, wherein the requested custom executable instruction is executed after the access permission is configured for the first child execution environment.

16. The computer system of claim 15, wherein the one or more processors and the one or more memory devices are included in a mobile cloud computer system, and wherein the computing device is a mobile computing device.

17. The computer system of claim 15, wherein the first child execution environment inherits a configuration of the template execution environment.

18. The computer system of claim 15, wherein configuring the access permission includes adjusting permission for accessing the requested custom executable instruction, and wherein the permission is adjusted to prevent the requested custom executable instruction from being accessed from within the first child execution environment.

19. A computer-readable memory storing a set of instructions that, when executed by one or more processors, causes the one or more processors to:

execute a template execution environment, wherein the template execution environment is configured to establish child execution environments, each child execution environment configured to execute one or more custom executable instructions;

receive a request to execute a custom executable instruction;

establish a first child execution environment to execute the requested custom executable instruction, wherein the first child execution environment is established based on the template execution environment;

load the requested custom executable instruction for execution in the first child execution environment; and

then

configure an access permission for the first child execution environment; and

execute the requested custom executable instruction in the first child execution environment, wherein the requested custom executable instruction is executed after the access permission is configured.

20. The computer-readable memory of claim 19, wherein the first child execution environment inherits a configuration of the template execution environment.