Serverless application security protection method and system based on dynamic Token

Abstract

The invention provides a Serverless application security protection method and system based on dynamic Token, and aims to solve the problems of permission leakage and sensitive data leakage in Serverless application and give consideration to application performance at the same time. According to the method, temporary keys are managed and sensitive data are protected by dynamically generating and verifying Token, a function-level key and encryption rule design is adopted, and complete encryption, transmission, decryption and verification processes are realized. The system comprises a Token generation function module, a key management function module, a data encryption and decryption function module, a log management function module, a performance optimization function module and the like, and can flexibly adapt to different Serverless platforms and application scenes. Compared with the prior art, the security of the sensitive data and the execution permission is remarkably improved, permission and data leakage is effectively prevented, and meanwhile the influence on the application performance is small. In addition, the invention also provides a complete log auditing function, the traceability of the security event is enhanced, the user experience is good, and the method has a wide application prospect.

Description

Technical Field

[0001] The present invention relates to the field of cloud computing technology, and in particular to a security protection method and system for Serverless applications. Background Art

[0002] With the rapid development of cloud computing technology, Serverless architecture has been widely used in many fields due to its advantages such as high efficiency, flexibility and low cost. Serverless allows developers to focus on core business logic without having to worry about the management and maintenance of the underlying infrastructure. This new computing model has important application value in scenarios such as Web applications, data processing, and the Internet of Things.

[0003] Currently, Serverless applications mainly use identity and access management (IAM) mechanisms to achieve security protection. IAM controls access to resources by identifying and authorizing users and services. At the same time, the Serverless platform also provides some built-in security features, such as code encryption and log auditing. These security mechanisms guarantee the security of Serverless applications to a certain extent.

[0004] However, the existing Serverless security protection solutions still have some shortcomings. First, IAM configuration is relatively complex, prone to misconfiguration or excessive allocation of permissions, leading to potential security risks. Second, sensitive information in Serverless applications, such as keys and tokens, is usually stored in environment variables in plain text and is easily leaked. In addition, function instances and triggers in multi-tenant scenarios lack effective isolation, and malicious users may illegally access other users' resources by escalating privileges. These security issues may lead to serious data leaks and economic losses in actual applications.

[0005] To solve the above problems, the industry has proposed some improvement solutions. For example, using key management services such as Vault to centrally store and manage sensitive information; introducing role-based access control (RBAC) to refine the granularity of permission management; and implementing network isolation between different tenants through virtual private cloud (VPC). These methods have enhanced the security of Serverless applications to a certain extent, but they still face limitations such as complex integration, high performance overhead, and insufficient scalability.

[0006] In general, ensuring the security of Serverless applications has become a key issue that needs to be solved in the field of cloud computing. The ideal solution should be simple to configure, efficient, reliable, and easy to integrate, while minimizing the impact on application performance. Developing a new security protection technology specifically for Serverless scenarios has become a research hotspot and development trend in this field. Summary of the invention

[0007] The purpose of the present invention is to solve the problems of permission configuration errors, sensitive information leakage, and insufficient multi-tenant isolation in the existing Serverless application security protection mechanism. Specifically, the present invention aims to provide a Serverless application security protection method and system based on dynamic tokens, which can significantly improve the security of Serverless applications by introducing an additional security protection layer on the Serverless platform to achieve more comprehensive, fine-grained, and automated security protection for Serverless applications.

[0008] In addition, the present invention also aims to provide a security protection solution that is easy to integrate and has little impact on application performance, so that it can be applied to various Serverless platforms and application scenarios and has good versatility and practicality.

[0009] To achieve the above-mentioned purpose of the invention, the present invention provides a Serverless application security protection method based on dynamic Token, which is characterized by: the method first dynamically generates a secure Token according to the metadata information of the request and the preset rules; then uses the Token to obtain the exclusive key of the corresponding function from the key management service, and sends the key to the execution environment together with the function code; during the function execution process, the exclusive key is used to encrypt, store and transmit sensitive data, and the temporary key is destroyed immediately after the function execution is completed to avoid leakage of sensitive information.

