Automated Cloud-Native Dynamic Network Policy Generation Based on Microservices Topology
摘要
Microservice architecture is gradually replacing traditional monolithic applications, but its modular design introduces new security challenges in service interactions. To ensure the security of the entire microservices system, it is crucial to implement strict network policies that prevent a compromised service from maliciously exploiting or affecting other properly functioning microservices. However, the dynamic and large-scale nature of microservices makes traditional manual policy configuration impractical. This paper presents a network policy generation method based on service topology. Our approach comprises two fundamental techniques: (1) a real-time service topology generation method that leverages configuration files and network plugins to dynamically capture service interactions, and (2) an automatic network policy generation method based on the derived service topology. The effectiveness of the proposed method is validated through experiments on three popular microservice applications. The results demonstrate that our method can generate fine-grained and efficient network policies, reducing the time overhead by an average of 38% while maintaining high security standards and a minor performance overhead.