ThunQ: A Distributed and Deep Authorization Middleware for Early and Lazy Policy Enforcement in Microservice Applications

Abstract

Online software services are often designed as multi-tenant, API-based, microservice architectures. However, sharing service instances and storing sensitive data in a shared data store causes significant security risks. Application-level access control plays a key role in mitigating this risk by preventing unauthorized access to the application and data. Moreover, a microservice architecture introduces new challenges for access control on online services, as both the application logic and data are highly distributed. First, unauthorized requests should be denied as soon as possible, preferably at the facade API. Second, sensitive data should stay in the context of its microservice during policy evaluation. Third, the set of policies enforced on a single application request should be consistent for the entire distributed control flow. To solve these challenges, we present ThunQ, a distributed authorization middleware that enforces authorization policies both early at the facade API, as well as lazily by postponing authorization decisions to the appropriate data context. To achieve this, ThunQ leverages two techniques called partial evaluation and query rewriting, which support policy enforcement both at the facade API, as well as deep in the data tier.We implemented and open-sourced ThunQ as a set of reusable components for the Spring Cloud and Data ecosystem. Experimental results in an application case study show that ThunQ can efficiently enforce authorization policies in microservice applications, with acceptable increases in latency as the number of tenants and access rules grow.

User Authorization in Microservice-Based Applications

“…Compared to the previous work on authorization in microservice-based applications, which maintain a primarily technical focus on performing authorization, we provide a systematic approach to create authorization artifacts [14,15]. This approach can support developers in reducing the reported complexity of ABAC [28] while gaining a uniform understanding of what to authorize.…”

“…In the case of the policy presented in lines 7 through 12, an HTTP header containing the subject's identifier is returned. This is called partial evaluation and allows the actual microservice to perform the filtering and return the correct fleet objects (see [15]). Another option is to tell the microservice which objects to return by filtering with Rego within the OPA.…”

“…Each microservice has an IAM module that communicates with the authorization orchestrator and enforces decisions. Sauwens et al [15] describe a distributed authorization middleware called ThunQ that can perform authorization decisions early (i.e., when the first service is reached) and lazily (i.e., evaluating decisions only when possible). ThunQ allows authorization decisions to be made at the microservice level by including a query modifier.…”

“…Authorization for microservice-based applications has been primarily researched as a technical aspect of evaluating and enforcing authorization decisions in the microservice architecture [14,15]. The loose coupling of microservices offers a separation of concerns between business logic and authorization logic.…”

Secured Scalable Blockchain Networks for Trustworthy Distributed Deep Learning in VANETs

“…BC technology is used to support auditing the distributed training procedures in federated learning to improve the reliability of the entire training process, together with Exchange-FedAvg proposed to improve the training efficiency. ABAC and PBAC to authorize access from subjects to objects in micro-service system, and their design supports policies selectivity according to attribute counts and thus ensures dynamic controls [99]. Generally, access control designs based on the prevalent models gain much attention in applying ZTA, and mostly focuses on reliability and the extension of features in making control decision.…”