On-demand validated execution of specific tasks in isolation

Abstract

System and methods for on-demand isolated execution of specific tasks. A system receives, via a communication interface, requests to execute tasks. The system reacts to each of the requests by allocating, on-demand and per the request received, a unique sub-set of physical computational resources, so as to result in several such unique sub-sets of resources. The system executes, per each of the tasks, the respective commands of the task, by converting the respective commands of the task into executable instructions and running the executable instructions. The respective commands of each of the tasks are converted so as to cause the resulting executable instruction to refrain from accessing other unique sub-sets that were not allocated to the task, thereby facilitating said on-demand isolated execution of each of the tasks.

What is claimed is: 
     
         1 . A method for on-demand isolated execution of specific tasks, comprising:
 receiving, via a communication interface, in a computing platform, a request to execute a specific task, in which the specific task is expressed as a first code segment comprising a plurality of commands;   reacting, by the computing platform, to the request received, by allocating on-demand and per the request received, a sub-set of physical computational resources within the computing platform, in which said sub-set allocated is operative to facilitate successful execution of the specific task; and   executing, in the computing platform, the specific task, by (i) converting each of the commands into executable instructions, (ii) running the executable instructions, in which the commands are converted so as to cause the executable instructions to utilize resources within the allocated sub-set of physical computational resources, while avoiding utilization of other resources that were not allocated for the specific task, thereby facilitating said on-demand isolated execution of the specific task, and (iii) generating, in conjunction with said conversion and prior to run time, specific validation instructions within the executable instructions, in which said specific validation instructions are operative, during run time, to validate specific access addresses utilized by the executable instructions, in which said validation guarantees that the specific access addresses are contained within a set of addresses associated with the allocated sub-set.   
     
     
         2 . The method of  claim 1 , wherein said specific task has a starting point and an ending point, and the method further comprises:
 initiating said execution in conjunction with said starting point;   continuing said execution till the ending point;   terminating said execution immediately after reaching the ending point; and   releasing the sub-set of physical computational resources immediately after said termination and regardless of any state set by the specific task in conjunction with the sub-set of physical computational resources.   
     
     
         3 . The method of  claim 2 , wherein:
 a transition between said reception and said execution takes less than 10 (ten) millisecond as a combined result of said conversion being an interpretation process and said allocation on-demand.   
     
     
         4 . The method of  claim 3 , wherein:
 said transition together with said execution till the ending point and including said releasing takes less than 100 (one hundred) milliseconds as a combined result of said interpretation process, said allocation on-demand, and said specific task having said starting point and ending point.   
     
     
         5 . The method of  claim 1 , wherein the physical computational resources comprise physical memory, in which the sub-set of the physical computational resources comprise a sub-set of the physical memory. 
     
     
         6 . The method of  claim 5 , wherein the code segment further comprises data sets, and the method further comprising:
 setting, using the data sets, in conjunction with said execution, memory values in conjunction with the sub-set of the physical memory.   
     
     
         7 . The method of  claim 6 , further comprising:
 terminating the task when the task ends; and then immediately   releasing the sub-set of the physical memory for usage by other tasks, and regardless of said setting of memory values which are now no longer relevant upon said termination.   
     
     
         8 . The method of  claim 1 , further comprising:
 terminating said on-demand isolated execution immediately upon a particular event associated with the specific task, thereby releasing immediately the sub-set of physical computational resources for other tasks.   
     
     
         9 . The method of  claim 8 , wherein said particular event is selected from a group consisting of: (i) an ending or completion of the specific task, (ii) a timeout which limits the execution time of the specific task, (iii) a fault made by the specific task, and (iv) a supervision decision, by the computing platform, to terminate the specific task. 
     
     
         10 . The method of  claim 1 , wherein the conversion is an interpretation process, in which each of the commands is converted and executed separately from the other commands. 
     
     
         11 . The method of  claim 1 , wherein the conversion is a compilation process. 
     
     
         12 . The method of  claim 1 , wherein the conversion is a binary translation process. 
     
     
         13 . The method of  claim 1 , wherein said causing of the executable instructions to utilize resources within the allocated sub-set is facilitated by generating, in conjunction with said conversion and prior to run time, specific access addresses to be utilized by the executable instructions, in which said specific access addresses are guaranteed, by the computing platform, to be contained within a set of addresses associated with the allocated sub-set. 
     
     
         14 . The method of  claim 1 , wherein said causing of the executable instructions to utilize resources within the allocated sub-set is facilitated by said generating, in conjunction with said conversion and prior to run time, of the specific validation instructions within the executable instructions. 
     
