{"id":{"repo_id":"uiuc","oai_identifier":"oai:www.ideals.illinois.edu:2142/121334"},"canonical_url":"https://search.dev.ndltd.org/etd/uiuc/oai:www.ideals.illinois.edu:2142/121334","repository":{"repo_id":"uiuc","name":"University of Illinois - Urbana-Champaign","base_url":"https://www.ideals.illinois.edu/oai-pmh"},"display":{"title":"Defending against emerging threats in serverless computing through information flow analysis","abstract":"Submission published under a 24 month embargo labeled 'U of I Access', the embargo will last until 2025-08-01","abstract_html":"Submission published under a 24 month embargo labeled 'U of I Access', the embargo will last until 2025-08-01","abstract_has_math":false,"creators":["Datta, Pubali"],"institution":"University of Illinois at Urbana-Champaign","degree_name":"Ph.D.","degree_level":"Dissertation","degree_discipline":"Computer Science","degree_department":null,"school":null,"contributors":["Bates Yuile, Adam","Gunter, Carl","Mittal, Radhika","Enck, William"],"advisors":[],"committee_chairs":[],"committee_members":[],"year":2023,"date_issued":"2023-08","date_published":"2023-08","updated_at":"2026-07-22T22:24:57Z","subjects":["Computer Security","Cloud Computing","Serverless","Information Flow"],"languages":["en","eng"],"rights":["Copyright 2023 Pubali Datta"],"rights_urls":[],"identifier_entries":[]},"links":{"outbound_url":"https://hdl.handle.net/2142/121334","outbound_label":"Handle","outbound_source":"dc:identifier"},"metadata_groups":[{"id":"people","label":"People","entries":[{"key":"dc:contributor","label":"Contributor","values":["Bates Yuile, Adam","Gunter, Carl","Mittal, Radhika","Enck, William"]},{"key":"dc:creator","label":"Author","values":["Datta, Pubali"]}]},{"id":"academic_context","label":"Academic Context","entries":[{"key":"dc:date","label":"Dc Date","values":["2023-08","2023-07-06"]},{"key":"dc:type","label":"Dc Type","values":["text"]},{"key":"thesis:degree_discipline","label":"Discipline","values":["Computer Science"]},{"key":"thesis:degree_level","label":"Degree Level","values":["Dissertation"]},{"key":"thesis:degree_name","label":"Degree Name","values":["Ph.D."]},{"key":"thesis:institution_name","label":"Thesis Institution Name","values":["University of Illinois at Urbana-Champaign"]}]},{"id":"subjects_keywords","label":"Subjects and Keywords","entries":[{"key":"dc:subject","label":"Dc Subject","values":["Computer Security","Cloud Computing","Serverless","Information Flow"]}]},{"id":"language_rights","label":"Language and Rights","entries":[{"key":"dc:language","label":"Dc Language","values":["en","eng"]},{"key":"dc:rights","label":"Dc Rights","values":["Copyright 2023 Pubali Datta"]}]},{"id":"identifiers","label":"Identifiers","entries":[{"key":"dc:identifier","label":"Identifier","values":["https://hdl.handle.net/2142/121334"]}]},{"id":"additional","label":"Additional Metadata","entries":[{"key":"dc:description","label":"Description","values":["Submission published under a 24 month embargo labeled 'U of I Access', the embargo will last until 2025-08-01","The student, Pubali Datta, accepted the attached license on 2023-07-05 at 14:09.","The student, Pubali Datta, submitted this Dissertation for approval on 2023-07-05 at 14:19.","This Dissertation was approved for publication on 2023-07-06 at 15:19.","DSpace SAF Submission Ingestion Package generated from Vireo submission #19517 on 2023-12-04 at 17:18:11","Serverless computing has freed developers from the burden of managing their own platform and infrastructure, allowing them to rapidly prototype and deploy applications. Despite its surging popularity, however, serverless raises a number of concerning security implications. Many such application workflows are based in part on publicly-available functions developed by third-parties, creating the potential for functions to behave in unexpected, or even malicious, ways. At present, developers are not in total control of where and how their data is flowing, creating significant security and privacy risks. Existing role-based access control solutions are ineffective in protecting the serverless flows due to pervasive misconfiguration problems, and the likelihood of policy failures in serverless applications is high because of multitude of components. Moreover, investigating serverless intrusions is difficult – by decomposing traditional applications into ephemeral re-entrant functions, serverless has enabled attackers to conceal their activities within legitimate workflows, and even prevent root cause analysis by abusing warm container reuse policies to break causal paths. The focus of this dissertation, therefore, is on designing precise information flow based security mechanisms for serverless platforms leveraging the ephemeral, event-driven and stateless function patterns in serverless web applications. Due to the event-driven nature of serverless, function events and outputs can be reliably bound to an event-trigger thus allowing more accurate information flow tracking, and separating functionality into small reentrant functions alleviates dependency explosion. This work details three efforts to bring precise flow tracking to