Escalation-resistant secure network services using request-scoped authentication information

Description

BACKGROUND

Computing devices can utilize communication networks to exchange data. Companies and organizations operate computer networks that interconnect a number of computing devices to support operations or to provide services to third parties. The computing systems can be located in a single geographic location or located in multiple, distinct geographic locations (e.g., interconnected via private or public communication networks). Specifically, data centers or data processing centers, herein generally referred to as a “data center,” may include a number of interconnected computing systems to provide computing resources to users of the data center. The data centers may be private data centers operated on behalf of an organization or public data centers operated on behalf, or for the benefit of, the general public.

To facilitate increased utilization of data center resources, virtualization technologies allow a single physical computing device to host one or more instances of virtual machines that appear and operate as independent computing devices to users of a data center. With virtualization, the single physical computing device can create, maintain, delete, or otherwise manage virtual machines in a dynamic manner. In turn, users can request computer resources from a data center, including single computing devices or a configuration of networked computing devices, and be provided with varying numbers of virtual machine resources.

In some scenarios, virtual machine instances may be configured according to a number of virtual machine instance types to provide specific functionality. For example, various computing devices may be associated with different combinations of operating systems or operating system configurations, virtualized hardware resources and software applications to enable a computing device to provide different desired functionalities, or to provide similar functionalities more efficiently. These virtual machine instance type configurations are often contained within a device image, which includes static data containing the software (e.g., the OS and applications together with their configuration and data files, etc.) that the virtual machine will run once started. The device image is typically stored on the disk used to create or initialize the instance. Thus, a computing device may process the device image in order to implement the desired software configuration.

BRIEF DESCRIPTION OF DRAWINGS

FIG. 1 is a block diagram depicting an illustrative environment in which an on-demand code execution system can operate to implement escalation-resistant network services based on execution of tasks, by instantiating the services with authentication information inherited from requests to access the services;

FIG. 2 depicts a general architecture of a computing device providing an worker manager that is configured to facilitate implementation of escalation-resistant network services based on execution of tasks on the on-demand code execution system of FIG. 1;

FIG. 3 is a flow diagram depicting illustrative interactions for implementing an escalation-resistant network service on the on-demand code execution system of FIG. 1 based on a request to access the service;

FIG. 4 is a flow diagram depicting illustrative interactions for accessing additional services from the escalation-resistant network service the on-demand code execution system of FIG. 1 in a secure manner; and

FIG. 5 is a flow chart depicting an illustrative routine for implementing escalation-resistant network services, which may be implemented by the on-demand code execution system of FIG. 1.

DETAILED DESCRIPTION

Generally described, aspects of the present disclosure relate to implementing escalation-resistant services via execution of code on an on-demand code execution system, which system may also be referred to as a “serverless” execution system. The on-demand code execution system enables rapid execution of source code, which may be supplied by users of the on-demand code execution system. In some instances, the code may be utilized to implement network services, such as backend processing for a user-facing application (e.g., a mobile device “app”). Because network services often handle sensitive or confidential information, it is typically desirable that such services be secured against malicious users. While a variety of malicious attacks exist with respect to network services, one particularly problematic category of attack is that of privilege escalation. Generally described, privilege escalation is the act of exploiting a bug, flaw, or oversight within a service that allows one user of the service to gain access to more resources of the service than was intended. For example, a successful privilege escalation may allow a first user to gain access to information of a second user, or to gain administrative privileges for a service. Because privilege escalation can result in loss of confidential information or even control of a service, a variety of attempts have been made to implement escalation-resistant network-services. In general, these attempts operate by limiting the ability of a user to escape their own set of privileges and gain privileges of other users of the service (or of the service itself). For example, a network-based service may operate to provide a database of information, and the service may be made escalation-resistant by attempting to limit each user's access to the database to their own information. One problem with such an approach is that the service is provided with greater privileges than any individual user, and is itself expected to limit the privileges of each user. Thus, vulnerabilities in the service allow for privilege escalations to occur. This paradigm may be considered a “necessary evil” in traditional services, as a service may be required to have greater privileges than any individual user in order to provide services to each individual user. However, with the advent of serverless code execution systems, it is now possible to execute request-driven services, such that an instance of a service is generated in response to a user's request to access the service. Because these instances are scoped to provide the service to an individual user associated with the request, the privileges of each service instance need be no larger than the privileges of the user requesting access to the service. Thus, by implementing the service with privileges scoped to those of the requesting user, privilege escalations can be prevented independent of operation of the service instance. In other words, even if a vulnerability existed within code of the service which allowed for a user to access privileges of a current instance of the service, if that instance has no more privileges than the user themselves, no privilege escalation would be possible. As will be discussed below, the present disclosure enables creation of such escalation-resistant network services on an on-demand code execution system.

The on-demand code execution system disclosed herein may enable users to create request-driven services, by submitting or designating computer-executable source code to be executed by virtual machine instances on the on-demand code execution system in response to user requests to access such services. Each set of code on the on-demand code execution system may define a “task,” and implement specific functionality corresponding to that task when executed on a virtual machine instance of the on-demand code execution system (e.g., functionality of a network-based service). Individual implementations of the task on the on-demand code execution system may be referred to as an “execution” of the task (or a “task execution”). The on-demand code execution system can further enable users to trigger execution of a task based on a variety of potential events, such as detecting new data at a network-based storage system, transmission of an application programming interface (“API”) call to the on-demand code execution system, or transmission of a specially formatted hypertext transport protocol (“HTTP”) packet to the on-demand code execution system. Thus, users may utilize the on-demand code execution system to execute any specified executable code “on-demand,” without requiring configuration or maintenance of the underlying hardware or infrastructure on which the code is executed. Further, the on-demand code execution system may be configured to execute tasks in a rapid manner (e.g., in under 100 milliseconds [ms]), thus enabling execution of tasks in “real-time” (e.g., with little or no perceptible delay to an end user). To enable this rapid execution, the on-demand code execution system can include one or more virtual machine instances that are “pre-warmed” or pre-initialized (e.g., booted into an operating system and executing a complete or substantially complete runtime environment) and configured to enable execution of user-defined code, such that the code may be rapidly executed in response to a request to execute the code, without delay caused by initializing the virtual machine instance. Thus, when an execution of a task is triggered, the code corresponding to that task can be executed within a pre-initialized virtual machine in a very short amount of time.

To provide escalation-resistant services, tasks on the on-demand code execution system can be configured to be executed in execution environments with privileges scoped to those provided within a request to access the service. Illustratively, a user of a user device may pass authentication information within a request to access a network-based service implemented by a task on the on-demand code execution system. The on-demand code execution system, in response, can instantiate an execution of the task within an execution environment, and provision that execution environment with the authentication information of the requesting user (and potentially without other authentication information). In implementing the service, the task execution may inherit the authentication information of the user, thus limiting the ability of the task execution to take actions other than those allowed for the user. For example, where the task execution accesses a network-based database, the task execution may be configured to pass the user's authentication information to the database, and thus be limited in its interactions with the database to those portions of the database accessible to the user. For that reason, even if a vulnerability existed within the task which allowed a user (e.g., via a maliciously formatted request) to escalate their privileges to that of the service, the user would be unable to gain any privileges other than their own. (This is in contrast to operation of typical network-based services, which are generally given more privileges than individual users who access the service, and are thus vulnerability at least in theory to privilege escalation exploits.)

In one embodiment, the authentication information passed within a request to access a task-based service may include credentials of an accessing user, such as a username and password. In another embodiment, the authentication information passed within the request may be alternative information, such as an authentication token provided by an authentication service based on prior authentication with the service. The use of a token may be beneficial, for example, where such token also authorizes the user with privileges (e.g., access to specific resources or actions that may be taken by the user). For example, security tokens, which are generally known in the art, may be used to indicate that a user has been authenticated, and may be associated with authorizations of the user across multiple services. Other credentials, such as a username and password, may also be associated with authorizations of the user across multiple services; however, this is generally undesirable, as it is typically considered insecure to duplicate a username and password across multiple services.

As used in the present disclosure, authentication and authorization are separate concepts in security. Generally, authentication establishes the identity of a user (e.g., “I am User A”), while authorization establishes what privileges a user has (e.g., “User A may modify data X”). In one embodiment, a service instance (e.g., generated on an on-demand code execution system as a task execution) is scoped by passing authentication information to the instance based on the authentication information provided within the request to access the service, and authorizations of the user are enforced by systems external to the service. For example, an authorization agent of the on-demand code executions system may ensure that a user requesting to access a service is authorized to initiate execution of a task providing the service. Once executing, the service's access to other, auxiliary services may be limited by authorization agents executing on such auxiliary services. For example, a service implemented as a task execution may attempt to modify data stored within an auxiliary network-attached-storage (NAS) service, and in doing so pass to the NAS service the authentication information of a user whose request cause the task execution. The NAS service may include an authorization agent which verifies that the user identified by the authentication information is authorized to modify the data. As such, the task execution may not be required to provide any authorization control. In other words, an author of code executing on the on-demand code execution service may not be required to conduct any checks as to whether a requesting user has authorization to undertake any action via the execution of code. Instead, such authorization checks are implemented by the on-demand code execution system itself, and by third-party services with which the task interactions. This configuration may simplify creation of tasks on the on-demand code execution system, and reduce the possibility that users introduce bugs or vulnerabilities into those tasks. In other embodiments, a task execution may itself additionally or alternatively implement authorization with respect to user actions.

As will be appreciated by one of skill in the art in light of the present disclosure, the embodiments disclosed herein improves the ability of computing systems, such as on-demand code execution systems, to implement network-accessible services in a secure manner. Specifically, aspects of the present disclosure reduce the susceptibility of privilege escalation attacks on network-accessible services by enabling creation of service instances that are scoped to the authentication information used to request access to a service. Moreover, the presently disclosed embodiments address technical problems inherent within computing systems; specifically, the susceptibility of computing systems to malicious use and the difficulty of providing secure network-based services. These technical problems are addressed by the various technical solutions described herein, including the creation of scoped execution environments for services instances based on authentication information used to request access to a service. Thus, the present disclosure represents an improvement on existing code execution systems and computing systems in general.

The general execution of tasks on the on-demand code execution system will now be discussed. To execute tasks, the on-demand code execution system described herein may maintain a pool of pre-initialized virtual machine instances that are ready for use as soon as a user request is received. Due to the pre-initialized nature of these virtual machines, delay (sometimes referred to as latency) associated with executing the user code (e.g., instance and language runtime startup time) can be significantly reduced, often to sub-100 millisecond levels. Illustratively, the on-demand code execution system may maintain a pool of virtual machine instances on one or more physical computing devices, where each virtual machine instance has one or more software components (e.g., operating systems, language runtimes, libraries, etc.) loaded thereon. When the on-demand code execution system receives a request to execute the program code of a user (a “task”), which specifies one or more computing constraints for executing the program code of the user, the on-demand code execution system may select a virtual machine instance for executing the program code of the user based on the one or more computing constraints specified by the request and cause the program code of the user to be executed on the selected virtual machine instance. The program codes can be executed in isolated containers that are created on the virtual machine instances. Since the virtual machine instances in the pool have already been booted and loaded with particular operating systems and language runtimes by the time the requests are received, the delay associated with finding compute capacity that can handle the requests (e.g., by executing the user code in one or more containers created on the virtual machine instances) is significantly reduced.

The on-demand code execution system may include a virtual machine instance manager configured to receive user code (threads, programs, etc., composed in any of a variety of programming languages) and execute the code in a highly scalable, low latency manner, without requiring user configuration of a virtual machine instance. Specifically, the virtual machine instance manager can, prior to receiving the user code and prior to receiving any information from a user regarding any particular virtual machine instance configuration, create and configure virtual machine instances according to a predetermined set of configurations, each corresponding to any one or more of a variety of run-time environments. Thereafter, the virtual machine instance manager receives user-initiated requests to execute code, and identifies a pre-configured virtual machine instance to execute the code based on configuration information associated with the request. The virtual machine instance manager can further allocate the identified virtual machine instance to execute the user's code at least partly by creating and configuring containers inside the allocated virtual machine instance, and provisioning the containers with code of the task as well as dependency code objects. Various embodiments for implementing a virtual machine instance manager and executing user code on virtual machine instances is described in more detail in U.S. Pat. No. 9,323,556, entitled “PROGRAMMATIC EVENT DETECTION AND MESSAGE GENERATION FOR REQUESTS TO EXECUTE PROGRAM CODE” and filed Sep. 30, 2014 (“the '556 Patent”), the entirety of which is hereby incorporated by reference.

As used herein, the term “virtual machine instance” is intended to refer to an execution of software or other executable code that emulates hardware to provide an environment or platform on which software may execute (an “execution environment”). Virtual machine instances are generally executed by hardware devices, which may differ from the physical hardware emulated by the virtual machine instance. For example, a virtual machine may emulate a first type of processor and memory while being executed on a second type of processor and memory. Thus, virtual machines can be utilized to execute software intended for a first execution environment (e.g., a first operating system) on a physical device that is executing a second execution environment (e.g., a second operating system). In some instances, hardware emulated by a virtual machine instance may be the same or similar to hardware of an underlying device. For example, a device with a first type of processor may implement a plurality of virtual machine instances, each emulating an instance of that first type of processor. Thus, virtual machine instances can be used to divide a device into a number of logical sub-devices (each referred to as a “virtual machine instance”). While virtual machine instances can generally provide a level of abstraction away from the hardware of an underlying physical device, this abstraction is not required. For example, assume a device implements a plurality of virtual machine instances, each of which emulate hardware identical to that provided by the device. Under such a scenario, each virtual machine instance may allow a software application to execute code on the underlying hardware without translation, while maintaining a logical separation between software applications running on other virtual machine instances. This process, which is generally referred to as “native execution,” may be utilized to increase the speed or performance of virtual machine instances. Other techniques that allow direct utilization of underlying hardware, such as hardware pass-through techniques, may be used, as well.

While a virtual machine executing an operating system is described herein as one example of an execution environment, other execution environments are also possible. For example, tasks or other processes may be executed within a software “container,” which provides a runtime environment without itself providing virtualization of hardware. Containers may be implemented within virtual machines to provide additional security, or may be run outside of a virtual machine instance.

The foregoing aspects and many of the attendant advantages of this disclosure will become more readily appreciated as the same become better understood by reference to the following description, when taken in conjunction with the accompanying drawings.

FIG. 1 is a block diagram of an illustrative operating environment 100 in which an on-demand code execution system 110 may operate based on communication with user computing devices 102, auxiliary services 106, and an authentication service 170.

By way of illustration, various example user computing devices 102 are shown in communication with the on-demand code execution system 110, including a desktop computer, laptop, and a mobile phone. In general, the user computing devices 102 can be any computing device such as a desktop, laptop or tablet computer, personal computer, wearable computer, server, personal digital assistant (PDA), hybrid PDA/mobile phone, mobile phone, electronic book reader, set-top box, voice command device, camera, digital media player, and the like.

The on-demand code execution system 110 may provide the user computing devices 102 with one or more user interfaces, command-line interfaces (CLI), application programing interfaces (API), and/or other programmatic interfaces for generating and uploading user-executable source code (e.g., including metadata identifying dependency code objects for the uploaded code), invoking the user-provided source code (e.g., submitting a request to execute the source code on the on-demand code execution system 110), scheduling event-based jobs or timed jobs, tracking the user-provided source code, and/or viewing other logging or monitoring information related to their requests and/or source code. Although one or more embodiments may be described herein as using a user interface, it should be appreciated that such embodiments may, additionally or alternatively, use any CLIs, APIs, or other programmatic interfaces.

The illustrative environment 100 further includes one or more auxiliary services 106, which can interact with the one-demand code execution environment 110 to implement desired functionality on behalf of a user. Auxiliary services 106 can correspond to network-connected computing devices, such as servers, which generate data accessible to the one-demand code execution environment 110 or otherwise communicate to the on-demand code execution environment 110. For example, the auxiliary services 106 can include web services (e.g., associated with the user computing devices 102, with the on-demand code execution system 110, or with third parties), databases, really simple syndication (“RSS”) readers, social networking sites, or any other source of network-accessible service or data source. In some instances, auxiliary services 106 may be invoked by code execution on the on-demand code execution system 110, such as by API calls to the auxiliary services 106. One or more auxiliary services 106 may be associated with the on-demand code execution system 110, e.g., to provide billing or logging services to the on-demand code execution system 110. An auxiliary service 106 may actively transmit information, such as API calls or other task-triggering information, to the on-demand code execution system 110, or may be passive, such that data is made available for access by the on-demand code execution system 110. For example, components of the on-demand code execution system 110 may periodically poll such passive data sources, and trigger execution of tasks within the on-demand code execution system 110 based on the data provided. While depicted in FIG. 1 as distinct from the user computing devices 102 and the on-demand code execution system 110, in some embodiments, various auxiliary services 106 may be implemented by either the user computing devices 102 or the on-demand code execution system 110.

