Enhancing Effective Bidirectional Isolation for Function Fusion in Serverless Architectures

Serverless computing has emerged as a popular paradigm in modern cloud environments, offering flexibility and scalability to tenants. A serverless function might handle sensitive tenant data. Employing Trusted Execution Environment (TEE) techniques to protect such a function from untrusted cloud service providers is attractive for tenant privacy. However, this introduces response latency, thereby impacting the performance of function execution. This paper introduces Fundue, a serverless architecture with bidirectional isolation between tenant and cloud provider that achieves light-weight isolation of functions and reduces cold start latency by fusing functions. Fundue enables multiple functions uploaded by the same tenant to share a single execution environment embedded into the enclave. Fundue allocates separate memory for each serverless function within the execution environment and establishes robust isolation between functions through bounds checking mechanisms. We extensively evaluate Fundue with diverse workloads and representative serverless functions. Our results demonstrate a significant reduction in response latency of serverless function execution, ranging from 17.8% to 88.7% compared to AccTEE, an open-source two-way sandbox serverless framework. Additionally, Fundue mitigates vulnerabilities in existing execution environments, such as stack-based buffer overflows.