S-FaaS: Trustworthy and Accountable Function-as-a-Service using Intel SGX

by   Fritz Alder, et al.

Function-as-a-Service (FaaS) is a recent and already very popular paradigm in cloud computing. The function provider need only specify the function to be run, usually in a high-level language like JavaScript, and the service provider orchestrates all the necessary infrastructure and software stacks. The function provider is only billed for the actual computational resources used by the function invocation. Compared to previous cloud paradigms, FaaS requires significantly more fine-grained resource measurement mechanisms, e.g. to measure compute time and memory usage of a single function invocation with sub-second accuracy. Thanks to the short duration and stateless nature of functions, and the availability of multiple open-source frameworks, FaaS enables non-traditional service providers e.g. individuals or data centers with spare capacity. However, this exacerbates the challenge of ensuring that resource consumption is measured accurately and reported reliably. It also raises the issues of ensuring computation is done correctly and minimizing the amount of information leaked to service providers. To address these challenges, we introduce S-FaaS, the first architecture and implementation of FaaS to provide strong security and accountability guarantees backed by Intel SGX. To match the dynamic event-driven nature of FaaS, our design introduces a new key distribution enclave and a novel transitive attestation protocol. A core contribution of S-FaaS is our set of resource measurement mechanisms that securely measure compute time inside an enclave, and actual memory allocations. We have integrated S-FaaS into the popular OpenWhisk FaaS framework. We evaluate the security of our architecture, the accuracy of our resource measurement mechanisms, and the performance of our implementation, showing that our resource measurement mechanisms add less than 6.3


Estimating the Capacities of Function-as-a-Service Functions

Serverless computing is a cloud computing paradigm that allows developer...

On Using P2P Technology for Decentralized Detection of Service Level Agreement Violations

Critical networked services enable significant revenue for network opera...

FaaSNet: Scalable and Fast Provisioning of Custom Serverless Container Runtimes at Alibaba Cloud Function Compute

Serverless computing, or Function-as-a-Service (FaaS), enables a new way...

Function-as-a-Service Benchmarking Framework

Cloud Service Providers deliver their products in form of 'as-a-Service'...

Proactive Serverless Function Resource Management

This paper introduces a new primitive to serverless language runtimes ca...

SFS: Smart OS Scheduling for Serverless Functions

Serverless computing enables a new way of building and scaling cloud app...

SNF: Serverless Network Functions

It is increasingly common to outsource network functions (NFs) to the cl...

Please sign up or login with your details

Forgot password? Click here to reset