Practical Defense-in-depth Solution for Microservice Systems

Microservices are a widely deployed pattern for implementing large-scale distributed systems. However, in order to harden the overall system and when crossing datacenter boundaries, the authenticity and confidentiality of microservice calls have to be secured even for internal calls. In practice, however, in many cases no internal security mechanisms are employed mainly due to the increased complexity on backend side. This complexity arises as result of standard security mechanisms like TLS requiring secrets for each involved microservice. Building on previous work [19], in this paper we present a novel communication architecture based on roles that on the one hand guarantees a high level of security and on the other hand remains easy to manage. The approach provides encryption, forward secrecy and protection against replay attacks even for out-of-order communication.