The illustrative environment 100 further includes an authentication service 170 configured to authenticate user computing devices 102. As noted above, authentication generally refers to a process of verifying the identity of a user. Thus, the authentication service 170 may include a number of components which allow a user to submit credentials or other identification information to the service 170, and to receive authentication information provided by the service 170 which establishes that the user has authenticated with the service 170. For example, the authentication service 170 may include a user interface 172 through which users may submit credentials or other identification information to the service 170. Credentials or identification information may include, by way of non-limiting example, usernames or passwords, secret keys, biometric information (e.g., fingerprints, facial or retinal scans, etc.), or cryptographic values (e.g., as generated by a physical security token). The user interface 172 may provide any number of different interfaces, such as GUIs, CLIs, or APIs through which such information may be provided. The authentication service 170 may verify the credentials or identification information based on information within an authorization data store 174. The authentication data store 174 may include, for example, authoritative versions of the credentials or identification information, or (and often preferably) non-credential information that can otherwise verify the credentials or identity information (e.g., a salted hash of a credential which does not itself disclose the credential). The authentication data store 174 may correspond to any persistent or substantially persistent data store, such as one or more of a hard disk drive (HDD), solid state drive (SSD), virtual disk drive, tape drive, network attached storage (NAS) device, or any other persistent or substantially persistent storage component. To allow for authentication to other network services, such as the on-demand code execution system, the authentication service 170 further includes a token generator 176. The token generator 176 may be configured to apply cryptographic techniques to generate a unique item of data (a “token”) which, when provided to a network service, authenticates a bearer of the token as a particular user of the authentication service 170. In some embodiments, the token may be associated with additional restrictions, such as a validity time. The generation of authentication tokens is known in the art, and thus will not be described in detail herein. While shown as distinct from on-demand code execution system 110, the authentication service 170 may additionally or alternative be implemented as part of the on-demand code execution system 110.

The user computing devices 102, auxiliary services 106, and authentication service 170 may communicate with the on-demand code execution system 110 via network 104, which may include any wired network, wireless network, or combination thereof. For example, the network 104 may be a personal area network, local area network, wide area network, over-the-air broadcast network (e.g., for radio or television), cable network, satellite network, cellular telephone network, or combination thereof. As a further example, the network 104 may be a publicly accessible network of linked networks, possibly operated by various distinct parties, such as the Internet. In some embodiments, the network 104 may be a private or semi-private network, such as a corporate or university intranet. The network 104 may include one or more wireless networks, such as a Global System for Mobile Communications (GSM) network, a Code Division Multiple Access (CDMA) network, a Long Term Evolution (LTE) network, or any other type of wireless network. The network 104 can use protocols and components for communicating via the Internet or any of the other aforementioned types of networks. For example, the protocols used by the network 104 may include Hypertext Transfer Protocol (HTTP), HTTP Secure (HTTPS), Message Queue Telemetry Transport (MQTT), Constrained Application Protocol (CoAP), and the like. Protocols and components for communicating via the Internet or any of the other aforementioned types of communication networks are well known to those skilled in the art and, thus, are not described in more detail herein.

The on-demand code execution system 110 is depicted in FIG. 1 as operating in a distributed computing environment including several computer systems that are interconnected using one or more computer networks (not shown in FIG. 1). The on-demand code execution system 110 could also operate within a computing environment having a fewer or greater number of devices than are illustrated in FIG. 1. Thus, the depiction of the on-demand code execution system 110 in FIG. 1 should be taken as illustrative and not limiting to the present disclosure. For example, the on-demand code execution system 110 or various constituents thereof could implement various Web services components, hosted or “cloud” computing environments, and/or peer to peer network configurations to implement at least a portion of the processes described herein.

Further, the on-demand code execution system 110 may be implemented directly in hardware or software executed by hardware devices and may, for instance, include one or more physical or virtual servers implemented on physical computer hardware configured to execute computer executable instructions for performing various features that will be described herein. The one or more servers may be geographically dispersed or geographically co-located, for instance, in one or more data centers. In some instances, the one or more servers may operate as part of a system of rapidly provisioned and released computing resources, often referred to as a “cloud computing environment.”

In the example of FIG. 1, the on-demand code execution system 110 is illustrated as connected to the network 104. In some embodiments, any of the components within the on-demand code execution system 110 can communicate with other components of the on-demand code execution system 110 via the network 104. In other embodiments, not all components of the on-demand code execution system 110 are capable of communicating with other components of the virtual environment 100. In one example, only the frontend 120 (which may in some instances represent multiple frontends 120) may be connected to the network 104, and other components of the on-demand code execution system 110 may communicate with other components of the environment 100 via the frontends 120.

In FIG. 1, users, by way of user computing devices 102, may interact with the on-demand code execution system 110 to provide source code, and establish rules or logic defining when and how such code should be executed on the on-demand code execution system 110, thus establishing a “task” which may implement a network-based service. For example, a user may wish to run a piece of code in connection with a web or mobile application that the user has developed. One way of running the code would be to acquire virtual machine instances from service providers who provide infrastructure as a service, configure the virtual machine instances to suit the user's needs, and use the configured virtual machine instances to run the code. In order to avoid the complexity of this process, the user may alternatively provide the code to the on-demand code execution system 110, and request that the on-demand code execution system 110 execute the code using one or more pre-established virtual machine instances. The on-demand code execution system 110 can handle the acquisition and configuration of compute capacity (e.g., containers, instances, etc., which are described in greater detail below) based on the code execution request, and execute the code using the compute capacity. The on-demand code execution system 110 may automatically scale up and down based on the volume, thereby relieving the user from the burden of having to worry about over-utilization (e.g., acquiring too little computing resources and suffering performance issues) or under-utilization (e.g., acquiring more computing resources than necessary to run the codes, and thus overpaying).

To enable interaction with the on-demand code execution system 110, the system 110 includes one or more frontends 120, which enable interaction with the on-demand code execution system 110. In an illustrative embodiment, the frontends 120 serve as a “front door” to the other services provided by the on-demand code execution system 110, enabling users (via user computing devices 102) to provide, request execution of, and view results of computer executable source code. The frontends 120 include a variety of components to enable interaction between the on-demand code execution system 110 and other computing devices. For example, each frontend 120 may include a request interface providing user computing devices 102 with the ability to upload or otherwise communication user-specified code to the on-demand code execution system 110 and to thereafter request execution of that code. In one embodiment, the request interface communicates with external computing devices (e.g., user computing devices 102, auxiliary services 106, authentication service 170, etc.) via a graphical user interface (GUI), CLI, or API. The frontends 120 process the requests and makes sure that the requests are properly authorized. For example, the frontends 120 may determine whether the user associated with the request (e.g., the user identified by authentication information within the request) is authorized to access the source code specified in the request.

References to source code as used herein may refer to any program code (e.g., a program, routine, subroutine, thread, etc.) written in a specific program language. In the present disclosure, the terms “source code,” “user code,” and “program code,” may be used interchangeably. Source code which has been compiled for execution on a specific device is generally referred to herein as “machine code.” Both “source code” and “machine code” are representations of the same instructions, which may be collectively referred to as “code.” Such code may be executed to achieve a specific function, for example, in connection with a particular web application or mobile application developed by the user. As noted above, individual collections of code (e.g., to achieve a specific function) are referred to herein as “tasks,” while specific executions of that code are referred to as “task executions” or simply “executions.” Source code for a task may be written, by way of non-limiting example, in JavaScript (e.g., node.js), Java, Python, and/or Ruby (and/or another programming language). Tasks may be “triggered” for execution on the on-demand code execution system 110 in a variety of manners. In one embodiment, a user or other computing device may transmit a request to execute a task may, which can generally be referred to as “call” to execute of the task. Such calls may include the source code (or the location thereof) to be executed and one or more arguments to be used for executing the source code. For example, a call may provide the source code of a task along with the request to execute the task. In another example, a call may identify a previously uploaded task by its name or an identifier. In yet another example, source code corresponding to a task may be included in a call for the task, as well as being uploaded in a separate location (e.g., storage of an auxiliary service 106 or a storage system internal to the on-demand code execution system 110) prior to the request being received by the on-demand code execution system 110. A request interface of the frontend 120 may receive calls to execute tasks as Hypertext Transfer Protocol Secure (HTTPS) requests from a user. Also, any information (e.g., headers and parameters) included in the HTTPS request may also be processed and utilized when executing a task. Any other protocols, including, for example, HTTP, MQTT, and CoAP, may be used to transfer the message containing a task call to the request interface.

A call to execute a task may specify one or more third-party libraries (including native libraries) to be used along with the user code corresponding to the task. In one embodiment, the call may provide to the on-demand code execution system 110 a ZIP file containing the source code and any libraries (and/or identifications of storage locations thereof) corresponding to the task requested for execution. In some embodiments, the call includes metadata that indicates the source code of the task to be executed, the language in which the source code is written, the user associated with the call, and/or the computing resources (e.g., memory, etc.) to be reserved for executing the source code. For example, the source code of a task may be provided with the call, previously uploaded by the user, provided by the on-demand code execution system 110 (e.g., standard routines), and/or provided by third parties. Illustratively, code not included within a call or previously uploaded by the user may be referenced within metadata of the task by use of a URI associated with the code. In some embodiments, such resource-level constraints (e.g., how much memory is to be allocated for executing a particular code) are specified for the particular task, and may not vary over each execution of the task. In such cases, the on-demand code execution system 110 may have access to such resource-level constraints before each individual call is received, and the individual call may not specify such resource-level constraints. In some embodiments, the call may specify other constraints such as permission data that indicates what kind of permissions or authorities that the call invokes to execute the task. Such permission data may be used by the on-demand code execution system 110 to access private resources (e.g., on a private network). In some embodiments, individual code sets may also be associated with permissions or authorizations. For example, a third party may submit a code object and designate the object as readable by only a subset of users. The on-demand code execution system 110 may include functionality to enforce these permissions or authorizations with respect to code sets.

In some embodiments, a call may specify the behavior that should be adopted for handling the call. In such embodiments, the call may include an indicator for enabling one or more execution modes in which to execute the task referenced in the call. For example, the call may include a flag or a header for indicating whether the task should be executed in a debug mode in which the debugging and/or logging output that may be generated in connection with the execution of the task is provided back to the user (e.g., via a console user interface). In such an example, the on-demand code execution system 110 may inspect the call and look for the flag or the header, and if it is present, the on-demand code execution system 110 may modify the behavior (e.g., logging facilities) of the container in which the task is executed, and cause the output data to be provided back to the user. In some embodiments, the behavior/mode indicators are added to the call by the user interface provided to the user by the on-demand code execution system 110. Other features such as source code profiling, remote debugging, etc. may also be enabled or disabled based on the indication provided in a call.

To manage requests for code execution, the frontend 120 can include an execution queue (not shown in FIG. 1), which can maintain a record of requested task executions. Illustratively, the number of simultaneous task executions by the on-demand code execution system 110 is limited, and as such, new task executions initiated at the on-demand code execution system 110 (e.g., via an API call, via a call from an executed or executing task, etc.) may be placed on the execution queue and processed, e.g., in a first-in-first-out order. In some embodiments, the on-demand code execution system 110 may include multiple execution queues, such as individual execution queues for each user account. For example, users of the on-demand code execution system 110 may desire to limit the rate of task executions on the on-demand code execution system 110 (e.g., for cost reasons). Thus, the on-demand code execution system 110 may utilize an account-specific execution queue to throttle the rate of simultaneous task executions by a specific user account. In some instances, the on-demand code execution system 110 may prioritize task executions, such that task executions of specific accounts or of specified priorities bypass or are prioritized within the execution queue. In other instances, the on-demand code execution system 110 may execute tasks immediately or substantially immediately after receiving a call for that task, and thus, the execution queue may be omitted.

As noted above, tasks may be triggered for execution at the on-demand code execution system 110 based on explicit calls from user computing devices 102 (e.g., as received at the request interface). Alternatively or additionally, tasks may be triggered for execution at the on-demand code execution system 110 based on data retrieved from one or more auxiliary services 106 or network-based data storage services 108. To facilitate interaction with auxiliary services 106, the frontend 120 can include a polling interface (not shown in FIG. 1), which operates to poll auxiliary services 106 or data storage services 108 for data. Illustratively, the polling interface may periodically transmit a request to one or more user-specified auxiliary services 106 or data storage services 108 to retrieve any newly available data (e.g., social network “posts,” news articles, files, records, etc.), and to determine whether that data corresponds to user-established criteria triggering execution a task on the on-demand code execution system 110. Illustratively, criteria for execution of a task may include, but is not limited to, whether new data is available at the auxiliary services 106 or data storage services 108, the type or content of the data, or timing information corresponding to the data. In some instances, the auxiliary services 106 or data storage services 108 may function to notify the frontend 120 of the availability of new data, and thus the polling service may be unnecessary with respect to such services.

In addition to tasks executed based on explicit user calls and data from auxiliary services 106, the on-demand code execution system 110 may in some instances operate to trigger execution of tasks independently. For example, the on-demand code execution system 110 may operate (based on instructions from a user) to trigger execution of a task at each of a number of specified time intervals (e.g., every 10 minutes).

The frontend 120 can further includes an output interface (not shown in FIG. 1) configured to output information regarding the execution of tasks on the on-demand code execution system 110. Illustratively, the output interface may transmit data regarding task executions (e.g., results of a task, errors related to the task execution, or details of the task execution, such as total time required to complete the execution, total data processed via the execution, etc.) to the user computing devices 102 or to auxiliary services 106, which may include, for example, billing or logging services. The output interface may further enable transmission of data, such as service calls, to auxiliary services 106. For example, the output interface may be utilized during execution of a task to transmit an API request to an external service 106 (e.g., to store data generated during execution of the task).

In some embodiments, the on-demand code execution system 110 may include multiple frontends 120. In such embodiments, a load balancer (not shown in FIG. 1) may be provided to distribute the incoming calls to the multiple frontends 120, for example, in a round-robin fashion. In some embodiments, the manner in which the load balancer distributes incoming calls to the multiple frontends 120 may be based on the location or state of other components of the on-demand code execution system 110. For example, a load balancer may distribute calls to a geographically nearby frontend 120, or to a frontend with capacity to service the call. In instances where each frontend 120 corresponds to an individual instance of another component of the on-demand code execution system, such as the warming pools 130A or active pools 140A described below, the load balancer may distribute calls according to the capacities or loads on those other components. As will be described in more detail below, calls may in some instances be distributed between frontends 120 deterministically, such that a given call to execute a task will always (or almost always) be routed to the same frontend 120. This may, for example, assist in maintaining an accurate execution record for a task, to ensure that the task executes only a desired number of times. While distribution of calls via a load balancer is illustratively described, other distribution techniques, such as anycast routing, will be apparent to those of skill in the art.

To execute tasks, the on-demand code execution system 110 includes one or more warming pool managers 130, which “pre-warm” (e.g., initialize) virtual machine instances to enable tasks to be executed quickly, without the delay caused by initialization of the virtual machines. The on-demand code execution system 110 further includes one or more worker managers 140, which manage active virtual machine instances (e.g., currently assigned to execute tasks in response to task calls).

The warming pool managers 130 ensure that virtual machine instances are ready to be used by the worker managers 140 when the on-demand code execution system 110 detects an event triggering execution of a task on the on-demand code execution system 110. In the example illustrated in FIG. 1, each warming pool manager 130 manages a corresponding warming pool 130A, which is a group (sometimes referred to as a pool) of pre-initialized and pre-configured virtual machine instances that may be used to execute tasks in response to triggering of those tasks. In some embodiments, the warming pool managers 130 cause virtual machine instances to be booted up on one or more physical computing machines within the on-demand code execution system 110 and added to a corresponding warming pool 130A. For example, each warming pool manager 130 may cause additional instances to be added to the corresponding warming pool 130A based on the available capacity in the corresponding warming pool 130A to service incoming calls. As will be described below, the warming pool managers 130 may further work in conjunction with other components of the on-demand code execution system 110, such as the worker managers 140, to add or otherwise manage instances and/or containers in the warming pools 130A based on received pre-trigger notifications. In some embodiments, the warming pool managers 130 may use both physical computing devices within the on-demand code execution system 110 and one or more virtual machine instance services to acquire and maintain compute capacity that can be used to service calls received by the frontends 120. Further, the on-demand code execution system 110 may comprise one or more logical knobs or switches for controlling (e.g., increasing or decreasing) the available capacity in the warming pools 130A. For example, a system administrator may use such a knob or switch to increase the capacity available (e.g., the number of pre-booted instances) in the warming pools 130A during peak hours. In some embodiments, virtual machine instances in the warming pools 130A can be configured based on a predetermined set of configurations independent from a specific call to execute a task. The predetermined set of configurations can correspond to various types of virtual machine instances to execute tasks. The warming pool managers 130 can optimize types and numbers of virtual machine instances in the warming pools 130A based on one or more metrics related to current or previous task executions. Further, the warming pool managers 130 can establish or modify the types and number of virtual machine instances in the warming pools 130A based on pre-trigger notifications (e.g., by pre-initializing one or more virtual machine instances based on requirements of a task expected to be executed based on a received pre-trigger notification).

