Paladin: A Policy Framework for Securing Cloud APIs by Combining Application Context with Generative AI
This addresses security challenges for enterprises deploying cloud-based applications and APIs, offering a novel approach to policy enforcement that is application-agnostic, though it builds incrementally on existing security and AI methods.
The paper tackles the problem of securing cloud APIs against application-layer threats by designing Paladin, a framework that uses large language models to extract semantic meaning from API requests, enabling administrators to define and enforce policies for preventing issues like unrestricted resource consumption and broken authentication. Evaluations show the framework has broad applicability, good policy identification accuracy, and reasonable overheads.
Enterprises and organizations today increasingly deploy in-house, cloud based applications and APIs for internal operations or external customers. These deployments deal with increasing number of threats, despite security features offered by cloud service providers. This work focus on threats that exploit application layer vulnerabilities of cloud workloads. Prevention and mitigation measures against such threats need to be cognizant of application semantics, posing a hurdle to existing solutions. In this work, we design and implement a security framework that allow cloud workload administrators to easily define and enforce policies capable of preventing (i) unrestricted resource consumption, (ii) unrestricted access to sensitive business flows, and (iii) broken authentication. Our framework, Paladin, leverages large language models to extract sufficient semantic meaning from API requests to provide cloud administrators with an application agnostic policy definition interface. Once defined, requests are automatically matched with relevant policies and enforced by high performance proxies. Evaluations with our prototype show that such a framework has broad applicability across applications, good policy identification accuracy, and reasonable overheads, making it substantially easier to define and enforce cross application policies.