[0010] Furthermore, the present invention also provides a supporting Serverless application security protection system, which includes functional modules such as request processing, token generation, key management, function scheduling, security configuration storage, policy management, and audit logs, realizing automated security protection for the entire life cycle of Serverless applications. This system adopts a highly modular architecture design, allowing users to customize security policies in a declarative manner, with strong scalability and flexibility.

[0011] A key feature of the present invention is the dynamic Token generation mechanism. The system uses a secure hash algorithm (such as SHA-256) to dynamically generate a random and unpredictable Token based on the metadata information of each request (such as request ID, timestamp, caller IP, etc.) and preset rules (such as token validity period, caller IP whitelist, etc.). The Token contains key declaration information, such as function name, version number, etc., which is used for subsequent key management and authorization verification.

[0012] Another important feature is fine-grained function key management. The system generates a symmetric encryption key for each function and uses the platform's root key to re-encrypt the function key to form a key package. The key package is sent to the actual execution environment of the function through a secure channel and dynamically decrypted when used. This key distribution method ensures that only legitimate function instances can access their own keys. Even if the key of an instance is leaked, it will not affect other function instances.

[0013] Preferably, the present invention realizes automatic encryption protection of sensitive data throughout the life cycle of Serverless applications. This includes encryption of sensitive configurations of persistent storage, function code environment variables, sensitive data generated at runtime, etc., as well as end-to-end encryption of data communicated between functions. The encryption process is transparent to developers and is automatically completed by the system.

[0014] Optionally, the present invention introduces a declarative security policy management mechanism, allowing users to flexibly define the security protection policy of each function through configuration files, including token validity period, key strength, access control rules, etc. The system's policy parsing engine can automatically apply user-defined security policies to achieve differentiated security protection for different functions.

[0015] Another feature of the present invention is a comprehensive security audit mechanism. The system records all sensitive operations during function execution, including token issuance, key usage, plaintext data access, etc., and stores the audit logs securely. Platform administrators can promptly discover and handle abnormal security events through log analysis.

[0016] In a preferred embodiment, the present invention takes the AWS Lambda platform as an example and provides a complete end-to-end Serverless application security solution: use AWS IAM service for user authentication and authorization, and use AWS Cognito to implement federated identity management; centrally manage function keys and other sensitive configuration information through AWS Secrets Manager; use the Envelope Encryption function of the AWS KMS service to achieve decoupling between key management and data encryption; use AWS CloudTrail to perform detailed audit logs for all sensitive operations; and centrally manage security incidents through AWS SecurityHub to achieve automated security operations.

[0017] This embodiment makes full use of the various security features provided by the AWS platform, from identity authentication, key management to security reinforcement, incident response, etc., to provide one-stop security protection for the development, deployment, and operation and maintenance of Serverless applications. System components are managed in the form of IaC code, support automated deployment, and provide supporting SDKs and management panels, greatly improving the efficiency of development and operation and maintenance.

[0018] In summary, the present invention effectively solves the main security challenges currently faced by Serverless applications by building a new dynamic Token security protection layer on the Serverless platform. Compared with the prior art, the present invention has the following advantages: First, the present invention achieves more fine-grained security isolation. Traditional Serverless platforms usually share keys between functions, which poses a risk of key leakage. However, the present invention implements request-level identity authentication through dynamic tokens and assigns independent temporary keys to each function instance, minimizing the scope of key leakage.

[0019] Secondly, the present invention provides more comprehensive data protection. The present invention not only protects the sensitive data in persistent storage, but also provides automatic encryption protection for the sensitive data generated during the function execution process, thus truly achieving end-to-end data security.

[0020] Thirdly, the present invention supports more flexible security policies. Through declarative security policy configuration, the present invention can implement differentiated security protection for different functions without modifying the function code, which greatly improves the flexibility of security management and control.

[0021] In addition, the present invention also has stronger security auditing capabilities. The audit log of the present invention covers the entire life cycle of function execution, uses the platform's native log audit service, and provides a solid data foundation for compliance auditing and event investigation.

[0022] Finally, the present invention is easier to integrate and use. The present invention provides a complete IaC deployment script, supporting SDK and management panel, which developers can integrate into existing Serverless applications and CI / CD processes at a very low cost, truly realizing DevSecOps.

[0023] The present invention is applicable to various Serverless computing platforms and application scenarios, and is a universal Serverless application security solution.

