Serverless Function Flow Validation via Secondary Container Interception

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Serverless functions in cloud computing environments are vulnerable to flow manipulation by malicious actors due to exposed endpoints, allowing unauthorized control over the execution order of functions.

Innovation Solution

Implementing an iterative validation cycle that uses a secondary container to intercept and digitally sign invocation requests before routing them through an authentication node, ensuring only valid requests execute in the correct order.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If serverless function endpoints are exposed for direct invocation, then ease of operation is improved, but security against flow manipulation attacks deteriorates

Engineering Contradiction:

Improveease of invocationVSAvoidflow manipulation vulnerability

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The patent introduces an intermediary validation mechanism that sits between the exposed endpoints and the serverless function execution. This intermediary validates invocation requests against the predefined sequence before allowing execution, thereby maintaining ease of invocation through exposed endpoints while preventing flow manipulation attacks by enforcing proper execution order.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Adaptability or versatility

If serverless functions are independently executable, then adaptability is improved, but reliability of execution flow deteriorates

Engineering Contradiction:

Improveindependent executabilityVSAvoidexecution flow integrity

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent implements a feedback mechanism where the system monitors and validates the execution sequence of independently executable serverless functions. Each function invocation is checked against the predefined sequence, and the system provides feedback by allowing or blocking execution based on whether the invocation follows the correct order, thus maintaining reliability while preserving independent executability.

Inventive Principle:

Principle #23Feedback

3Productivity

If developers are charged based on individual function execution time, then productivity is improved, but vulnerability to unauthorized control increases

Engineering Contradiction:

Improvebilling efficiencyVSAvoidunauthorized flow control

Core Design Contradiction:

ProductivityVSObject-affected harmful factors

Solution Approach 1:

The patent applies preliminary action by establishing validation rules and security checks before serverless functions are invoked. The system pre-defines the correct execution sequence and validates each invocation request against these predefined rules before allowing execution, thereby preventing unauthorized flow control while maintaining the individual billing model based on execution time.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS11310057B2Preventing exploitation of serverless-function flows

Publication Date: 2022.04.19 RED HAT INC

AI summary

One exemplary system described herein can detect a first request associated with invoking a serverless function in a sequence of serverless functions. In response, the system can deploy a primary container and a secondary container in a cloud computing environment. The primary container can execute the serverless function and transmit a second request for invoking a second serverless function in the sequence. The secondary container can intercept the second request and generate a modified second request. The secondary container can then transmit the modified second request to a destination other than an endpoint of the second serverless function, where the destination can cause the second serverless function to be executed in response to receiving the modified second request.