Alboqmi Rami, Gamble Rose F
Department of Computer Science, Tandy School of Computer Science, University of Tulsa, Tulsa, OK 74104, USA.
Sensors (Basel). 2025 Feb 3;25(3):914. doi: 10.3390/s25030914.
Cloud-native computing enhances the deployment of microservice architecture (MSA) applications by improving scalability and resilience, particularly in Beyond 5G (B5G) environments such as Sixth-Generation (6G) networks. This is achieved through the ability to replace traditional hardware dependencies with software-defined solutions. While service meshes enable secure communication for deployed MSAs, they struggle to identify vulnerabilities inherent to microservices. The reliance on third-party libraries and modules, essential for MSAs, introduces significant supply chain security risks. Implementing a zero-trust approach for MSAs requires robust mechanisms to continuously verify and monitor the software supply chain of deployed microservices. However, existing service mesh solutions lack runtime trust evaluation capabilities for continuous vulnerability assessment of third-party libraries and modules. This paper introduces a mechanism for continuous runtime trust evaluation of microservices, integrating vulnerability assessments within a service mesh to enhance the deployed MSA application. The proposed approach dynamically assigns trust scores to deployed microservices, rewarding secure practices such as timely vulnerability patching. It also enables the sharing of assessment results, enhancing mitigation strategies across the deployed MSA application. The mechanism is evaluated using the Train Ticket MSA, a complex open-source benchmark MSA application deployed with Docker containers, orchestrated using Kubernetes, and integrated with the Istio service mesh. Results demonstrate that the enhanced service mesh effectively supports dynamic trust evaluation based on the vulnerability posture of deployed microservices, significantly improving MSA security and paving the way for future self-adaptive solutions.
云原生计算通过提高可扩展性和弹性来增强微服务架构（MSA）应用程序的部署，特别是在诸如第六代（6G）网络等超5G（B5G）环境中。这是通过用软件定义的解决方案取代传统硬件依赖的能力来实现的。虽然服务网格为已部署的MSA实现了安全通信，但它们难以识别微服务固有的漏洞。对MSA至关重要的第三方库和模块的依赖带来了重大的供应链安全风险。为MSA实施零信任方法需要强大的机制来持续验证和监控已部署微服务的软件供应链。然而，现有的服务网格解决方案缺乏对第三方库和模块进行持续漏洞评估的运行时信任评估能力。本文介绍了一种微服务持续运行时信任评估机制，将漏洞评估集成到服务网格中以增强已部署的MSA应用程序。所提出的方法为已部署的微服务动态分配信任分数，奖励诸如及时打补丁等安全做法。它还能够共享评估结果，增强整个已部署的MSA应用程序的缓解策略。使用火车票MSA对该机制进行了评估，火车票MSA是一个复杂的开源基准MSA应用程序，通过Docker容器部署，使用Kubernetes编排，并与Istio服务网格集成。结果表明，增强后的服务网格有效地支持基于已部署微服务的漏洞态势进行动态信任评估，显著提高了MSA的安全性，并为未来的自适应解决方案铺平了道路。