As shown in FIG. 1, instances may have operating systems (OS) and/or language runtimes loaded thereon. For example, the warming pool 130A managed by a warming pool manager 130 can comprise instances 152, 154. The instance 152 includes an OS 152A and a runtime 152B. The instance 154 includes an OS 154A. In some embodiments, the instances in the warming pool 130A may also include containers (which may further contain copies of operating systems, runtimes, user codes, etc.), which are described in greater detail below. Although the instance 152 is shown in FIG. 1 to include a single runtime, in other embodiments, the instances depicted in FIG. 1 may include two or more runtimes, each of which may be used for running a different user code. In some embodiments, the warming pool managers 130 may maintain a list of instances in a corresponding warming pool 130A. The list of instances may further specify the configuration (e.g., OS, runtime, container, etc.) of the instances.

In some embodiments, the virtual machine instances in a warming pool 130A may be used to serve any user's calls. In one embodiment, all the virtual machine instances in a warming pool 130A are configured in the same or substantially similar manner. In another embodiment, the virtual machine instances in a warming pool 130A may be configured differently to suit the needs of different users. For example, the virtual machine instances may have different operating systems, different language runtimes, and/or different libraries loaded thereon. In yet another embodiment, the virtual machine instances in a warming pool 130A may be configured in the same or substantially similar manner (e.g., with the same OS, language runtimes, and/or libraries), but some of those instances may have different container configurations. For example, one instance might have a container created therein for running code written in Python, and another instance might have a container created therein for running code written in Ruby.

The warming pool managers 130 may pre-configure the virtual machine instances in a warming pool 130A, such that each virtual machine instance is configured to satisfy at least one of the operating conditions that may be requested or specified by a user when defining a task. In one embodiment, the operating conditions may include program languages in which the potential source code of a task may be written. For example, such languages may include Java, JavaScript, Python, Ruby, and the like. In some embodiments, the set of languages that the source code of a task may be written in may be limited to a predetermined set (e.g., set of 4 languages, although in some embodiments sets of more or less than four languages are provided) in order to facilitate pre-initialization of the virtual machine instances that can satisfy calls to execute the task. For example, when the user is configuring a task via a user interface provided by the on-demand code execution system 110, the user interface may prompt the user to specify one of the predetermined operating conditions for executing the task. In another example, the service-level agreement (SLA) for utilizing the services provided by the on-demand code execution system 110 may specify a set of conditions (e.g., programming languages, computing resources, etc.) that tasks should satisfy, and the on-demand code execution system 110 may assume that the tasks satisfy the set of conditions in handling the requests. In another example, operating conditions specified by a task may include: the amount of compute power to be used for executing the task; the type of triggering event for a task (e.g., an API call, HTTP packet transmission, detection of a specific data at an auxiliary service 106); the timeout for the task (e.g., threshold time after which an execution of the task may be terminated); and security policies (e.g., may control which instances in the warming pools 130A are usable by which user), among other specified conditions.

One or more worker managers 140 manage the instances used for servicing incoming calls to execute tasks. In the example illustrated in FIG. 1, each worker managers 140 manages an active pool 140A, which is a group (sometimes referred to as a pool) of virtual machine instances, implemented by one or more physical host computing devices, that are currently assigned to one or more users. Although the virtual machine instances are described here as being assigned to a particular user, in some embodiments, the instances may be assigned to a group of users, such that the instance is tied to the group of users and any member of the group can utilize resources on the instance. For example, the users in the same group may belong to the same security group (e.g., based on their security credentials) such that executing one member's task in a container on a particular instance after another member's task has been executed in another container on the same instance does not pose security risks. Similarly, the worker managers 140 may assign the instances and the containers according to one or more policies that dictate which requests can be executed in which containers and which instances can be assigned to which users. An example policy may specify that instances are assigned to collections of users who share the same account (e.g., account for accessing the services provided by the on-demand code execution system 110). In some embodiments, the requests associated with the same user group may share the same containers (e.g., if the user codes associated therewith are identical). In some embodiments, a task does not differentiate between the different users of the group and simply indicates the group to which the users associated with the task belong.

As shown in FIG. 1, instances may have operating systems (OS), language runtimes, and containers. The containers may have individual copies of the OS, the runtimes, and user codes corresponding to various tasks loaded thereon. In the example of FIG. 1, the active pools 140A managed by a worker manager 140 includes the instances 156, 158. The instance 156 has an OS 156A, runtimes 156B, 156C, and containers 156D, 156E. The container 156D includes a copy of the OS 156A, a copy of the runtime 156B, and a copy of a code 156D-1. The container 156E includes a copy of the OS 156A, a copy of the runtime 156C, and a copy of a code 156E-1. The instance 158 has an OS 158A, runtimes 158B, 158C, 158E, 158F, a container 158D, and codes 158G, 158H. The container 158D has a copy of the OS 158A, a copy of the runtime 158B, and a copy of a code 158D-1. As illustrated in FIG. 1, instances may have user codes loaded thereon, and containers within those instances may also have user codes loaded therein. In some embodiments, the runtimes may also be user provided. A runtime—sometimes referred to as a runtime system—generally includes a set of software designed to support execution of source code written in a given computer language. In accordance with the present disclosure, the runtime may include a JIT compiler configured to implement a variety of trace-based optimization techniques. The runtime may further include an interpreter or other system to enable execution of the source code without or in cooperation with the JIT compiler. In some embodiments, the worker managers 140 may maintain a list of instances in an active pool 140A. The list of instances may further specify the configuration (e.g., OS, runtime, container, etc.) of the instances. In some embodiments, the worker managers 140 may have access to a list of instances in a warming pool 130A (e.g., including the number and type of instances). In other embodiments, the worker managers 140 requests compute capacity from a warming pool manager 130 without having knowledge of the virtual machine instances in a warming pool 130A.

In the example illustrated in FIG. 1, tasks are executed in isolated execution environments referred to as containers (e.g., containers 156D, 156E, 158D). Containers are logical units created within a virtual machine instance using the resources available on that instance. For example, each worker manager 140 may, based on information specified in a call to execute a task, create a new container or locate an existing container in one of the instances in an active pool 140A and assigns the container to the call to handle the execution of the task. In one embodiment, such containers are implemented as Linux containers.

Once a triggering event to execute a task has been successfully processed by a frontend 120, the frontend 120 passes a request to a worker manager 140 to execute the task. In one embodiment, each frontend 120 may be associated with a corresponding worker manager 140 (e.g., a worker manager 140 co-located or geographically nearby to the frontend 120) and thus, the frontend 120 may pass most or all requests to that worker manager 140. In another embodiment, a frontend 120 may include a location selector 126 configured to determine a worker manager 140 to which to pass the execution request. Illustratively, to assist in implementation of execution guarantees, the location selector 126 to select the same worker manager 140 to receive each call to a task to the same worker manager 140, such that the worker manager 140 can maintain an authoritative execution record for the task. In one embodiment, the location selector 126 may determine the worker manager 140 to receive a call based on hashing the call, and distributing the call to a worker manager 140 selected based on the hashed value (e.g., via a hash ring). Various other mechanisms for distributing calls between worker managers 140 will be apparent to one of skill in the art.

On receiving a request to execute a task, a worker manager 140 finds capacity to execute a task on the on-demand code execution system 110. For example, if there exists a particular virtual machine instance in the active pool 140A that has a container with the user code of the task already loaded therein (e.g., code 156D-1 shown in the container 156D), the worker manager 140 may assign the container to the task and cause the task to be executed in the container. Alternatively, if the user code of the task is available in the local cache of one of the virtual machine instances (e.g., codes 158G, 158H, which are stored on the instance 158 but do not belong to any individual containers), the worker manager 140 may create a new container on such an instance, assign the container to the task, and cause the user code of the task to be loaded and executed in the container.

If the worker manager 140 determines that the source code associated with the triggered task is not found on any of the instances (e.g., either in a container or the local cache of an instance) in the active pool 140A, the worker manager 140 may determine whether any of the instances in the active pool 140A is currently assigned to the user associated with the triggered task and has compute capacity to handle the triggered task. If there is such an instance, the worker manager 140 may create a new container on the instance and assign the container to execute the triggered task. Alternatively, the worker manager 140 may further configure an existing container on the instance assigned to the user, and assign the container to the triggered task. For example, the worker manager 140 may determine that the existing container may be used to execute the task if a particular library demanded by the task is loaded thereon. In such a case, the worker manager 140 may load the particular library and the code of the task onto the container and use the container to execute the task.

If the active pool 140 does not contain any instances currently assigned to the user, the worker manager 140 pulls a new virtual machine instance from the warming pool 130A, assigns the instance to the user associated with the triggered task, creates a new container on the instance, assigns the container to the triggered task, and causes the source code of the task to be downloaded and executed on the container.

In some embodiments, the on-demand code execution system 110 is adapted to begin execution of a task shortly after it is received (e.g., by the frontend 120). A time period can be determined as the difference in time between initiating execution of the task (e.g., in a container on a virtual machine instance associated with the user) and detecting an event that triggers execution of the task (e.g., a call received by the frontend 120). The on-demand code execution system 110 is adapted to begin execution of a task within a time period that is less than a predetermined duration. In one embodiment, the predetermined duration is 500 ms. In another embodiment, the predetermined duration is 300 ms. In another embodiment, the predetermined duration is 100 ms. In another embodiment, the predetermined duration is 50 ms. In another embodiment, the predetermined duration is 10 ms. In another embodiment, the predetermined duration may be any value chosen from the range of 10 ms to 500 ms. In some embodiments, the on-demand code execution system 110 is adapted to begin execution of a task within a time period that is less than a predetermined duration if one or more conditions are satisfied. For example, the one or more conditions may include any one of: (1) the source code of the task is loaded on a container in the active pool 140 at the time the request is received; (2) the source code of the task is stored in the code cache of an instance in the active pool 140 at the time the call to the task is received; (3) the active pool 140A contains an instance assigned to the user associated with the call at the time the call is received; or (4) the warming pool 130A has capacity to handle the task at the time the event triggering execution of the task is detected.

Once the worker manager 140 locates one of the virtual machine instances in the warming pool 130A that can be used to execute a task, the warming pool manager 130 or the worker manger 140 takes the instance out of the warming pool 130A and assigns it to the user associated with the request. The assigned virtual machine instance is taken out of the warming pool 130A and placed in the active pool 140A. In some embodiments, once the virtual machine instance has been assigned to a particular user, the same virtual machine instance cannot be used to execute tasks of any other user. This provides security benefits to users by preventing possible co-mingling of user resources. Alternatively, in some embodiments, multiple containers belonging to different users (or assigned to requests associated with different users) may co-exist on a single virtual machine instance. Such an approach may improve utilization of the available compute capacity.

In some embodiments, the on-demand code execution system 110 may maintain a separate cache in which code of tasks are stored to serve as an intermediate level of caching system between the local cache of the virtual machine instances and the account data store 164 (or other network-based storage not shown in FIG. 1). The various scenarios that the worker manager 140 may encounter in servicing the call are described in greater detail within the '556 Patent, incorporated by reference above (e.g., at FIG. 4 of the '556 Patent).

After the task has been executed, the worker manager 140 may tear down the container used to execute the task to free up the resources it occupied to be used for other containers in the instance. Alternatively, the worker manager 140 may keep the container running to use it to service additional calls from the same user. For example, if another call associated with the same task that has already been loaded in the container, the call can be assigned to the same container, thereby eliminating the delay associated with creating a new container and loading the code of the task in the container. In some embodiments, the worker manager 140 may tear down the instance in which the container used to execute the task was created. Alternatively, the worker manager 140 may keep the instance running to use it to service additional calls from the same user. The determination of whether to keep the container and/or the instance running after the task is done executing may be based on a threshold time, the type of the user, average task execution volume of the user, and/or other operating conditions. For example, after a threshold time has passed (e.g., 5 minutes, 30 minutes, 1 hour, 24 hours, 30 days, etc.) without any activity (e.g., task execution), the container and/or the virtual machine instance is shutdown (e.g., deleted, terminated, etc.), and resources allocated thereto are released. In some embodiments, the threshold time passed before a container is torn down is shorter than the threshold time passed before an instance is torn down.

In some embodiments, the on-demand code execution system 110 may provide data to one or more of the auxiliary services 106 as it executes tasks in response to triggering events. For example, the frontends 120 may communicate with the monitoring/logging/billing services included within the auxiliary services 106. The monitoring/logging/billing services may include: a monitoring service for managing monitoring information received from the on-demand code execution system 110, such as statuses of containers and instances on the on-demand code execution system 110; a logging service for managing logging information received from the on-demand code execution system 110, such as activities performed by containers and instances on the on-demand code execution system 110; and a billing service for generating billing information associated with executing user code on the on-demand code execution system 110 (e.g., based on the monitoring information and/or the logging information managed by the monitoring service and the logging service). In addition to the system-level activities that may be performed by the monitoring/logging/billing services (e.g., on behalf of the on-demand code execution system 110), the monitoring/logging/billing services may provide application-level services on behalf of the tasks executed on the on-demand code execution system 110. For example, the monitoring/logging/billing services may monitor and/or log various inputs, outputs, or other data and parameters on behalf of the tasks being executed on the on-demand code execution system 110.

In some embodiments, the worker managers 140 may perform health checks on the instances and containers managed by the worker managers 140 (e.g., those in a corresponding active pool 140A). For example, the health checks performed by a worker manager 140 may include determining whether the instances and the containers managed by the worker manager 140 have any issues of (1) misconfigured networking and/or startup configuration, (2) exhausted memory, (3) corrupted file system, (4) incompatible kernel, and/or any other problems that may impair the performance of the instances and the containers. In one embodiment, a worker manager 140 performs the health checks periodically (e.g., every 5 minutes, every 30 minutes, every hour, every 24 hours, etc.). In some embodiments, the frequency of the health checks may be adjusted automatically based on the result of the health checks. In other embodiments, the frequency of the health checks may be adjusted based on user requests. In some embodiments, a worker manager 140 may perform similar health checks on the instances and/or containers in a warming pool 130A. The instances and/or the containers in a warming pool 130A may be managed either together with those instances and containers in an active pool 140A or separately. In some embodiments, in the case where the health of the instances and/or the containers in a warming pool 130A is managed separately from an active pool 140A, a warming pool manager 130, instead of a worker manager 140, may perform the health checks described above on the instances and/or the containers in a warming pool 130A.

In the depicted example, virtual machine instances (“instances”) 152, 154 are shown in a warming pool 130A managed by a warming pool manager 130, and instances 156, 158 are shown in an active pool 140A managed by a worker manager 140. The illustration of the various components within the on-demand code execution system 110 is logical in nature and one or more of the components can be implemented by a single computing device or multiple computing devices. For example, the instances 152, 154, 156, 158 can be implemented on one or more physical computing devices in different various geographic regions. Similarly, each frontend 120, warming pool manager 130, and worker manager 140 can be implemented across multiple physical computing devices. Alternatively, one or more of a frontend 120, a warming pool manager 130, and a worker manager 140 can be implemented on a single physical computing device. Although four virtual machine instances are shown in the example of FIG. 1, the embodiments described herein are not limited as such, and one skilled in the art will appreciate that the on-demand code execution system 110 may comprise any number of virtual machine instances implemented using any number of physical computing devices. Similarly, although multiple warming pools 130A and active pools 140A are shown in the example of FIG. 1, the embodiments described herein are not limited as such, and one skilled in the art will appreciate that the on-demand code execution system 110 may comprise any number of warming pools and active pools.

In accordance with embodiments of the present disclosure, the worker manager 140 can be configured to generate execution environments (e.g., VM instances, containers, etc.) scoped to the privileges of a user requesting execution of a task on the system 110 (e.g., to create an instance of a network-based service). In one embodiment, scoping the privileges of an execution environment may include passing authentication information received within a request to execute a task into the execution environment, such that the execution environment is limited in it's access to other network-based services to those which are accessible based on the passed authentication information. This mechanism of passing authentication information can effectively limit the scope of privileges of an environment, particularly in instances where the ability of a task execution to cause permanent modifications to the on-demand code execution system 110 or other systems is limited. For example, where local modifications to the execution environment are not persisted at the system 110 (which in one embodiment of the system 110 they are not), then no local authorization need by conducted at the system 110 with respect to the environment. However, in some embodiments, it may be desirable for the worker manager 140 to additionally implement authorization at the system 110 based on authentication information passed within a request which causes execution of the code in the environment. For example, where a user attempts to access a task-based service implemented in an environment of the system 110, the worker manager 140 may limit the abilities of the environment to match privileges of the user, based on authentication information in the request to access the service. Illustratively, where the user (identified based on authentication information) has no privileges to write to a hard disk drive of the environment, the worker manager 140 may implement the environment such that no code executing within the environment may right to a hard disk drive of the environment, or the worker manager 140 may implement the environment without a hard disk drive. Thus, even if vulnerabilities were to exist within code executing a service, those vulnerabilities could not be exploited to gain access to additional privileges.

