MisMesh: Security Issues and Challenges in Service Meshes
MisMesh: Security Issues and Challenges in Service Meshes
复制标题
DOI：
10.1007/978-3-030-63086-7_9
复制
发表时间：
2020
期刊：
影响因子：
--
通讯作者：
Dalton A. Hahn;Drew Davidson;Alexandru G. Bardas
中科院分区：
文献类型：
--
作者：
Dalton A. Hahn;Drew Davidson;Alexandru G. Bardas
服务网格已成为一种有吸引力的 DevOps 解决方案，用于收集、管理和协调微服务部署。然而，当前的服务网格缺少基本的安全机制或不完整。安全负担意味着服务网格实际上可能会比传统的整体系统给管理员带来额外的工作负载和开销。通过评估服务网格工具的有效性和实用性，这项工作为服务网格的可用安全性提供了必要的见解。我们在熟练的管理员（部署可用安全机制的最佳配置）和默认配置的指导下评估服务网格。我们考虑了一组全面的对抗场景，发现了与系统目标相矛盾的设计缺陷，并提出了在运营环境中使用服务网格工具时遇到的限制和挑战。
Service meshes have emerged as an attractive DevOps solution for collecting, managing, and coordinating microservice deployments. However, current service meshes leave fundamental security mechanisms missing or incomplete. The security burden means service meshes may actually cause additional workload and overhead for administrators over traditional monolithic systems. By assessing the effectiveness and practicality of service mesh tools, this work provides necessary insights into the available security of service meshes. We evaluate service meshes under skilled administrators (who deploy optimal configurations of available security mechanisms) and default configurations. We consider a comprehensive set of adversarial scenarios, uncover design flaws contradicting system goals, and present limitations and challenges encountered in employing service mesh tools for operational environments.