Micro service architecture has revolutionized the landscape for the development of web and mobile applications alike. Due to the stateless nature and loose coupling involved in the design of micro services, native mobile applications can be developed by utilizing the same backend services which feed the inputs to the web application front ends. Extending the same concept, a plethora of automated devices, thanks to the advancements in the field of IOT, have come into existence which can feed on the same set of micro services. This concept of build once and utilize for many use cases has become a new norm in the enterprise design patterns. To handle the horizontal scalability needs of so many calling clients, significant advancements have been made on the containerization and their orchestration strategies on the public cloud platforms. However, scalable design techniques have led to the increased exposure of backend services to unwanted entities. This broadened the attack surface and also the risk. On top of it the mix of heterogeneous technologies in MSA, their distinct logging strategies, makes the central logging difficult, which in turn loosens the security. Additionally, the complexity around building the resilience for fault tolerance across the decentralized networks, adds to the security loop holes. The simple security designs which were once used with traditional web applications cannot be used for Microservice based applications. This paper articulates the innovative approaches of handling the security needs involved in protection of distributed services in Microservice architecture.
As cloud providers push multi-tenancy to new levels to meet growing scalability demands, ensuring that externally developed untrusted microservices will preserve tenant isolation has become a high priority. Developers, in turn, lack a means for expressing and automatically enforcing high-level application security requirements at deployment time. In this paper, we observe that orchestration systems are ideally situated between developers and the cloud provider to address these issues. We propose a security policy framework that enables security-oriented orchestration of microservices by captur…
Security has become paramount in modern software services as more and more security breaches emerge, impacting final users and organizations alike. Trends like the Microservice Architecture bring new security challenges related to communication, system design, development, and operation. The literature presents a plethora of security-related solutions for microservices-based systems, but the spread of information difficult practitioners' adoption of novel security related solutions. In this study, we aim to present a catalogue and discussion of security solutions based on algorithms, protocols…
Security issues in processor architectures remain really critical since users and devices continue to share computing as well as networking resources. So, preserving data privacy in such an environment is really a critical concern. We know that there is a continuous growth in security and privacy issues that need to be addressed. Here, we have chosen a microservice architecture, which is a small or even an independent microprocess that interacts, acts, and responds to messages via lightweight technologies such as Thrift, HTTP, or REST API.
Despite the numerous benefits of microservices systems, security has been a critical issue in such systems. Several factors explain this difficulty, including a knowledge gap among microservices practitioners on properly securing a microservices system. To (partially) bridge this gap, we conducted an empirical study. We first manually analyzed 861 microservices security points, including 567 issues, 9 documents, and 3 wiki pages from 10 GitHub open-source microservices systems and 306 Stack Overflow posts concerning security in microservices systems. In this study, a microservices security poi…
Objective. Service-oriented architecture increases technical abilities for attacker to move laterally and maintain multiple pivot points inside of compromised environment. Microservice-based infrastructure brings more challenges for security architect related to internal event visibility and monitoring. Properly implemented logging and audit approach is a baseline for security operations and incident management. The aim of this study is to provide helpful resource to application and product security architects, software and operation engineers on existing architecture patterns to implement tru…
Context. Service-oriented architecture and its microservice-based approach increase an attack surface of applications. Exposed microservices become a pivot point for advanced persistent threats and completely change the threat landscape. Correctly implemented authentication and authorization architecture patterns are basis of any software maturity program. Objective. The aim of this study is to provide a helpful resource to application security architect and developers on existing architecture patterns to implement authentication and authorization in microservices-based systems. Method. In thi…
Context: Securing microservice-based applications is crucial, as many IT companies are delivering their businesses through microservices. If security smells affect microservice-based applications, they can possibly suffer from security leaks and need to be refactored to mitigate the effects of security smells therein. Objective: As the currently available knowledge on securing microservices is scattered across different pieces of white and grey literature, our objective here is to distill well-known smells for securing microservices, together with the refactorings enabling to mitigate the effe…