FIG. 2 depicts a general architecture of a computing system (referenced as worker manager 140) that manages the virtual machine instances in the on-demand code execution system 110. The general architecture of the worker manager 140 depicted in FIG. 2 includes an arrangement of computer hardware and software modules that may be used to implement aspects of the present disclosure. The hardware modules may be implemented with physical electronic devices, as discussed in greater detail below. The worker manager 140 may include many more (or fewer) elements than those shown in FIG. 2. It is not necessary, however, that all of these generally conventional elements be shown in order to provide an enabling disclosure. Additionally, the general architecture illustrated in FIG. 2 may be used to implement one or more of the other components illustrated in FIG. 1. As illustrated, the worker manager 140 includes a processing unit 190, a network interface 192, a computer readable medium drive 194, and an input/output device interface 196, all of which may communicate with one another by way of a communication bus. The network interface 192 may provide connectivity to one or more networks or computing systems. The processing unit 190 may thus receive information and instructions from other computing systems or services via the network 104. The processing unit 190 may also communicate to and from memory 180 and further provide output information for an optional display (not shown) via the input/output device interface 196. The input/output device interface 196 may also accept input from an optional input device (not shown).

The memory 180 may contain computer program instructions (grouped as modules in some embodiments) that the processing unit 190 executes in order to implement one or more aspects of the present disclosure. The memory 180 generally includes random access memory (RAM), read only memory (ROM) and/or other persistent, auxiliary or non-transitory computer readable media. The memory 180 may store an operating system 184 that provides computer program instructions for use by the processing unit 190 in the general administration and operation of the worker manager 140. The memory 180 may further include computer program instructions and other information for implementing aspects of the present disclosure. For example, in one embodiment, the memory 180 includes a user interface unit 182 that generates user interfaces (and/or instructions therefor) for display upon a computing device, e.g., via a navigation and/or browsing interface such as a browser or application installed on the computing device. In addition, the memory 180 may include and/or communicate with one or more data repositories (not shown), for example, to access user program codes and/or libraries.

In addition to and/or in combination with the user interface unit 182, the memory 180 may include an instance allocation unit 186 and a user code execution unit 188 that may be executed by the processing unit 190. In one embodiment, the user interface unit 182, instance allocation unit 186, and user code execution unit 188 individually or collectively implement various aspects of the present disclosure, e.g., finding compute capacity (e.g., a container) to be used for executing user code, causing the user code to be loaded and executed on the container, etc.

The instance allocation unit 186 finds the compute capacity to be used for servicing a request to execute user code. For example, the instance allocation unit 186 identifies a virtual machine instance and/or a container that satisfies any constraints specified by the request and assigns the identified virtual machine instance and/or container to the user or the request itself. The instance allocation unit 186 may perform such identification based on the programming language in which the user code is written. For example, if the user code is written in Python, and the instance allocation unit 186 may find a virtual machine instance (e.g., in the warming pool 130A of FIG. 1) having the Python runtime pre-loaded thereon and assign the virtual machine instance to the user. In another example, if the program code specified in the request of the user is already loaded on an existing container or on another virtual machine instance assigned to the user (e.g., in the active pool 140A of FIG. 1), the instance allocation unit 186 may cause the request to be processed in the container or in a new container on the virtual machine instance. In some embodiments, if the virtual machine instance has multiple language runtimes loaded thereon, the instance allocation unit 186 may create a new container on the virtual machine instance and load the appropriate language runtime on the container based on the computing constraints specified in the request.

The user code execution unit 188 manages the execution of the program code specified by the request of the user once a particular virtual machine instance has been assigned to the user associated with the request and a container on the particular virtual machine instance has been assigned to the request. If the code is pre-loaded in a container on the virtual machine instance assigned to the user, the code is simply executed in the container. If the code is available via a network storage (e.g., an auxiliary service 106 of FIG. 1), the user code execution unit 188 downloads the code into a container on the virtual machine instance and causes the code to be executed (e.g., by communicating with the frontend 120 of FIG. 1) once it has been downloaded.

In addition, the memory further includes an authentication provisioning unit 189, which executed by the processing unit 190 enables the worker manager 140 to scope an execution environment's privileges based on authentication information passed within a request which causes execution of a task within the environment. The authentication provisioning unit 189 may scope the environment's privileges, for example, by passing to the environment the authentication information of the request, and potentially be excluding the environment from accessing other authentication information (such as authentication information of a user who created a task, which user may be distinct from a user who submits a request to access a service implemented as an execution a task). The authentication provisioning unit 189 may further scope the privileges of an execution environment may limiting the ability of the environment to take actions on the system 110. Illustratively, the authentication provisioning unit 189 may, during initialization of an environment, scope the abilities of the environment based on privileges associated with authentication information passed within a request to execute code within the environment. As such, code executing within the environment may not be required to conduct authentication or authorization, negating the possibility of vulnerabilities within such code.

While the instance allocation unit 186, the user code execution unit 188, and authentication provisioning unit 189 are shown in FIG. 2 as part of the worker manager 140, in other embodiments, all or a portion of the instance allocation unit 186, the user code execution unit 188, and authentication provisioning unit 189 may be implemented by other components of the on-demand code execution system 110 and/or another computing device. For example, in certain embodiments of the present disclosure, another computing device in communication with the on-demand code execution system 110 may include several modules or components that operate similarly to the modules and components illustrated as part of the worker manager 140.

In some embodiments, the worker manager 140 may further include components other than those illustrated in FIG. 2. For example, the memory 180 may further include a container manager for managing creation, preparation, and configuration of containers within virtual machine instances, such as based on task queues associated with a variety of different runtimes submitted to or available on the on-demand code execution system 110.

With reference to FIG. 3, illustrative interactions are depicted for implementing escalation-resistant services within an environment of the on-demand code execution system 110 which has privileges scoped to those of a requesting user.

The interactions of FIG. 3 begin at (1), where a user device 102 submits an authentication request to the authentication service 170. The authentication request 170 may be transmitted, for example, via user interaction with a login process implemented on the user device 120 (which login process may be implemented by a software application on the device 120, for example). The authentication request may include authentication information of the user, such as a username and password, secret key, biometric information, secure information generated based on the foregoing (e.g., a cryptographic hash), or the like.

At (2), the authentication service 170 authenticates the user device 102, by verifying that the information within the authentication request matches or otherwise corresponds to information stored at the authentication service 170. For example, the authentication service 170 may confirm that cryptographic hash within the request matches a hash stored at the service 170. Thereafter, the authentication service 170 generates authentication information for the user device 102, which may be passed to other services to indicate that the user device 102 has authenticated with the authentication service 170 as a particular identity (e.g., a given user). In one embodiment, the authentication information is a “token”—a secret data value (likely cryptographic). The token may be associated with various restrictions, such as a time period during which the token is valid. At (4), the authentication service 170 returns the authentication information to the user device 102 such that the user device 102 may present the authentication information to other services in order to authenticate with such services.

Thereafter, the user device 102, at (5), transmits a request to the on-demand code execution system 110 to access a service implemented by a task executing on the system 110. The request may be generated, for example, based on software executing on the user device 102. In one embodiment, the request is an HTTP request. The request illustratively includes the authentication information provided to the user device 102 by the authentication service 170 (e.g., as an authentication token), which the system 110 can utilize to generate an escalation-resistant instance of the requested service.

Specifically, at (6), the frontend 120 of the system 110 transmits to a worker manager 140 instructions to execute a task corresponding to the requested service, using the authentication information. The task may be identified, for example, based on information within the request (e.g., a URL to which the request was transmitted). While not shown in FIG. 3, the frontend 120 may additionally take other actions, such as verifying whether the user device 102, as identified by the authentication information, is enabled to execute the requested task.

At (7), the worker manager 140 generates an execution environment 302 scoped to the authentication information provided by the user device 102. The execution environment 302 may be, for example, a virtual machine instance or a container. In one embodiment, generation of a scoped execution environment 302 may include passing the authentication information to the execution environment 302, and ensuring that the execution environment 302 does not have access to other authentication information (e.g., of other users, of an administrator, etc.). For example, if the worker manager 140 elects to reuse an execution environment 302 previously created for another user, the worker manager 140 may wipe a memory location of the execution environment 302 associated with authentication information of the other user, and place within that location the authentication information of the requesting user device 120. Thus, the execution environment 302 may be prevented from using authentication information other than that provided within the request. In other embodiments, the worker manager 140 may additionally or alternatively set privileges of the execution environment 302 based on the authentication information passed from the user device 120. For example, the worker manager 140 may access privileges previously associated with the authentication information (or a user identified by such information), and generate an execution environment 302 with those privileges. Illustratively, if a user identified by authentication information is restricted from making persistent changes to an execution environment, the worker manager 140 may configured the execution environment 302 such that changes to the execution environment 302 made during execution of the task on behalf of the user are discarded by a host system (e.g., a hypervisor or host OS).

Thereafter, at (8), code of the task executes within the scoped execution environment. Illustratively, the task execution may utilize the information of the request to undertake some action on behalf of the user device 102. In doing so the task execution may, for example, access one or more other network services, and authenticate itself with such other network services. In a conventional service implementation, the information used to authenticate one service with another is typically broader than the authentication information passed to the first service. For example, a data processing service may authenticate itself to a database service and gain privileges through such authentication to modify an entire table in the service. The data processing service may then modify only a portion of that table required to service a given user request. However, if a vulnerability exists in the code of the data processing service, it is conceivable that a specifically crafted request may allow a user to modify other portions of the table, to which the data processing service has privileges but the user does not, resulting in privilege escalation. In contrast to this model, the scoped execution environment 302 of FIG. 3 can be prevented from authenticating with other services as any identity other than that identified within the authentication information used to call the task execution in the environment 302. Thus, if the task of the environment 302 were to implement the data processing service noted above, a given execution of the task would, independently of the code of the task, gain access only to those rows of the table needed to service the user request. In this manner, and contrary to conventional service implementations, the code which implements the service need not be required to implement authorization control, and thus will not be subject to privilege escalation vulnerabilities.

While the interactions of FIG. 3 are shown with respect to a single request to execution of a service, the interactions of FIG. 3 may occur multiple times, serially, in parallel, or both. As such, each user which requests to access a service may be provided with an isolated instance of that service, with privileges scoped to a requesting user. In this way, services may be created that can provide high levels of scalability while isolating each service instance to the privileges of a user who interacts with the instance.

Moreover, while the request of FIG. 3 is depicted as stemming from a user device 102, requests may be generated by any number of devices. Illustratively, the user device 102 may configure an auxiliary service 106 to transmit service request to the on-demand code execution system 110 on behalf of a user. As another example, a user device 102 may configure the system 110 itself to generate service requests, which in turn cause execution of a request-scoped service instance. Illustratively, a given user may specify that the system 110 execute a task on behalf of the user periodically, or in response to state changes on the system 110 or other devices. The user may enable the system 110 to pass authentication information associated with the user within requests to execute the task which are generated by the system 110 based on the user's specifications. Thus, the system 110 may operate to periodically or occasionally generate escalation-resistant service instances on behalf of a specifying user. From at least the foregoing examples, it should be understood that a service request (or a request to execute a task on the system 110) may be obtained from any number of sources.

With reference to FIG. 4, illustrative interactions are described for interactions between an escalation-resistant service implemented by executions of a task within a scoped execution environment 302 of the system 110. The interactions of FIG. 4 may occur, for example, subsequent to the interactions of FIG. 3.

The interactions of FIG. 4 begin at (1), where a task executing within a scoped execution environment attempts to call an auxiliary service 106, such as a database service. Illustratively, the call may be generated based on execution of code within the scoped environment 302, which code attempts to call an auxiliary service 106 via function call.

While the privileges of the scoped execution environment 302 would be limited to those of a calling user, in some embodiments, it may be desirable for calls from the scoped execution environment 302 to be further restricted. For example, it may be desirable to prevent a task executing within a scoped execution environment 302 from itself accessing the service implemented by the environment 302, or to prevent other services called by the task execution from gaining the full authentication information of a user who called the service as implemented in the environment 302. As such, the call from the environment 302 may be intercepted by the worker manager 140 (e.g., via configuration of a host for the scoped execution environment 302). Thereafter, at (2), the authentication information included within the call may be scoped down by the worker manager 140, to further restrict the privileges to which the authentication information provides access. In one embodiment, privileges may be scoped down based on authorizations of a user identified within the authentication information of the environment 302. For example, a creator of a task which implements a service may specify that instances of that service, executing on behalf of individual users, are disallowed from invoking additional instances of the service on the system 110. Thus, the worker manager 140 may remove portions of the authentication information that authenticate the user with the system 110 from any calls issued from the scoped execution environment 302 (which has inherited the authorization of a calling user). Accordingly, any attempt to call for an additional instance of the service from the scoped execution environment 302 is expected to fail, as authentication information for the system 110 would be removed from such a call. In one embodiment, scoping down of authentication information may be accomplished by removing a portion of the authentication information associated with a service which the scoped environment 3021 is disallowed from calling.

After scoping down the authentication information, the worker manager 140, at (3), transmits the call to an original destination (e.g., an auxiliary service 106) including the scoped down authentication information. The auxiliary service 106 in turn, at (3), determines the environment 302 authorization to access the service 106 based on the scoped down authentication information, and returns a response to the call based on the determined authorization, at (4). As noted above, because the authentication information passed within the call to the auxiliary service 106 provides no greater privileges than those of the user for which the environment 302 was created, the call to the auxiliary service 106 should similarly be limited to accessing privileges available to that user. In this manner, task executing within the scoped execution environment 302 provides an escalation-resistant service.

With reference to FIG. 5, one illustrative routine 500 is depicted to implement an escalation-resistant network service. The routine 500 may be implemented, for example, by the on-demand code execution system 110.

The routine 500 begins at block 502, where a request is received at the system 100 to access a service implemented by execution of a task on the system 110. The request includes or otherwise specifies authentication information for a user who wishes to access the service. In one embodiment, the authentication information is an authentication token, such as may be issued by the authentication service 170.

At block 504, the system 110 generates an execution environment, such as a virtual machine instance or container, which has privileges scoped to those of the user identified by the authentication information. Scoping of privileges for an environment may include, for example, ensuring that the environment has only the authentication information of the request to access the service, and thus may not authenticate itself as another entity (e.g., another user, administrator, etc.). Scoping of the privileges for the environment may further include limiting the abilities of any code executing within the environment to undertake actions other than those authorized based on the authentication information. For example, scoping the privileges of the environment may include limiting a type of data which can be transmitted from the environment (e.g., based on network protocol) to those types of data allowed based on authentication information.

At block 506, code of the task implementing the service is executed within the scoped environment, in order to provide an escalation-resistant instance of the service. Specifically, because the privileges of the environment are limited to those of a user accessing the instance of the service, it is expected that the code executing the service will be unable to take actions other than authorized under those privileges, even if vulnerabilities in that code were to exist. Thus, the instance of the service can be considered escalation-resistant.

At block 508, implementation of the routine 500 varies according to whether additional requests to access the service are received. As noted above, the system 110 in some instances may function to maintain an execution environment in which a task can execute for some period of time after an execution of the task completes. In this manner, the system 110 can better utilize resources, by reducing the need to create new execution environments. However, in such an instance, if authentication information is persisted across task executions, a later execution of a task may be able to obtain privileges associated with a prior execution. For this reason, if additional service requests are obtained and are to be serviced by a task execution of an existing execution environment, the routine 500 continues to block 510, where existing authentication information (e.g., passed in a prior request to access the service) is removed from the execution environment. The routine 500 then returns to block 504, where the execution environment is scoped to the authentication information provided by a subsequent request to access the service. The routine 500 may continue in the above manner until no additional calls to access the service are received, at which point the routine 500 can end at block 512.

While the routine 500 is described above sequentially, it may be desirable in some instances for a service to handle multiple concurrent requests. The traditional model for doing so is to provide a service instance with sufficient privileges to service requests from multiple clients, which privileges are typically at least a superset of the privileges of each client who concurrently requests the service. This traditional model generally leaves a service vulnerable at least in theory to privilege escalation attacks. To maintain an escalation-resistant service while enabling concurrent handling of user requests, embodiments of the present disclosure may implement multiple instances of the routine 500 concurrently, such that individual concurrent users are serviced by isolated service instances, each scoped to the privileges of a respective individual user.

