保护微服务与微服务架构：一项系统性映射研究
Securing Microservices and Microservice Architectures: A Systematic Mapping Study
AI总结：
本文通过系统性映射研究，对微服务架构的安全威胁及防护方案进行分类，并设计了可查询的轻量级安全模式本体，揭示了当前研究偏重外部攻击防御与软基础设施层等不平衡现象。
摘要：
微服务架构（MSA）正成为现有软件开发范式的流行替代方案，特别是在开发复杂和分布式应用方面。微服务作为一种架构设计模式出现，旨在解决可扩展性并简化在线服务的维护。然而，安全漏洞不断增加，威胁着基于微服务系统的可用性、完整性和机密性。越来越多的文献开始探讨针对单个微服务和微服务架构的安全威胁与安全机制。本研究的目的是为开发者提供一份有用的指南，介绍已识别的微服务威胁以及如何检测、缓解或预防这些威胁；我们还旨在识别保护MSA方面的潜在研究空白。在本文中，我们进行了系统性映射，以对MSA的威胁及其安全提案进行分类。因此，我们提取了选定研究中报告的威胁和拟议解决方案的细节。获得的结果用于设计MSA安全模式的轻量级本体。可以查询该本体以识别威胁来源、用于预防每种威胁的安全机制、适用性层以及每种机制使用的验证技术。系统性搜索共获得1067项研究，其中46项被选为初步研究。映射结果显示，研究重点不平衡，偏向于外部攻击；与预防和缓解相比，审计和强制访问控制是研究最多的技术。此外，我们发现与通信和部署等其他层相比，大多数拟议的解决方案属于软基础设施适用层。我们还发现，性能分析和案例研究是安全提案最常用的验证技术。
英文摘要：
Microservice architectures (MSA) are becoming trending alternatives to existing software development paradigms notably for developing complex and distributed applications. Microservices emerged as an architectural design pattern aiming to address the scalability and ease the maintenance of online services. However, security breaches have increased threatening availability, integrity and confidentiality of microservice-based systems. A growing body of literature is found addressing security threats and security mechanisms to individual microservices and microservice architectures. The aim of this study is to provide a helpful guide to developers about already recognized threats on microservices and how they can be detected, mitigated or prevented; we also aim to identify potential research gaps on securing MSA. In this paper, we conduct a systematic mapping in order to categorize threats on MSA with their security proposals. Therefore, we extracted threats and details of proposed solutions reported in selected studies. Obtained results are used to design a lightweight ontology for security patterns of MSA. The ontology can be queried to identify source of threats, security mechanisms used to prevent each threat, applicability layer and validation techniques used for each mechanism. The systematic search yielded 1067 studies of which 46 are selected as primary studies. The results of the mapping revealed an unbalanced research focus in favor of external attacks; auditing and enforcing access control are the most investigated techniques compared with prevention and mitigation. Additionally, we found that most proposed solutions are soft-infrastructure applicable layer compared with other layers such as communication and deployment. We also found that performance analysis and case studies are the most used validation techniques of security proposals.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
