# US 12,225,013 B2 · Securing application behavior in serverless computing > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,225,013 B2 - Document ID: US12225013B2 - Status: Granted - Kind: B2 - Application number: 18/353,238 - Filed: 2023-07-17 - Published: 2023-11-09 - Granted: 2025-02-11 - Earliest claimed: 2019-02-20 - Assignees: Palo Alto Networks, Inc. - Applicants: Palo Alto Networks, Inc. - Inventors: Ory Segal; Yuri Shapira; Avraham Shulman; Benny Nissimov; Shaked Zin - Web page: https://patentgrep.com/patent/US12225013B2 ## CPC - H04L 63/10: {for controlling access to devices or network resources} - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/554: {involving event detection and direct action} - G06N 5/04: Inference or reasoning models - G06N 20/00: Machine learning - H04L 9/0897: {involving additional devices, e.g. trusted platform module [TPM], smartcard or USB} - H04L 9/3247: {involving digital signatures} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract A method for securing a serverless application including: (a) receiving a list of components which make up the serverless application and one or more intended usage flows of the serverless application; (b) creating and applying a security policy for each component of the serverless application, the security policy denying all access requests except from authorized components, wherein the authorized components are selected based on access requirements dictated by the one or more intended usage flows. ## Claims ### Claim 1 A method comprising: determining components of a serverless application; learning intended behavior of the serverless application, wherein learning intended behavior of the serverless application comprises determining a set of one or more usage flows among the components of the serverless application; and creating a set of one or more security policies to restrict behavior of the serverless application to the intended behavior, wherein creating the set of one or more security policies is based, at least in part, on the set of one or more usage flows. ### Claim 2 (depends on 1) The method of claim 1, wherein determining the set of one or more usage flows comprises at least one of observing runtime application behavior of the serverless application with instrumentation and analyzing application log files. ### Claim 3 (depends on 1) The method of claim 1, wherein learning the intended behavior of the serverless application is while running the serverless application during an initial or calibration phase. ### Claim 4 (depends on 1) The method of claim 1, wherein the set of security policies comprise at least one runtime protection policy and at least one identity and access management policy. ### Claim 5 (depends on 4) The method of claim 4, wherein enforcing the runtime protection policy comprises verifying that order-sequence identifiers added to data and/or events of the serverless application conform to one of the set of usage flows. ### Claim 6 (depends on 1) The method of claim 1, wherein the components of the serverless application comprise a serverless function and a resource. ### Claim 7 (depends on 6) The method of claim 6, wherein the components further comprise at least one of a cloud service, a security permission, and a configuration file. ### Claim 8 (depends on 1) The method of claim 1, wherein creating the set of one or more security policies comprises creating at least one security policy for each component that is a serverless function and each component that is a resource, based on the set of usage flows. ### Claim 9 (depends on 1) The method of claim 1, wherein a usage flow indicates at least one invocation of at least one serverless function and/or at least one access of at least one resource. ### Claim 10 A non-transitory, machine-readable medium having program code stored thereon, the program code comprising instructions to: determine components of a serverless application; learn intended behavior of the serverless application, wherein the instructions to learn intended behavior of the serverless application comprise instructions to determine a set of one or more usage flows among the components of the serverless application; and create a set of one or more security policies to restrict behavior of the serverless application to the intended behavior, wherein creation of the set of one or more security policies is based, at least in part, on the set of one or more usage flows. ### Claim 11 (depends on 10) The non-transitory, machine-readable medium of claim 10, wherein the instructions to determine the set of one or more usage flows comprise at least one of instructions to observe runtime application behavior of the serverless application and instructions to analyze application log files. ### Claim 12 (depends on 10) The non-transitory, machine-readable medium of claim 10, wherein the instructions to learn the intended behavior of the serverless application comprise instructions to run the serverless application in an initial or calibration phase. ### Claim 13 (depends on 10) The non-transitory, machine-readable medium of claim 10, wherein the set of security policies comprise at least one runtime protection policy and at least one identity and access management policy. ### Claim 14 (depends on 13) The non-transitory, machine-readable medium of claim 13 further comprising instructions to verify that order-sequence identifiers added to data and/or events of the serverless application conform to one of the set of usage flows for enforcement of the runtime protection policy. ### Claim 15 (depends on 10) The non-transitory, machine-readable medium of claim 10, wherein the components of the serverless application comprise a serverless function and a resource and wherein a usage flow indicates at least one invocation of at least one serverless function and/or at least one access of at least one resource. ### Claim 16 (depends on 10) The non-transitory, machine-readable medium of claim 10, wherein the instructions to create the set of one or more security policies comprise instructions to create at least one security policy for each component that is a serverless function and each component that is a resource, based on the set of usage flows. ### Claim 17 An apparatus comprising: a processor; and a machine-readable medium having instructions stored thereon that are executable by the processor to cause the apparatus to, determine components of a serverless application; learn intended behavior of the serverless application, wherein the instructions to learn intended behavior of the serverless application comprise instructions to determine a set of one or more usage flows among the components of the serverless application; and create a set of one or more security policies to restrict behavior of the serverless application to the intended behavior, wherein creation of the set of one or more security policies is based, at least in part, on the set of one or more usage flows. ### Claim 18 (depends on 17) The apparatus of claim 17, wherein the machine-readable medium further has stored thereon instructions executable by the processor to cause the apparatus to: associate cryptographic keys with a first of the components that accesses data generated by a second of the components, wherein the instructions to create the security policies comprise instructions executable by the processor to cause the apparatus to include the cryptographic keys in the security policies of the first and second components for the second component to digitally sign data generated by the second component and the first component to validate the cryptographic signature and corresponding data. ### Claim 19 (depends on 17) The apparatus of claim 17, wherein the instructions to determine the set of one or more usage flows comprise at least one of instructions to observe runtime application behavior of the serverless application and instructions to analyze application log files. ### Claim 20 (depends on 17) The apparatus of claim 17, wherein the instructions to create the set of one or more security policies comprise instructions executable by the processor to cause the apparatus to create at least one security policy for each component that is a serverless function and each component that is a resource, based on the set of usage flows.