While embodiments of the present disclosure are described with respect to execution environments whose privileges are scoped to those of individual users, some embodiments may enable service instances to be implemented on execution environments whose privileges are scoped to the privileges of a group of users, between which a lesser security for privilege escalation is acceptable. For example, two service instances may be provided to handle requests for users within two organizations, respectively. Each service instance may obtain privileges scoped to their respective organizations. Thus, each service instance may be said to be escalation resistant with respect to privileges of the other organization. Grouping of users in this manner may increase the efficiency of implementation of a service on the system 110, since multiple user requests could be handled concurrently within a single service instance. However, the greater scope of privileges of a service instance may leave a possibility of privilege escalation within that scope of privileges.

All of the methods and processes described above may be embodied in, and fully automated via, software code modules executed by one or more computers or processors. The code modules may be stored in any type of non-transitory computer-readable medium or other computer storage device. Some or all of the methods may alternatively be embodied in specialized computer hardware.

Conditional language such as, among others, “can,” “could,” “might” or “may,” unless specifically stated otherwise, are otherwise understood within the context as used in general to present that certain embodiments include, while other embodiments do not include, certain features, elements and/or steps. Thus, such conditional language is not generally intended to imply that features, elements and/or steps are in any way required for one or more embodiments or that one or more embodiments necessarily include logic for deciding, with or without user input or prompting, whether these features, elements and/or steps are included or are to be performed in any particular embodiment.

Disjunctive language such as the phrase “at least one of X, Y or Z,” unless specifically stated otherwise, is otherwise understood with the context as used in general to present that an item, term, etc., may be either X, Y or Z, or any combination thereof (e.g., X, Y and/or Z). Thus, such disjunctive language is not generally intended to, and should not, imply that certain embodiments require at least one of X, at least one of Y or at least one of Z to each be present.

Unless otherwise explicitly stated, articles such as ‘a’ or ‘an’ should generally be interpreted to include one or more described items. Accordingly, phrases such as “a device configured to” are intended to include one or more recited devices. Such one or more recited devices can also be collectively configured to carry out the stated recitations. For example, “a processor configured to carry out recitations A, B and C” can include a first processor configured to carry out recitation A working in conjunction with a second processor configured to carry out recitations B and C.

Any routine descriptions, elements or blocks in the flow diagrams described herein and/or depicted in the attached figures should be understood as potentially representing modules, segments, or portions of code which include one or more executable instructions for implementing specific logical functions or elements in the routine. Alternate implementations are included within the scope of the embodiments described herein in which elements or functions may be deleted, or executed out of order from that shown or discussed, including substantially synchronously or in reverse order, depending on the functionality involved as would be understood by those skilled in the art.

It should be emphasized that many variations and modifications may be made to the above-described embodiments, the elements of which are to be understood as being among other acceptable examples. All such modifications and variations are intended to be included herein within the scope of this disclosure and protected by the following claims.

Claims

1. A system to implement privilege-escalation-resistant service instances via execution of a code on an on-demand code execution system, wherein executions of the code implement instances of a network-accessible service, the system comprising: a physical data store storing the code; andone or more computing devices configured with specific computer-executable instructions to: receive transmissions corresponding to interactions with the network-accessible service, wherein each transmission includes authentication information of a user interacting with the network-accessible service, and wherein each user is associated with privileges denoting actions on the network-accessible service allowed to be taken by the user;for each transmission corresponding to an interaction with the network-accessible service: generate a virtualized execution environment with privileges scoped to privileges of the user interacting with the network-accessible service at least partly by limiting the virtualized execution environment based on the authentication information included within the transmission corresponding to the interaction with the network-accessible service; andexecute the code within the virtualized execution environment to provide a privilege-escalation-resistant instance of the network-accessible service with privileges scoped to the privileges of the user interacting with the network-accessible service, wherein the instance of the network-accessible service processes the transmission to conduct the interactions;wherein, for at least a second transmission of the transmissions, generating the virtualized execution environment comprises: removing the authentication information of a user corresponding to a prior transmission from the virtualized execution environment; andprovisioning the virtualized execution environment with the authentication information of a user corresponding to the second transmission.
2. The system of claim 1, wherein the virtualized execution environment is at least one of a software container or a virtual machine instance.
3. The system of claim 1, wherein the one or more computing devices are further configured with specific computer-executable instructions to delete the virtualized execution environment subsequent to the execution of the code.
4. The system of claim 1, wherein the authentication information is an authentication token obtained by an authentication service.
5. A computer-implemented method comprising: receiving transmissions corresponding to interactions with a network-accessible service, wherein network-accessible service is implemented via execution of code on an on-demand code execution system, wherein each transmission includes authentication information of a user interacting with the network-accessible service, and wherein each user is associated privileges denoting actions on the network-accessible service allowed to be taken by the user;for each transmission corresponding to an interaction with the network-accessible service: generating a virtualized execution environment on the on-demand code execution system with privileges scoped to privileges of the user interacting with the network-accessible service at least partly by limiting the virtualized execution environment to the authentication information included within the transmission corresponding to the interaction with the network-accessible service; andexecuting the code within the virtualized execution environment to provide an instance of the network-accessible service with privileges scoped to the privileges of the user interacting with the network-accessible service, wherein the instance of the network-accessible service processes the transmission to conduct the interaction;wherein, for at least a second transmission of the transmissions, generating the virtualized execution environment comprises: removing the authentication information of a user corresponding to a prior transmission from the virtualized execution environment; andprovisioning the virtualized execution environment with the authentication information of a user corresponding to the second transmission.
6. The computer-implemented method of claim 5, wherein generating the virtualized execution environment on the on-demand code execution system with privileges scoped to privileges of the user interacting with the network-accessible service includes restricting the virtualized execution environment to the actions on the network-accessible service allowed to be taken by the user.
7. The computer-implemented method of claim 6, wherein restricting the virtualized execution environment to the actions on the service allowed to be taken by the user includes implementing at least one restriction for the virtualized execution environment on a host computing device hosting the virtualized execution environment.
8. The computer-implemented method of claim 5, wherein each user is associated with privileges denoting actions on the network-accessible service allowed to be taken by the user at least partly based on pre-established authorizations for the user.
9. The computer-implemented method of claim 5, further comprising, at a host computing device hosting the execution environment: determining authorizations indicating services to which the virtualized execution environment can issue calls;detecting a call generated by an execution of the code within the virtualized execution environment; andmodifying the call to exclude at least a portion of the authentication information associated with a service not indicated within the authorizations.
10. Non-transitory computer-readable media comprising instructions executable on a computing system to: receive transmissions corresponding to interactions with a network-accessible service, wherein network-accessible service is implemented via execution of code on an on-demand code execution system, wherein each transmission identifies authentication information of a user interacting with the network-accessible service, and wherein each user is associated privileges denoting actions on the network-accessible service allowed to be taken by the user;for each transmission corresponding to an interaction with the network-accessible service: generate a virtualized execution environment on the on-demand code execution system with privileges scoped to privileges of the user interacting with the network-accessible the service at least partly by limiting the virtualized execution environment to the authentication information included within the transmission corresponding to the interaction with the network-accessible service; andexecute the code within the virtualized execution environment to provide an instance of the network-accessible service with privileges scoped to the privileges of the user interacting with the network-accessible service, wherein the instance of the network-accessible service processes the transmission to conduct the interaction;wherein, for at least a second transmission of the transmissions, generating the virtualized execution environment comprises: removing the authentication information of a user corresponding to a prior transmission from the virtualized execution environment; andprovisioning the virtualized execution environment with the authentication information of a user corresponding to the second transmission.
11. The non-transitory computer-readable media of claim 10, wherein, to generate the virtualized execution environment on the on-demand code execution system with privileges scoped to privileges of the user interacting with the network-accessible service, the instructions are executable on the computing system to restrict the virtualized execution environment to the actions on the network-accessible service allowed to be taken by the user.
12. The non-transitory computer-readable media of claim 10, wherein, to restrict the virtualized execution environment to the actions on the service allowed to be taken by the user, the instructions are executable on the computing system to implement at least one restriction for the virtualized execution environment on a host computing device hosting the virtualized execution environment.
13. The non-transitory computer-readable media of claim 10, wherein each user is associated with privileges denoting actions on the network-accessible service allowed to be taken by the user at least partly based on pre-established authorizations for the user.
14. The non-transitory computer-readable media of claim 10, wherein the instructions are further executable on the computing system to: determine authorizations indicating services to which the virtualized execution environment can issue calls;detect a call generated by an execution of the code within the virtualized execution environment; andmodify the call to exclude at least a portion of the authentication information associated with a service not indicated within the authorizations.

US Referenced Citations (791)

