Microservice architecture is gradually replacing traditional monolithic applications, but its modular design introduces new security challenges in service interactions. To ensure the security of the entire microservices system, it is crucial to implement strict network policies that prevent a compromised service from maliciously exploiting or affecting other properly functioning microservices. However, the dynamic and large-scale nature of microservices makes traditional manual policy configuration impractical. This paper presents a network policy generation method based on service topology. Our approach comprises two fundamental techniques: (1) a real-time service topology generation method that leverages configuration files and network plugins to dynamically capture service interactions, and (2) an automatic network policy generation method based on the derived service topology. The effectiveness of the proposed method is validated through experiments on three popular microservice applications. The results demonstrate that our method can generate fine-grained and efficient network policies, reducing the time overhead by an average of 38% while maintaining high security standards and a minor performance overhead.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Automated Cloud-Native Dynamic Network Policy Generation Based on Microservices Topology

  • Weiqiang Huang,
  • Junling You,
  • Tong Li,
  • Jingguo Ge,
  • He Kong,
  • Liangxiong Li

摘要

Microservice architecture is gradually replacing traditional monolithic applications, but its modular design introduces new security challenges in service interactions. To ensure the security of the entire microservices system, it is crucial to implement strict network policies that prevent a compromised service from maliciously exploiting or affecting other properly functioning microservices. However, the dynamic and large-scale nature of microservices makes traditional manual policy configuration impractical. This paper presents a network policy generation method based on service topology. Our approach comprises two fundamental techniques: (1) a real-time service topology generation method that leverages configuration files and network plugins to dynamically capture service interactions, and (2) an automatic network policy generation method based on the derived service topology. The effectiveness of the proposed method is validated through experiments on three popular microservice applications. The results demonstrate that our method can generate fine-grained and efficient network policies, reducing the time overhead by an average of 38% while maintaining high security standards and a minor performance overhead.