Year: 2018
Type: article
Abstract: The rise of serverless computing provides an opportunity to rethink cloud security. We present an approach for securing serverless systems using a novel form of dynamic information flow control (IFC). We show that in serverless applications, the termination channel found in most existing IFC systems can be arbitrarily amplified via multiple concurrent requests, necessitating a stronger termination-sensitive non-interference guarantee, which we achieve using a combination of static labeling of serverless processes and dynamic faceted labeling of persistent data. We describe our implementation of this approach on top of JavaScript for AWS Lambda and OpenWhisk serverless platforms, and present three realistic case studies showing that it can enforce important IFC security properties with modest overhead.
DOI: 10.1145/3276488
Language: English
Subfield: Hardware and Architecture
Field: Computer Science
Domain: Physical Sciences
Open Access status: diamond
Awards: SHF: Small: Collaborative Research: Fast and Precise Dynamic Race Detection: Eliminating State and Checking Redundancy, G2982765432, G3293295176, XPS: FP: DeCoP: Deterministic Cooperative Parallelism, NeTS: Small: Video-Aware Network Transport + Network-Aware Video Coding, G5384496013, University of Washington - R/V Thomas G. Thompson and R/V Rachel Carson SSSE
OpenAlex ID: W2788556107