Number	Name	Date	Kind
4949254	Shorter	Aug 1990	A
5283888	Dao et al.	Feb 1994	A
5835764	Platt et al.	Nov 1998	A
5970488	Crowe et al.	Oct 1999	A
5983197	Enta	Nov 1999	A
6237005	Griffin	May 2001	B1
6260058	Hoenninger et al.	Jul 2001	B1
6385636	Suzuki	May 2002	B1
6463509	Teoman et al.	Oct 2002	B1
6501736	Smolik et al.	Dec 2002	B1
6523035	Fleming et al.	Feb 2003	B1
6549936	Hirabayashi	Apr 2003	B1
6708276	Yarsa et al.	Mar 2004	B1
7036121	Casabona et al.	Apr 2006	B1
7308463	Taulbee et al.	Dec 2007	B2
7340522	Basu et al.	Mar 2008	B1
7558719	Donlin	Jul 2009	B1
7577722	Khandekar et al.	Aug 2009	B1
7590806	Harris et al.	Sep 2009	B2
7665090	Tormasov et al.	Feb 2010	B1
7707579	Rodriguez	Apr 2010	B2
7730464	Trowbridge	Jun 2010	B2
7774191	Berkowitz et al.	Aug 2010	B2
7823186	Pouliot	Oct 2010	B2
7831464	Nichols et al.	Nov 2010	B1
7870153	Croft et al.	Jan 2011	B2
7886021	Scheifler et al.	Feb 2011	B2
7949677	Croft et al.	May 2011	B2
7954150	Croft et al.	May 2011	B2
8010679	Low et al.	Aug 2011	B2
8010990	Ferguson et al.	Aug 2011	B2
8024564	Bassani et al.	Sep 2011	B2
8046765	Cherkasova et al.	Oct 2011	B2
8051180	Mazzaferri et al.	Nov 2011	B2
8051266	DeVal et al.	Nov 2011	B2
8065676	Sahai et al.	Nov 2011	B1
8065682	Baryshnikov et al.	Nov 2011	B2
8095931	Chen et al.	Jan 2012	B1
8127284	Meijer et al.	Feb 2012	B2
8146073	Sinha	Mar 2012	B2
8166304	Murase et al.	Apr 2012	B2
8171473	Lavin	May 2012	B2
8201026	Bornstein et al.	Jun 2012	B1
8209695	Pruyne et al.	Jun 2012	B1
8219987	Vlaovic et al.	Jul 2012	B1
8296267	Cahill et al.	Oct 2012	B2
8321554	Dickinson	Nov 2012	B2
8321558	Sirota et al.	Nov 2012	B1
8336079	Budko et al.	Dec 2012	B2
8352608	Keagy et al.	Jan 2013	B1
8387075	McCann et al.	Feb 2013	B1
8392558	Ahuja et al.	Mar 2013	B1
8417723	Lissack	Apr 2013	B1
8429282	Ahuja	Apr 2013	B1
8448165	Conover	May 2013	B1
8479195	Adams	Jul 2013	B2
8490088	Tang	Jul 2013	B2
8555281	Van Dijk et al.	Oct 2013	B1
8560699	Theimer et al.	Oct 2013	B1
8566835	Wang et al.	Oct 2013	B2
8601323	Tsantilis	Dec 2013	B2
8613070	Borzycki et al.	Dec 2013	B1
8615589	Adogla et al.	Dec 2013	B1
8631130	Jackson	Jan 2014	B2
8667471	Wintergerst et al.	Mar 2014	B2
8677359	Cavage et al.	Mar 2014	B1
8694996	Cawlfield et al.	Apr 2014	B2
8700768	Benari	Apr 2014	B2
8719415	Sirota et al.	May 2014	B1
8725702	Raman et al.	May 2014	B1
8756322	Lynch	Jun 2014	B1
8756696	Miller	Jun 2014	B1
8769519	Leitman et al.	Jul 2014	B2
8793676	Quinn et al.	Jul 2014	B2
8799236	Azari et al.	Aug 2014	B1
8799879	Wright et al.	Aug 2014	B2
8806468	Meijer et al.	Aug 2014	B2
8806644	McCorkendale et al.	Aug 2014	B1
8819679	Agarwal et al.	Aug 2014	B2
8825863	Hansson et al.	Sep 2014	B2
8825964	Sopka et al.	Sep 2014	B1
8839035	Dimitrovich et al.	Sep 2014	B1
8850432	Mcgrath et al.	Sep 2014	B2
8869300	Singh et al.	Oct 2014	B2
8874952	Tameshige et al.	Oct 2014	B2
8904008	Calder et al.	Dec 2014	B2
8966495	Kulkarni	Feb 2015	B2
8972980	Banga	Mar 2015	B2
8997093	Dimitrov	Mar 2015	B2
9027087	Ishaya et al.	May 2015	B2
9038068	Engle et al.	May 2015	B2
9052935	Rajaa	Jun 2015	B1
9086897	Oh et al.	Jul 2015	B2
9086924	Barsness et al.	Jul 2015	B2
9092837	Bala et al.	Jul 2015	B2
9098528	Wang	Aug 2015	B2
9110732	Forschmiedt et al.	Aug 2015	B1
9110770	Raju et al.	Aug 2015	B1
9111037	Nalis et al.	Aug 2015	B1
9112813	Jackson	Aug 2015	B2
9116733	Banga	Aug 2015	B2
9141410	Leafe et al.	Sep 2015	B2
9146764	Wagner	Sep 2015	B1
9152406	De et al.	Oct 2015	B2
9164754	Pohlack	Oct 2015	B1
9183019	Kruglick	Nov 2015	B2
9208007	Harper et al.	Dec 2015	B2
9218190	Anand et al.	Dec 2015	B2
9223561	Orveillon et al.	Dec 2015	B2
9223966	Satish et al.	Dec 2015	B1
9250893	Blahaerath et al.	Feb 2016	B2
9268586	Voccio et al.	Feb 2016	B2
9298633	Zhao et al.	Mar 2016	B1
9317689	Aissi	Apr 2016	B2
9323556	Wagner	Apr 2016	B2
9361145	Wilson et al.	Jun 2016	B1
9413626	Reque et al.	Aug 2016	B2
9417918	Chin	Aug 2016	B2
9436555	Dornemann et al.	Sep 2016	B2
9461996	Hayton et al.	Oct 2016	B2
9471775	Wagner	Oct 2016	B1
9471776	Gu	Oct 2016	B2
9483335	Wagner et al.	Nov 2016	B1
9489227	Oh et al.	Nov 2016	B2
9497136	Ramarao et al.	Nov 2016	B1
9501345	Lietz et al.	Nov 2016	B1
9514037	Dow et al.	Dec 2016	B1
9537788	Reque et al.	Jan 2017	B2
9563613	Dinkel et al.	Feb 2017	B1
9575798	Terayama et al.	Feb 2017	B2
9588790	Wagner et al.	Mar 2017	B1
9594590	Hsu	Mar 2017	B2
9596350	Dymshyts et al.	Mar 2017	B1
9600312	Wagner et al.	Mar 2017	B2
9613127	Rus et al.	Apr 2017	B1
9626204	Banga	Apr 2017	B1
9628332	Bruno, Jr. et al.	Apr 2017	B2
9635132	Lin et al.	Apr 2017	B1
9652306	Wagner et al.	May 2017	B1
9652617	Evans et al.	May 2017	B1
9654508	Barton et al.	May 2017	B2
9661011	Van Horenbeeck et al.	May 2017	B1
9678773	Wagner et al.	Jun 2017	B1
9678778	Youseff	Jun 2017	B1
9703681	Taylor et al.	Jul 2017	B2
9715402	Wagner et al.	Jul 2017	B2
9720661	Gschwind	Aug 2017	B2
9720662	Gschwind	Aug 2017	B2
9727725	Wagner et al.	Aug 2017	B2
9733967	Wagner et al.	Aug 2017	B2
9760387	Wagner et al.	Sep 2017	B2
9760443	Tarasuk-Levin et al.	Sep 2017	B2
9767271	Ghose	Sep 2017	B2
9785476	Wagner et al.	Oct 2017	B2
9787779	Frank et al.	Oct 2017	B2
9811363	Wagner	Nov 2017	B1
9811434	Wagner	Nov 2017	B1
9817695	Clark	Nov 2017	B2
9830175	Wagner	Nov 2017	B1
9830193	Wagner et al.	Nov 2017	B1
9830449	Wagner	Nov 2017	B1
9864636	Patel et al.	Jan 2018	B1
9898393	Moorthi	Feb 2018	B2
9910713	Wisniewski et al.	Mar 2018	B2
9921864	Singaravelu et al.	Mar 2018	B2
9928108	Wagner et al.	Mar 2018	B1
9929916	Subramanian et al.	Mar 2018	B1
9930103	Thompson	Mar 2018	B2
9930133	Susarla et al.	Mar 2018	B2
9952896	Wagner et al.	Apr 2018	B2
9977691	Marriner et al.	May 2018	B2
9979817	Huang et al.	May 2018	B2
9983982	Kumar et al.	May 2018	B1
10002026	Wagner	Jun 2018	B1
10013267	Wagner et al.	Jul 2018	B1
10042660	Wagner et al.	Aug 2018	B2
10048974	Wagner et al.	Aug 2018	B1
10061613	Brooker et al.	Aug 2018	B1
10067801	Wagner	Sep 2018	B1
10102040	Marriner et al.	Oct 2018	B2
10108443	Wagner et al.	Oct 2018	B2
10139876	Lu et al.	Nov 2018	B2
10140137	Wagner	Nov 2018	B2
10146635	Chai et al.	Dec 2018	B1
10162655	Tuch	Dec 2018	B2
10162672	Wagner et al.	Dec 2018	B2
10162688	Wagner	Dec 2018	B2
10191861	Steinberg	Jan 2019	B1
10193839	Tandon	Jan 2019	B2
10203990	Wagner et al.	Feb 2019	B2
10248467	Wisniewski et al.	Apr 2019	B2
10255090	Tuch	Apr 2019	B2
10277708	Wagner	Apr 2019	B2
10303492	Wagner et al.	May 2019	B1
10331462	Varda et al.	Jun 2019	B1
10346625	Anderson	Jul 2019	B2
10353678	Wagner	Jul 2019	B1
10353746	Reque et al.	Jul 2019	B2
10360025	Foskett	Jul 2019	B2
10360067	Wagner	Jul 2019	B1
10365985	Wagner	Jul 2019	B2
10387177	Wagner et al.	Aug 2019	B2
10402231	Marriner et al.	Sep 2019	B2
10423158	Hadlich	Sep 2019	B1
10437629	Wagner et al.	Oct 2019	B2
10445140	Sagar et al.	Oct 2019	B1
10459822	Gondi	Oct 2019	B1
10503626	Idicula et al.	Dec 2019	B2
10528390	Brooker et al.	Jan 2020	B2
10531226	Wang et al.	Jan 2020	B1
10552193	Wagner et al.	Feb 2020	B2
10564946	Wagner et al.	Feb 2020	B1
10572375	Wagner	Feb 2020	B1
10592269	Wagner et al.	Mar 2020	B2
10608973	Kuo	Mar 2020	B2
10623476	Thompson	Apr 2020	B2
10637817	Kuo	Apr 2020	B2
10649749	Brooker et al.	May 2020	B1
10649792	Kulchytskyy et al.	May 2020	B1
10650156	Anderson	May 2020	B2
10691498	Wagner	Jun 2020	B2
10713080	Brooker et al.	Jul 2020	B1
10719367	Kim et al.	Jul 2020	B1
10725752	Wagner et al.	Jul 2020	B1
10725826	Sagar et al.	Jul 2020	B1
10733085	Wagner	Aug 2020	B1
10754701	Wagner	Aug 2020	B1
10776091	Wagner et al.	Sep 2020	B1
10776171	Wagner et al.	Sep 2020	B2
10817331	Mullen et al.	Oct 2020	B2
10824484	Wagner et al.	Nov 2020	B2
10831898	Wagner	Nov 2020	B1
10846117	Steinberg	Nov 2020	B1
10853112	Wagner et al.	Dec 2020	B2
10853115	Mullen et al.	Dec 2020	B2
10884722	Brooker et al.	Jan 2021	B2
10884787	Wagner et al.	Jan 2021	B1
10884802	Wagner et al.	Jan 2021	B2
10884812	Brooker et al.	Jan 2021	B2
10891145	Wagner et al.	Jan 2021	B2
10915371	Wagner et al.	Feb 2021	B2
20010044817	Asano et al.	Nov 2001	A1
20020120685	Srivastava et al.	Aug 2002	A1
20020172273	Baker et al.	Nov 2002	A1
20030071842	King et al.	Apr 2003	A1
20030084434	Ren	May 2003	A1
20030149801	Kushnirskiy	Aug 2003	A1
20030191795	Bernardin et al.	Oct 2003	A1
20030229794	James, II et al.	Dec 2003	A1
20040003087	Chambliss et al.	Jan 2004	A1
20040019886	Berent et al.	Jan 2004	A1
20040044721	Song et al.	Mar 2004	A1
20040049768	Matsuyama et al.	Mar 2004	A1
20040098154	McCarthy	May 2004	A1
20040158551	Santosuosso	Aug 2004	A1
20040205493	Simpson et al.	Oct 2004	A1
20040249947	Novaes et al.	Dec 2004	A1
20040268358	Darling et al.	Dec 2004	A1
20050027611	Wharton	Feb 2005	A1
20050044301	Vasilevsky et al.	Feb 2005	A1
20050120160	Plouffe et al.	Jun 2005	A1
20050132167	Longobardi	Jun 2005	A1
20050132368	Sexton et al.	Jun 2005	A1
20050149535	Frey et al.	Jul 2005	A1
20050193113	Kokusho et al.	Sep 2005	A1
20050193283	Reinhardt et al.	Sep 2005	A1
20050237948	Wan et al.	Oct 2005	A1
20050257051	Richard	Nov 2005	A1
20060010440	Anderson	Jan 2006	A1
20060015740	Kramer	Jan 2006	A1
20060080678	Bailey et al.	Apr 2006	A1
20060123066	Jacobs et al.	Jun 2006	A1
20060129684	Datta	Jun 2006	A1
20060155800	Matsumoto	Jul 2006	A1
20060168174	Gebhart et al.	Jul 2006	A1
20060184669	Vaidyanathan et al.	Aug 2006	A1
20060200668	Hybre et al.	Sep 2006	A1
20060212332	Jackson	Sep 2006	A1
20060218601	Michel	Sep 2006	A1
20060242647	Kimbrel et al.	Oct 2006	A1
20060242709	Seinfeld	Oct 2006	A1
20060248195	Toumura et al.	Nov 2006	A1
20060259763	Cooperstein	Nov 2006	A1
20060288120	Hoshino et al.	Dec 2006	A1
20070033085	Johnson	Feb 2007	A1
20070050779	Hayashi	Mar 2007	A1
20070094396	Takano et al.	Apr 2007	A1
20070101325	Bystricky et al.	May 2007	A1
20070112864	Ben-Natan	May 2007	A1
20070130341	Ma	Jun 2007	A1
20070174419	O'Connell et al.	Jul 2007	A1
20070180449	Croft et al.	Aug 2007	A1
20070180450	Croft et al.	Aug 2007	A1
20070180493	Croft et al.	Aug 2007	A1
20070186212	Mazzaferri et al.	Aug 2007	A1
20070192082	Gaos et al.	Aug 2007	A1
20070192329	Croft et al.	Aug 2007	A1
20070198656	Mazzaferri et al.	Aug 2007	A1
20070199000	Shekhel et al.	Aug 2007	A1
20070220009	Morris et al.	Sep 2007	A1
20070226700	Gal et al.	Sep 2007	A1
20070240160	Paterson-Jones	Oct 2007	A1
20070255604	Seelig	Nov 2007	A1
20080028409	Cherkasova et al.	Jan 2008	A1
20080052401	Bugenhagen et al.	Feb 2008	A1
20080052725	Stoodley et al.	Feb 2008	A1
20080082977	Araujo et al.	Apr 2008	A1
20080104247	Venkatakrishnan et al.	May 2008	A1
20080104608	Hyser et al.	May 2008	A1
20080115143	Shimizu et al.	May 2008	A1
20080126110	Haeberle et al.	May 2008	A1
20080126486	Heist	May 2008	A1
20080127125	Anckaert et al.	May 2008	A1
20080147893	Marripudi et al.	Jun 2008	A1
20080189468	Schmidt et al.	Aug 2008	A1
20080195369	Duyanovich et al.	Aug 2008	A1
20080201568	Quinn et al.	Aug 2008	A1
20080201711	Amir Husain	Aug 2008	A1
20080209423	Hirai	Aug 2008	A1
20080244547	Wintergerst et al.	Oct 2008	A1
20080288940	Adams	Nov 2008	A1
20090006897	Sarsfield	Jan 2009	A1
20090013153	Hilton	Jan 2009	A1
20090025009	Brunswig et al.	Jan 2009	A1
20090055810	Kondur	Feb 2009	A1
20090055829	Gibson	Feb 2009	A1
20090070355	Cadarette et al.	Mar 2009	A1
20090077569	Appleton et al.	Mar 2009	A1
20090125902	Ghosh et al.	May 2009	A1
20090158275	Wang et al.	Jun 2009	A1
20090158407	Nicodemus et al.	Jun 2009	A1
20090177860	Zhu et al.	Jul 2009	A1
20090183162	Kindel et al.	Jul 2009	A1
20090193410	Arthursson et al.	Jul 2009	A1
20090198769	Keller et al.	Aug 2009	A1
20090204960	Ben-yehuda et al.	Aug 2009	A1
20090204964	Foley et al.	Aug 2009	A1
20090222922	Sidiroglou et al.	Sep 2009	A1
20090271472	Scheifler et al.	Oct 2009	A1
20090288084	Astete et al.	Nov 2009	A1
20090300151	Friedman et al.	Dec 2009	A1
20090300599	Piotrowski	Dec 2009	A1
20090307430	Bruening	Dec 2009	A1
20100023940	Iwamatsu et al.	Jan 2010	A1
20100031274	Sim-Tang	Feb 2010	A1
20100031325	Maigne et al.	Feb 2010	A1
20100036925	Haffner	Feb 2010	A1
20100037031	DeSantis et al.	Feb 2010	A1
20100058342	Machida	Mar 2010	A1
20100058351	Yahagi	Mar 2010	A1
20100064299	Kacin et al.	Mar 2010	A1
20100070678	Zhang et al.	Mar 2010	A1
20100070725	Prahlad et al.	Mar 2010	A1
20100083048	Calinoiu et al.	Apr 2010	A1
20100083248	Wood et al.	Apr 2010	A1
20100094816	Groves, Jr. et al.	Apr 2010	A1
20100106926	Kandasamy et al.	Apr 2010	A1
20100114825	Siddegowda	May 2010	A1
20100115098	De Baer et al.	May 2010	A1
20100122343	Ghosh	May 2010	A1
20100131936	Cheriton	May 2010	A1
20100131959	Spiers et al.	May 2010	A1
20100186011	Magenheimer	Jul 2010	A1
20100198972	Umbehocker	Aug 2010	A1
20100199285	Medovich	Aug 2010	A1
20100257116	Mehta et al.	Oct 2010	A1
20100257269	Clark	Oct 2010	A1
20100269109	Cartales	Oct 2010	A1
20100299541	Ishikawa et al.	Nov 2010	A1
20100312871	Desantis et al.	Dec 2010	A1
20100325727	Neystadt et al.	Dec 2010	A1
20100329149	Singh et al.	Dec 2010	A1
20100329643	Kuang	Dec 2010	A1
20110010690	Howard et al.	Jan 2011	A1
20110010722	Matsuyama	Jan 2011	A1
20110023026	Oza	Jan 2011	A1
20110029970	Arasaratnam	Feb 2011	A1
20110029984	Norman et al.	Feb 2011	A1
20110040812	Phillips	Feb 2011	A1
20110055378	Ferris et al.	Mar 2011	A1
20110055396	DeHaan	Mar 2011	A1
20110055683	Jiang	Mar 2011	A1
20110078679	Bozek et al.	Mar 2011	A1
20110099204	Thaler	Apr 2011	A1
20110099551	Fahrig et al.	Apr 2011	A1
20110131572	Elyashev et al.	Jun 2011	A1
20110134761	Smith	Jun 2011	A1
20110141124	Halls et al.	Jun 2011	A1
20110153541	Koch et al.	Jun 2011	A1
20110153727	Li	Jun 2011	A1
20110153838	Belkine et al.	Jun 2011	A1
20110154353	Theroux et al.	Jun 2011	A1
20110173637	Brandwine et al.	Jul 2011	A1
20110179162	Mayo et al.	Jul 2011	A1
20110184993	Chawla et al.	Jul 2011	A1
20110225277	Freimuth et al.	Sep 2011	A1
20110231680	Padmanabhan et al.	Sep 2011	A1
20110247005	Benedetti et al.	Oct 2011	A1
20110258603	Wisnovsky et al.	Oct 2011	A1
20110265067	Schulte et al.	Oct 2011	A1
20110265164	Lucovsky	Oct 2011	A1
20110271276	Ashok et al.	Nov 2011	A1
20110276945	Chasman et al.	Nov 2011	A1
20110276963	Wu et al.	Nov 2011	A1
20110296412	Banga	Dec 2011	A1
20110314465	Smith et al.	Dec 2011	A1
20110321033	Kelkar et al.	Dec 2011	A1
20110321051	Rastogi	Dec 2011	A1
20120011496	Shimamura	Jan 2012	A1
20120011511	Horvitz et al.	Jan 2012	A1