[0024] The present invention has the following beneficial effects: (1) It provides a simple and easy-to-integrate serverless application security protection solution, greatly reducing the risk of misconfiguration and improper management; (2) Through the dynamic token mechanism and refined key management, the problem of sensitive data leakage is fundamentally solved; (3) Implemented access control and security isolation at the function instance level to effectively deal with various threats in multi-tenant scenarios; (4) A comprehensive audit log and event analysis mechanism was introduced to achieve automated discovery and response to security threats; (5) Through a series of performance optimizations, the impact of security protection mechanisms on Serverless application performance is minimized.

[0025] In summary, the present invention provides a comprehensive, reliable and efficient Serverless application security solution, which is expected to become a key technology in this field and promote the further development and application of Serverless computing. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the technical solution of the present invention, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention, and for those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative work.

[0027] Figure 1 This is the overall architecture diagram of the present invention. User requests trigger function execution through the Serverless platform, which dynamically generates a token and obtains a key package from the key management service. The function instance uses the key to decrypt sensitive data, perform calculations, and return the encrypted result to the caller.

[0028] Figure 2 The dynamic token generation process is shown. The Serverless platform extracts request metadata (such as request ID), combines user-defined rules (such as validity period), and uses a secure token generation algorithm (such as SHA256) to dynamically generate a unique token.

[0029] Figure 3 This section describes the process of function key management and data encryption and decryption. The key management service generates a separate key package for each function. The function instance decrypts the key package and uses the key to encrypt and decrypt sensitive data. After the function is executed, the local key is securely destroyed.

[0030] Figure 4The process of log auditing and security incident handling is demonstrated. Function call logs are collected in real time into the log auditing service, and are visualized and abnormal event alarms are generated through monitoring and analysis processes. Alarms notify security administrators to analyze and handle incidents.

[0031] Figure 5 This is a diagram of the interface components of the security management panel. The panel mainly includes components such as function list, security rule configuration, and security event list, and provides functions such as configuring function security rules, monitoring function running status, and investigating security events.

[0032] Figure 6 It is an architecture diagram of the present invention, showing the relationship and composition between various modules. DETAILED DESCRIPTION

[0033] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0034] In the description of the present invention, it should be noted that the terms "center", "up", "down", "left", "right", "vertical", "horizontal", "inside", "outside" and the like indicate directions or positional relationships based on the directions or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific direction, be constructed and operated in a specific direction, and therefore should not be understood as a limitation on the present invention.

[0035] Example 1: This example provides a method for protecting the security of Serverless applications based on dynamic tokens. Figure 1 As shown, the method mainly includes the following steps.

[0036] Step 1: Dynamically generate a secure token. When the Serverless platform receives a user request, it extracts the metadata information of the request, such as the request ID, timestamp, caller IP, etc. The platform then inputs this metadata information into the token generation algorithm together with preset user-defined rules (such as token validity period, caller IP whitelist, etc.). The token generation algorithm can choose a secure hash algorithm, such as SHA-256 or SHA-3, to ensure that the generated token is highly unpredictable and collision-resistant. Specifically, the token generation process can be expressed as: Among them, HMAC represents the key-hashed message authentication code algorithm, SecretKey is the platform key, Metadata is the request metadata, CustomRules is the user-defined rules, and || represents the string concatenation operation. This algorithm uses the platform key and request metadata to generate a dynamic and difficult-to-forge Token, which improves the security of the Token.

[0037] The token may also contain other necessary declarations, such as function name, function version number, etc., for subsequent key management and authorization verification. Compared with static access keys, dynamic tokens have more fine-grained access control capabilities and shorter validity periods, which is a key improvement of the present invention.

[0038] Step 2: Get the function-specific key based on the token. The Serverless platform generates a unique symmetric key for each function and encrypts the function key with the platform's root key to form a key package. The key package, together with other metadata of the function (such as function name and version number), is sent to a key management service through a secure and reliable channel for centralized storage, such as AWS KMS. When the Serverless platform receives the token generated in step 1, it immediately sends the token to the key management service and requests the key package corresponding to the function declared in the token. The key management service verifies the validity and integrity of the token, confirms that the function declared in the token does exist and the token has not expired, and then returns the corresponding key package to the Serverless platform through a secure channel.

