FMS Sensors Using Seccomp for Kernel-Restricted FaaS
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
FaaS cloud computing environments face heightened security risks and resource wastage due to conventional endpoint security software's inadequacy in restricted access environments, necessitating a solution that secures applications without using OS kernels.
Innovation Solution
Implementing a Function Monitoring Security (FMS) sensor that monitors application behavior using the Linux kernel's seccomp mechanism, allowing real-time monitoring without OS kernel access, and utilizing internal and external extensions to track user-function calls and events.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional endpoint security software is used in FaaS environments, then security monitoring capability is provided, but the software cannot operate effectively due to restricted access rights and may cause resource wastage
Solution Approach 1:
The patent introduces a security sensor as an intermediary component that operates within the FaaS environment to monitor application behavior. The sensor uses the seccomp mechanism as a mediator to capture system call information without requiring direct kernel access rights, thereby enabling security monitoring in restricted access environments where conventional endpoint security software fails
Solution Approach 2:
The patent replaces the traditional mechanical approach of endpoint security software that requires direct OS kernel access with a substitute mechanism using the seccomp filter system. This substitution allows security monitoring through application-layer hooks and seccomp event capture rather than direct kernel interaction, making the system adaptable to restricted access FaaS environments
2Reliability
If security sensors monitor all application behavior in real-time, then security threats are detected, but system complexity and processing overhead increase
Solution Approach 1:
The patent applies local quality by making the security sensor configurable to monitor specific system calls, events, and behavioral patterns rather than all application activity uniformly. The sensor can focus monitoring resources on high-risk operations and suspicious patterns, reducing overall system complexity while maintaining effective threat detection capability
Solution Approach 2:
The patent implements partial monitoring action by allowing selective capture of seccomp events based on predefined criteria and risk levels. Rather than processing every single system call, the sensor filters and prioritizes monitoring of critical operations and anomalous behaviors, reducing processing overhead while maintaining security effectiveness
Data Source
AI summary
A system and method of securing a Function as a Service (FaaS) cloud computing system without using access rights to operating system (OS) kernels of the cloud service system. The method includes receiving a request to invoke a user-function associated with a computing language. The method includes executing the user-function within an operating system that executes on a processing device of the cloud service system. The method includes monitoring, by the processing device, a real-time behavior of the user-function using a security sensor that executes within the operating system, wherein the security sensor is without access rights to a kernel of the operating system. The method includes acquiring behavioral data indicative of the real-time behavior of the user-function.