Cloud-based application deployment is becoming increasingly popular among businesses, thanks to the emergence of microservices. However, securing such architectures is a challenging task since traditional security concepts cannot be directly applied to microservice architectures due to their distributed nature. The situation is exacerbated by the scattered nature of guidelines and best practices advocated by practitioners and organizations in this field. This research paper we aim to shay light over the current microservice security discussions hidden within Grey Literature (GL) sources. Parti…
In recent years, the Internet of Things (IoT) technology has led to the emergence of multiple smart applications in different vital sectors including healthcare, education, agriculture, energy management, etc. IoT aims to interconnect several intelligent devices over the Internet such as sensors, monitoring systems, and smart appliances to control, store, exchange, and analyze collected data. The main issue in IoT environments is that they can present potential vulnerabilities to be illegally accessed by malicious users, which threatens the safety and privacy of gathered data. To face this pro…
Advancement in artificial intelligence (AI) and machine learning (ML), dynamic data driven application systems (DDDAS), and hierarchical cloud-fog-edge computing paradigm provide opportunities for enhancing multi-domain systems performance. As one example that represents multi-domain scenario, a "fly-by-feel" system utilizes DDDAS framework to support autonomous operations and improve maneuverability, safety and fuel efficiency. The DDDAS "fly-by-feel" avionics system can enhance multi-domain coordination to support domain specific operations. However, conventional enabling technologies rely o…
Deployed microservices must adhere to a multitude of application-level security requirements and regulatory constraints imposed by mutually distrusting application principals--software developers, cloud providers, and even data owners. Although these principals wish to enforce their individual security requirements, they do not currently have a common way of easily identifying, expressing and automatically enforcing these requirements at deployment time. CDI (Code Deployment Integrity) is a security policy framework that enables distributed application principals to establish trust in deployed…
Connected societies require reliable measures to assure the safety, privacy, and security of members. Public safety technology has made fundamental improvements since the first generation of surveillance cameras were introduced, which aims to reduce the role of observer agents so that no abnormality goes unnoticed. While the edge computing paradigm promises solutions to address the shortcomings of cloud computing, e.g., the extra communication delay and network security issues, it also introduces new challenges. One of the main concerns is the limited computing power at the edge to meet the on…
Service meshes have emerged as an attractive DevOps solution for collecting, managing, and coordinating microservice deployments. However, current service meshes leave fundamental security mechanisms missing or incomplete. The security burden means service meshes may actually cause additional workload and overhead for administrators over traditional monolithic systems. By assessing the effectiveness and practicality of service mesh tools, this work provides necessary insights into the available security of service meshes. We evaluate service meshes from two perspectives: skilled system adminis…
While the smart surveillance system enhanced by the Internet of Things (IoT) technology becomes an essential part of Smart Cities, it also brings new concerns in security of the data. Compared to the traditional surveillance systems that is built following a monolithic architecture to carry out lower level operations, such as monitoring and recording, the modern surveillance systems are expected to support more scalable and decentralized solutions for advanced video stream analysis at the large volumes of distributed edge devices. In addition, the centralized architecture of the conventional s…
We present a case study on the strategic planning of a security operations center in a typical, modern, mid-size organization. Against the backdrop of the company's multi-cloud strategy a distributed approach envisioning the involvement of external providers is taken. From a security-centric abstraction of the organizational IT-landscape, a novel strategic planning method for security operation centers is developed with an adaptable relationship matrix as core tool. The method is put to a practical test in modeling different levels of engagement of external providers in the center's operation.…
The Internet-of-Things (IoT) is an emerging and cognitive technology which connects a massive number of smart physical devices with virtual objects operating in diverse platforms through the internet. IoT is increasingly being implemented in distributed settings, making footprints in almost every sector of our life. Unfortunately, for healthcare systems, the entities connected to the IoT networks are exposed to an unprecedented level of security threats. Relying on a huge volume of sensitive and personal data, IoT healthcare systems are facing unique challenges in protecting data security and …
