An Encryption-as-a-service Architecture on Cloud Native Platform

Bo Yang,Fan Zhang,Samee U. Khan
DOI: https://doi.org/10.1109/ICCCN52240.2021.9522248
2021-01-01
Abstract:The Kubernetes is currently one of the most popular and powerful open-source cloud-native container orchestration platforms. Security at the container level of a Kubernetes cluster is known to be lacking. In this paper, we study an encryption-as-a-service architecture for Kubernetes pods, which provides a unified, flexible and universal method for encrypting the data flow internally and externally between containers. We inject an HAProxy container on the fly to the application pod to perform the encryption. We use Elasticsearch-based microservices as a case study to implement our architecture. In the experiments, we tested the overhead and performance degradation with this framework using various experimental settings. The results show that our proposed solution achieves communication encryption at the cost of only 7% of the write performance degradation. The query/read performance hardly drops.
What problem does this paper attempt to address?