On automated RBAC assessment by constructing a centralized perspective for microservice mesh

Area of Science:

• Computer Science
• Software Engineering
• Cybersecurity

Background:

• Enforcing access control on protected services and resources is crucial in software development.
• Role-Based Access Control (RBAC) is commonly applied to REST API endpoints, but policies can be inconsistent across services.
• Manual assessment via penetration testing is costly and impractical for numerous APIs, especially in microservice architectures lacking a unified view.

Purpose of the Study:

• To present a novel approach for automated Systematic Architecture Reconstruction (SAR) tailored for microservice architectures.
• To construct a centralized perspective of a microservice mesh by analyzing REST communication patterns.
• To leverage the generated views from SAR for automated detection of RBAC inconsistencies.

Main Methods:

• Developed an automated SAR technique to analyze REST communication patterns within a microservice mesh.
• Generated centralized views representing the application's architecture from the communication patterns.
• Utilized these generated views to implement an automated RBAC inconsistency detection mechanism.

Main Results:

• Successfully demonstrated an automated method for SAR in microservice environments.
• The automated SAR process effectively constructs a unified architectural perspective.
• The proposed approach enables automated identification of RBAC policy discrepancies across services.

Conclusions:

• Automated SAR provides an efficient solution for understanding complex microservice architectures.
• This method facilitates the automated assessment and correction of RBAC inconsistencies.
• The approach enhances the security and maintainability of microservice-based applications.