Zero Trust API Security Architecture for Microservices-Based Enterprise Applications
DOI:
https://doi.org/10.15680/IJCTECE.2024.0704020Keywords:
Zero Trust Security, API Security, Microservices, Continuous Authentication, Least-Privilege Access, Identity-Aware Authorization, Cloud SecurityAbstract
The loss of trust relations to change as the service to service communication and credential abuse, lateral movement, and the shift in the trust relationship, exposes enterprise applications based on microservices to security risks. Security models built around perimeters do not suffice to protect distributed APIs because in most instances, they will implicitly believe that there is trust once a request has been issued out of an authenticated environment. This research paper proposes the Zero Trust API Security Architecture (ZTASA) of microservice-based enterprise applications, which enforces the policies of constant verification, least-privilege authorization, identity-related access control, API gateway enforcement, service-to-service authentication and runtime threat monitoring. The identity control proposed is centralized with fine-grained policy enforcement to authenticate every API request on the basis of identity, service context, device or workload, requested resource, and behavioral characteristics. It is a policy layer that is dynamically computed, and continuously verifies access decisions and sessions across heterogeneous microservices. Anomaly detection via telemetry also is included in the model, and is performed to identify suspicious API behavior and lateral motion. Factors of determining the suggested architecture are security, the performance of authorization, detection-anomaly, and the performance of policy enforcement. This implies better blocking on illegitimate requests, previous chances to proceed laterally and practical enforcement of minimum privilege access, and fair processing overhead of APIs. The architecture offers a viable security base to support enterprise micro services that run on hybrid and cloud native platform.
References
[1] Lu, Z., Delaney, D. T., & Lillis, D. (2023). A survey on microservices trust models for open systems. IEEE Access, 11, 28840–28855. https://doi.org/10.1109/ACCESS.2023.3260147
[2] Hannousse, A., & Yahiouche, S. (2021). Securing microservices and microservice architectures: A systematic mapping study. Computer Science Review, 41, 100415. https://doi.org/10.1016/j.cosrev.2021.100415
[3] Ponce, F., Soldani, J., Astudillo, H., & Brogi, A. (2022). Smells and refactorings for microservices security: A multivocal literature review. Journal of Systems and Software, 192, 111393. https://doi.org/10.1016/j.jss.2022.111393
[4] Neri, D., Soldani, J., Zimmermann, O., & Brogi, A. (2020). Design principles, architectural smells and refactorings for microservices: A multivocal review. Software-Intensive Cyber-Physical Systems, 35(1–2), 3–15. https://doi.org/10.1007/s00450-019-00407-8
[5] Zimmermann, O. (2017). Microservices tenets. Computer Science – Research and Development, 32(3–4), 301–310.
[6] Truong, N. B., Lee, H., Askwith, B., & Lee, G. M. (2017). Toward a trust evaluation mechanism in the social Internet of Things. Sensors, 17(6), 1346. https://doi.org/10.3390/s17061346
[7] Pourghebleh, B., Wakil, K., & Navimipour, N. J. (2019). A comprehensive study on the trust management techniques in the Internet of Things. IEEE Internet of Things Journal, 6(6), 9326–9337.
[8] Laskey, K. B., & Laskey, K. (2009). Service oriented architecture. Wiley Interdisciplinary Reviews: Computational Statistics, 1(1), 101–105. https://doi.org/10.1002/wics.8
[9] Teerakanok, S., Uehara, T., & Inomata, A. (2021). Migrating to zero trust architecture: Reviews and challenges. Security and Communication Networks, 2021, 9947347. https://doi.org/10.1155/2021/9947347
[10] Palmer, G. (2005). De-perimeterisation: Benefits and limitations. Information Security Technical Report, 10(4), 189–203. https://doi.org/10.1016/j.istr.2005.09.001
[11] He, Y., Huang, D., Chen, L., Ni, Y., & Ma, X. (2022). A survey on zero trust architecture: Challenges and future trends. Wireless Communications and Mobile Computing, 2022, 6476274. https://doi.org/10.1155/2022/6476274
[12] Zheng, T., Zheng, X., Zhang, Y., Deng, Y., Dong, E., Zhang, R., & Liu, X. (2019). SmartVM: A SLA-aware microservice deployment framework. World Wide Web, 22, 275–293. https://doi.org/10.1007/s11280-018-0562-5
[13] Kochovski, P., Gec, S., Stankovski, V., Bajec, M., & Drobintsev, P. D. (2019). Trust management in a blockchain based fog computing platform with trustless smart oracles. Future Generation Computer Systems, 101, 747–759. https://doi.org/10.1016/j.future.2019.07.030
[14] Papadakis-Vlachopapadopoulos, K., González, R. S., Dimolitsas, I., Dechouniotis, D., Ferrer, A. J., & Papavassiliou, S. (2019). Collaborative SLA and reputation-based trust management in cloud federations. Future Generation Computer Systems, 100, 498–512. https://doi.org/10.1016/j.future.2019.05.030
[15] Liu, F., Wang, L., Gao, L., Li, H., Zhao, H., & Men, S. K. (2014). A web service trust evaluation model based on small-world networks. Knowledge-Based Systems, 57, 161–167. https://doi.org/10.1016/j.knosys.2013.12.015
[16] Mehdi, M., Bouguila, N., & Bentahar, J. (2016). Trust and reputation of web services through QoS correlation lens. IEEE Transactions on Services Computing, 9(6), 968–981. https://doi.org/10.1109/TSC.2015.2426185
[17] Aljazzaf, Z. M., Capretz, M. A. M., & Perry, M. (2016). Trust-based service-oriented architecture. Journal of King Saud University – Computer and Information Sciences, 28(4), 470–480. https://doi.org/10.1016/j.jksuci.2015.12.003
[18] Lu, L., & Yuan, Y. (2018). A novel TOPSIS evaluation scheme for cloud service trustworthiness combining objective and subjective aspects. Journal of Systems and Software, 143, 71–86. https://doi.org/10.1016/j.jss.2018.05.004
[19] Malik, Z., & Bouguettaya, A. (2009). RATEWeb: Reputation assessment for trust establishment among web services. The VLDB Journal, 18(4), 885–911.
[20] Tang, M., Dai, X., Liu, J., & Chen, J. (2017). Towards a trust evaluation middleware for cloud service selection. Future Generation Computer Systems, 74, 302–312. https://doi.org/10.1016/j.future.2016.01.009
[21] Adewuyi, A. A., Cheng, H., Shi, Q., Cao, J., Wang, X., & Zhou, B. (2022). SCTRUST: A dynamic model for trustworthy service composition in the Internet of Things. IEEE Internet of Things Journal, 9(5), 3298–3312
