Citation:

Rajesh Balaji, 2024. "Threat-Model-Driven Zero-Trust Authorization for Microservice APIs in Kubernetes-Based Cloud-Native Applications ", ESP Journal of Engineering & Technology Advancements  4(4): 223-234.

Abstract:

Authorization failures in micro service APIs often arise from ordinary requests whose identity, object, or service context is not checked consistently. We investigate whether a structured threat model can be converted into executable authorization tests, rather than remaining a design document. The study uses AegisCommerce, a modeled seven-service retail API, and combines STRIDE and the OWASP API Security Top 10 to identify misuse cases. We then map those cases to Open Policy Agent (OPA) rules and configuration checks, comparing a baseline policy with a threat-informed alternative. The experiment evaluates actual OPA decisions over a fixed request universe; it does not deploy the complete microservice application on Kubernetes. Of 820 enumerated requests, 540 were over-permitted by the baseline and 28 by the hardened policy, a 94.8% reduction. All 73 intended requests remained permitted in the modeled test set. Automated checks passed for 19 of 22 catalogued threats, versus five at baseline. None of the specified attacker starting states reached the five modeled goals after hardening, although 28 residual permissions remain when an escalated role claim is supplied. Separately measured OPA and ES256 component costs were composed into illustrative added-overhead estimates of 0.58–2.32 ms for an order read and 1.37–4.86 ms for checkout; these are not end-to-end application measurements. The results demonstrate a repeatable way to test authorization against an explicit threat model while exposing the limits of role-claim trust and model coverage.

References:

[1] S. Rose, O. Borchert, S. Mitchell, and S. Connelly, "Zero Trust Architecture," NIST Special Publication 800-207, Aug. 2020.

[2] R. Chandramouli, "Security Strategies for Microservices-based Application Systems," NIST Special Publication 800-204, Aug. 2019.

[3] R. Chandramouli and Z. Butcher, "A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Location Environments," NIST Special Publication 800-207A, Sep. 2023.

[4] R. Chandramouli, Z. Butcher, and A. Chetal, "Attribute-based Access Control for Microservices-based Applications Using a Service Mesh," NIST Special Publication 800-204B, Aug. 2021.

[5] A. Shostack, Threat Modeling: Designing for Security. Indianapolis, IN, USA: Wiley, 2014.

[6] OWASP Foundation, "OWASP API Security Top 10 – 2023," owasp.org.

[7] D. Hardt, Ed., "The OAuth 2.0 Authorization Framework," RFC 6749, IETF, Oct. 2012.

[8] M. Jones, J. Bradley, and N. Sakimura, "JSON Web Token (JWT)," RFC 7519, IETF, May 2015.

[9] SPIFFE Project, "SPIFFE and SPIRE," spiffe.io.

[10] Open Policy Agent Project, openpolicyagent.org.

[11] R. Pang et al., "Zanzibar: Google's Consistent, Global Authorization System," in Proc. USENIX Annual Technical Conference (ATC), 2019.

[12] M. Jones, A. Nadalin, B. Campbell, J. Bradley, and C. Mortimore, "OAuth 2.0 Token Exchange," RFC 8693, IETF, Jan. 2020.

[13] B. Campbell, J. Bradley, N. Sakimura, and T. Lodderstedt, "OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens," RFC 8705, IETF, Feb. 2020.

[14] D. Fett, B. Campbell, J. Bradley, T. Lodderstedt, M. Jones, and D. Waite, "OAuth 2.0 Demonstrating Proof of Possession (DPoP)," RFC 9449, IETF, Sep. 2023.

[15] V. C. Hu et al., "Guide to Attribute Based Access Control (ABAC) Definition and Considerations," NIST Special Publication 800-162, Jan. 2014.

[16] OpenAPI Initiative, "OpenAPI Specification v3.1.0," 2021.

[17] OWASP Foundation, "Application Security Verification Standard 4.0.3," 2021.

[18] Regulation (EU) 2016/679 (General Data Protection Regulation), Articles 5 and 25.

[19] National Institute of Standards and Technology, "NIST Privacy Framework," version 1.0, Jan. 2020.

[20] Istio Authors, "Authorization Policy," istio.io documentation.

[21] Envoy Project Authors, "External Authorization," envoyproxy.io documentation.

[22] OWASP Foundation, "Server-Side Request Forgery Prevention Cheat Sheet," cheatsheetseries.owasp.org.

[23] N. Novaes Neto, S. Madnick, A. M. G. de Paula, and N. M. Borges, "A Case Study of the Capital One Data Breach," Cybersecurity at MIT Sloan, Working Paper, 2020.

[24] T. Yarygina and A. H. Bagge, "Overcoming Security Challenges in Microservice Architectures," in Proc. IEEE Symposium on Service-Oriented System Engineering (SOSE), 2018.

[25] O. Sheyner, J. Haines, S. Jha, R. Lippmann, and J. M. Wing, "Automated Generation and Analysis of Attack Graphs," in Proc. IEEE Symposium on Security and Privacy, 2002.

[26] A. Pereira-Vale, E. B. Fernandez, R. Monge, H. Astudillo, and G. Márquez, "Security in Microservice-Based Systems: A Multivocal Literature Review," Computers & Security, vol. 103, 2021.

Keywords:

API Security, Microservices, Zero Trust, Authorization, OWASP API Top 10, STRIDE, Open Policy Agent, Oauth Token Exchange, BOLA, Kubernetes