     
         15 . The method of  claim 1 , wherein said specific task has a starting point and an ending point, and the method further comprises:
 initiating said execution in conjunction with said starting point;   continuing said execution till the ending point;   terminating said execution immediately after reaching the ending point; and   preserving the sub-set of physical computational resources after said termination, thereby allowing re-use of the sub-set for consequent tasks that are identified to be associated with a group of tasks to which the specific task belongs.   
     
     
         16 . A system operative to facilitate on-demand isolated execution of a plurality of tasks, comprising:
 a set of physical computational resources;   at least one compute element belonging to at least one central-processing-unit; and   a communication interface;   wherein the system is configured to:   receive, via the communication interface, a plurality of requests to execute respectively a plurality of tasks, in which each of the plurality of tasks comprises a plurality of commands;   react, to each the requests received, by allocating on-demand and per the request received, a unique sub-set of the physical computational resources, so that a plurality of the unique sub-sets coexists at least temporarily in conjunction with the plurality of tasks respectively; and   execute, per each of the plurality of tasks, in a designated one of the compute elements, the respective commands of the task, by converting the respective commands of the task into executable instructions and associated validation instructions and running the executable instructions and the associated validation instructions, in which the respective commands of the task are converted so as to cause the respective executable instructions to not access other unique sub-sets that were not allocated to the task, while the validation instructions are operative to validate that the other unique sub-sets are indeed not accessed, thereby facilitating said on-demand isolated execution of each of the plurality of tasks.   
     
     
         17 . The system of  claim 16 , wherein the system is further configured to terminate the on-demand isolated execution of each of the tasks immediately upon a particular event associated with the task, thereby releasing immediately the respective unique sub-set of the task, thereby assuring that the respective unique sub-set of each of the tasks exist only for a duration in which the task is being executed and being terminated. 
     
     
         18 . The system of  claim 17 , wherein:
 said duration of existence, on average, is between 1 (one) milliseconds and one (1) second;   an average time for performing said allocation for each the unique sub-sets is less than 1/10 (one tenth) of said duration; and   an average time for performing said releasing for each the unique sub-sets is less than 1/10 (one tenth) of said duration.   
     
     
         19 . The system of  claim 18 , wherein:
 said plurality of requests are received as a stream of incoming requests; and   said duration and average times allow, per each of the compute elements, to sustain, on average, a rate of executing of at least one of the tasks per second, and up to a maximum rate of executing of 1000 (one thousand) of the tasks per second.   
     
     
         20 . The system of  claim 19 , wherein each of the requests is a remote-procedure-call (RPC). 
     
     
         21 . The system of  claim 17 , wherein:
 the system is a computing platform that communicates with remote nodes via said communication interface and a network;   the communication interface is a physical network adapter connected to the network; and   the requests are received in the system, from the remote nodes, via the network.   
     
     
         22 . The system of  claim 17 , wherein:
 the communication interface is a logical interface; and   at least some f the requests are generated from within the system and possibly by some of the tasks themselves.   
     
     
         23 . The system of  claim 17 , wherein at least one of the requests is a remote-procedure-call (RPC). 
     
     
         24 . The system of  claim 23 , wherein at least one of the tasks is configured to calculate at least one value, and to return the value as a respond to the respective remote node upon said termination of the task. 
     
     
         25 . The system of  claim 23 , wherein at least one of the tasks is configured to receive a value via the respective request, and to use this value in conjunction with the respective execution of the respective commands. 
     
     
         26 . The system of  claim 17 , wherein at least one of the requests is an internal system request associated with a system event that requires handling by one of the tasks. 
     
     
         27 . The system of  claim 16 , wherein the set of physical computational resources comprises at least one of: (i) physical memory such as a random-access-memory (RAM) or a flash memory, in which each of the unique sub-sets is a unique subset of the physical memory, (ii) physical storage such as magnetic hard disks or flash disks, in which each of the unique sub-sets comprises a unique subset of the physical storage, and (iii) input-output (TO) channels, in which each of the unique sub-sets comprises a unique subset of the TO channels. 
     
     
         28 . The system of  claim 16 , wherein the system is further configured to limit, per each of the tasks being executed, an extent to which the task is utilizing other system resource, in which said other system resource comprise at least one of: (i) the respective computer element clock cycles, (ii) communication bandwidth, and (iii) power dissipation. 
     
     
         29 . The system of  claim 16 , wherein the set of physical computational resources is a physical memory such as a random-access-memory (RAM) or a flash memory, in which each of the unique sub-sets is a memory space of less than 1 MByte (one megabyte), thereby allowing for at least 1,000 (one thousand) of the tasks to be concurrently active per 1 Gbyte (one gigabyte) of the physical memory.