Serverless Object Validation for DoS Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Serverless computing systems face challenges in detecting and preventing denial of service (DoS) attacks, where attackers transmit bogus files with false metadata, leading to wastage of computing resources and difficulty in detection.
Innovation Solution
A processing logic is implemented to analyze incoming objects using scripts at the object-based storage level, validating attributes by comparing content patterns with metadata, and publishing validation events to determine whether to process objects with serverless functions, thereby preserving computational resources and detecting potential DoS attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If serverless functions process all incoming objects without validation, then processing speed is maintained, but computing resources are wasted on bogus files from DoS attacks
Solution Approach 1:
The system performs preliminary validation of incoming objects at the object storage level before serverless functions are invoked. This early validation checks object attributes and content to identify bogus files, preventing wasteful processing by serverless functions and preserving computing resources while maintaining processing speed for legitimate objects.
Solution Approach 2:
The patent introduces an intermediary validation layer between object reception and serverless function processing. This intermediary component validates objects at the object storage level, acting as a filter that prevents bogus files from reaching serverless functions while allowing legitimate objects to pass through for normal processing.
2Loss of energy
If validation is performed at the object storage level before serverless function invocation, then computing resources are preserved, but system complexity increases
Solution Approach 1:
The validation mechanism leverages existing object storage level capabilities and metadata structures to perform self-validation without requiring a separate complex validation system. The object storage system itself provides the validation functionality using its existing infrastructure, minimizing additional system complexity while preserving computing resources.
3Adaptability or versatility
If all incoming objects are processed by serverless functions, then service completeness is maintained, but DoS attacks cause resource exhaustion
Solution Approach 1:
The system applies preliminary anti-action by validating objects at the object storage level before serverless function invocation. This preemptive validation identifies and blocks bogus files from DoS attacks, preventing resource exhaustion while maintaining service completeness for legitimate objects that pass validation.
Data Source
AI summary
An object may be received by a serverless computing system, such as a distributed object storage system, to be processed using serverless functions of the distributed object storage system. The object includes object metadata indicating an attribute of the object. The content of the object, such as the object's header is analyzed and the attribute indicated in the object metadata is validated based on the content of the object. The object analysis is performed using one or more scripts at an object-based storage level of the distributed object storage. A validation event is published indicating a validation status of the attribute. Serverless computing functions of the distributed object storage system may determine whether to process the object based on the validation status indicated in the validation event.