Back to results
US 12,608,466 B1Granted
Controlling deployment of serverless function codes in customer accounts on serverless platforms
AssigneeTrend Micro Incorporated
InventorsSuraj Prakash Sahu, Pawan Kinger, Alfredo de Oliveira, David Fiser
Life of this patent
Estimating the term…
Abstract
A customer account on a serverless platform is monitored for deployment of serverless function codes. When a serverless function code is detected to have been deployed in the customer account, the deployment is checked against admission control policies of the customer account. A corresponding serverless function in the customer account that results from the deployment of the serverless function code is terminated when the deployment of the serverless function code is prohibited by an admission control policy.
Claims16
A method of controlling deployment of serverless function codes, the method comprising:
- monitoring deployment of serverless function codes in a plurality of customer accounts of corresponding customers on a serverless platform of a cloud service provider, wherein the serverless platform dynamically manages allocation of computing resources of the serverless platform to run serverless functions in the plurality of customer accounts;
- detecting deployment of a serverless function code of a customer in a first customer account of the plurality of customer accounts, the deployment of the serverless function code of the customer executes the serverless function code of the customer resulting in a corresponding serverless function of the customer to run in the first customer account;
- responsive to detecting the deployment of the serverless function code of the customer in the first customer account, determining whether if any of a first set of admission control policies of the first customer account applies to the deployment of the serverless function code of the customer in the first customer account, wherein each customer account of the plurality of customer accounts has a separate set of admission control policies that apply to deployment of function codes in the customer account;
- and
- terminating the corresponding serverless function of the customer in the first customer account responsive to determining that the deployment of the serverless function code of the customer in the first customer account is prohibited by an admission control policy of the first set of admission control policies,
- wherein a user that deployed the serverless function code of the customer in the first customer account is a prohibited user, and the admission control policy indicates terminating a corresponding serverless function of a serverless function code deployed by a prohibited user.
3 more elements
A system for controlling deployment of serverless function codes, the system comprising:
- a serverless platform of a cloud service provider, the serverless platform comprising at least one processor and a memory, the memory of the serverless platform storing instructions that when executed by the at least one processor of the serverless platform cause the serverless platform to dynamically manage allocation of computing resources of the serverless platform to run serverless functions of a plurality of customers, each of the plurality of customers having a corresponding customer account of a plurality of customer accounts on the serverless platform;
- and
- a computer system that is separate from the serverless platform, the computer system
- comprising at least one processor and a memory, the memory of the computer system storing instructions that when executed by the at least one processor of the computer system cause the computer system to:
- monitor deployment of serverless function codes of the plurality of customers on the serverless platform;
- detect deployment of a serverless function code of a first customer of the plurality of customers in a first customer account of the plurality of customer accounts, the deployment of the serverless function code of the first customer executes the serverless function code of the first customer resulting in a corresponding serverless function of the first customer running in the first customer account;
- responsive to detecting the deployment of the serverless function code of the first customer in the first customer account, determine whether any of a first set of admission control policies of the first customer account applies to the deployment of the serverless function code of the first customer in the first customer account, wherein each customer account of the plurality of customer accounts has a separate set of admission control policies that apply to deployment of function codes in the customer account;
- and
- initiate termination of the corresponding serverless function of the first customer in the first customer account responsive to determining that the deployment of the serverless function code of the first customer in the first customer account is prohibited by an admission control policy of the first set of admission control policies,
- wherein a user that deployed the serverless function code of the first customer in the first customer account is a prohibited user, and the admission control policy indicates terminating a corresponding serverless function of a serverless function code deployed by a prohibited user.
7 more elements
A method of controlling deployment of serverless function codes, the method comprising:
- detecting deployment of a serverless function code of a customer in a customer account of a plurality of customer accounts on a serverless platform, the deployment of the serverless function code of the customer causes the serverless function code of the customer to execute resulting in a corresponding serverless function of the customer running in the customer account, the deployment of the serverless function code of the customer being detected from outside the customer account, wherein the serverless platform dynamically manages allocation of computing resources of the serverless platform to run serverless functions of a plurality of customers in corresponding customer accounts;
- responsive to detecting the deployment of the serverless function code of the customer, determining whether the serverless function code of the customer has been subjected to cybersecurity analysis;
- responsive to the serverless function code of the customer being determined as not having been subjected to cybersecurity analysis, copying the serverless function code of the customer from a first storage location to a second storage location;
- after copying the serverless function code of the customer from the first storage location to the second storage location, performing cybersecurity analysis on the serverless function code of the customer to generate a risk score of the serverless function code of the customer;
- and
- terminating the corresponding serverless function of the customer in the customer account in response to the risk score indicating that the serverless function code of the customer poses a severe security risk,
- wherein terminating the corresponding serverless function of the customer in the customer account comprises issuing an application programming interface (API) call from another serverless function in the customer account to delete the corresponding serverless function of the customer.
4 more elements
Dependencies are inferred from the claim text.