Authentication and Authorization in Microservice-Based Systems: Survey of Architecture Patterns

Abstract

Objective. Service-oriented architecture and its microservice-based approach increase an attack surface of applications. Exposed microservices become a pivot point for advanced persistent threats and completely change the threat landscape. Correctly implemented authentication and authorization architecture patterns are basis of any software maturity program. The aim of this study is to provide a helpful resource to application security architect and developers on existing architecture patterns to implement authentication and authorization in microservices-based systems. Method. In this paper, we conduct a systematic review of major electronic databases and libraries as well as security standards and presentations at the major security conferences. Results and practical relevance. In this work based on research papers and major security conferences presentations analysis, we identified industry best practices in authentication and authorization patterns and its applicability depending on environment characteristic. For each described patterns we reviewed its advantages and disadvantages that could be used as decision-making criteria for application security architects during architecture design phase.

Enhancing Microservices Security with Token-Based Access Control Method

“…Access control in microservices refers to the mechanisms used to regulate and manage the access and permissions at edge level, service level and context of identity of different services and users of the system’s resources [ 14 ]. In the model of an access control of distributed architecture of microservices, proposed by the authors in [ 15 ], the private API gateway is only available to the internal microservice, the so-called front-end of microservices.…”

Authentication and Authorization in Microservice-Based Systems: Survey of Architecture Patterns

“…NIST published standards 29,30 on microservice-based system security. NIST analyzed the multiple implementation options available for each individual core security feature (authentication and access management, service discovery, secure communication protocols, security monitoring, availability/resiliency improvement techniques, load balancing and throttling, integrity assurance techniques and handling of session persistence) and configuration options in architectural frameworks, and devel-oped security strategies that counter threats specific to microservice-based systems.…”

“…The challenges requires novel methods of monitoring and threat detection even based machine learning techniques [21,22] that take into account the specificity of microservice operations. 30 Аннотация Цель статьи. Использование сервис-ориентированной архитектуры и микросервисного подхода при проектировании программного обеспечения увеличивает поверхность атаки и вероятность успешной реализации угроз безопасности информации.…”