Cloud computing platform that isolates suspicious third-party code in a distributed cloud computing network
A worker process monitors a behavior of a third-party code piece executing in a first isolated execution environment of a plurality of isolated execution environments of a first process in a first compute server. When the behavior of the executing third-party code piece is indicative of a potential speculative execution attack, the third-party code piece is flagged. When a subsequent request is received that triggers execution of the flagged third-party code piece, the worker process generates a private process in the first compute server, separate from the first process, and instantiates a single isolated execution environment within the second process for executing the third-party code piece. The work process loads the third-party code piece in the single isolated execution environment and the second process executes the third-party code piece.
1. A method, comprising:
monitoring a behavior of a third-party code piece executing in a first isolated execution environment of a plurality of isolated execution environments of a first process in a first compute server, wherein the first compute server is one of a plurality of compute servers that are part of a distributed cloud computing network;
determining that the behavior of the executing third-party code piece is indicative of a potential speculative execution attack;
receiving, at the first compute server of the plurality of compute servers from a client device, a request that triggers execution of the third-party code piece whose behavior has been determined to be indicative of the potential speculative execution attack;
generating, in response to the request, a second process of the first compute server of the plurality of compute servers, wherein the second process is separate from the first process;
instantiating a single isolated execution environment within the second process for executing the third-party code piece;
loading the third-party code piece in the single isolated execution environment;
executing, by the second process, the third-party code piece, wherein the third-party code piece is run in the single isolated execution environment within the second process; and
transmitting, to the client device, a response to the request based at least in part on the executed third-party code piece.
2. The method of claim 1 , wherein the second process is configured for executing only the third-party code piece.
3. The method of claim 1 , wherein the second process is a child process of the first process.
4. The method of claim 1 , further comprising:
generating, by the second process, the response to the request based at least in part on the executed third-party code piece; and
sending, by the second process, the response to the request to the first process.
5. The method of claim 1 , wherein executing the third-party code piece causes a subrequest to be generated that triggers execution of a second one of a plurality of third-party code pieces, and wherein the subrequest is sent to the first process for transmission to a gateway for determining the execution of the second one of the plurality of third-party code pieces.
6. The method of claim 1 , wherein loading the third-party code piece in the single isolated execution environment comprises:
receiving the third-party code piece from the first process.
7. The method of claim 1 , wherein determining that the behavior of the executing third-party code piece is indicative of the potential speculative execution attack comprises:
setting an indicator for the third-party code piece to indicate that the third-party code piece is exhibiting behavior indicative of the potential speculative execution attack comprises.
8. A non-transitory machine-readable storage medium that provides instructions that, when executed by a processor, cause said processor to perform operations comprising:
monitoring a behavior of a third-party code piece executing in a first isolated execution environment of a plurality of isolated execution environments of a first process in a first compute server, wherein the first compute server is one of a plurality of compute servers that are part of a distributed cloud computing network;
determining that the behavior of the executing third-party code piece is indicative of a potential speculative execution attack;
receiving, at the first compute server of the plurality of compute servers from a client device, a request that triggers execution of the third-party code piece whose behavior has been determined to be indicative of the potential speculative execution attack;
generating, in response to the request, a second process of the first compute server of the plurality of compute servers, wherein the second process is separate from the first process;
instantiating a single isolated execution environment within the second process for executing the third-party code piece;
loading the third-party code piece in the single isolated execution environment;
executing, by the second process, the third-party code piece, wherein the third-party code piece is run in the single isolated execution environment within the second process; and
transmitting, to the client device, a response to the request based at least in part on the executed third-party code piece.
9. The non-transitory machine-readable storage medium of claim 8 , wherein the second process is configured for executing only the third-party code piece.
10. The non-transitory machine-readable storage medium of claim 8 , wherein the second process is a child process of the first process.
11. The non-transitory machine-readable storage medium of claim 8 , further comprising:
generating, by the second process, the response to the request based at least in part on the executed third-party code piece; and
sending, by the second process, the response to the request to the first process.
12. The non-transitory machine-readable storage medium of claim 8 , wherein executing the third-party code piece causes a subrequest to be generated that triggers execution of a second one of a plurality of third-party code pieces, and wherein the subrequest is sent to the first process for transmission to a gateway for determining the execution of the second one of the plurality of third-party code pieces.
13. The non-transitory machine-readable storage medium of claim 8 , wherein loading the third-party code piece in the single isolated execution environment comprises:
receiving the third-party code piece from the first process.
14. The non-transitory machine-readable storage medium of claim 8 , wherein determining that the behavior of the executing third-party code piece is indicative of the potential speculative execution attack comprises:
setting an indicator for the third-party code piece to indicate that the third-party code piece is exhibiting behavior indicative of the potential speculative execution attack comprises.
15. An apparatus, comprising:
a processor;
a non-transitory machine-readable storage medium coupled with the processor that stores instructions that, when executed by the processor, causes said processor to perform the following:
monitor a behavior of a third-party code piece executing in a first isolated execution environment of a plurality of isolated execution environments of a first process in a first compute server, wherein the first compute server is one of a plurality of compute servers that are part of a distributed cloud computing network;
determine that the behavior of the executing third-party code piece is indicative of a potential speculative execution attack;
receive, at the first compute server of the plurality of compute servers from a client device, a request that triggers execution of the third-party code piece whose behavior has been determined to be indicative of the potential speculative execution attack;
generate, in response to the request, a second process of the first compute server of the plurality of compute servers, wherein the second process is separate from the first process;
instantiate a single isolated execution environment within the second process for executing the third-party code piece;
load the third-party code piece in the single isolated execution environment;
execute, by the second process, the third-party code piece, wherein the third-party code piece is run in the single isolated execution environment within the second process, and
transmit, to the client device, a response to the request based at least in part on the executed third-party code piece.
16. The apparatus of claim 15 , wherein the second process is configured for executing only the third-party code piece.
17. The apparatus of claim 15 , wherein the second process is a child process of the first process.
18. The apparatus of claim 15 , wherein the instructions further cause said processor to perform the following:
generate, by the second process, the response to the request based at least in part on the executed third-party code piece; and
send, by the second process, the response to the request to the first process.
19. The apparatus of claim 15 , wherein executing the third-party code piece causes a subrequest to be generated that triggers execution of a second one of a plurality of third-party code pieces, and wherein the subrequest is sent to the first process for transmission to a gateway for determining the execution of the second one of the plurality of third-party code pieces.
20. The apparatus of claim 15 , wherein loading the third-party code piece in the single isolated execution environment comprises:
receiving the third-party code piece from the first process.
21. The apparatus of claim 15 , wherein determining that the behavior of the executing third-party code piece is indicative of the potential speculative execution attack comprises:
setting an indicator for the third-party code piece to indicate that the third-party code piece is exhibiting behavior indicative of the potential speculative execution attack comprises.