Access Control with Delegated Authorization Policy Evaluation for Data-Driven Microservice Workflows

Abstract

Microservices offer a compelling competitive advantage for building data flow systems as a choreography of self-contained data endpoints that each implement a specific data processing functionality. Such a 'single responsibility principle' design makes them well suited for constructing scalable and flexible data integration and real-time data flow applications. In this paper, we investigate microservice based data processing workflows from a security point of view, i.e., (1) how to constrain data processing workflows with respect to dynamic authorization policies granting or denying access to certain microservice results depending on the flow of the data; (2) how to let multiple microservices contribute to a collective data-driven authorization decision and (3) how to put adequate measures in place such that the data within each individual microservice is protected against illegitimate access from unauthorized users or other microservices. Due to this multifold objective, enforcing access control on the data endpoints to prevent information leakage or preserve one's privacy becomes far more challenging, as authorization policies can have dependencies and decision outcomes cross-cutting data in multiple microservices. To address this challenge, we present and evaluate a workflow-oriented authorization framework that enforces authorization policies in a decentralized manner and where the delegated policy evaluation leverages feature toggles that are managed at runtime by software circuit breakers to secure the distributed data processing workflows. The benefit of our solution is that, on the one hand, authorization policies restrict access to the data endpoints of the microservices, and on the other hand, microservices can safely rely on other data endpoints to collectively evaluate cross-cutting access control decisions without having to rely on a shared storage backend holding all the necessary information for the policy evaluation.

Towards a Security Stress-Test for Cloud Configurations

“…Access control and network security policies for cloud deployment are well studied by providing either access control solutions [6], [7], [8], [9] or by supporting the automated policy generation from given specifications [10], [6], [11]. Recent works also provide mechanisms for formal verification of microservice deployments [12], or continuous assessment methodologies [13].…”

Towards trustworthy Cyber-physical Production Systems: A dynamic agent accountability approach

“…Liu et al [24] raised similar security concerns particularly for collaborative manufacturing systems, and argued that configuring and enforcing an access control model in a collaborative manufacturing system is a challenging task. This concern was addressed in [34,35] with a framework that enables policy-based access control to maintain trust relationships that cross the boundaries of collaborating organizations, while lifting the burden to manually align diverse sets of authorization policies of different organizations.…”

Προσαρμοστική Διαχείριση Ασφάλειας Βάσει Πολιτικών

“…Recent research and industry activities focus on the M2M dynamic authorisations with policy-based capabilities in pursuit of a systematic empirical research to address an extensible scheme approach to support the secure message-exchange, the dynamic authorisations for μServices and the access control requirements. Preuveneers et al [221] demonstrate the enforcement of the authorisation policies based on the Universal Scalability Law to their throughput measurements. The efficiency curve demonstrates the latency overhead of delegating the policy to another one along with the performance trade-offs of policy delegation.…”