Bom Kim

Serverless environments are rapidly emerging as the new paradigm for cloud computing due to their automatic scalability, cost efficiency, and ease of operation. However, IAM-based privilege management and event-driven execution mechanisms can introduce security vulnerabilities. In particular, complex inter-functional call relationships expose systems to attacks such as privilege abuse and event call condition exploitation. These attacks often occur dynamically at runtime, making them difficult to address with static defenses. Existing static analysis methods attempt to mitigate these risks, but are inherently limited in capturing dynamic attacks that occur at runtime. In this paper, we propose Bambda, a dynamic security framework for serverless environments that prevents privilege abuse and chained function call attacks. Bambda performs real-time function call verification through centralized logging and automated code injection based on application-specific log groups. Specifically, we introduce a multi-step verification process that distinguishes between direct calls, event-driven calls, and API calls, effectively preventing unauthorized attacks without requiring additional security configurations from developers. Experiments conducted in AWS Lambda environments demonstrate that Bambda effectively defends against privilege abuse and chained function call attacks, achieving practical deployment with minimal performance overhead of 8.12% under warm start conditions.

Container Network Interfaces (CNIs) are critical for securing containerized environments, yet their various security features and performance remain under-analyzed. This study presents an in-depth analysis of major CNI plugins (Cilium, Calico, WeaveNet, Kube-router, and Antrea) in Kubernetes environments. We first analyze their architectural characteristics and basic security features (encryption, multi-tenancy, etc.), and then perform a detailed examination of their network policy enforcement mechanisms. To understand the performance implications of policy enforcement, we evaluate Layer 3/4 policy processing, policy complexity scaling, pod scalability, and Layer 7 policy processing. Our results show clear patterns: eBPF-based Cilium maintains 8.9K Mbps throughput under complex L3/4 policies, but drops to 94 Mbps with L7 processing, while Antrea achieves 6.6K Mbps at L7 through HTTP filtering, although performance degrades as policy complexity increases. Under high concurrent pod loads, iptables-based CNIs show a 60-70% reduction in throughput, while Cilium maintains performance within 10% of baseline. These results highlight the trade-offs between architectural choices and security capabilities, and provide actionable insights for optimizing CNI selection based on cloud-native use cases.

Recently, containers have become the standard for cloud-native service delivery, ensuring scalability and reliability. However, they are also prime targets for various security attacks that exploit vulnerabilities. In particular, deploying security policies in dynamic cloud-native environments presents significant challenges, such as misconfigurations arising from the heterogeneity of different security policies. Despite numerous attempts to address these challenges, existing solutions often lack a unified framework for consistently managing and enforcing heterogeneous security policies across network, system, and cluster layers. Current approaches typically focus on isolated aspects of security rather than providing a comprehensive policy management solution. This fragmentation leads to inconsistencies, inefficiencies, and potential security gaps. To address these challenges, in this paper, we propose KUBEAEGIS, an advanced and unified policy management framework designed to manage the integration, verification, and enforcement of heterogeneous security policies at the network, system, and cluster levels. Our framework enables centralized management of security policies, simplifying the integration of new security tools through an adapter-based approach and API recommendation mechanisms. We also incorporate a pre-validation process to detect potential misconfigurations before policy enforcement and to enable real-time tracking of policies applied to containers. Our evaluation demonstrates the effectiveness of KUBEAEGIS in integrating and managing network, system, and cluster security policies in real cloud-native environments, providing extensive coverage and achieving a minimal translation delay of approximately 17ms.