[0039] Compared with traditional static keys, the present invention adopts dynamic function-specific keys and entrusts key management to professional key management services, which effectively reduces the risk of key leakage and improves the reliability of key management, which is another improvement of the present invention.

[0040] Step 3: Send the key package to the function instance. When scheduling the function execution, the Serverless platform sends the key package obtained from the key management service together with the function code to the execution environment, such as the execution context of AWS Lambda. Here, it is necessary to ensure that the transmission process of the key package is secure. You can use the secure communication channel provided by the platform, such as AWS Lambda using AWS PrivateLink to protect communication with AWS KMS. After receiving the key package, the function instance uses the preset platform public key to decrypt the key package, extract the symmetric key corresponding to this function instance, and store it in the secure memory of the function instance (such as Intel SGX) for subsequent use.

[0041] Compared with simply sending the plaintext key together with the function code, the present invention uses the key package to ensure that the key is always encrypted during transmission and storage. Even if the function code is stolen, the key cannot be directly obtained, thereby improving the confidentiality of the key. This is an innovation of the present invention in key distribution.

[0042] Step 4: Use keys to protect sensitive data. During the execution of the function code, some sensitive data needs to be accessed, such as database connection strings, API keys, etc. This invention recommends storing these sensitive data in a secure configuration service (such as AWS Systems Manager Parameter Store), and then obtaining the ciphertext of these sensitive data through the specified key name (such as " / prod / my-app / db-password") in the code. When the function instance needs to use sensitive data, first use the symmetric key obtained in step 3 to decrypt the ciphertext and load the plaintext data into the memory; after the function is executed, immediately and securely erase the plaintext data from the memory to avoid sensitive information leakage. If the function needs to obtain sensitive data from the event input, the caller can be required to use the public key (obtained from the key management service) to encrypt the sensitive data and then transmit it to the function instance. The function instance uses the private key to decrypt it before use.

[0043] The present invention always adheres to encryption protection throughout the entire life cycle (storage, transmission, and use) of sensitive data. Even if an attacker obtains the ciphertext of sensitive data, he cannot obtain the plaintext information because he does not have the decryption key. Compared with only protecting sensitive data in static storage, the data protection solution of the present invention is more comprehensive, covering all aspects of sensitive data use, which is a significant improvement.

[0044] Step 5: Encrypt the function output data. When the function outputs the calculation results to the downstream service, if the results contain sensitive information (such as personal identity information PII), it is necessary to first use the symmetric key obtained in step 3 to encrypt the sensitive fields, and then send the ciphertext to the downstream service. The downstream service that receives the results can obtain the corresponding key from the key management service for decryption. In order to improve the efficiency of encryption and decryption, you can choose a higher-performance symmetric encryption algorithm, such as AES-GCM. The AES-GCM algorithm combines symmetric encryption and message authentication. While providing confidentiality, it can also prevent data from being tampered with, and has higher security. The encryption process can be expressed as: Among them, Key is the symmetric key, IV is the initialization vector, PlainData is the plaintext data, AAD is the additional authentication data, Ciphertext is the ciphertext, and Tag is the authentication tag.

[0045] Traditional Serverless applications usually ignore the protection of function output data, which poses a risk of sensitive information leakage. This invention introduces a data encryption mechanism in the function output link, further expanding the coverage of data protection and making up for the shortcomings of existing solutions.

[0046] Step 6: Safely destroy keys and sensitive data. When the function instance is executed, the symmetric key obtained in step 3 needs to be destroyed immediately to ensure that the key does not reside in an untrusted environment for a long time. For the plaintext sensitive data decrypted in step 4, it is also necessary to erase the memory as soon as possible to avoid it remaining in the system and being stolen by malicious programs.

[0047] Timely destruction of temporary keys and plaintext data is a basic principle in cryptography. However, in a Serverless environment, since the lifecycle of function instances is managed by the platform, developers often overlook this operation, resulting in long-term retention of sensitive information that should have been destroyed, increasing the risk of data leakage. The present invention improves the security of the system by automatically destroying keys and data to ensure that sensitive information is securely deleted immediately after use. This is also an improvement in detail.

