Trusted Microservices: A Security Framework for Users' Interaction with Microservices Applications
Article content
Abstract
Microservices architecture emerges as a promising software design approach that provides large scale soft-ware systems with flexibility, scalability and fault tolerance. Moreover, it is considered a suitable design to be implemented using software containers provided with several cloud providers. However, microservices suffer from several security challenges that hinder its progress. The concept of microservices is to break down the system functionality to a number of small coherent services. Hence, using microservices as a design approach increases the security risks by expanding the risk surface. In contrast to microservices, monolithic applica-tions are implemented as a bulk of codes using single programming language. Such environment has several drawbacks related to flexibility and maintainability, but limits security issues. On the other hand, microservices implementation uses several programming languages and frameworks to implement small units of system func-tionality. Such environment opens the door to new critical security issues. The proposed work introduces the problem of securing microservices and provides a novel approach to protect microservices applications from masquerade attacks. The proposed framework also provides high protection to users from malicious services. The framework was implemented using 150 software containers to define users' HTTP requests and a set of 20 microservices were tested to proof its applicability and benefits.
Keywords
Cybersecurity, Microservices architecture, Monolithic applications, Malicious services, Masquerade attacks
Downloads
References
A. Chatterjee, M. W. Gerdes, P. Khatiwada and A. Prinz, "SFTSDH: Applying Spring Security Framework With TSD-Based OAuth2 to Protect Microservice Architecture APIs," IEEE Access, vol. 10, pp. 41914-41934, 2022, doi: 10.1109/ACCESS.2022.3165548.
P. Billawa, A. B. Tukaram, N. E. D. Ferreyra, J.-P. Steghöfer, R. Scandariato, and G. Simhandl, “SoK: Security of Microservice Applications: A Practitioners’ Perspective on Challenges and Best Practices,” in Proc. 17th Int. Conf. Availab. Reliab. Secur. (ARES '22), Austria, 2022, pp. 1-10, doi: 10.1145/3538969.3538986.
F. Al-Doghman, N. Moustafa, I. Khalil, Z. Tari and A. Zomaya, “AI-enabled Secure Microservices in Edge Computing: Opportunities and Challenges,” IEEE Trans. Serv. Comput., doi: 10.1109/TSC.2022.3155447.
Y. Zhang, C. Li, N. Chen and P. Zhang, “Intelligent Requests Orchestration for Microservice Management Based on Blockchain in Software Defined Networking: a Security Guarantee,” in 2022 IEEE Int. Conf. Commun. Workshops (ICC Workshops), Korea, 2022, pp. 254-259, doi: 10.1109/ICCWorkshops53468.2022.9814536.
M. Elkholy and A.-B. Mohamed, “Efficient Security Model for RDF Files Used in IoT Applications” Int. J. Adv. Comput. Sci. Appl. (IJACSA), vol. 12, no. 4, 2021, doi: 10.14569/IJACSA.2021.0120431.
D. Yu, Y. Jin, Y. Zhang, and X. Zheng, “A survey on security issues in services communication of Microservices-enabled fog applications,” Concurr. Comput. Pract. Exp., vol. 31, no. 22, e4436, 2018, doi: 10.1002/cpe.4436.
R. Santos, P. Soares, E. Rodrigues, P. H. M. Maia and A. Silveira, “How Blockchain and Microservices are Being Used Together: a Systematic Mapping Study,” in 2022 IEEE/ACM 5th Int. Workshop Emerg. Trends Softw. Eng. Blockchain (WETSEB), USA, 2022, pp. 39-46, doi: 10.1145/3528226.3528371.
[8] R. S. de O. Júnior, R. C. A. da Silva, M. S. Santos, D. W. Albuquerque, H. O. Almeida and D. F. S. Santos, “An Extensible and Secure Architecture based on Microservices,” in 2022 IEEE Int. Conf. Consum. Electron. (ICCE), 2022, pp. 01-02, doi: 10.1109/ICCE53296.2022.9730757.
A. Chatterjee and A. Prinz, “Applying Spring Security Framework with KeyCloak-Based OAuth2 to Protect Microservice Architecture APIs: A Case Study,” Sensors, vol. 22, no. 5, 1703, 2022, doi: 10.3390/s22051703.
[10] M. E. Kholy and A. E. Fatatry, “Framework for Interaction Between Databases and Microservice Architecture,” IT Prof., vol. 21, no. 5, pp. 57-63, 1 Sept.-Oct. 2019, doi: 10.1109/MITP.2018.2889268.
D. Li, L. Deng, Z. Cai, and A. Souri, “Blockchain as a service models in the Internet of Things management: Systematic review,” Trans. Emerg. Telecommun. Technol., vol. 33, no. 4, e4139, 2020, doi: 10.1002/ett.4139.
