Enhancing Microservice Security Through Vulnerability-Driven Trust in the Service Mesh Architecture

Area of Science:

• Cloud-native computing
• Microservice architecture (MSA)
• Network security
• Software supply chain security

Background:

• Microservice architecture (MSA) applications are increasingly deployed in cloud-native environments, benefiting from scalability and resilience, especially in Beyond 5G (B5G) and Sixth-Generation (6G) networks.
• Service meshes facilitate secure communication for MSAs but lack capabilities to identify inherent microservice vulnerabilities and assess the security of third-party libraries, posing significant supply chain risks.
• A zero-trust approach is crucial for MSA security, necessitating continuous verification of the software supply chain, yet current service meshes lack runtime trust evaluation for third-party components.

Purpose of the Study:

• To introduce a mechanism for continuous runtime trust evaluation of microservices within a service mesh.
• To enhance the security of deployed MSA applications by integrating vulnerability assessments.
• To dynamically assign trust scores to microservices based on their security posture and vulnerability management.

Main Methods:

• Development of a mechanism for continuous runtime trust evaluation of microservices.
• Integration of vulnerability assessment capabilities into a service mesh.
• Dynamic assignment of trust scores to microservices, rewarding secure practices like timely patching.
• Enabling the sharing of assessment results for improved mitigation strategies.
• Evaluation using the Train Ticket MSA benchmark application deployed with Docker and Kubernetes, integrated with the Istio service mesh.

Main Results:

• The enhanced service mesh effectively supports dynamic trust evaluation for microservices.
• The system dynamically assesses the vulnerability posture of deployed microservices.
• The approach significantly improves the overall security of the deployed MSA application.
• Results demonstrate enhanced mitigation strategies through shared assessment data.

Conclusions:

• The proposed mechanism enhances MSA security by providing continuous runtime trust evaluation.
• This approach addresses the limitations of existing service meshes in assessing third-party library vulnerabilities.
• The dynamic trust scoring and result sharing pave the way for future self-adaptive and more secure MSA solutions.