Serverless Function Integrity Validation via Hash Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computing platforms without complete developer control are vulnerable to security threats during software development, particularly in serverless computing architectures where functions deployed on FaaS platforms can be tampered with, necessitating a method to validate and ensure the integrity of deployed functions.
Innovation Solution
A system and method that involves receiving a list of functions from a host server in a serverless computing architecture, generating and comparing hash values to detect tampering, and generating alerts when validation fails, using digital signatures and hash values to verify the integrity of deployed functions periodically or in response to events.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If functions are deployed on a serverless computing platform without complete developer control, then the platform provides automated resource management and scalability, but the deployed functions become vulnerable to tampering by hackers
Solution Approach 1:
The system performs preliminary validation by generating hash values of deployed functions and storing them in a validation database before deployment occurs. This pre-established baseline enables subsequent detection of any tampering by comparing against the original hash values, resolving the contradiction by establishing integrity checks in advance on the serverless platform.
Solution Approach 2:
The patent introduces a validation system as an intermediary layer between the developer and the serverless platform. This intermediary performs automated validation by comparing deployed function hash values against stored baseline values, providing a mechanism to detect tampering while maintaining the serverless platform's automated resource management capabilities.
2Reliability
If validation processes are implemented to detect tampering, then function integrity is improved, but the complexity of the deployment system increases
Solution Approach 1:
The patent replaces complex manual validation mechanisms with automated cryptographic hash-based validation. Instead of requiring complex inspection systems, the solution uses hash value generation and comparison, which are computationally simple operations that can be automated, thereby maintaining low system complexity while improving function integrity.
Solution Approach 2:
The validation system performs self-service by automatically generating hash values of deployed functions, retrieving baseline hash values from the validation database, comparing them, and generating alerts without human intervention. This automation reduces operational complexity while maintaining high reliability in detecting tampering.
3Reliability
If continuous validation monitoring is performed on all deployed functions, then security against tampering is improved, but the computational overhead and processing time increase
Solution Approach 1:
The system implements periodic validation monitoring where hash values are compared at scheduled intervals or triggered by specific events rather than continuously. This periodic approach maintains security validation reliability while significantly reducing computational overhead and processing time compared to continuous monitoring of all functions.
Solution Approach 2:
The validation system performs partial validation by focusing on comparing hash values rather than re-validating entire function codebases. This partial action approach provides sufficient security validation while minimizing the time and computational resources required, avoiding excessive processing overhead.
Data Source
AI summary
A method that involves receiving, from a host server in a serverless computing architecture, a list of functions comprising a deployed function on the host server, wherein the functions execute within a function as a service (FaaS) platform; receiving validation data for each of the functions; executing a validation process for each of the functions using the validation data; and generating a validation alert in response to the deployed function failing the validation process.