On automated RBAC assessment by constructing a centralized perspective for microservice mesh

Dipta Das; Andrew Walker; Vincent Bushong; Jan Svacina; Tomas Cerny; Vashek Matyas

doi:10.7717/peerj-cs.376

On automated RBAC assessment by constructing a centralized perspective for microservice mesh

PeerJ Comput Sci. 2021 Feb 1:7:e376. doi: 10.7717/peerj-cs.376. eCollection 2021.

Authors

Dipta Das¹, Andrew Walker¹, Vincent Bushong¹, Jan Svacina¹, Tomas Cerny¹, Vashek Matyas²

Affiliations

¹ Department of Computer Science, Baylor University, Waco, TX, USA.
² Faculty of Informatics, Masaryk University, Brno, Czech Republic.

Abstract

It is important in software development to enforce proper restrictions on protected services and resources. Typically software services can be accessed through REST API endpoints where restrictions can be applied using the Role-Based Access Control (RBAC) model. However, RBAC policies can be inconsistent across services, and they require proper assessment. Currently, developers use penetration testing, which is a costly and cumbersome process for a large number of APIs. In addition, modern applications are split into individual microservices and lack a unified view in order to carry out automated RBAC assessment. Often, the process of constructing a centralized perspective of an application is done using Systematic Architecture Reconstruction (SAR). This article presents a novel approach to automated SAR to construct a centralized perspective for a microservice mesh based on their REST communication pattern. We utilize the generated views from SAR to propose an automated way to find RBAC inconsistencies.

Keywords: Access control; Authorization; Microservices; RBAC; REST; Security; Static code analysis; Systematic architecture reconstruction.

Grants and funding

This material is based upon work supported by the National Science Foundation under Grant No. 1854049 and a grant from Red Hat Research. The funders had no role in study design, data collection and analysis, decision to publish, or preparation of the manuscript.