Abstract
In recent years, big data technologies have focused their efforts on promoting the use of IoT devices. Thanks to the latest advances, it is a consolidated reality today and the forecast of this phenomenon will continue to grow in the coming years. However, at the security level, new threats arise that must be taken into account when we try to connect our IoT devices with services that can expose our data. For example, from a security point of view, it would be interesting to analyze the actions and events that are sent to a serverless application taking an IoT device as its origin. In this paper we analyze the main security threats on IoT platforms and how some of these threats are related to security problems in serverless applications. First, we analyze the main threats we have in IoT devices and serverless applications, finally we analyze how IoT devices could lead to a security issue in serverless applications with which it is communicating, for example by producing a Denial of wallet due to events generated in an uncontrolled way.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
References
Sewak, M., Singh, S.: Winning in the Era of Serverless Computing and Function as a Service. In: 2018 3rd International Conference for Convergence in Technology (I2CT), pp. 1–5 (2018). https://doi.org/10.1109/I2CT.2018.8529465
Carver, B., Zhang, J., Wang, A., Cheng, Y.: In search of a fast and efficient serverless DAG engine. In: 2019 IEEE/ACM Fourth International Parallel Data Systems Workshop (PDSW) (2019)
Mora, H., Peral, J., Ferrandez, A., Gil, D., Szymanski, J.: Distributed architectures for intensive urban computing: a case study on smart lighting for sustainable cities. IEEE Access 7, 58449–58465 (2019)
Mora, H., Mora Gimeno, F.J., Signes-Pont, M.T., Volckaert, B.: Multilayer architecture model for mobile cloud computing paradigm. Complexity 2019 (2019)
AWS IoT rule actions. https://docs.aws.amazon.com/iot/latest/developerguide/iot-rule-actions.html. Accessed 23 June 2022
Lambda rule action. https://docs.aws.amazon.com/iot/latest/developerguide/lambda-rule-action.html. Accessed 23 June 2022
Sharaf, S.: Security issues in serverless computing architecture. Int. J. Emerg. Trends Eng. Res. 8(2) (2020)
Hassan, W.H.: Current research on Internet of Things (loT) security: a survey. Comput. Netw. 148, 283–294 (2019)
Khan, M.A., Salah, K.: loT security: review blockchain solutions and open challenges. Futur. Gener. Comput. Syst. 82, 395–411 (2018)
Kumar, R., Goyal, R.: On cloud security requirements threats, vulnerabilities and countermeasures: a survey. Comput. Sci. Rev. 33, 1–48 (2019)
Wang, Z., et al.: An empirical study on business analytics affordances enhancing the management of cloud computing data security. Int. J. Inf. Manage. 50, 387–394 (2019)
Zhou, W., et al.: Discovering and understanding the security hazards in the interactions between loT devices, mobile apps and clouds on smart home platforms. In: 28th {USENIX} Security Symposium ({USENIX} Security 19) (2019)
Baseline Security Recommendations for IoT. https://www.enisa.europa.eu/publications/baseline-security-recommendations-for-iot. Accessed 14 Sep 2022
OWASP IoT Top 10. https://owasp.org/www-pdf-archive/OWASP-IoT-Top-10-2018-final.pdf. Accessed 14 Sep 2022
MITRE attack cloud matrix. https://attack.mitre.org/matrices/enterprise/cloud/. Accessed 14 Sep 2022
Marin, E., Perino, D., Di Pietro, R.: Serverless Computing: A Security Perspective (2021)
Shafiei, H., Khonsari, A., Mousavi, P.: Serverless computing: a survey of opportunities, challenges, and applications. ACM Comput. Surv. 1, 1 (2021)
Serverless security risks, Sysdig (2021). https://sysdig.com/learn-cloud-native/kubernetes-security/serverless-security-risks-and-best-practices. Accessed 14 Sep 2022
Denial of wallet attack. https://www.cequence.ai/use-cases/denial-of-wallet. Accessed 23 June 2022
Kelly, D., Glavin, F.G., Barrett, E.: Denial of wallet—defining a looming threat to serverless computing. J. Inf. Secur. Appl. 60, 102843 (2021). ISSN 2214–2126 https://doi.org/10.1016/j.jisa.2021.102843
Junjie Xiong, Mingkui Wei, Zhuo Lu, and Yao Liu.: Warmonger: inflicting denial-of-service via serverless functions in the cloud. In: Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security (CCS 2021), November 15–19, 2021, Virtual Event, Republic of Korea, p. 15. ACM, New York, NY, USA (2021). https://doi.org/10.1145/3460120.3485372
Monge, M.A.S., Vidal, J.M., Pérez, G.M.: Detection of economic denial of sustainability (EDoS) threats in self-organizing networks. Comput. Commun. 145, 284–308 (2019)
Twelve Factor App Methodology. https://12factor.net. Accessed 14 Sep 2022
Case Study on Cloud Migration and Improvement of Twelve-Factor App. https://www.utupub.fi/bitstream/handle/10024/152389/DI_tyo_peltotalo.pdf. Accessed 14 Sep 2022
Go Serverless: Securing Cloud via Serverless Design Patterns Sanghyun Hong and Abhinav Srivastava and William Shambrook and Tudor Dumitras, HotCloud (2018). https://www.usenix.org/conference/hotcloud18/presentation/hong
Acknowledgements
This work was supported by the Spanish Research Agency (AEI) under project HPC4Industry PID2020-120213RB-I00.
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2023 The Author(s), under exclusive license to Springer Nature Switzerland AG
About this paper
Cite this paper
Candel, J.M.O., Gimeno, F.J.M., Mora Mora, H. (2023). Serverless Security Analysis for IoT Applications. In: Bravo, J., Ochoa, S., Favela, J. (eds) Proceedings of the International Conference on Ubiquitous Computing & Ambient Intelligence (UCAmI 2022). UCAmI 2022. Lecture Notes in Networks and Systems, vol 594. Springer, Cham. https://doi.org/10.1007/978-3-031-21333-5_39
Download citation
DOI: https://doi.org/10.1007/978-3-031-21333-5_39
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-031-21332-8
Online ISBN: 978-3-031-21333-5
eBook Packages: Intelligent Technologies and RoboticsIntelligent Technologies and Robotics (R0)