Security Design Patterns in Distributed Microservice Architecture

Abstract: Micro service architecture has revolutionized the landscape for the development of web and mobile applications alike. Due to the stateless nature and loose coupling involved in the design of micro services, native mobile applications can be developed by utilizing the same backend services which feed the inputs to the web application front ends. Extending the same concept, a plethora of automated devices, thanks to the advancements in the field of IOT, have come into existence which can feed on the same set of micro services. This concept of build once and utilize for many use cases has become a new norm in the enterprise design patterns. To handle the horizontal scalability needs of so many calling clients, significant advancements have been made on the containerization and their orchestration strategies on the public cloud platforms. However, scalable design techniques have led to the increased exposure of backend services to unwanted entities. This broadened the attack surface and also the risk. On top of it the mix of heterogeneous technologies in MSA, their distinct logging strategies, makes the central logging difficult, which in turn loosens the security. Additionally, the complexity around building the resilience for fault tolerance across the decentralized networks, adds to the security loop holes. The simple security designs which were once used with traditional web applications cannot be used for Microservice based applications. This paper articulates the innovative approaches of handling the security needs involved in protection of distributed services in Microservice architecture.