X. Sun, S. Boranbaev, S. Han, H. Wang, D. Yu, “Expert system for automatic microservices identification using API similarity graph,” Expert Syst., e12158, 2022, doi: 10.1111/exsy.13158.
T. Cerny, A. S. Abdelfattah, V. Bushong, A. Al Maruf and D. Taibi, “Microservice Architecture Reconstruction and Visualization Techniques: A Review,” in 2022 IEEE Int. Conf. on Serv. Oriented Syst. Eng. (SOSE), 2022, pp. 39-48, doi: 10.1109/SOSE55356.2022.00011.
F. Ponce, J. Soldani, H. Astudillo, and A. Brogi, “Should Microservice Security Smells Stay or be Refactored? Towards a Trade-off Analysis,” in Softw. Archit. 16th Eur. Conf., Czech Republic, 2022, pp. 19-23, doi: 10.1007/978-3-031-16697-6_9.
[ Mohamed El kholy and Abdel baes Mohamed, “Efficient Security Model for RDF Files Used in IoT Applications” International Journal of Advanced Computer Science and Applications(IJACSA), 12(4), 2021. http://dx.doi.org/10.14569/IJACSA.2021.0120431
[T. Yarygina and A. H. Bagge, “Overcoming Security Challenges in Microservice Architectures,” in 2022 IEEE Int. Conf. on Serv. Oriented Syst. Eng. (SOSE), Germany, 2018, pp. 11-20, doi: 10.1109/SOSE.2018.00011.
M. Elkholy, Y. Baghdadi, and M. Marzouk, “Snowball Framework for Web Service Composition in SOA Applications,” Int. J. Adv. Comput. Sci. Appl., vol. 13, no. 1, 2022, doi: 10.14569/IJACSA.2022.0130143.
B. K. Mohanta, D. Jena, U. Satapathy, and S. Patnaik, “Survey on IoT security: Challenges and solution using machine learning, artificial intelligence and blockchain technology,” Internet of Things, vol. 11, 100227, 2020, doi: 10.1016/j.iot.2020.100227.
A. Pereira-Vale, G. Márquez, H. Astudillo and E. B. Fernandez, "Security Mechanisms Used in Microservices-Based Systems: A Systematic Mapping," in 2019 XLV Latin Am. Comput. Conf. (CLEI), 2019, pp. 01-10, doi: 10.1109/CLEI47609.2019.235060.
A. Botta, W. de Donato, V. Persico, and A. Pescapé, “Integration of Cloud computing and Internet of Things: A survey,” Future Gener. Comput. Syst., vol. 56, pp. 684-700, 2016, doi: 10.1016/j.future.2015.09.021.
J. Soldani, D. A. Tamburri, and W.-J. Van Den Heuvel, “The pains and gains of microservices: A Systematic grey literature review,” J. Syst. Softw., vol. 146, pp. 215-232, 2018, doi: 10.1016/j.jss.2018.09.082.
M. -O. Pahl and F. -X. Aubet, “All Eyes on You: Distributed Multi-Dimensional IoT Microservice Anomaly Detection,” in 2018 14th Int. Conf. Netw. Serv. Manag. (CNSM), Italy, 2018, pp. 72-80.
M. -O. Pahl, F. -X. Aubet, and S. Liebald, "Graph-based IoT microservice security," in NOMS 2018 - 2018 IEEE/IFIP Netw. Oper. Manag. Symp., Taiwan, 2018, pp. 1-3, doi: 10.1109/NOMS.2018.8406118.
S. Haselböck, R. Weinreich and G. Buchgeher, “An Expert Interview Study on Areas of Microservice Design,” in 2018 IEEE 11th Conf. Serv. -Oriented Comput. Appl. (SOCA), 2018, pp. 137-144, doi: 10.1109/SOCA.2018.00028.
X. Zhou, et al. “Revisiting the practices and pains of microservice architecture in reality: An industrial inquiry,” J. Syst. Softw., vol. 195, 111521, 2023, doi: 10.1016/j.jss.2022.111521.
A. K. Chitturi and P. Swarnalatha, “Exploration of Various Cloud Security Challenges and Threats,” in Soft Comput. Probl. Solving, K. N. Das, J. C. Bansal, K. Deep, A. K. Nagar, P. Pathipooranam, and R. C. Naidu, Eds., in Advances in Intelligent Systems and Computing, vol. 1057, 2019, doi: 10.1007/978-981-15-0184-5_76.
N. Mateus-Coelho, M. Cruz-Cunha, and L. G. Ferreira, “Security in Microservices Architectures,” Procedia Comput. Sci., vol. 181, pp. 1225-1236, 2021, doi: 10.1016/j.procs.2021.01.320.
Article details
This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.
You must read and accept the copyright terms and conditions(click here for copyright terms).