FaaSGuard: An Adaptive Framework for Obfuscating Function Activity States in Serverless Applications

Function-as-a-Service (FaaS), the core implementation of Serverless Computing, is widely adopted in modern applications. However, its multi-tenant, shared infrastructure creates opportunities for network side-channel attacks, leading to the leakage of sensitive information such as function activity states. Most existing defense solutions lack specific considerations for the unique FaaS architecture. To address this issue, we propose FaaSGuard, an adaptive traffic obfuscation framework designed to protect function activity states and enhance the privacy of serverless applications. FaaSGuard achieves adaptiveness through a dual-mode monitoring mechanism, ensures covertness using traffic camouflage techniques, and guarantees application transparency with a tag-based packet handling mechanism. Our prototype evaluation on an open-source FaaS platform demonstrates that FaaSGuard effectively hides real traffic patterns under varying loads. The end-to-end response latency it introduces is almost negligible, and it achieves significant privacy enhancement at an acceptable resource cost. Specifically, it requires a maximum increase of about 25.3% in gateway CPU usage and a 12% increase in memory usage.