# US 11,310,057 B2 · Preventing exploitation of serverless-function flows > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,310,057 B2 - Document ID: US11310057B2 - Status: Granted - Kind: B2 - Application number: 16/682,744 - Filed: 2019-11-13 - Published: 2021-05-13 - Granted: 2022-04-19 - Earliest claimed: 2019-11-13 - Assignees: Red Hat, Inc. - Applicants: Red Hat, Inc. - Inventors: Huamin Chen - Web page: https://patentgrep.com/patent/US11310057B2 ## CPC - G06F 9/45558: {Hypervisor-specific management and integration aspects} - H04L 9/3247: {involving digital signatures} - G06F 8/60: Software deployment - H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying} - H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/126: {the source of the received data} - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - G06F 2009/45562: {Creating, deleting, cloning virtual machine instances} - G06F 2009/45575: {Starting, stopping, suspending or resuming virtual machine instances} - H04L 67/51: Discovery or management thereof, e.g. service location protocol [SLP] or web services - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract One exemplary system described herein can detect a first request associated with invoking a serverless function in a sequence of serverless functions. In response, the system can deploy a primary container and a secondary container in a cloud computing environment. The primary container can execute the serverless function and transmit a second request for invoking a second serverless function in the sequence. The secondary container can intercept the second request and generate a modified second request. The secondary container can then transmit the modified second request to a destination other than an endpoint of the second serverless function, where the destination can cause the second serverless function to be executed in response to receiving the modified second request. ## Claims ### Claim 1 A node comprising: a processor; and a memory device comprising instructions that are executable by the processor for causing the processor to perform operations including: detecting a first request associated with a first serverless function in a predefined sequence of serverless functions; and in response to detecting the first request, causing a secondary container to be deployed in a cloud computing environment, the secondary container being configured to: intercept a second request transmitted from a primary container configured to execute the first serverless function, the second request being configured to invoke a second serverless function in the predefined sequence of serverless functions; generate a modified second request based on the second request; and transmit the modified second request to a destination other than an endpoint of the second serverless function, the destination being configured to cause the second serverless function to be executed in response to receiving the modified second request. ### Claim 2 (depends on 1) The node of claim 1, wherein the predefined sequence of serverless functions is configured to implement at least part of a distributed application. ### Claim 3 (depends on 1) The node of claim 1, wherein the modified second request includes a digital signature generated using cryptographic information stored internally to the cloud computing environment. ### Claim 4 (depends on 3) The node of claim 3, wherein the destination is configured to: receive the modified second request with the digital signature from the secondary container; validate the digital signature; and cause the second serverless function to be executed in response to validating the digital signature. ### Claim 5 (depends on 4) The node of claim 4, wherein the digital signature is a first digital signature, and wherein the destination is configured to cause the second serverless function to be executed in response to validating the first digital signature by: generating a third request comprising (i) an identifier usable for invoking the second serverless function and (ii) a second digital signature that is different from the first digital signature; and transmitting the third request to a routing node, the routing node being configured to invoke the second serverless function based on the identifier and in response to validating the second digital signature. ### Claim 6 (depends on 1) The node of claim 1, wherein the destination is an authentication node in the cloud computing environment, the authentication node being part of a messaging system for enabling nodes of the cloud computing environment to transmit messages to one another. ### Claim 7 (depends on 1) The node of claim 1, wherein the endpoint associated with the second serverless function is a second endpoint, and wherein causing the secondary container to be deployed in the cloud computing environment comprises: generating a modified first request based on the first request; and transmitting the modified first request to a first endpoint associated with the first serverless function, the first endpoint being configured to receive the modified first request and deploy the primary container and the secondary container together in a container pod based on a header of the modified first request. ### Claim 8 (depends on 1) The node of claim 1, wherein the node is a function router, the destination is within the cloud computing environment, and the endpoint is within the cloud computing environment. ### Claim 9 (depends on 1) The node of claim 1, wherein the modified second request includes an identifier usable to invoke the second serverless function, and the destination is configured to cause the second serverless function to be executed based on the identifier. ### Claim 10 (depends on 1) The node of claim 1, wherein the operations further include detecting the first request based on a webhook event triggered in response to the first request. ### Claim 11 A computer-implemented method comprising: detecting, by a processor, a first request associated with a first serverless function in a predefined sequence of serverless functions; and in response to detecting the first request, causing, by the processor, a secondary container to be deployed in a cloud computing environment, the secondary container being configured to: intercept a second request transmitted from a primary container configured to execute the first serverless function, the second request being configured to invoke a second serverless function in the predefined sequence of serverless functions; generate a modified second request based on the second request; and transmit the modified second request to a destination other than an endpoint of the second serverless function, the destination being configured to cause the second serverless function to be executed in response to receiving the modified second request. ### Claim 12 (depends on 11) The method of claim 11, wherein the predefined sequence of serverless functions is configured to implement at least part of a distributed application. ### Claim 13 (depends on 11) The method of claim 11, wherein the modified second request includes a digital signature generated using cryptographic information stored internally to the cloud computing environment. ### Claim 14 (depends on 13) The method of claim 13, wherein the destination is configured to: receive the modified second request with the digital signature from the secondary container; validate the digital signature; and cause the second serverless function to be executed in response to validating the digital signature. ### Claim 15 (depends on 14) The method of claim 14, wherein the digital signature is a first digital signature, and wherein the destination is configured to cause the second serverless function to be executed in response to validating the first digital signature by: generating a third request comprising (i) an identifier usable for invoking the second serverless function and (ii) a second digital signature that is different from the first digital signature; and transmitting the third request to a routing node, the routing node being configured to invoke the second serverless function based on the identifier and in response to validating the second digital signature. ### Claim 16 (depends on 11) The method of claim 11, wherein the destination is an authentication node in the cloud computing environment, the authentication node being part of a messaging system for enabling nodes of the cloud computing environment to transmit messages to one another. ### Claim 17 (depends on 11) The method of claim 11, wherein the endpoint associated with the second serverless function is a second endpoint, and wherein causing the secondary container to be deployed in the cloud computing environment comprises: generating a modified first request based on the first request; and transmitting the modified first request to a first endpoint associated with the first serverless function, the first endpoint being configured to receive the modified first request and deploy the primary container and the secondary container together in a container pod based on a header of the modified first request. ### Claim 18 (depends on 11) The method of claim 11, further comprising detecting the first request based on a webhook event triggered in response to the first request. ### Claim 19 A non-transitory computer-readable medium comprising program code that is executable by a processor for causing the processor to perform operations including: detecting a first request associated with a first serverless function in a predefined sequence of serverless functions; and in response to detecting the first request, causing a secondary container to be deployed in a cloud computing environment, the secondary container being configured to: intercept a second request transmitted from a primary container configured to execute the first serverless function, the second request being configured to invoke a second serverless function in the predefined sequence of serverless functions; generate a modified second request based on the second request, wherein the modified second request includes an identifier usable to invoke the second serverless function; and transmit the modified second request to a destination other than an endpoint of the second serverless function, the destination being configured to cause the second serverless function to be executed in response to receiving the modified second request and based on the identifier. ### Claim 20 (depends on 19) The non-transitory computer-readable medium of claim 19, wherein the identifier is a unique identifier of the second serverless function.