Detection and prevention of unauthorized execution of serverless functions
Methods and systems for detecting and responding to fabricated or unauthorized events received by serverless computing environments are provided. In one embodiment the method is provided that includes receiving an event from an event source external to the serverless computing environment for execution by function. The method may then include creating a message that includes the events and signing the message with an identifier of the event source. The message may then be received at the function and the identifier of the event source may be validated. The event may then be executed with the function of the serverless computing environment if the identifier of the event sources successfully validated. However, if the identifier of the event source is not successfully validated, execution of the event with the function may be prevented.
1. A method comprising:
issuing, by a function of a serverless computing environment, a first certificate that uniquely identifies an event source that is external to the serverless computing environment;
storing, by the serverless computing environment, the first certificate in an authority database; and
subsequent to storing the first certificate in the authority database;
receiving, at a controller of the serverless computing environment, an event from the event source for execution by the function of the serverless computing environment, the function executing in a first container of the serverless computing environment;
obtaining, by the controller, a copy of the first certificate from the authority database;
creating, at the controller, a message including the event and the copy of the first certificate;
transmitting, by the controller, the message to a second container of the serverless computing environment, the second container implementing a proxy for the function;
receiving, at the proxy of the second container, the message;
validating, by the proxy of the second container, the copy of the first certificate; and
in response to validating the copy of the first certificate, transmitting, by the second container, a signal to the first container for causing the function to execute the event.
2. The method of claim 1 , further comprising determining that validation is required for the function, wherein the second container is created in response to determining that validation is required.
3. The method of claim 1 , wherein the message is encrypted and based in part on at least one of (i) the event and (ii) a private key corresponding to the controller.
4. The method of claim 3 , wherein validating the copy of the first certificate further comprises decrypting the encrypted message using a public key of the controller.
5. The method of claim 1 , further comprising:
issuing a second certificate that uniquely identifies the controller; and
validating, by the proxy of the second container, a copy of the second certificate.
6. The method of claim 5 , wherein validating the copy of the first certificate further comprises:
requesting the first certificate corresponding to the event source from the authority database; and
determining that the copy of the first certificate matches the first certificate.
7. The method of claim 1 , wherein the function of the serverless computing environment is one of multiple functions of the serverless computing environment, and wherein the method further comprises:
identifying, responsive to receiving the event, a type for the event, wherein the type specifies one or more types of tasks for execution in response to the event; and
identifying, as corresponding to the type for the event, the function of the serverless computing environment from among the multiple functions of the serverless computing environment.
8. The method of claim 1 , wherein the second container is a sidecar container of the first container.
9. The method of claim 1 , further comprising sending, from the controller to the second container, the message containing the event, wherein the message is signed with the copy of the first certificate.
10. The method of claim 1 , wherein the event source is one of multiple event sources of the serverless computing environment, wherein the controller is one of multiple controllers of the serverless computing environment, and wherein each of the multiple event sources has a corresponding controller from among the multiple controllers.
11. A system comprising:
a processor; and
a memory storing instructions which, when executed by the processor, cause the processor to:
issue, by a function of a serverless computing environment, a first certificate that uniquely identifies an event source that is external to the serverless computing environment;
store, by the serverless computing environment, the first certificate in an authority database; and
subsequent to storing the first certificate in the authority database:
receive, at a controller of the serverless computing environment, an event from the event source for execution by the function of the serverless computing environment, the function executing in a first container of the serverless computing environment;
obtain, by the controller, a copy of the first certificate from the authority database;
create, at the controller, a message including the event and the copy of the first certificate;
transmit, by the controller, the message to a second container of the serverless computing environment, the second container implementing a proxy for the function;
receive, at the proxy of the second container, the message;
validate, by the proxy of the second container, the copy of the first certificate; and
in response to validating the copy of the first certificate, transmitting, by the second container, a signal to the first container for causing the function to execute the event.
12. The system of claim 11 , wherein the instructions further cause the processor to determine that validation is required for the function, wherein the second container is created in response to determining that validation is required.
13. The system of claim 11 , wherein the message is encrypted and based in part on at least one of (i) the event and (ii) a private key corresponding to the controller.
14. The system of claim 13 , wherein the instructions further cause the processor, while validating the copy of the first certificate, to decrypt the encrypted message using a public key of the controller.
15. The system of claim 11 , further comprising:
issuing a second certificate that uniquely identifies the controller; and
validating, by the proxy of the second container, a copy of the second certificate.
16. The system of claim 15 , wherein the instructions further cause the processor, while validating the copy of the first certificate, to:
request the first certificate corresponding to the event source from the authority database; and
determine that the copy of the first certificate matches the first certificate.
17. The system of claim 11 , wherein the function of the serverless computing environment is one of multiple functions of the serverless computing environment, and wherein the instructions further cause the processor to:
identify, responsive to receiving the event, a type for the event, wherein the type specifies one or more types of tasks for execution in response to the event; and
identify, as corresponding to the type for the event, the function of the serverless computing environment from among the multiple functions of the serverless computing environment.
18. The system of claim 11 , wherein the second container is a sidecar container of the first container.
19. The system of claim 11 , wherein the event source is one of multiple event sources of the serverless computing environment, wherein the controller is one of multiple controllers of the serverless computing environment, and wherein each of the multiple event sources has a corresponding controller from among the multiple controllers.
20. A non-transitory, computer-readable medium storing instructions which, when executed by one or more processors, cause the one or more processors to:
issue, by a function of a serverless computing environment, a certificate that uniquely identifies an event source that is external to the serverless computing environment;
store, by the serverless computing environment, the certificate in an authority database; and
subsequent to storing the certificate in the authority database:
receive, at a controller of the serverless computing environment, an event from the event source for execution by the function of the serverless computing environment, the function executing in a first container of the serverless computing environment;
obtain by the controller, a copy of the certificate from the authority database;
create, at the controller, a message including the event and the copy of the certificate;
transmit, by the controller, the message to a second container of the serverless computing environment, the second container implementing a proxy for the function
receive, at the proxy of the second container, the message;
validate, by the proxy of the second container, the copy of the certificate; and
in response to validating the copy of the certificate, transmitting, by the second container, a signal to the first container for causing the function to execute the event.