Securing application behavior in serverless computing
AssigneePalo Alto Networks, Inc.
InventorsOry Segal, Yuri Shapira, Avraham Shulman, Benny Nissimov, Shaked Zin
Life of this patent
Estimating the term…
Abstract
A method for securing a serverless application including: (a) receiving a list of components which make up the serverless application and one or more intended usage flows of the serverless application; (b) creating and applying a security policy for each component of the serverless application, the security policy denying all access requests except from authorized components, wherein the authorized components are selected based on access requirements dictated by the one or more intended usage flows.
Claims20
A method comprising:
- determining components of a serverless application;
- learning intended behavior of the serverless application, wherein learning intended behavior of the serverless application comprises determining a set of one or more usage flows among the components of the serverless application;
- and
- creating a set of one or more security policies to restrict behavior of the serverless application to the intended behavior, wherein creating the set of one or more security policies is based, at least in part, on the set of one or more usage flows.
A non-transitory, machine-readable medium having program code stored thereon, the program code comprising instructions to:
- determine components of a serverless application;
- learn intended behavior of the serverless application, wherein the instructions to learn intended behavior of the serverless application comprise instructions to determine a set of one or more usage flows among the components of the serverless application;
- and
- create a set of one or more security policies to restrict behavior of the serverless application to the intended behavior, wherein creation of the set of one or more security policies is based, at least in part, on the set of one or more usage flows.
An apparatus comprising:
- a processor;
- and
- a machine-readable medium having instructions stored thereon that are executable by the processor to cause the apparatus to,
- determine components of a serverless application;
- learn intended behavior of the serverless application, wherein the instructions to learn intended behavior of the serverless application comprise instructions to determine a set of one or more usage flows among the components of the serverless application;
- and
- create a set of one or more security policies to restrict behavior of the serverless application to the intended behavior, wherein creation of the set of one or more security policies is based, at least in part, on the set of one or more usage flows.
Dependencies are inferred from the claim text.