Towards Automated Inter-Service Authorization for Microservice Applications.

Xing Li,Yan Chen,Zhiqiang Lin

DOI: https://doi.org/10.1145/3342280.3342288

2019-01-01

Abstract: An abstract is not available.

What problem does this paper attempt to address?

An Authorization Architecture Oriented to Engineering and Scientific Computation in Grid Environments

Changqin Huang,Guanghua Song,Yao Zheng,Deren Chen

DOI: https://doi.org/10.1007/978-3-540-30102-8_39

2004-01-01

Abstract:Large-scale scientific and engineering computation is normally accomplished through the interaction of collaborating groups and diverse heterogeneous resources. Grid computing is emerging as an applicable paradigm, whilst, there is a critical challenge of authorization in the grid infrastructure. This paper proposes a Parallelized Subtask-level Authorization Service architecture (PSAS) based on the least privilege principle, and presents a context-aware authorization approach and a flexible task management mechanism. The minimization of the privileges is conducted by decomposing the parallelizable task and re-allotting the privileges required for each subtask. The dynamic authorization is carried out by constructing a multi-value community policy and adaptively transiting the mapping. Besides applying a relevant management policy, a delegation mechanism collaboratively performs the authorization delegation for task management. In the enforcement mechanisms involved, the authors have extended the RSL specification and the proxy certificate, and have modified the Globus gatekeeper, jobmanager and the GASS library to allow authorization callouts. Therefore the authorization requirement of an application is effectively met in the presented architecture.
Authentication and Authorization in Microservices Architecture: A Systematic Literature Review

Murilo Góes de Almeida,Edna Dias Canedo

DOI: https://doi.org/10.3390/app12063023

2022-03-16

Applied Sciences

Abstract:The microservice architectural style splits an application into small services, which are implemented independently, with their own deployment unit. This architecture can bring benefits, nevertheless, it also poses challenges, especially about security aspects. In this case, there are several microservices within a single system, it represents an increase in the exposure of the safety surface, unlike the monolithic style, there are several applications running independently and must be secured individually. In this architecture, microservices communicate with each other, sometimes in a trust relationship. In this way, unauthorized access to a specific microservice could compromise an entire system. Therefore, it brings a need to explore knowledge about issues of security in microservices, especially in aspects of authentication and authorization. In this work, a Systematic Literature Review is carried out to answer questions on this subject, involving aspects of the challenges, mechanisms and technologies that deal with authentication and authorization in microservices. It was found that there are few studies dealing with the subject, especially in practical order, however, there is a consensus that communication between microservices, mainly due to its individual and trustworthy characteristics, is a concern to be considered. To face the problems, mechanisms such as OAuth 2.0, OpenID Connect, API Gateway and JWT are used. Finally, it was found that there are few open-source technologies that implement the researched mechanisms, with some mentions of the Spring Framework.
A research on multi-layer structure for dynamic service integration an innovative model based on SOA

Zhuoren Jiang,Yan Chen,Ming Yang

DOI: https://doi.org/10.1109/ICIME.2010.5477923

2010-01-01

Abstract:Recently, SOA plays a more and more important role in software research and software development. On the basis of the research findings on SOA, this paper presents an innovative model for applying SOA: Multi-layer Structure For Dynamic Service Integration (MSFDSI). The paper expatiates on the organization of MSFDSI, on the basis of typical organization of SOA, MSFDSI adds a authorized institution and a service integration & analysis adapter to achieve the service authorization, service analysis and dynamic service integration. The paper also presents the hierarchy of MSFDSI, analyzes its service, proposes innovative concepts of coordination service and procedural service which traditional SOA models never contain, gives the Meta-model for service contracts and describes the main process of MSFDSI. Moreover, this paper gives a real case study of applying this model in a project of "Maritime and shipping integrated system of Yunnan Province". The case study shows that MSFDSI separates the business logic and the specific implementation technology, achieves the dynamic service integration successfully, improves the performance of system and provides a new and effective solution for applying SOA.
Automatic Policy Generation for Inter-Service Access Control of Microservices

