Request-Scoped Authentication for Escalation-Resistant Serverless Services
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional network services are vulnerable to privilege escalation attacks due to their need for greater privileges than individual users, which can lead to unauthorized access and data breaches, especially in serverless code execution systems where instances are not scoped to user privileges.
Innovation Solution
The on-demand code execution system implements escalation-resistant network services by scoping virtual machine instances to the authentication information of requesting users, ensuring that tasks execute within environments with privileges no larger than those of the user, thereby preventing privilege escalation even if vulnerabilities exist.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If traditional network services are implemented with greater privileges than individual users, then the services can provide full functionality to users, but the services become vulnerable to privilege escalation attacks
Solution Approach 1:
The patent segments the service execution into request-scoped instances, where each instance is isolated to the privileges of the requesting user. This segmentation prevents privilege escalation by ensuring that even if a vulnerability exists in one instance, it cannot affect other users or gain elevated privileges. Each service instance is created with limited scopes based on the authentication information of the requesting user.
2Adaptability or versatility
If serverless code execution systems use non-scoped instances, then the system can provide flexible code execution, but the instances are not limited to user privileges allowing unauthorized access
Solution Approach 1:
The patent applies local quality by scoping the execution environment to the specific privileges of the requesting user. Each code execution instance is configured with local security contexts that match the authentication information of the user who triggered the execution. This ensures that the code can execute with the necessary flexibility for its intended purpose while being constrained by the user's privilege scope, preventing unauthorized access to other users' data or resources.
3Object-affected harmful factors
If virtual machine instances are scoped to user privileges, then privilege escalation is prevented, but the system complexity increases
Solution Approach 1:
The patent introduces an intermediary layer in the form of a worker manager that sits between the user code execution and the underlying virtual machine instances. This worker manager handles the complexity of creating, configuring, and managing request-scoped execution environments. It automatically scopes the privileges based on authentication information, eliminating the need for users to manually configure security contexts while maintaining the privilege escalation prevention benefits.
Data Source
AI summary
Systems and methods are described for providing escalation-resistant network-accessible services by providing the service through a set of service instances, each executing in an environment with privileges scoped based on a user requesting to access the service. Each service instance can be implemented by code on a serverless code system, executed in response to a user request to access the service. Because the code is executed in an environment with privileges scoped to those of a requesting user, the code itself need not attempt to limit the privileges or a requesting user. For that reason, potential for privilege escalations of the service are reduced, even if vulnerabilities in the code might otherwise allow for such escalations.