Scoped Credentials for Secure On-Demand Code Execution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing on-demand code execution systems face security vulnerabilities due to the reuse of execution role credentials across multiple requests or sessions, which can lead to side-channel attacks and persistent malware, as well as difficulties in tracking down data leaks.
Innovation Solution
Implementing scoped credentials that are valid for a single request or session, associated with the smallest atomic precision level, such as individual data items, and invalidated after use, to limit access rights and prevent credential reuse.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If execution role credentials are reused across multiple requests or sessions, then resource utilization is improved, but security is worsened due to side-channel attacks and persistent malware
Solution Approach 1:
The patent segments credentials by creating distinct execution role credentials for each request or session, rather than reusing a single credential across multiple requests. This segmentation isolates the security context of each request, preventing side-channel attacks and persistent malware from affecting other requests. The provisioning service generates a new execution role credential for each code execution request, ensuring that credentials are request-specific rather than session-reusable.
2Device complexity
If execution role credentials are reused across multiple requests, then credential management complexity is reduced, but the ability to track down data leaks is worsened
Solution Approach 1:
The patent applies local quality by making each execution role credential unique to a specific request or session, with credentials having different scopes and permissions tailored to the specific code execution context. This allows the system to track down data leaks by examining which specific credential was used, as each credential is associated with a particular request, user, and set of permissions. The credential scope includes request-specific identifiers that enable precise tracking of data access and leaks.
3Productivity
If a single execution environment handles multiple requests, then resource utilization is improved, but security isolation between requests is worsened
Solution Approach 1:
The patent extracts the credential from the persistent execution environment state by generating new execution role credentials for each request. Instead of relying on the execution environment's persistent credentials, the system extracts and provides request-specific credentials that are invalidated after use. This extraction ensures that even if the execution environment is reused, each request maintains its own security context through unique, non-reusable credentials.
Data Source
AI summary
Systems and methods are provided for scoped credentials within secure execution environments executing within virtual machines instances in an on-demand code execution system. In the on-demand code execution system, the execution environments are reset after every request or session. By resetting the single execution environment after each request or session, security issues are addressed, such as side-channel attacks and persistent malware. Additionally, the use of scoped credentials improves security by limiting the access rights for each code execution request or session to the smallest atomic level for the request or session. Following the request or session, the scoped credential is invalidated.