Xing Li,Yan Chen,Zhiqiang Lin,Xiao Wang,Jim Hao Chen

2021-01-01

Abstract:Cloud applications today are often composed of many microservices. To prevent a microservice from being abused by other (compromised) microservices, inter-service access control is applied. However, the complexity of fine-grained access control policies, along with the large-scale and dynamic nature of microservices, makes the current manual configurationbased access control unsuitable. This paper presents AUTOARMOR, the first attempt to automate inter-service access control policy generation for microservices, with two fundamental techniques: (1) a static analysis-based request extraction mechanism that automatically obtains the invocation logic among microservices, and (2) a graph-based policy management mechanism that generates corresponding access control policies with on-demand policy update. Our evaluation on popular microservice applications shows that AUTOARMOR is able to generate fine-grained inter-service access control policies and update them timely based on changes in the application, with only a minor runtime overhead. By seamlessly integrating with the lifecycle of microservices, it does not require any changes to existing code and infrastructures.
An Authorization Model without Central Authority for Service Collaboration

Ran Yang,Chuang Lin,Yixin Jiang,Xiaowen Chu

DOI: https://doi.org/10.1109/GLOCOM.2011.6134072

2011-01-01

Abstract:In the service-oriented computing, a single transaction initiated by a client might invoke many different services in other administrative domains. Existing models for authorizing the access assume that all services involved in collaboration are managed by the central authority, which is not always a realistic premise. In this paper, we propose a novel authorization model for dynamic service collaboration. With the authorization discovery process, the client can discover the needed authorization for service access available in other autonomous domains. With extensions to SoD relationship, the conflicts of client interests can be formalized and expressed as constraints. The authorization problems are formalized to choose the optimal access path for each task. At last, the example and experiments show the practicality and the effectiveness of our scheme.
Automated Security Analysis for Microservice Architecture.

Nacha Chondamrongkul,Jing Sun,Ian Warren

DOI: https://doi.org/10.1109/icsa-c50368.2020.00024

2020-01-01

Abstract:Designing a software system that applied the microservice architecture style is a challenging task, as its characteristics are vulnerable to various security attacks. Software architect, therefore, needs to pinpoint the security flaws in the design before the implementation can proceed. This task is error-prone as it requires manual analysis on the design model, to identify security threats and trace possible attack scenarios. This paper presents an automated security analysis approach for microservice architecture. Our approach can automatically identify security threats according to a collection of formally defined security characteristics and provide an insightful result that demonstrates how the attack scenarios may happen. A collection of formally defined security characteristics can be extended to support other security characteristics not addressed in this paper.
Multi-Level Authorization Mechanism for Web Services Based Business System

CHEN Yong,ZHAO Xi-bin,GU Ming

DOI: https://doi.org/10.3969/j.issn.1001-3695.2006.07.071

2006-01-01

Abstract:There are some problems to difine and realize the complex authorization in a large-scale E-commerce applications.This paper analyzes the requirement of authorization service for Web Services based business systems and proposes the multi-level authorization mechanism as a basic mechanism for implementing the authorization service,which is based on the theory of threshold closure.Then the paper designs and realizes a service-oriented authorization server using this mechanism.
WEB SERVICE BASED AUTHORIZATION ACCESS CONTROL METHOD

Feng Xiang,Gan Ling,Ni Kai,Zhang Chao

DOI: https://doi.org/10.3969/j.issn.1000-386X.2007.10.022

2007-01-01

Abstract:Authorization access control is an essential and important module in MIS.Traditional authorization control needs to be improved on coupling and reusability.A Web service based authorization access control method is designed.By abstracting the basic functions in the field of authorization access control,and setting the authorization intonation into a five-tuple table in database,the functions of authorizatin access control are separated.The authorization access control method is made to run as Web Service,and thus the model is of low coupling,high reusability,and can be easily used in different applications running on isomerism environment.
AOMO - An AI-aided Optimizer for Microservices Orchestration.

Xue Leng,Tzung-Han Juang,Yan Chen,Han Liu

DOI: https://doi.org/10.1145/3342280.3342287

2019-01-01

Abstract: An abstract is not available.
Minimal privacy authorization in web services collaboration

Linyuan Liu,Haibin Zhu,Zhiqiu Huang,Dongqing Xie

DOI: https://doi.org/10.1016/j.csi.2010.09.001

2011-03-01

Abstract:With the popularity of Internet technology, web services are becoming the most promising paradigm for distributed computing. This increased use of web services has meant that more and more personal information of consumers is being shared with web service providers, leading to the need to guarantee that the private data of consumers are not illegitimate collected, used and disclosed in services collaboration. This paper studies how to realize the minimal privacy authorization while achieving the functional goals. Initially, this paper uses authorization policies to specify the privacy privileges of the services collaboration, and utilizes the trust relationships among services to make authorization decision. Next, it models the interface behaviors of services by extending the interface automata to support privacy semantics. Furthermore, it quantitatively analyzes the minimum set of privacy privileges which are required by the services to achieve the functional goals, and presents the minimal authorization algorithm, which helps us to automatically derive optimal authorization policies for a services collaboration. Finally, it verifies the correctness and efficiency of the approach proposed by this paper through a case study.

