Secure serverless computing framework
AssigneeCapital One Services, LLC
InventorSteve Frensch
Life of this patent
Estimating the term…
Abstract
A serverless computing framework is secured against malicious payload injection. A series of functions can be strung together to perform a workflow in response to a triggering event. A validator can be included with a function that verifies that an input payload originated from a trusted source. A validation value, such as a hash, can be computed based on the result payload in combination with the source code of the function that produced the result payload. A downstream function can receive the result payload and the hash and utilize the result payload and a copy of the upstream source code to produce another hash. The received and generated hashes can then be compared and utilized to control execution of the downstream function. Execution can be prevented when there is a mismatch between the hashes.
Claims20
A system, comprising:
- a processor coupled to a memory that includes instructions associated with a function of a serverless framework that, when executed by the processor, cause the processor to:
- execute a first function to generate a result payload;
- acquire source code for the first function;
- compute a validation value based on the result payload and the source code;
- and
- output the result payload and the validation value to a second function.
A method of providing function as a service, comprising:
- executing a first function to generate a result payload;
- acquiring source code for the first function that generated the result payload;
- computing a first hash of the result payload and the source code;
- and
- outputting the result payload and the first hash to a second function.
A method, comprising:
- executing, on a processor, instructions that cause the processor to perform operations associated with a function provided as a service in a serverless framework, the operations comprising:
- identifying source code of a first function in response to receipt of a payload and a first hash from the first function;
- generating a second hash from the payload and the source code of the first function;
- and
- controlling execution of a second function based on a comparison between the first hash and the second hash, wherein execution of the second function is prevented when there is a mismatch between the first hash and the second hash.
Dependencies are inferred from the claim text.