[0048] Through the above steps, this method realizes the automatic encryption protection of sensitive data throughout the life cycle of the Serverless application, greatly reducing the risk of sensitive information leakage. Compared with the traditional Serverless security solution, the innovations of this invention mainly include: (1) Dynamic Token combined with refined key management ensures that each function instance uses an independent temporary key. Even if the key of an instance is leaked, it will not affect the security of other instances and the entire application. (2) The automated key distribution and rotation mechanism eliminates the tedious and error-prone manual key management. Keys are centrally managed by a trusted key management service, further reducing the risk of key leakage; (3) A fine-grained data encryption solution that encrypts statically stored sensitive data, event input parameters, and function calculation results, achieving data security protection throughout the entire life cycle and making up for the shortcomings of existing solutions; (4) By utilizing the security capabilities provided by the platform, such as execution environment isolation, secure communication channels, and high-strength cryptographic algorithms, the data protection level is significantly improved and the risk of sensitive information leakage is reduced without adding additional development burden; (5) It is highly automated and almost imperceptible to developers. While ensuring security to the greatest extent possible, it does not bring additional complexity to the development and deployment of Serverless applications, thereby improving the availability of the system.

[0049] In summary, the present invention systematically solves the challenges faced by Serverless applications in data security from multiple aspects such as dynamic authentication, key management, data encryption, secure communication, key destruction, etc., and provides a set of automated, fine-grained, and full-life cycle data security solutions. Compared with the existing technology, it has significant innovation and improvement effects.

[0050] Embodiment 2: Based on Embodiment 1, this embodiment further provides a method for supporting user-defined security policies.

[0051] like Figure 2 As shown in the figure, this method introduces a policy management module, allowing users to configure personalized security protection policies for different functions. Based on the declarative policy definition language, users can flexibly define security attributes such as token generation rules, key strength, key validity period, ACL access control rules, etc. for each function through configuration files in YAML or JSON format.

[0052] Specifically, in this configuration file, users can specify security options such as the token generation algorithm (such as SHA-256 or SHA-512), token validity period, and whether to encrypt input and output parameters for a specific function.

[0053] In addition, users can also declare cryptographic parameters such as the KMS key specifications (such as AES-256) used. Through this declarative configuration method, users can customize security protection policies according to the sensitivity level of the function and business scenarios, improving the flexibility of policy management.

[0054] At the same time, the declarative configuration method also simplifies the complexity of policy management. Users only need to fill in predefined configuration items without writing additional code logic, which reduces the difficulty of integrating security functions.

[0055] In order to automatically execute user-defined security policies, this embodiment introduces a policy parsing engine. The policy parsing engine is responsible for parsing the policy configuration in YAML or JSON format provided by the user and converting it into an internal policy object model. When a function receives a request, the policy parsing engine intercepts the request and searches for the corresponding policy object based on the function name.

[0056] Based on the security attributes defined in the policy object, the policy parsing engine will perform corresponding security operations, such as generating tokens using the specified algorithm and calling the KMS service for data encryption and decryption.

[0057] Furthermore, the policy parsing engine also has a set of default best practice policies built in, which can provide basic security protection when the user does not explicitly configure certain attributes. By introducing the policy parsing engine, this embodiment achieves the decoupling of security policies from business logic and simplifies the integration and management of security functions.

[0058] In order to improve the auditability and credibility of Serverless applications, this embodiment also introduces a security audit module. The security audit module is responsible for recording all sensitive operations during the function execution process, including token issuance, key acquisition, encryption and decryption, and asynchronously sends the audit log to an independent log storage service to prevent local logs from being tampered with. At the same time, the security audit module also digitally signs and timestamps the audit logs to ensure the integrity of the logs. In order to protect the audit logs of highly sensitive functions, the security audit module supports log desensitization and independent storage.

[0059] Preferably, the security audit module also provides an anomaly detection function based on machine learning, which automatically identifies potential security threats by analyzing user behavior patterns. By integrating the security audit module, this embodiment provides a complete security event tracing capability, which facilitates post-audit and compliance verification.

