[Paper Review] Guarding Serverless Applications with SecLambda

Deepak Sirone Jegan, Liang Wang+3 more|arXiv (Cornell University)|Nov 10, 2020

Security and Verification in Computing33 references4 citations

TL;DR

SecLambda is an extensible security framework for serverless applications that uses local function state and global application state to enforce real-time security controls. By extending gVisor with custom runtime policies and a centralized controller, SecLambda enables fine-grained, application-aware protection against control flow attacks, credential leaks, and DoS threats with minimal performance overhead—demonstrated at under 6 ms per function call in evaluation.

ABSTRACT

As an emerging application paradigm, serverless computing attracts attention from more and more attackers. Unfortunately, security tools for conventional applications cannot be easily ported to serverless, and existing serverless security solutions are inadequate. In this paper, we present \emph{SecLambda}, an extensible security framework that leverages local function state and global application state to perform sophisticated security tasks to protect an application. We show how SecLambda can be used to achieve control flow integrity, credential protection, and rate limiting in serverless applications. We evaluate the performance overhead and security of SecLambda using realistic open-source applications, and our results suggest that SecLambda can mitigate several attacks while introducing relatively low performance overhead.

Motivation & Objective

• To address the lack of real-time, application-aware security mechanisms in serverless computing.
• To detect and prevent sophisticated attacks such as control flow hijacking, credential leakage, and DoS in serverless environments.
• To enable secure, fine-grained enforcement of policies across distributed serverless functions without requiring third-party service cooperation.
• To reduce performance overhead while maintaining strong security guarantees in production-grade serverless workloads.
• To provide an extensible framework that supports multiple security functions beyond basic access control.

Proposed method

• Extends gVisor container runtime with custom system call interception and policy enforcement based on high-level inputs like HTTP payloads and URLs.
• Uses a modified runtime (runsec) to capture and report function state to a guard module for runtime security analysis.
• Employs a centralized controller to aggregate function states and enable global visibility for detecting invalid execution paths.
• Introduces a guard module that executes security functions based on current function state and global application context.
• Supports pluggable security functions for control flow integrity, credential obfuscation, and rate limiting via customizable policy logic.
• Enables communication between guards and the controller with minimal overhead (under 6 ms per call) via lightweight, synchronous state exchange.

Experimental results

Research questions

• RQ1 How can serverless applications be secured against control flow attacks that exploit incorrect execution order?
• RQ2 Can credential exposure be prevented in serverless functions without modifying third-party services?
• RQ3 What is the performance overhead of enforcing real-time, application-aware security policies in serverless environments?
• RQ4 How can global application behavior be modeled and monitored without requiring cooperation from external services?
• RQ5 Can an extensible framework effectively support multiple security functions simultaneously in a serverless setting?

Key findings

• SecLambda achieved effective detection and mitigation of control flow injection attacks through flow tracking, without requiring changes to third-party services.
• The credential management function successfully decoupled sensitive data from function code, preventing exposure upon compromise.
• Rate limiting was enforced effectively to prevent DoS attacks and abuse of serverless functions.
• Performance overhead from guard-controller communication was under 6 ms per function call, equivalent to less than $0.000001667 per invocation on AWS Lambda.
• The framework introduced negligible overhead in real-world applications, with measurable performance impact only in network- or I/O-intensive workloads.
• Evaluation on three open-source serverless applications confirmed SecLambda’s effectiveness and efficiency in practical deployment scenarios.