computer science, software engineering, hardware & architecture
A Service-Oriented Trust Management Model on Application Server

Minghui Zhou,Haiyan Zhao,Hong Mei

DOI: https://doi.org/10.1109/ICWS.2006.14

2006-01-01

Abstract:In the service-oriented architecture, the components deployed on application servers are published as Web services. Though many researches focus on how to authorize at the Web service level currently, there is little work involving the authorization gap between the service and its component implementation. This paper tries to bridge the gap by proposing a service-oriented trust management model, which expands the application server's capability to deal with more complex trust relationship between service users and services, and supplies a flexible trust management mechanism to integrate authentication and authorization together. Moreover, the model provides a finer granularity access control, sustains delegation between users, and has a certain extent reasoning capability. The model has been implemented in a J2EE application server, and the experiment has demonstrated that the model has high flexibility and scalability
Enterprise unified authentication and authorization system based on Web services

HU He,ZHANG Qin,CHEN Guo-qing,YANG Yang

DOI: https://doi.org/10.3724/SP.J.1087.2011.00577

2011-01-01

Journal of Computer Applications

Abstract:In order to achieve the goal of unified scheduling and unified management in application system,unified authentication and authorization has become more and more important and sophisticated.The background and the goal of unified authentication and unified authorization system were analyzed firstly,then the unified authentication,authorization and Web services were analyzed and compared,and a unified method of authentication and authorization in enterprise combining the Web services was proposed;therefore,it was more convenient to administer the concrete application system for administrator,which truly reconstructed completely unified authentication and authorization,and the design and implementation of the concrete service specification(or interface) by the practical project were given.
Information and Communication Security Mechanisms For Microservices-based Systems

Lenin Leines-Vite,Juan Carlos Pérez-Arriaga,Xavier Limón

DOI: https://doi.org/10.5121/ijnsa.2021.13607

2021-11-30

Abstract:Security has become paramount in modern software services as more and more security breaches emerge, impacting final users and organizations alike. Trends like the Microservice Architecture bring new security challenges related to communication, system design, development, and operation. The literature presents a plethora of security-related solutions for microservices-based systems, but the spread of information difficult practitioners' adoption of novel security related solutions. In this study, we aim to present a catalogue and discussion of security solutions based on algorithms, protocols, standards, or implementations; supporting principles or characteristics of information security, considering the three possible states of data, according to the McCumber Cube. Our research follows a Systematic Literature Review, synthesizing the results with a meta-aggregation process. We identified a total of 30 primary studies, yielding 75 security solutions for the communication of microservices.

English Else
Authentication and authorization in microservice-based systems: survey of architecture patterns

Alexander Barabanov,Denis Makrushin

DOI: https://doi.org/10.48550/arXiv.2009.02114

2020-09-04

Abstract:Context. Service-oriented architecture and its microservice-based approach increase an attack surface of applications. Exposed microservices become a pivot point for advanced persistent threats and completely change the threat landscape. Correctly implemented authentication and authorization architecture patterns are basis of any software maturity program. Objective. The aim of this study is to provide a helpful resource to application security architect and developers on existing architecture patterns to implement authentication and authorization in microservices-based systems. Method. In this paper, we conduct a review of major electronic databases and libraries as well as security standards and presentations at the major security conferences. Results. In this work based on research papers and major security conferences presentations analysis we identified industry best practices in authentication and authorization patterns and its applicability depending on environment characteristic. For each described patterns we reviewed its advantages and disadvantages that could be used as decision-making criteria for application security architects during architecture design phase.

Cryptography and Security
Representation and Discovery of Intelligent E-Services

Xia Wang,Bernd J. Krämer,Yi Zhao,Wolfgang A. Halang

DOI: https://doi.org/10.1007/978-3-540-37017-8_10

2007-01-01

Abstract:Without Abstract
An Authentication and Authorization Solution Supporting SOA-based Distributed Systems

Peng Qi-rui,Wang Cheng,Wu Jing,Li Jun

DOI: https://doi.org/10.1109/icsess.2010.5552305

2010-01-01

Abstract:To integrate distributed information systems in group companies, people favor the Service-Oriented-Architecture (SOA) for its features such as loose-coupling and standardization. But SOA brings security problems. Consequently, an authentication and authorization solution is proposed in this paper. By designing security architecture based on Service-Access-Agent, this solution can simplify the security program, and bring good to the system flexibility and loose coupling, thereby meet the integrated system's requirements for dynamics and agility. This solution has been applied to a project of “national 863 plan”, and shown its validity in engineering practices.
An Automated Web Services Composition System Based on Service Classification and AI Planning.