[0060] In summary, the advantages of this embodiment are: (1) Supports customized security policies, allowing users to flexibly configure security protection policies of different granularities based on the sensitivity level of the function and business scenarios, thereby improving security and applicability; (2) Declarative policy configuration is adopted based on the common YAML / JSON format, which reduces the user's learning cost and configuration burden and facilitates integration into the existing development and operation system; (3) The introduction of a policy parsing engine decouples security logic from business logic, simplifying the integration and management of security functions; (4) Built-in default best practice policies, which reduce the user configuration burden while providing basic security protection; (5) The integrated security audit module provides complete audit logs and anomaly detection functions, improves the credibility of Serverless applications, and facilitates compliance verification and incident handling.

[0061] Compared with the existing technology, this embodiment has significant improvements in fine-grained security policy management and perfect security auditing. On the one hand, this embodiment allows users to define customized security protection policies at the function level, which makes up for the deficiency of the existing solution in applying a unified policy to all functions and improves the sophistication of security protection. On the other hand, this embodiment also provides a built-in anomaly detection and log protection mechanism, which further enhances the depth and credibility of security auditing on the basis of the existing solution. Therefore, this embodiment provides a flexible, easy-to-use and reliable solution for the security protection of Serverless applications.

[0062] Embodiment 3: As shown in Figure 6, this embodiment provides a Serverless application security protection system based on dynamic tokens. The system mainly includes a request processing module, a token generation module, a key management module, a function scheduling module, an execution environment, a security configuration storage, a policy management module, and an audit log module.

[0063] Specifically, the request processing module is responsible for receiving and parsing the Serverless function call request sent by the user. In order to generate a dynamic token, the request processing module extracts the metadata information of the request, such as the request ID, timestamp, caller IP, etc., and passes these metadata to the token generation module. By introducing the request processing module, this system realizes centralized processing of requests and parameter extraction, providing the necessary input for subsequent token generation.

[0064] Furthermore, the token generation module dynamically generates a secure token based on the request metadata and preset rules. The token contains declarations such as function name, version number, and validity period, which are used for subsequent key management and authorization verification. The token generation module supports multiple token generation algorithms, such as SHA-256, SHA-3, etc., which can be configured according to security and performance requirements. By using dynamic tokens, this system achieves more fine-grained access control and identity authentication, improving the security of the system.

[0065] In order to manage the keys of functions, this system introduces a key management module. The key management module is responsible for storing and managing the exclusive keys of each function. When receiving the token sent by the token generation module, the key management module verifies the validity of the token. If the verification is successful, the key package of the corresponding function is returned to the request processing module through a secure channel. In addition, the key management module is also responsible for the regular rotation and destruction of keys to ensure the security of the keys. By centrally managing function keys, this system reduces the risk of key leakage and improves the reliability of key management.

[0066] On the basis of key management, this system also introduces a function scheduling module to schedule the execution of functions. After receiving the function call request forwarded by the request processing module, the function scheduling module will put the request into the execution queue and obtain the corresponding key package from the request processing module. When there is an idle execution environment, the function scheduling module sends the key package and function code to the execution environment together. By sending the key package together with the function code, this system ensures that sensitive data will only be decrypted when the function is executed, improving the confidentiality of the data.

[0067] The execution environment is the carrier of the actual operation of the function. After the execution environment obtains the key package from the function scheduling module, it will use the preset key to decrypt the key package and obtain the function-specific key. Using this key, the execution environment can further decrypt the sensitive configuration in the security configuration storage and load the plaintext configuration into the memory for use by the function code. It should be noted that after the function is executed, the execution environment will immediately erase the plaintext data and key from the memory, and encrypt the calculation result and return it to the request processing module. By cleaning up sensitive data in a timely manner, this system reduces the risk of data leakage.

[0068] In order to facilitate the management of sensitive configurations, this system provides a secure configuration storage module. The secure configuration storage is used to centrally store sensitive configuration data of functions, such as database connection strings, API keys, etc. These configuration data are all encrypted with the function key and will only be decrypted and loaded into memory when the function is actually executed. The secure configuration storage and key management module together form a complete sensitive data management solution to ensure the confidentiality of sensitive data.

[0069] Considering that different functions may have different security requirements, this system also introduces a policy management module. The policy management module allows users to define the security protection policy of each function in a declarative way, including token validity period, key strength, ACL rules, etc. The policy management module will apply the user-configured policies to other functional modules to achieve refined security management and control of Serverless applications. Through flexible policy configuration, this system improves the adaptability and customizability of security protection.

