Transient Least Privileged Roles for Serverless Functions

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

The fine granularity of identity access and management in serverless architectures can lead to over-permissive roles being assigned to serverless functions, increasing the risk of security breaches due to complex role assignment processes.

Innovation Solution

A serverless security access control system that uses static analysis and runtime information to create and assign transient, least privilege roles to serverless functions on-the-fly, leveraging a security access broker to manage and update these roles dynamically, thereby reducing the risk of over-permissive access.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If developers manually assign roles to serverless functions, then security enforcement capability is improved, but role assignment complexity increases leading to over-permissive roles

Engineering Contradiction:

Improvesecurity enforcement capabilityVSAvoidrole assignment complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system enables serverless functions to automatically obtain their own least-privilege roles through the access broker without developer intervention. The function requests a role, the broker analyzes the function code and execution context to determine minimum necessary permissions, and assigns the role automatically. This self-service mechanism eliminates manual role assignment complexity while maintaining security enforcement.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The system dynamically changes the privilege parameters of serverless function roles based on runtime execution context and historical behavior analysis. Instead of static roles assigned during deployment, roles are adjusted at runtime to provide only the minimum necessary permissions for each specific execution, transforming fixed security parameters into adaptive ones.

Inventive Principle:

Principle #35Parameter changes

2Object-affected harmful factors

If transient roles are created on-the-fly for each serverless function execution, then security risk is reduced through least privilege, but system complexity increases due to dynamic role management

Engineering Contradiction:

Improvesecurity risk from over-permissive rolesVSAvoiddynamic role management complexity

Core Design Contradiction:

Object-affected harmful factorsVSDevice complexity

Solution Approach 1:

The access broker serves as an intermediary component between serverless functions and the identity management system. It handles the complexity of dynamic role creation, analysis of function code and execution context, and interaction with cloud service providers. This intermediary abstracts the complexity from the serverless functions themselves, allowing them to simply request roles while the broker manages the sophisticated dynamic role creation process.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system performs preliminary analysis of serverless function code and execution context before role assignment to pre-determine the minimum necessary permissions. This preliminary action allows the system to create appropriately scoped roles in advance of execution, reducing security risks while managing complexity through proactive rather than reactive role management.

Inventive Principle:

Principle #10Preliminary action

3Ease of manufacture

If default roles are assigned to serverless functions, then ease of deployment is improved, but security risk increases due to over-permissive access

Engineering Contradiction:

Improveease of deploymentVSAvoidsecurity risk from over-permissive access

Core Design Contradiction:

Ease of manufactureVSObject-affected harmful factors

Solution Approach 1:

The system transitions from static default role assignment to dynamic role adaptation. Serverless functions start with a default role for ease of deployment, but the access broker continuously monitors execution behavior and adjusts roles dynamically to match actual permission requirements. This dynamic approach maintains deployment simplicity while progressively reducing security risks through adaptive privilege management.

Inventive Principle:

Principle #15Dynamics

Data Source

PatentUS11489844B2On-the-fly creation of transient least privileged roles for serverless functions

Publication Date: 2022.11.01 PALO ALTO NETWORKS INC

AI summary

The disclosed serverless security access control system leverages static analysis information about application code and runtime information to create and assign on-the-fly transient serverless function roles. A default role can be initially assigned to serverless functions of the application. The default role allows the function to communicate with a security access broker. The access broker accesses least privilege information about an invoked serverless function and then creates and assigns a transient role to the serverless function based on that information. The short life of the role reduces and possibly eliminates the security risk of an over-permissive role. The access broker can update the least privilege information based on updated analysis of the application code and runtime information to allow flexibility and adaptation over executions.