serverless cloud applications. We first present design and implementation of a serverless flow control system where workflow-centric perspective on access control effectively mediates serverless application functions preventing flow violations, especially when compared to the commonly-used RBAC (Role Based Access Control) policies. Next we propose Alastor, the first auditing framework based on provenance for serverless. Alastor is a function-agnostic provenance framework for attack investigation in serverless environments enabling investigation of serverless specific attack strategies. Finally, we present a privilege reduction technique for serverless application through combined formal policy analysis and static code analysis. Using these systems, we will demonstrate that classical in- formation flow analysis based security approaches can be effectively adapted to solve security problems in the serverless paradigm including flow manipulation, and data exfiltration."]},{"key":"dc:format","label":"Dc Format","values":["application/pdf"]},{"key":"dc:title","label":"Title","values":["Defending against emerging threats in serverless computing through information flow analysis"]}]}],"canonical_facts":{"dc:contributor":["Bates Yuile, Adam","Gunter, Carl","Mittal, Radhika","Enck, William"],"dc:creator":["Datta, Pubali"],"dc:date":["2023-08","2023-07-06"],"dc:description":["Submission published under a 24 month embargo labeled 'U of I Access', the embargo will last until 2025-08-01","The student, Pubali Datta, accepted the attached license on 2023-07-05 at 14:09.","The student, Pubali Datta, submitted this Dissertation for approval on 2023-07-05 at 14:19.","This Dissertation was approved for publication on 2023-07-06 at 15:19.","DSpace SAF Submission Ingestion Package generated from Vireo submission #19517 on 2023-12-04 at 17:18:11","Serverless computing has freed developers from the burden of managing their own platform and infrastructure, allowing them to rapidly prototype and deploy applications. Despite its surging popularity, however, serverless raises a number of concerning security implications. Many such application workflows are based in part on publicly-available functions developed by third-parties, creating the potential for functions to behave in unexpected, or even malicious, ways. At present, developers are not in total control of where and how their data is flowing, creating significant security and privacy risks. Existing role-based access control solutions are ineffective in protecting the serverless flows due to pervasive misconfiguration problems, and the likelihood of policy failures in serverless applications is high because of multitude of components. Moreover, investigating serverless intrusions is difficult – by decomposing traditional applications into ephemeral re-entrant functions, serverless has enabled attackers to conceal their activities within legitimate workflows, and even prevent root cause analysis by abusing warm container reuse policies to break causal paths. The focus of this dissertation, therefore, is on designing precise information flow based security mechanisms for serverless platforms leveraging the ephemeral, event-driven and stateless function patterns in serverless web applications. Due to the event-driven nature of serverless, function events and outputs can be reliably bound to an event-trigger thus allowing more accurate information flow tracking, and separating functionality into small reentrant functions alleviates dependency explosion. This work details three efforts to bring precise flow tracking to serverless cloud applications. We first present design and implementation of a serverless flow control system where workflow-centric perspective on access control effectively mediates serverless application functions preventing flow violations, especially when compared to the commonly-used RBAC (Role Based Access Control) policies. Next we propose Alastor, the first auditing framework based on provenance for serverless. Alastor is a function-agnostic provenance framework for attack investigation in serverless environments enabling investigation of serverless specific attack strategies. Finally, we present a privilege reduction technique for serverless application through combined formal policy analysis and static code analysis. Using these systems, we will demonstrate that classical in- formation flow analysis based security approaches can be effectively adapted to solve security problems in the serverless paradigm including flow manipulation, and data exfiltration."],"dc:format":["application/pdf"],"dc:identifier":["https://hdl.handle.net/2142/121334"],"dc:language":["en","eng"],"dc:rights":["Copyright 2023 Pubali Datta"],"dc:subject":["Computer Security","Cloud Computing","Serverless","Information Flow"],"dc:title":["Defending against emerging threats in serverless computing through information flow analysis"],"dc:type":["text"],"thesis:degree_discipline":["Computer Science"],"thesis:degree_level":["Dissertation"],"thesis:degree_name":["Ph.D."],"thesis:institution_name":["University of Illinois at Urbana-Champaign"]},"updated_at":"2026-07-22T22:24:57Z"}