[0070] Finally, in order to support security audit and compliance requirements, this system has designed an audit log module. The audit log module is responsible for recording sensitive operations during function execution, such as the use of keys, loading of plaintext data, etc., and generates detailed audit logs. Cloud platform security administrators can analyze these logs to promptly discover and deal with suspicious behaviors. By providing reliable audit logs, this system enhances the auditability and credibility of the system.

[0071] In summary, the system architecture designed in this embodiment fully decouples the security protection logic and the serverless application business logic. The various functional modules communicate through clearly defined interfaces, and have strong modularity and scalability. This system provides an additional security protection layer on the native serverless platform, making up for the platform's deficiencies in key management and sensitive data encryption. By introducing dynamic tokens, centralized key management, configurable security policies, and a complete audit mechanism, this system significantly improves the security of serverless applications, allowing developers to obtain all-round security protection without having to pay attention to the underlying security mechanism. Compared with the prior art, this embodiment has obvious improvements in the flexibility of the architecture, the granularity of security protection, and the auditability of security operations.

[0072] Embodiment 4: This embodiment, in combination with Embodiments 1 to 3, provides an end-to-end Serverless application security solution suitable for enterprise-level production environments.

[0073] At the deployment level, this embodiment uses Infrastructure as Code (IaC) technology to define all system components in Example 3, including key management services, security configuration storage, policy management modules, etc., as code. Through IaC, we can achieve version management and automated deployment of security infrastructure. This ensures that the online environment is consistent with the security architecture defined in the code repository, reducing security risks caused by human errors. The IaC-based deployment method improves the maintainability and reproducibility of the security infrastructure, making it easier to quickly promote security practices in multiple environments.

[0074] At the development level, in order to simplify the security integration work of developers, we provide a supporting SDK. The SDK encapsulates the security programming mode mentioned in Example 1 and Example 2, including dynamic acquisition of function keys, encryption and decryption of sensitive data, and secure storage of function configurations. By providing an easy-to-use API interface, the SDK shields the underlying key management and data encryption details from the developer's view. Developers only need to code according to the SDK's interface specifications without having to pay attention to complex security implementation logic. This SDK-based security integration method significantly reduces the developer's learning cost and development burden, and increases the popularity of security features.

[0075] At the operation and maintenance level, in order to improve the efficiency of security operations, we provide a web-based security management panel. The management panel implements functions such as the policy management mentioned in Example 2 and the audit log analysis in Example 3. Through the management panel, operation and maintenance personnel can monitor the function execution of Serverless applications in real time, view key security indicators, and analyze and handle suspicious events. The management panel is seamlessly integrated with other operation and maintenance tools of the cloud platform, providing unified monitoring, alarm, log management and other capabilities. The visual operation and maintenance method based on the management panel improves the speed of discovery and response to security incidents and reduces the labor cost of security operations.

[0076] Combining the designs at the above levels, this embodiment fully considers the requirements of enterprise-level applications for automation, security, and auditability, and provides a complete set of DevSecOps solutions. This embodiment deeply integrates security capabilities with DevOps processes by using IaC technology to achieve automated deployment of security infrastructure, by providing SDK to simplify the development and integration of security functions, and by implementing visual security operations and maintenance through the management panel. We not only perform security scanning and reinforcement during the build and deployment phases, but also embed security practices throughout the development lifecycle to reduce the introduction of security vulnerabilities from the source. This end-to-end security protection solution can not only greatly reduce the security risks of Serverless applications, but also improve development and operation efficiency and reduce corporate compliance costs.

[0077] The advantages of this embodiment are: First, IaC technology is used to achieve the replicability and maintainability of the security infrastructure, ensuring the consistency of security configuration in multiple environments and avoiding human errors. Secondly, SDK is provided to simplify the security integration of developers, reduce the learning cost and development burden, and improve the coverage of security features. Thirdly, the introduction of a visual management panel improves the efficiency of security operations and accelerates the discovery and handling of security incidents. In addition, by building a DevSecOps solution, a deep integration of security and development and operation is achieved, and security practices are embedded in all stages of the development life cycle to improve the inherent security of the system from the source. Finally, end-to-end security protection covers the entire life cycle of Serverless applications, comprehensively reducing security risks while taking into account the compliance requirements of the enterprise.