20120016721	Weinman	Jan 2012	A1
20120041970	Ghosh et al.	Feb 2012	A1
20120054744	Singh et al.	Mar 2012	A1
20120072762	Atchison et al.	Mar 2012	A1
20120072914	Ota	Mar 2012	A1
20120072920	Kawamura	Mar 2012	A1
20120079004	Herman	Mar 2012	A1
20120096271	Ramarathinam et al.	Apr 2012	A1
20120096468	Chakravorty et al.	Apr 2012	A1
20120102307	Wong	Apr 2012	A1
20120102333	Wong	Apr 2012	A1
20120102481	Mani et al.	Apr 2012	A1
20120102493	Allen et al.	Apr 2012	A1
20120110155	Adlung et al.	May 2012	A1
20120110164	Frey et al.	May 2012	A1
20120110570	Jacobson et al.	May 2012	A1
20120110588	Bieswanger et al.	May 2012	A1
20120131379	Tameshige et al.	May 2012	A1
20120144290	Goldman et al.	Jun 2012	A1
20120166624	Suit et al.	Jun 2012	A1
20120192184	Burckart et al.	Jul 2012	A1
20120197795	Campbell et al.	Aug 2012	A1
20120197958	Nightingale et al.	Aug 2012	A1
20120198442	Kashyap et al.	Aug 2012	A1
20120198514	McCune	Aug 2012	A1
20120204164	Castanos et al.	Aug 2012	A1
20120209947	Glaser	Aug 2012	A1
20120222038	Katragadda et al.	Aug 2012	A1
20120233464	Miller et al.	Sep 2012	A1
20120324236	Srivastava et al.	Dec 2012	A1
20120331113	Jain et al.	Dec 2012	A1
20130014101	Ballani et al.	Jan 2013	A1
20130042234	DeLuca et al.	Feb 2013	A1
20130054804	Jana et al.	Feb 2013	A1
20130054927	Raj et al.	Feb 2013	A1
20130055262	Lubsey et al.	Feb 2013	A1
20130061208	Tsao et al.	Mar 2013	A1
20130061212	Krause et al.	Mar 2013	A1
20130061220	Gnanasambandam et al.	Mar 2013	A1
20130067484	Sonoda et al.	Mar 2013	A1
20130067494	Srour et al.	Mar 2013	A1
20130080641	Lui et al.	Mar 2013	A1
20130091387	Bohnet et al.	Apr 2013	A1
20130097601	Podvratnik et al.	Apr 2013	A1
20130111032	Alapati et al.	May 2013	A1
20130111469	B et al.	May 2013	A1
20130124807	Nielsen et al.	May 2013	A1
20130132942	Wang	May 2013	A1
20130132953	Chuang et al.	May 2013	A1
20130139152	Chang et al.	May 2013	A1
20130139166	Zhang et al.	May 2013	A1
20130145354	Bruening	Jun 2013	A1
20130151587	Takeshima et al.	Jun 2013	A1
20130151648	Luna	Jun 2013	A1
20130151684	Forsman et al.	Jun 2013	A1
20130152047	Moorthi	Jun 2013	A1
20130167147	Corrie et al.	Jun 2013	A1
20130179574	Calder et al.	Jul 2013	A1
20130179881	Calder et al.	Jul 2013	A1
20130179894	Calder et al.	Jul 2013	A1
20130179895	Calder et al.	Jul 2013	A1
20130185719	Kar et al.	Jul 2013	A1
20130185729	Vasic et al.	Jul 2013	A1
20130191924	Tedesco	Jul 2013	A1
20130198319	Shen et al.	Aug 2013	A1
20130198743	Kruglick	Aug 2013	A1
20130198748	Sharp et al.	Aug 2013	A1
20130198763	Kunze et al.	Aug 2013	A1
20130205092	Roy et al.	Aug 2013	A1
20130219390	Lee et al.	Aug 2013	A1
20130227097	Yasuda et al.	Aug 2013	A1
20130227534	Ike et al.	Aug 2013	A1
20130227563	McGrath	Aug 2013	A1
20130227641	White	Aug 2013	A1
20130227710	Barak et al.	Aug 2013	A1
20130232190	Miller et al.	Sep 2013	A1
20130232480	Winterfeldt et al.	Sep 2013	A1
20130239125	Iorio	Sep 2013	A1
20130246944	Pandiyan et al.	Sep 2013	A1
20130262556	Xu et al.	Oct 2013	A1
20130263117	Konik et al.	Oct 2013	A1
20130274006	Hudlow et al.	Oct 2013	A1
20130275376	Hudlow et al.	Oct 2013	A1
20130275958	Ivanov et al.	Oct 2013	A1
20130275969	Dimitrov	Oct 2013	A1
20130275975	Masuda et al.	Oct 2013	A1
20130283141	Stevenson et al.	Oct 2013	A1
20130283176	Hoole et al.	Oct 2013	A1
20130290538	Gmach et al.	Oct 2013	A1
20130291087	Kailash et al.	Oct 2013	A1
20130297964	Hegdal et al.	Nov 2013	A1
20130298183	McGrath et al.	Nov 2013	A1
20130311650	Brandwine et al.	Nov 2013	A1
20130326506	McGrath et al.	Dec 2013	A1
20130326507	McGrath et al.	Dec 2013	A1
20130339950	Ramarathinam et al.	Dec 2013	A1
20130346470	Obstfeld et al.	Dec 2013	A1
20130346946	Pinnix	Dec 2013	A1
20130346952	Huang et al.	Dec 2013	A1
20130346964	Nobuoka et al.	Dec 2013	A1
20130346987	Raney et al.	Dec 2013	A1
20130346994	Chen et al.	Dec 2013	A1
20130347095	Barjatiya et al.	Dec 2013	A1
20140007097	Chin et al.	Jan 2014	A1
20140019523	Heymann et al.	Jan 2014	A1
20140019735	Menon et al.	Jan 2014	A1
20140019965	Neuse et al.	Jan 2014	A1
20140019966	Neuse et al.	Jan 2014	A1
20140040343	Nickolov et al.	Feb 2014	A1
20140040857	Trinchini et al.	Feb 2014	A1
20140040880	Brownlow et al.	Feb 2014	A1
20140058871	Marr et al.	Feb 2014	A1
20140059209	Alnoor	Feb 2014	A1
20140059226	Messerli et al.	Feb 2014	A1
20140059552	Cunningham et al.	Feb 2014	A1
20140068568	Wisnovsky	Mar 2014	A1
20140068608	Kulkarni	Mar 2014	A1
20140068611	McGrath et al.	Mar 2014	A1
20140073300	Leeder et al.	Mar 2014	A1
20140081984	Sitsky et al.	Mar 2014	A1
20140082165	Marr et al.	Mar 2014	A1
20140082201	Shankari et al.	Mar 2014	A1
20140101643	Inoue	Apr 2014	A1
20140101649	Kamble et al.	Apr 2014	A1
20140108722	Lipchuk et al.	Apr 2014	A1
20140109087	Jujare et al.	Apr 2014	A1
20140109088	Dournov et al.	Apr 2014	A1
20140129667	Ozawa	May 2014	A1
20140130040	Lemanski	May 2014	A1
20140137110	Engle et al.	May 2014	A1
20140173614	Konik et al.	Jun 2014	A1
20140173616	Bird et al.	Jun 2014	A1
20140180862	Certain et al.	Jun 2014	A1
20140189677	Curzi et al.	Jul 2014	A1
20140189704	Narvaez et al.	Jul 2014	A1
20140201735	Kannan et al.	Jul 2014	A1
20140207912	Thibeault	Jul 2014	A1
20140214752	Rash et al.	Jul 2014	A1
20140215073	Dow et al.	Jul 2014	A1
20140229221	Shih et al.	Aug 2014	A1
20140245297	Hackett	Aug 2014	A1
20140279581	Devereaux	Sep 2014	A1
20140280325	Krishnamurthy et al.	Sep 2014	A1
20140282418	Wood et al.	Sep 2014	A1
20140282559	Verduzco et al.	Sep 2014	A1
20140282615	Cavage et al.	Sep 2014	A1
20140282629	Gupta et al.	Sep 2014	A1
20140283045	Brandwine et al.	Sep 2014	A1
20140289286	Gusak	Sep 2014	A1
20140298295	Overbeck	Oct 2014	A1
20140304246	Helmich et al.	Oct 2014	A1
20140304698	Chigurapati et al.	Oct 2014	A1
20140304815	Maeda	Oct 2014	A1
20140317617	O'Donnell	Oct 2014	A1
20140337953	Banatwala et al.	Nov 2014	A1
20140344457	Bruno, Jr. et al.	Nov 2014	A1
20140344736	Ryman et al.	Nov 2014	A1
20140359093	Raju et al.	Dec 2014	A1
20140365781	Dmitrienko	Dec 2014	A1
20140372489	Jaiswal	Dec 2014	A1
20140372533	Fu et al.	Dec 2014	A1
20140380085	Rash et al.	Dec 2014	A1
20150033241	Jackson et al.	Jan 2015	A1
20150039891	Ignatchenko et al.	Feb 2015	A1
20150040229	Chan et al.	Feb 2015	A1
20150046926	Kenchammana-Hosekote et al.	Feb 2015	A1
20150052258	Johnson et al.	Feb 2015	A1
20150058914	Yadav	Feb 2015	A1
20150067019	Balko	Mar 2015	A1
20150067830	Johansson et al.	Mar 2015	A1
20150074659	Madsen et al.	Mar 2015	A1
20150074661	Kothari et al.	Mar 2015	A1
20150074662	Saladi et al.	Mar 2015	A1
20150081885	Thomas et al.	Mar 2015	A1
20150095822	Feis et al.	Apr 2015	A1
20150106805	Melander et al.	Apr 2015	A1
20150120928	Gummaraju et al.	Apr 2015	A1
20150121391	Wang	Apr 2015	A1
20150134626	Theimer et al.	May 2015	A1
20150135287	Medeiros et al.	May 2015	A1
20150142747	Zou	May 2015	A1
20150142952	Bragstad et al.	May 2015	A1
20150143374	Banga	May 2015	A1
20150143381	Chin	May 2015	A1
20150154046	Farkas et al.	Jun 2015	A1
20150161384	Gu	Jun 2015	A1
20150163231	Sobko et al.	Jun 2015	A1
20150178110	Li et al.	Jun 2015	A1
20150186129	Apte et al.	Jul 2015	A1
20150188775	Van Der Walt et al.	Jul 2015	A1
20150199218	Wilson et al.	Jul 2015	A1
20150205596	Hiltegen et al.	Jul 2015	A1
20150227598	Hahn et al.	Aug 2015	A1
20150229645	Keith et al.	Aug 2015	A1
20150235144	Gusev et al.	Aug 2015	A1
20150242225	Muller et al.	Aug 2015	A1
20150254248	Burns et al.	Sep 2015	A1
20150256621	Noda et al.	Sep 2015	A1
20150261578	Greden et al.	Sep 2015	A1
20150264014	Budhani et al.	Sep 2015	A1
20150269494	Kardes et al.	Sep 2015	A1
20150289220	Kim et al.	Oct 2015	A1
20150309923	Iwata et al.	Oct 2015	A1
20150319160	Ferguson et al.	Nov 2015	A1
20150324174	Bromley et al.	Nov 2015	A1
20150324182	Barros et al.	Nov 2015	A1
20150324229	Valine	Nov 2015	A1
20150332048	Mooring et al.	Nov 2015	A1
20150332195	Jue	Nov 2015	A1
20150334173	Coulmeau et al.	Nov 2015	A1
20150350701	Lemus et al.	Dec 2015	A1
20150356294	Tan et al.	Dec 2015	A1
20150363181	Alberti et al.	Dec 2015	A1
20150363304	Nagamalla et al.	Dec 2015	A1
20150370560	Tan et al.	Dec 2015	A1
20150370591	Tuch	Dec 2015	A1
20150370592	Tuch	Dec 2015	A1
20150371244	Neuse et al.	Dec 2015	A1
20150378762	Saladi et al.	Dec 2015	A1
20150378764	Sivasubramanian et al.	Dec 2015	A1
20150378765	Singh et al.	Dec 2015	A1
20150379167	Griffith et al.	Dec 2015	A1
20160011901	Hurwitz et al.	Jan 2016	A1
20160012099	Tuatini et al.	Jan 2016	A1
20160019081	Chandrasekaran et al.	Jan 2016	A1
20160019082	Chandrasekaran et al.	Jan 2016	A1
20160019536	Ortiz et al.	Jan 2016	A1
20160026486	Abdallah	Jan 2016	A1
20160048606	Rubinstein et al.	Feb 2016	A1
20160070714	D'Sa et al.	Mar 2016	A1
20160072727	Leafe et al.	Mar 2016	A1
20160077901	Roth et al.	Mar 2016	A1
20160092251	Wagner	Mar 2016	A1
20160092320	Baca	Mar 2016	A1
20160092493	Ko et al.	Mar 2016	A1
20160098285	Davis et al.	Apr 2016	A1
20160100036	Lo et al.	Apr 2016	A1
20160103739	Huang et al.	Apr 2016	A1
20160117163	Fukui et al.	Apr 2016	A1
20160117254	Susarla et al.	Apr 2016	A1
20160124665	Jain et al.	May 2016	A1
20160124978	Nithrakashyap et al.	May 2016	A1
20160140180	Park et al.	May 2016	A1
20160150053	Janczuk et al.	May 2016	A1
20160191420	Nagarajan et al.	Jun 2016	A1
20160203219	Hoch et al.	Jul 2016	A1
20160212007	Alatorre et al.	Jul 2016	A1
20160226955	Moorthi et al.	Aug 2016	A1
20160282930	Ramachandran et al.	Sep 2016	A1
20160285906	Fine et al.	Sep 2016	A1
20160292016	Bussard et al.	Oct 2016	A1
20160294614	Searle et al.	Oct 2016	A1
20160306613	Busi et al.	Oct 2016	A1
20160315910	Kaufman	Oct 2016	A1
20160350099	Suparna et al.	Dec 2016	A1
20160357536	Firlik et al.	Dec 2016	A1
20160364265	Cao et al.	Dec 2016	A1
20160364316	Bhat et al.	Dec 2016	A1
20160371127	Antony et al.	Dec 2016	A1
20160371156	Merriman	Dec 2016	A1
20160378449	Khazanchi et al.	Dec 2016	A1
20160378547	Brouwer et al.	Dec 2016	A1
20160378554	Gummaraju et al.	Dec 2016	A1
20170004169	Merrill et al.	Jan 2017	A1
20170041144	Krapf et al.	Feb 2017	A1
20170041309	Ekambaram et al.	Feb 2017	A1
20170060615	Thakkar et al.	Mar 2017	A1
20170060621	Whipple et al.	Mar 2017	A1
20170068574	Cherkasova et al.	Mar 2017	A1
20170075749	Ambichl et al.	Mar 2017	A1
20170083381	Cong et al.	Mar 2017	A1
20170085447	Chen et al.	Mar 2017	A1
20170085591	Ganda et al.	Mar 2017	A1
20170093684	Jayaraman et al.	Mar 2017	A1
20170093920	Ducatel et al.	Mar 2017	A1
20170134519	Chen et al.	May 2017	A1
20170149740	Mansour et al.	May 2017	A1
20170161059	Wood et al.	Jun 2017	A1
20170177854	Gligor	Jun 2017	A1
20170188213	Nirantar et al.	Jun 2017	A1
20170230262	Sreeramoju et al.	Aug 2017	A1
20170230499	Mumick et al.	Aug 2017	A1
20170249130	Smiljamic et al.	Aug 2017	A1
20170264681	Apte et al.	Sep 2017	A1
20170272462	Kraemer et al.	Sep 2017	A1
20170286143	Wagner et al.	Oct 2017	A1
20170286187	Chen et al.	Oct 2017	A1
20170308520	Beahan, Jr. et al.	Oct 2017	A1
20170315163	Wang et al.	Nov 2017	A1
20170329578	Iscen	Nov 2017	A1
20170346808	Anzai et al.	Nov 2017	A1
20170353851	Gonzalez et al.	Dec 2017	A1
20170364345	Fontoura et al.	Dec 2017	A1
20170371703	Wagner	Dec 2017	A1
20170371706	Wagner	Dec 2017	A1
20170371720	Basu et al.	Dec 2017	A1
20170371724	Wagner et al.	Dec 2017	A1
20170372142	Bilobrov	Dec 2017	A1
20180004555	Ramanathan et al.	Jan 2018	A1
20180004556	Marriner et al.	Jan 2018	A1
20180004572	Wagner	Jan 2018	A1
20180004575	Marriner et al.	Jan 2018	A1
20180046453	Nair et al.	Feb 2018	A1
20180046482	Karve et al.	Feb 2018	A1
20180060132	Maru et al.	Mar 2018	A1
20180060221	Yim et al.	Mar 2018	A1
20180060318	Yang et al.	Mar 2018	A1
20180067841	Mahimkar	Mar 2018	A1
20180067873	Pikhur	Mar 2018	A1
20180081717	Li	Mar 2018	A1
20180089232	Spektor et al.	Mar 2018	A1
20180095738	Dürkop et al.	Apr 2018	A1
20180121245	Wagner et al.	May 2018	A1
20180121665	Anderson	May 2018	A1
20180129684	Wilson et al.	May 2018	A1
20180143865	Wagner et al.	May 2018	A1
20180150339	Pan et al.	May 2018	A1
20180152401	Tandon	May 2018	A1
20180152405	Kuo	May 2018	A1
20180152406	Kuo	May 2018	A1
20180192101	Bilobrov	Jul 2018	A1
20180225096	Mishra et al.	Aug 2018	A1
20180239636	Arora et al.	Aug 2018	A1
20180253333	Gupta	Sep 2018	A1
20180268130	Ghosh	Sep 2018	A1
20180275987	Vandeputte	Sep 2018	A1
20180285101	Yahav et al.	Oct 2018	A1
20180300111	Bhat et al.	Oct 2018	A1
20180309819	Thompson	Oct 2018	A1
20180314845	Anderson	Nov 2018	A1
20180341504	Kissell	Nov 2018	A1
20190004866	Du et al.	Jan 2019	A1
20190028552	Johnson, II	Jan 2019	A1
20190043231	Uzgin et al.	Feb 2019	A1
20190072529	Andrawes et al.	Mar 2019	A1
20190079751	Foskett	Mar 2019	A1
20190102231	Wagner	Apr 2019	A1
20190108058	Wagner et al.	Apr 2019	A1
20190140831	De Lima Junior et al.	May 2019	A1
20190147085	Pal et al.	May 2019	A1
20190155629	Wagner et al.	May 2019	A1
20190171423	Mishra et al.	Jun 2019	A1
20190171470	Wagner	Jun 2019	A1
20190179725	Mital et al.	Jun 2019	A1
20190180036	Shukla	Jun 2019	A1
20190188288	Holm et al.	Jun 2019	A1
20190196884	Wagner	Jun 2019	A1
20190227849	Wisniewski et al.	Jul 2019	A1
20190235848	Swiecki et al.	Aug 2019	A1
20190238590	Talukdar et al.	Aug 2019	A1
20190250937	Thomas et al.	Aug 2019	A1
20190268152	Sandoval	Aug 2019	A1
20190286475	Mani	Sep 2019	A1
20190303117	Kocberber et al.	Oct 2019	A1
20190311115	Lavi	Oct 2019	A1
20190318312	Foskett	Oct 2019	A1
20190361802	Li et al.	Nov 2019	A1
20190363885	Schiavoni et al.	Nov 2019	A1
20190384647	Reque et al.	Dec 2019	A1
20190391834	Mullen et al.	Dec 2019	A1
20200007456	Greenstein et al.	Jan 2020	A1
20200026527	Xu et al.	Jan 2020	A1
20200028936	Gupta et al.	Jan 2020	A1
20200057680	Marriner et al.	Feb 2020	A1
20200065079	Kocberber et al.	Feb 2020	A1
20200073770	Mortimore, Jr. et al.	Mar 2020	A1
20200073987	Perumala et al.	Mar 2020	A1
20200081745	Cybulski et al.	Mar 2020	A1
20200104198	Hussels et al.	Apr 2020	A1
20200104378	Wagner et al.	Apr 2020	A1
20200110691	Bryant et al.	Apr 2020	A1
20200120120	Cybulski	Apr 2020	A1
20200142724	Wagner et al.	May 2020	A1
20200167208	Floes et al.	May 2020	A1
20200192707	Brooker et al.	Jun 2020	A1
20200327236	Pratt	Oct 2020	A1
20200341799	Wagner et al.	Oct 2020	A1
20200412707	Siefker et al.	Dec 2020	A1
20200412720	Siefker et al.	Dec 2020	A1
20200412825	Siefker et al.	Dec 2020	A1
20210117534	Maximov	Apr 2021	A1

