Timing Side-Channel Analysis of Cold Start Behavior in OpenFaaS Environments

Abstract

Serverless computing has seen rapid adoption in recent years. Platforms like AWS Lambda and Google Cloud Functions allow developers to deploy code without managing servers. However, the cold start problem—the delay when a function is invoked after being idle—remains a challenge. Most research treats cold starts as a performance issue. In this paper, we examine them from a security perspective. Specifically, we ask whether the timing difference between cold and warm starts can be used as a side-channel to infer information about a FaaS environment. Two experiments were conducted on OpenFaaS deployed on Kubernetes. In the first, response times were measured under cold and warm start conditions across 50 trials. Cold starts averaged 1415.4ms, warm starts 91.8ms. Cold starts were detected with 84% accuracy (p < 0.000001). In the second experiment, two functions were deployed in the same Pod—a victim and a CPU-intensive target—and the victim's response time was measured under idle and loaded conditions. Response times rose from 58.3ms to 113.8ms under load, yielding 90% detection (p < 0.000001). The results suggest that, under the tested OpenFaaS configuration, container-level isolation may not fully mitigate timing side-channel leakage. These findings indicate the potential feasibility of such attacks, though further validation under production environments is warranted.