An Intelligent Native Network Slicing Security Architecture Empowered by Federated Learning
Federal University of Viçosa (UFV)（维索萨联邦大学）；Federal University of Espírito Santo (UFES)（圣埃斯皮里图联邦大学）；Salvador University (UNIFACS)（萨尔瓦多大学）；Federal University of Ceará (UFC)（塞阿拉联邦大学）；University of São Paulo (USP)（圣保罗大学）；University of Minho (UMinho)（米尼奥大学）
A security policy specifies a security property as the maximal information flow. A distributed system composed of interacting processes implicitly defines an intransitive security policy by repudiating direct information flow between processes that do not exchange messages directly. We show that implicitly defined security policies in distributed systems are enforced, provided that processes run in separation, and possible process communication on a technical platform is restricted to specified message paths of the system. Furthermore, we propose to further restrict the allowable information f…
Motivated by developer productivity, serverless computing, and microservices have become the de facto development model in the cloud. Microservices decompose monolithic applications into separate functional units deployed individually. This deployment model, however, costs CSPs a large infrastructure tax of more than 25%. To overcome these limitations, CSPs shift workloads to Infrastructure Processing Units (IPUs) like Amazon's Nitro or, complementary, innovate by building on memory-safe languages and novel software abstractions. Based on these trends, we hypothesize a \arch providing a genera…
Sensor Networks technologies had proved their great practicability in the real world, being just a matter of time until this kind of networks will be standardized and used in the field. We focus on security issues in Distributed Sensor Networks like useful cryptosystems, attacks, preventing and detecting possible attacks, describing state of the art in domain and proposing new methods for further investigation
Deployment of distributed systems sets high requirements for procedures for the security testing of these systems. This work introduces: (1) a list of typical threats based on standards and actual practices; (2) an extended six-layered model for test generation mission on the basis of technical specifications and end-user requirements. Based on the list of typical threats and the multilayer model, we describe a formal approach to the automated design and generation of security mechanisms checklists for complex distributed systems.
We propose in this paper the Security Policy Language (SePL), which is a formal language for capturing and integrating distributed security policies. The syntax of SePL includes several operators for the integration of policies and it is endowed with a denotational semantics that is a generic semantics, i.e., which is independent of any evaluation environment. We prove the completeness of SePL with respect to sets theory. Furthermore, we provide a formalization of a subset of the eXtensible Access Control Markup Language (XACML), which is the well-known standard informal specification language…
We introduce a simple, practical approach with probabilistic information-theoretic security to mitigate one of quantum key distribution's major limitations: the short maximum transmission distance (~200 km) possible with present day technology. Our scheme uses classical secret sharing techniques to allow secure transmission over long distances through a network containing randomly-distributed compromised nodes. The protocol provides arbitrarily high confidence in the security of the protocol, with modest scaling of resource costs with improvement of the security parameter. Although some types …
Due to the increasing complexity of distributed systems, security testing is becoming increasingly critical in insuring reliability of such systems in relation to their security requirements. . To challenge this issue, we rely in this paper1 on model based active testing. In this paper we propose a framework to specify security policies and test their implementation. Our framework makes it possible to automatically generate test sequences, in order to validate the conformance of a security policy. This framework contains several new methods to ease the test case generation. To demonstrate the …
The paper examines quantitative assessment of wireless distribution system security, as well as an assessment of risks from attacks and security violations. Furthermore, it describes typical security breach and formal attack models and five methods for assessing security. The proposed normalized method for assessing the degree of security assurance operates with at least three characteristics, which allows comparatively analyze heterogeneous information systems. The improved calculating formulas have been proposed for two security assessment methods, and the elements of functional-cost analysi…
A Unitychain is a novel blockchain-like structure that drastically improves transaction scalability and security while maintaining ongoing network performance, even if participating nodes are required to perform a new Distributed Key Generation procedure for security purposes. The Unitychain structure, furthermore, enables greater parallel processing by the assignment of different network node configurations for various database and compute ranges into multiple strands of blockchains that intersect, creating a multi-helix structure, which we call a Unitychain. This thereby enables the network …