Foreign Referenced Citations (44)

Number	Date	Country
2975522	Aug 2016	CA
1341238	Mar 2002	CN
101002170	Jul 2007	CN
101345757	Jan 2009	CN
101496005	Jul 2009	CN
2663052	Nov 2013	EP
3201762	Aug 2017	EP
3254434	Dec 2017	EP
3201768	Dec 2019	EP
2002287974	Oct 2002	JP
2006-107599	Apr 2006	JP
2007-538323	Dec 2007	JP
2010-026562	Feb 2010	JP
2011-065243	Mar 2011	JP
2011-233146	Nov 2011	JP
2011257847	Dec 2011	JP
2013-156996	Aug 2013	JP
2014-525624	Sep 2014	JP
2017-534107	Nov 2017	JP
2017-534967	Nov 2017	JP
2018-503896	Feb 2018	JP
2018-512087	May 2018	JP
2018-536213	Dec 2018	JP
WO 2008114454	Sep 2008	WO
WO 2009137567	Nov 2009	WO
WO 2012039834	Mar 2012	WO
WO 2012050772	Apr 2012	WO
WO 2013106257	Jul 2013	WO
WO 2015078394	Jun 2015	WO
WO 2015108539	Jul 2015	WO
WO 2016053950	Apr 2016	WO
WO 2016053968	Apr 2016	WO
WO 2016053973	Apr 2016	WO
WO 2016090292	Jun 2016	WO
WO 2016126731	Aug 2016	WO
WO 2016164633	Oct 2016	WO
WO 2016164638	Oct 2016	WO
WO 2017059248	Apr 2017	WO
WO 2017112526	Jun 2017	WO
WO 2017172440	Oct 2017	WO
WO 2018005829	Jan 2018	WO
WO 2018098445	May 2018	WO
WO 2020005764	Jan 2020	WO
WO 2020069104	Apr 2020	WO

Non-Patent Literature Citations (107)

Entry
Search Query Report from IP.com (performed Dec. 2, 2020). (Year: 2020).
Search Query Report from IP.com (performed May 27, 2021). (Year: 2021).
Ha et al., A Concurrent Trace-based Just-In-Time Compiler for Single-threaded JavaScript, utexas.edu (Year: 2009).
Huang, Zhe, Danny HK Tsang, and James She. “A virtual machine consolidation framework for mapreduce enabled computing clouds.” 2012 24th International Teletraffic Congress (ITC 24). IEEE, 2012. (Year: 2012).
Lagar-Cavilla, H. Andres, et al. “Snowflock: Virtual machine cloning as a first-class cloud primitive.” ACM Transactions on Computer Systems (TOCS) 29.1 (2011): 1-45. (Year: 2011).
Tange, “GNU Parallel: The Command-Line Power Tool”, vol. 36, No. 1, Jan. 1, 1942, pp. 42-47.
Wood, Timothy, et al. “Cloud Net: dynamic pooling of cloud resources by live WAN migration of virtual machines.” ACM Sigplan Notices 46.7 (2011): 121-132. (Year: 2011).
Zhang et al., VMThunder: Fast Provisioning of Large-Scale Virtual Machine Clusters, IEEE Transactions on Parallel and Distributed Systems, vol. 25, No. 12, Dec. 2014, pp. 3328-3338.
Extended Search Report in European Application No. 19199402.9 dated Mar. 6, 2020.
Office Action in Canadian Application No. 2,962,633 dated May 21, 2020.
Office Action in Canadian Application No. 2,962,631 dated May 19, 2020.
Office Action in European Application No. 16781265.0 dated Jul. 13, 2020.
International Search Report and Written Opinion dated Oct. 15, 2019 for International Application No. PCT/US2019/039246 in 16 pages.
International Search Report for Application No. PCT/US2019/038520 dated Aug. 14, 2019.
International Search Report for Application No. PCT/US2020/039996 dated Oct. 8, 2020.
Anonymous: “Docker run reference”, Dec. 7, 2015, XP055350246, Retrieved from the Internet: URL:https://web.archive.org/web/20151207111702/https:/docs.docker.com/engine/reference/run/ [retrieved on Feb. 28, 2017].
Adapter Pattern, Wikipedia, https://en.wikipedia.org/w/index.php?title=Adapter_pattern&oldid=654971255, [retrieved May 26, 2016], 6 pages.
Amazon, “AWS Lambda: Developer Guide”, Retrieved from the Internet, Jun. 26, 2016, URL : http://docs.aws.amazon.com/lambda/ latest/dg/lambda-dg.pdf, 346 pages.
Amazon, “AWS Lambda: Developer Guide”, Retrieved from the Internet, 2019, URL : http://docs.aws.amazon.com/lambda/ latest/dg/lambda-dg.pdf, 521 pages.
Balazinska et al., Moirae: History-Enhanced Monitoring, Published: 2007, 12 pages.
Ben-Yehuda et al., “Deconstructing Amazon EC2 Spot Instance Pricing”, ACM Transactions on Economics and Computation 1.3, 2013, 15 pages.
Bhadani et al., Performance evaluation of web servers using central load balancing policy over virtual machines on cloud, Jan. 2010, 4 pages.
CodeChef ADMIN discussion web page, retrieved from https://discuss.codechef.com/t/what-are-the-memory-limit-and-stack-size-on-codechef/14159, 2019.
CodeChef IDE web page, Code, Compile & Run, retrieved from https://www.codechef.com/ide, 2019.
Czajkowski, G., and L. Daynes, Multitasking Without Compromise: A Virtual Machine Evolution 47(4a):60-73, ACM SIGPLAN Notices—Supplemental Issue, Apr. 2012.
Das et al., Adaptive Stream Processing using Dynamic Batch Sizing, 2014, 13 pages.
Deis, Container, 2014, 1 page.
Dombrowski, M., et al., Dynamic Monitor Allocation in the Java Virtual Machine, JTRES '13, Oct. 9-11, 2013, pp. 30-37.
Dynamic HTML, Wikipedia page from date Mar. 27, 2015, retrieved using the WayBackMachine, from https://web.archive.org/web/20150327215418/https://en.wikipedia.org/wiki/Dynamic_HTML, 2015, 6 pages.
Espadas, J., et al., A Tenant-Based Resource Allocation Model for Scaling Software-as-a-Service Applications Over Cloud Computing Infrastructures, Future Generation Computer Systems, vol. 29, pp. 273-286, 2013.
Han et al., Lightweight Resource Scaling for Cloud Applications, 2012, 8 pages.
Hoffman, Auto scaling your website with Amazon Web Services (AWS)—Part 2, Cardinalpath, Sep. 2015, 15 pages.
http://discuss.codechef.com discussion web page from date Nov. 11, 2012, retrieved using the WayBackMachine, from https://web.archive.org/web/20121111040051/http://discuss.codechef.com/questions/2881 /why-are-simple-java-programs-using-up-so-much-space, 2012.
https://www.codechef.com code error help page from Jan. 2014, retrieved from https://www.codechef.com/JAN14/status/ERROR,va123, 2014.
http://www.codechef.com/ide web page from date Apr. 5, 2015, retrieved using the WayBackMachine, from https://web.archive.org/web/20150405045518/http://www.codechef.com/ide, 2015.
Kamga et al., Extended scheduler for efficient frequency scaling in virtualized systems, Jul. 2012, 8 pages.
Kato, et al. “Web Service Conversion Architecture of the Web Application and Evaluation”; Research Report from Information Processing Society, Apr. 3, 2006 with Machine Translation.
Kazempour et al., AASH: an asymmetry-aware scheduler for hypervisors, Jul. 2010, 12 pages.
Kraft et al., 10 performance prediction in consolidated virtualized environments, Mar. 2011, 12 pages.
Krsul et al., “VMPlants: Providing and Managing Virtual Machine Execution Environments for Grid Computing”, Supercomputing, 2004. Proceedings of the ACM/IEEESC 2004 Conference Pittsburgh, PA, XP010780332, Nov. 6-12, 2004, 12 pages.
Meng et al., Efficient resource provisioning in compute clouds via VM multiplexing, Jun. 2010, 10 pages.
Merkel, “Docker: Lightweight Linux Containers for Consistent Development and Deployment”, Linux Journal, vol. 2014 Issue 239, Mar. 2014, XP055171140, 16 pages.
Monteil, Coupling profile and historical methods to predict execution time of parallel applications. Parallel and Cloud Computing, 2013, <hal-01228236, pp. 81-89.
Nakajima, J., et al., Optimizing Virtual Machines Using Hybrid Virtualization, SAC '11, Mar. 21-25, 2011, TaiChung, Taiwan, pp. 573-578.
Qian, H. and D. Medhi, et al., Estimating Optimal Cost of Allocating Virtualized Resources With Dynamic Demand, ITC 2011, Sep. 2011, pp. 320-321.
Sakamoto, et al. “Platform for Web Services using Proxy Server”; Research Report from Information Processing Society, Mar. 22, 2002, vol. 2002, No. 31.
Shim (computing), Wikipedia, https://en.wikipedia.org/w/index.php?title+Shim_(computing)&oldid+654971528, [retrieved on May 26, 2016], 2 pages.
Stack Overflow, Creating a database connection pool, 2009, 4 pages.
Tan et al., Provisioning for large scale cloud computing services, Jun. 2012, 2 pages.
Vaghani, S.B., Virtual Machine File System, ACM SIGOPS Operating Systems Review 44(4):57-70, Dec. 2010.
Vaquero, L., et al., Dynamically Scaling Applications in the cloud, ACM SIGCOMM Computer Communication Review 41(1):45-52, Jan. 2011.
Wang et al., “Improving utilization through dynamic VM resource allocation in hybrid cloud environment”, Parallel and Distributed V Systems (ICPADS), IEEE, 2014. Retrieved on Feb. 14, 2019, Retrieved from the internet: URL<https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=7097814, 8 pages.
Wikipedia “API” pages from date Apr. 7, 2015, retrieved using the WayBackMachine from https://web.archive.org/web/20150407191158/https://en .wikipedia.org/wiki/Application_programming_interface.
Wikipedia List_of_HTTP status_codes web page, retrieved from https://en.wikipedia.org/wiki/List_of_HTTP status_codes, 2019.
Wikipedia Recursion web page from date Mar. 26, 2015, retrieved using the WayBackMachine, from https://web.archive.org/web/20150326230100/https://en.wikipedia.org/wiki/Recursion_(computer _science), 2015.
Wikipedia subroutine web page, retrieved from https://en.wikipedia.org/wiki/Subroutine, 2019.
Wu et al., HC-Midware: A Middleware to Enable High Performance Communication System Simulation in Heterogeneous Cloud, Association for Computing Machinery, Oct. 20-22, 2017, 10 pages.
Yamasaki et al. “Model-based resource selection for efficient virtual cluster deployment”, Virtualization Technology in Distributed Computing, ACM, Nov. 2007, pp. 1-7.
Yue et al., AC 2012-4107: Using Amazon EC2 in Computer and Network Security Lab Exercises: Design, Results, and Analysis, 2012, American Society for Engineering Education 2012.
Zheng, C., and D. Thain, Integrating Containers into Workflows: A Case Study Using Makeflow, Work Queue, and Docker, VTDC '15, Jun. 15, 2015, Portland, Oregon, pp. 31-38.
International Search Report and Written Opinion in PCT/US2015/052810 dated Dec. 17, 2015.
International Preliminary Report on Patentability in PCT/US2015/052810 dated Apr. 4, 2017.
Extended Search Report in European Application No. 15846932.0 dated May 3, 2018.
International Search Report and Written Opinion in PCT/US2015/052838 dated Dec. 18, 2015.
International Preliminary Report on Patentability in PCT/US2015/052838 dated Apr. 4, 2017.
Extended Search Report in European Application No. 15847202.7 dated Sep. 9, 2018.
International Search Report and Written Opinion in PCT/US2015/052833 dated Jan. 13, 2016.
International Preliminary Report on Patentability in PCT/US2015/052833 dated Apr. 4, 2017.
Extended Search Report in European Application No. 15846542.7 dated Aug. 27, 2018.
International Search Report and Written Opinion in PCT/US2015/064071dated Mar. 16, 2016.
International Preliminary Report on Patentability in PCT/US2015/064071 dated Jun. 6, 2017.
International Search Report and Written Opinion in PCT/US2016/016211 dated Apr. 13, 2016.
International Preliminary Report on Patentability in PCT/US2016/016211 dated Aug. 17, 2017.
International Search Report and Written Opinion in PCT/US2016/026514 dated Jun. 8, 2016.
International Preliminary Report on Patentability in PCT/US2016/026514 dated Oct. 10, 2017.
International Search Report and Written Opinion in PCT/US2016/026520 dated Jul. 5, 2016.
International Preliminary Report on Patentability in PCT/US2016/026520 dated Oct. 10, 2017.
International Search Report and Written Opinion in PCT/US2016/054774 dated Dec. 16, 2016.
International Preliminary Report on Patentability in PCT/US2016/054774 dated Apr. 3, 2018.
International Search Report and Written Opinion in PCT/US2016/066997 dated Mar. 20, 2017.
International Preliminary Report on Patentability in PCT/US2016/066997 dated Jun. 26, 2018.
International Search Report and Written Opinion in PCT/US/2017/023564 dated Jun. 6, 2017.
International Preliminary Report on Patentability in PCT/US/2017/023564 dated Oct. 2, 2018.
International Search Report and Written Opinion in PCT/US2017/040054 dated Sep. 21, 2017.
International Preliminary Report on Patentability in PCT/US2017/040054 dated Jan. 1, 2019.
International Search Report and Written Opinion in PCT/US2017/039514 dated Oct. 10, 2017.
International Preliminary Report on Patentability in PCT/US2017/039514 dated Jan. 1, 2019.
Extended European Search Report in application No. 17776325.7 dated Oct. 23, 2019.
Office Action in European Application No. 17743108.7 dated Jan. 14, 2020.
Bebenita et al., “Trace-Based Compilation in Execution Environments without Interpreters,” ACM, Copyright 2010, 10 pages.
Office Action in Japanese Application No. 2017-516160 dated Jan. 15, 2018.
Notice of Allowance in Japanese Application No. 2017-516160 dated May 8, 2018.
Office Action in Indian Application No. 201717013356 dated Jan. 22, 2021.
Office Action in Japanese Application No. 2017-516168 dated Mar. 26, 2018.
Office Action in Indian Application No. 201717019903 dated May 18, 2020.
Office Action in Australian Application No. 2016215438 dated Feb. 26, 2018.
Notice of Allowance in Australian Application No. 2016215438 dated Nov. 19, 2018.
Office Action in Canadian Application No. 2,975,522 dated Jun. 5, 2018.
Notice of Allowance in Canadian Application No. 2,975,522 dated Mar. 13, 2020.
Office Action in Indian Application No. 201717027369 dated May 21, 2020.
First Examination Report for Indian Application No. 201717034806 dated Jun. 25, 2020.
Office Action in European Application No. 201817013748 dated Nov. 20, 2020.
Office Action in European Application No. 17743108.7 dated Dec. 22, 2020.
International Preliminary Report on Patentability dated Dec. 29, 2020 for International Application No. PCT/US2019/039246 in 8 pages.
International Preliminary Report on Patentability for Application No. PCT/US2019/038520 dated Dec. 29, 2020.
International Search Report and Written Opinion in PCT/US2019/053123 dated Jan. 7, 2020.
International Search Report for Application No. PCT/US2019/065365 dated Mar. 19, 2020.

Escalation-resistant secure network services using request-scoped authentication information

Information

Patent Number

Date Filed

Date Issued

Inventors

Original Assignees

Examiners

Agents

CPC

Field of Search

CPC

International Classifications

Term Extension

Abstract

Description

Claims

US Referenced Citations (791)

Foreign Referenced Citations (44)

Non-Patent Literature Citations (107)