[0078] In summary, this embodiment is based on the actual scenario of enterprise-level Serverless application development, and systematically designs an end-to-end security solution from multiple dimensions such as deployment, development, and operation and maintenance. By implementing the core ideas of dynamic token mechanism, refined permission control, centralized key management, configurable security policy, and perfect audit mechanism proposed in Examples 1 to 3, and organically integrating them with the DevOps process, a set of automated, comprehensive, and three-dimensional Serverless application security protection system is formed, providing developers with out-of-the-box security services. Compared with traditional post-protection and static protection methods, this embodiment has significantly improved the timeliness, comprehensiveness, and consistency of security protection. At the same time, through API-based and automated security delivery methods, this embodiment also greatly reduces the security integration and operating costs of enterprises and improves the return on security investment. It is believed that with the help of the Serverless application security protection system constructed by this embodiment, enterprises can more confidently embrace the Serverless architecture and accelerate business innovation and digital transformation.

[0079] The Serverless application security protection method and system based on dynamic tokens provided by the present invention solves the limitations of traditional Serverless security solutions in sensitive data encryption, key management, identity authentication, access authorization, etc. by building a new security protection layer on the Serverless platform, and realizes more comprehensive, fine-grained and automated security protection for Serverless applications, effectively improving the security of Serverless applications.

[0080] It should be noted that the method and system provided by the present invention is a universal security protection framework that does not depend on a specific programming language, Serverless platform or cloud service provider. Some specific technologies mentioned in the embodiments, such as SHA-256, AES encryption algorithm, etc., can also be replaced or optimized according to actual needs. In addition, the present invention can also be combined with other security technologies, such as code security scanning, vulnerability detection, etc., to further improve the local security of Serverless applications. The above embodiments are only preferred implementation methods of the present invention and are not intended to limit the present invention. For those skilled in the art, many improvements and variations can be made without violating the principles of the present invention, all of which belong to the scope of protection of the present invention. For example, the present invention can be combined with technologies such as virtualization and edge computing to further expand the application scenarios and effects of intelligent scheduling.

Claims

1. A Serverless application security protection method based on dynamic token, characterized in that: The steps include: (1) Dynamically generate a unique and secure token by combining the built-in parameters of the Serverless environment and user-defined rules; (2) Design specific key and sensitive information encryption rules for each independent function, and refine them to the function instance level; (3) Ensure the secure storage and access of sensitive data in Serverless applications according to the designed encryption, transmission, decryption and verification processes; (4) Record the generation, allocation, use, and encryption and decryption operations of tokens in detail to support security incident tracking and analysis; (5) Use lightweight hash functions, instance-level processing and other measures to reduce the impact on application performance.

2. The security protection method according to claim 1, characterized in that: The serverless environment built-in parameters include a request ID, an instance ID, and a timestamp.

3. The security protection method according to claim 1, characterized in that: The user-defined rules include but are not limited to a key-based hash algorithm.

4. The security protection method according to claim 1, characterized in that: Further refinement is done to the per-instance level of the function when designing specific keys and encryption rules for each independent function.

5. The security protection method according to claim 1, characterized in that: The encryption and decryption process includes encrypting sensitive data using a symmetric encryption algorithm, storing the encrypted data in the environment variables of the Serverless instance, and dynamically decrypting and verifying the Token during execution.

6. The security protection method according to claim 5, characterized in that: The symmetric encryption algorithm used is preferably the AES algorithm.

7. The security protection method according to claim 1, characterized in that: The audit logs that record token operations in detail are stored in an independent encrypted security environment and support regular security reviews and analysis.

8. The security protection method according to claim 1, characterized in that: Minimize the impact on Serverless application performance by using lightweight hash functions, implementing instance-level decentralized processing of logic, and optimizing the order of code execution.

9. A Serverless application security protection system based on dynamic token, characterized in that: include: Token generation module for dynamically generating tokens; A key management module for managing the keys and encryption rules for each function; A data encryption and decryption module for performing data encryption and decryption operations; Log management module for recording audit logs; Performance optimization module for optimizing system performance.

10. The safety protection system according to claim 9, characterized in that: The Token generation module dynamically generates a unique and secure Token based on built-in parameters such as request ID, instance ID, timestamp, and a user-defined hash algorithm.

Images