IEEE CCGrid 2026

PoliFlow

Inferring Control-Flow Policies
from Serverless Workflows

Pedro Escaleira

escaleira@ua.pt

Vitor A. Cunha

vitorcunha@ua.pt

João P. Barraca

jpbarraca@ua.pt

Diogo Gomes

dgomes@ua.pt

Rui L. Aguiar

ruilaa@ua.pt

Co-funded by the European Union – 6GSNS

Problem statement

3/22

Core issue

RBAC protects edges, not execution order

f1 Authentication f2 Validation f3 Calculate refund f4 Issue refund D1 Orders database D2 Refunds database
4/22

Motivating example

Refund workflow attack

f1 Authentication f2 Validation f3 Calculate refund f4 Issue refund D1 Orders database D2 Refunds database

Intended flow

f1
→
d1
→
f2
→
f3
→
d2
→
f4

Attack path — bypasses f1 and f2

f3 — Calculate refund
→
d2 — Refunds database
→
f4 — Issue refund

State of the art

6/22

Related work

Existing systems and their gaps

System Approach Order-aware? No profiling?
Valve1Network-layer profiling✗✗
Kalium2Learned path models✓✗
PoliFlowSpecification-derived✓✓

1 P. Datta et al., “Valve: Securing Function Workflows on Serverless Computing Platforms,” The Web Conference 2020 – Proceedings of the World Wide Web Conference, WWW 2020, pp. 939–950, 2020. DOI: 10.1145/3366423.3380173.

2 D. S. Jegan et al., “Guarding Serverless Applications with Kalium,” 32nd USENIX Security Symposium, USENIX Security 2023, vol. 6, pp. 4087–4104, 2023. [Online]. Available: https://www.usenix.org/conference/usenixsecurity23/presentation/jegan.

Proposal

8/22

Key idea

Use the workflow as the source of truth

Specification-first

Least privilege by construction

Decentralized enforcement

9/22

Architecture

High-level architecture

Offline
Upload
Workflow
Definition
Upload
Function
Properties
↓ ↓
PoliFlow Extractor
↓
Allowed
Paths
→
Updated
Function
Properties
↓
Database
Functions Configuration
→

Instantiation

Running time
Sandbox Instance
Function
PoliFlow Enforcer
(Middleware)
← Functions Configuration loaded at startup
10/22

Extractor

State taxonomy

States Multi-way Choice • Switch One-way Map • For Parallel • Fork Do Try Atomic Task • Call • Run • Emit • Listen Success Fail • Raise Wait Pass • Set
11/22

Extractor

How each state type is extracted

Multi-way

One path per branch

Workflow
f1
↓
Switch
Branch 1
f2
Branch 2
f3
↓
f4
↓
f5
Generated allowed paths — for f5
Path 1 — for f5
f1
→
f2
Path 2 — for f5
f1
→
f3
→
f4

One-way — Parallel

Parallel structure preserved

Workflow
f1
↓
Parallel
Branch 1
f2
↓
f3
Branch 2
f4
↓
f5
↓
f6
Generated allowed path — for f6
f1
→
parallel
f2
→
f3
f4
→
f5

One-way — Loop

Parallel marked loop=true

Workflow
f1
↓
Loop
f2
↓
f3
↓
f4
Generated allowed path — for f4
f1
→
parallel · loop=true
f2
→
f3
12/22

Enforcer

Trace validation at runtime

PoliFlow Enforcer Received trace Normalization Parallel merge Multiple branch traces aligned by common prefix → merged Loop normalization Repeated subsequences detected → rewritten to canonical form Normalized trace Validation Allowed paths Precomputed by Extractor, injected at startup Normalized trace Comparison match? no Reject emit audit log yes Access granted Append entity ID to trace
13/22

Enforcement — execution examples

Parallel and loop handling

Parallel execution

Workflow definition
f1
→
Parallel
Branch 1
f2
→
f3
Branch 2
f4
→
f5
→
f6
What f6 receives
Branch 1:
f1
→
f2
→
f3
Branch 2:
f1
→
f4
→
f5
Trace normalization
Equal prefix → merge
f1
→
Distinct suffix → represent as parallel
B1
f2
→
f3
B2
f4
→
f5

Loop execution (3 iterations)

Workflow definition
f1
→
Loop
f2
→
f3
→
f6
What f6 receives
Branch 1
f1
→
f2
→
f3
Branch 2
f1
→
f2
→
f3
Branch 3
f1
→
f2
→
f3
Trace normalization
Equal prefix → merge
f1
→
Distinct suffix → represent as parallel
B1
f2
→
f3
B2
f2
→
f3
B3
f2
→
f3
⚠ Suffixes are identical across iterations. A random execution ID is appended to each function name at runtime so each branch is uniquely identifiable in the trace.

Evaluation

15/22

Evaluation

Methodology

OpenStack Private Cloud K3s Cluster K3s v1.32.6 | Knative v1.19 | SonataFlow Worker 1 16 vCPU 16 GB RAM Worker 2 16 vCPU 16 GB RAM Control plane 16 vCPU 16 GB RAM Benchmark VM 4 vCPU 8 GB RAM connects to
16/22

Results — overhead

Deployment & image overhead

Sidecar image size

Baseline
45.9 MB
With Enforcer
65.0 MB

1.42×

Deployment time

Baseline
~3.3 s
Simple workflow
~3.9 s
Complex workflow
~4.0 s

+~600ms

17/22

Refund workflow (5 functions in sequence)

Per-function overhead

Refund workflow (5 functions in sequence)

0 2 4 6 8 Average Latency (ms) Function f1 f2 f3 f4 result Mode baseline enforce

Valve real-estate (12 functions in sequence)

0 2 4 6 8 Average Latency (ms) Function f1 f4 f5 f6 f7 f8 f9 f10 f11 result Mode baseline enforce
18/22

Results — scalability

Overhead grows linearly with workflow length

Sequence of 70 functions — latency overhead per function

0123456f1f10f20f30f40f50f60f70FunctionLatency diff. (ms)y = 0.0303x + 0.6011Mean diff. ± std

70 parallel states (140 functions) — latency overhead per function

036912151821f1f20f40f60f80f100f120f140FunctionLatency diff. (ms)y = 0.0893x + 1.7439Mean diff. ± std

Takeaways

20/22

Conclusion

Workflow specs encode intent

PoliFlow turns that intent into enforceable control-flow policies, with no profiling.

Decentralized enforcement works

Each function validates only its own relevant prefixes. No central coordinator, no SPOF.

Overhead is practical

Milliseconds per function impact

21/22

Looking ahead

Future directions

Direct-call enforcement

Extend PoliFlow to cover serverless functions invoked via direct HTTP calls, beyond orchestrated workflows, enabling full enforcement without an explicit workflow definition

Additional workflow languages

Support for workflow languages beyond SonataFlow / CNCF Serverless Workflow — including AWS Step Functions, Azure Durable Functions, and Argo Workflows

Complementary security

Integration with complementary serverless security mechanisms such as IAM policy generation, anomaly detection, and runtime introspection to form a layered defence

Tamper-resistant enforcement

Harden the PoliFlow Enforcer against compromised functions that may attempt to alter or bypass its behaviour at runtime

22/22

Thank you

Questions?

github.com/ATNoG/poliflow