Shanfeng Qi,Xinhuai Tang,Delai Chen

DOI: https://doi.org/10.1109/cgc.2012.74

2012-01-01

Abstract:With the increasing number of web services available on the internet, the need for automated web services composition is becoming more and more important. A number of approaches have been proposed to tackle this problem. In this paper, we firstly summarize existing web service composition approaches, and then we present a service classification management mechanism to organize web services more efficiently and accurately. Finally, we design an automated web services composition system, which consists of two main parts: service management subsystem and service provision subsystem. The service management part is based on the service classification management mechanism, and service provision part is to meet the need of users' request by AI Planning.
Ascend: A Framework For Automatic Service Composition And Execution In Dynamic Environment

Shuiguang Deng,Zhaohui Wu,Ying Li

DOI: https://doi.org/10.1109/ICSMC.2004.1400877

2004-01-01

Abstract:Web service is becoming more and more popular on the Internet. Composing existing services into large functional units will bring added values for organizations. Due to the dynamic characteristic of the Internet, building a framework for service composition and execution must provide a mechanism to design and execute service composition in a very flexible and efficient way. To build such a framework, some basic issues related to services must be put into consideration. These issues include service description, service registration, service discovery, service matching and so on. To resolve those problems in an automatic or semiautomatic way, semantic knowledge is the key. ASCEND is a framework to provide a resolution for service composition and execution automatically and dynamically. In ASCEND, we combine ontology with service registration so that the automatic service discovery and service matching can be realized based on ontology inference.
Research on Multi-level Authorization Mechanism for Virtual Organization in Grid Computing System

ZHAO Xi-Bin,GUO Zhi,YONG Jian-Ping,GU Ming

2005-01-01

Computer Science

Abstract:It is a challenging work to implement authorization service for Virtual Organization in Grid Computing Sys- tem because of the dynamic and distributed nature of Virtual Organication. After analyzing the requirement of autho- rization service and the existing mechanisms for implementing authorization services in Grid Computing Systems, the paper proposes an efficient multi-level architecture named MLA for implementing authorization in Grid Computing Systems. With the use of threshold closure mechanism, the proposed architecture has the scalability and the strong power to express authorization policy, hence can provide flexible and efficient approach to implement authorization service in GCS.
Design and Realization for More Flexible Authentication Authorization System

Jiang Lifeng,Zhao Baohua

DOI: https://doi.org/10.3321/j.issn:1002-8331.2006.18.071

2006-01-01

Abstract:In the face of more and more problems of security of application information system,this paper analyses the disadvantage and shortage of traditional authentication authorization system.It promotes the whole structure of authentication authorization system based on the Java Authentication Authorization Service framework and model of Role-Based Access Control and its realization process are given.Some relative key techniques including the design of authentication module and authorization module are emphasized.

Towards Automated Inter-Service Authorization for Microservice Applications.

An Authorization Architecture Oriented to Engineering and Scientific Computation in Grid Environments

Authentication and Authorization in Microservices Architecture: A Systematic Literature Review

A research on multi-layer structure for dynamic service integration an innovative model based on SOA

Automatic Policy Generation for Inter-Service Access Control of Microservices

An Authorization Model without Central Authority for Service Collaboration

Automated Security Analysis for Microservice Architecture.

Multi-Level Authorization Mechanism for Web Services Based Business System

WEB SERVICE BASED AUTHORIZATION ACCESS CONTROL METHOD

AOMO - An AI-aided Optimizer for Microservices Orchestration.

Minimal privacy authorization in web services collaboration

A Service-Oriented Trust Management Model on Application Server

Enterprise unified authentication and authorization system based on Web services

Information and Communication Security Mechanisms For Microservices-based Systems

Authentication and authorization in microservice-based systems: survey of architecture patterns

Representation and Discovery of Intelligent E-Services

An Authentication and Authorization Solution Supporting SOA-based Distributed Systems

An Automated Web Services Composition System Based on Service Classification and AI Planning.

Ascend: A Framework For Automatic Service Composition And Execution In Dynamic Environment

Research on Multi-level Authorization Mechanism for Virtual Organization in Grid Computing System

Design and Realization for More Flexible Authentication Authorization System