Lambada: Autoscaling Confidential Function Chains without Centralized Trust

Aashutosh Poudel, Matthew Berthoud, and Stephen Herwig

William & Mary

Function, Function as a Service (FaaS), Function Chains

• Functions are small, modular pieces of code

2

Function, Function as a Service (FaaS), Function Chains

• Functions are small, modular pieces of code
• Cloud-based solution for running functions

​

3

Google Cloud Function

AWS Lambda

Function, Function as a Service (FaaS), Function Chains

• Functions are small, modular pieces of code
• Cloud-based solution for running functions
• Logical (ordered) grouping of Functions
• Example: A function chain to process loan applications

​

4

Google Cloud Function

AWS Lambda

Bank function to process applications

Function to verify applicant’s identity

Function to retrieve applicant’s credit score

Threat Landscape

• Infrastructure bugs and insider threats
• Data disclosures to law enforcement
• Data flow manipulation attacks can steal sensitive information

5

Research Question

Is it possible for a FaaS platform to guarantee the confidentiality and integrity of function chains without resorting to centralized trusted services?

6

Threat Model

7

Threat Model

8

Threat Model + Security Goals

9

Existing Solutions

• Trusted Execution Environments (TEEs), e.g. Intel SGX, provide data confidentiality and integrity
• Act as a reverse sandbox (enclave) — protecting code inside from privileged attackers like the OS or hypervisor

​

• Sealing — lets an enclave persist secrets to untrusted storage across restarts
• Attestation — an authenticated assertion of the platform's identity and of the enclave's code and data

10

Existing Solutions

• Central Key Distribution Server to provision identical keying material

11

Intel SGX

Shared Key

Key Distribution Server (KDS)

Our Approach

• Remove the central Key Distribution Server
• TEEs provide confidentiality and integrity

12

Our Approach

• Functions create their own keys

13

Our Approach

• There’s usually multiple copies (replicas) of functions scaled according to incoming requests

14

Our Approach

​

​

• AFGH05 Proxy Re-encryption Scheme (Section 6.4)

15

Proxy Re-encryption

16

Proxy Re-encryption

17

Proxy Re-encryption

18

Proxy Re-encryption

19

Proxy Re-encryption in Functions

20

Proxy Re-encryption in Functions

21

Proxy Re-encryption in Functions

22

Path Integrity

• BGLS03 Aggregate Signature Scheme (Section 6.4)

23

Request Flow in Lambada

24

Request Flow in Lambada

25

Request Flow in Lambada

26

Request Flow in Lambada

27

Replay Detection

28

Tamper-evident log

29

Key Rotation

30

End-to-end Design

31

End-to-end Design

32

End-to-end Design

33

End-to-end Design

34

End-to-end Design

35

Implementation: Knative

36

Implementation: Knative

37

Implementation: Knative

38

Implementation: Knative

39

Evaluation: Startup delay

40

Evaluation: Startup delay

41

Evaluation: Startup delay

42

Evaluation: Startup delay

43

Evaluation: Function Invocation

• Request decryption & Response encryption on request path
• 250 to 1250 (in increments of 250) and run each strategy for five minutes

44

Evaluation: Application Macrobenchmark

​

• Four-node Azure Kubernetes Service (AKS)
• Avg. time each request spends on a function (1% of 100 rps for 5 minutes)
• Emojivoto microservice: validate votes, record vote, count vote, display

45

Evaluation: Application Macrobenchmark

46

Evaluation: Application Macrobenchmark

47

Evaluation: Application Macrobenchmark

48

Summary

• Compose Intel SGX and proxy re-encryption to protect function I/O while preserving horizontal trust scaling.
• Implement a prototype in a popular FaaS framework (Knative), integrating transparently with FaaS workflows.
• Evaluate our prototype on a real system, showing modest overhead of 1.55–1.83× that of a function using shared RSA keys.

49

Lambada: Autoscaling Confidential Function Chains without Centralized Trust

Aashutosh Poudel, Matthew Berthoud, and Stephen Herwig

William & Mary

GitHub

Paper