Reliable Credential Rotation and Runtime Secret Convergence in Large-Scale Cloud-Native Systems
Main Article Content
Abstract
APIs, machine identities, certificates, and tokens, and other runtime secrets are increasingly becoming a part of the cloud-native system as they can assist distributed services, automated workflows and service-to-service communication. However, even now it remains difficult to realize credential rotation in large-scale systems as freshly issued credentials must be monolithic across heterogeneous workloads and stale and invalid credentials cannot be stored in service. The paper is a credential rotation and runtime secret convergence framework, a proven framework of cloud-native systems on a large scale. This proposed solution would consist of workload-aware policy-based rotation, a centralized lifecycle of credentials, secure distribution of secrets, and version tracking and run-time convergence validation. The framework constantly assesses the deploying workloads on the adoption of the latest version of credential and detects propagation failures, stale secrets, delays on synchronization, and disparities in the runtime state. An issuing and redistributing credential mechanism is convergent and hence promotes accuracy of issuance, distribution, activation, validation and retirement of credit, thus alleviating the operational risks of partial or incomplete rotation. He or she also offers the observability including conversion status, convergence goals, exception detection, and audit evidence through the framework. The proposed model provides a methodological framework to strengthen the freshness of credentials, parts of secrets reduction by stale secrets, and confidential continuity of services by dynamic cloud-native environments.
Article Details
Section
How to Cite
References
[1] Kim, B., & Lee, S. (2024). KubeAegis: A unified security policy management framework for containerized environments. IEEE Access, 12, 160636–160652. https://doi.org/10.1109/ACCESS.2024.3487990
[2] Theodoropoulos, T., Rosa, L., Benzaid, C., Gray, P., Marin, E., Makris, A., Cordeiro, L., Diego, F., Sorokin, P., Di Girolamo, M. D., Barone, P., Taleb, T., & Tserpes, K. (2023). Security in cloud-native services: A survey. Journal of Cybersecurity and Privacy, 3(4), 758–793. https://doi.org/10.3390/jcp3040034
[3] Xu, S., Zhou, Q., Huang, H., Jia, X., Du, H., Chen, Y., & Xie, Y. (2023). Log2Policy: An approach to generate fine-grained access control rules for microservices from scratch. In Proceedings of the 39th Annual Computer Security Applications Conference (pp. 229–240). Association for Computing Machinery. https://doi.org/10.1145/3627106.3627137
[4] Li, X., Chen, Y., Lin, Z., Wang, X., & Chen, J. H. (2021). Automatic policy generation for inter-service access control of microservices. In Proceedings of the 30th USENIX Security Symposium (pp. 3971–3988). USENIX Association.
[5] Wong, A. Y., Chekole, E. G., Ochoa, M., & Zhou, J. (2021). Threat modeling and security analysis of containers: A survey. arXiv. https://arxiv.org/abs/2111.11475
[6] Abgaz, Y., McCarren, A., Elger, P., Solan, D., Lapuz, N., Bivol, M., Jackson, G., Yilmaz, M., Buckley, J., & Clarke, P. (2023). Decomposition of monolith applications into microservices architectures: A systematic review. IEEE Transactions on Software Engineering, 49(8), 4213–4242. https://doi.org/10.1109/TSE.2023.3287297
[7] Li, Y., Hu, X., Jia, C., Wang, K., & Li, J. (2023). Kano: Efficient cloud native network policy verification. IEEE Transactions on Network and Service Management, 20(3), 3747–3764. https://doi.org/10.1109/TNSM.2022.3229675
[8] Kang, H., & Shin, S. (2022). Verikube: Automatic and efficient verification for container network policies. IEICE Transactions on Information and Systems, E105.D(12), 2131–2134.
[9] Ghavamnia, S., Palit, T., Benameur, A., & Polychronakis, M. (2020). Confine: Automated system call policy generation for container attack surface reduction. In Proceedings of the 23rd International Symposium on Research in Attacks, Intrusions and Defenses (pp. 443–458).
[10] Li, Y., Huang, C., Yuan, L., Ding, Y., & Cheng, H. (2020). ASPGen: An automatic security policy generating framework for AppArmor. In Proceedings of the IEEE International Conference on Parallel and Distributed Processing Applications, Big Data and Cloud Computing, Sustainable Computing and Communications, Social Computing and Networking (pp. 392–400). IEEE. https://doi.org/10.1109/ISPA-BDCloud-SocialCom-SustainCom51426.2020.00075
[11] Khan, S., Kabanov, I., Hua, Y., & Madnick, S. (2023). A systematic analysis of the Capital One data breach: Critical lessons learned. ACM Transactions on Privacy and Security, 26(1), 1–29. https://doi.org/10.1145/3546068
[12] Le, M. V., Ahmed, S., Williams, D., & Jamjoom, H. (2023). Securing container-based clouds with syscall-aware scheduling. In Proceedings of the ACM Asia Conference on Computer and Communications Security (pp. 812–826). Association for Computing Machinery. https://doi.org/10.1145/3579856.3582835
[13] Wang, Z., Zhu, S., Li, J., Jiang, W., Ramakrishnan, K. K., Zheng, Y., Yan, M., Zhang, X., & Liu, A. X. (2022). DeepScaling: Microservices autoscaling for stable CPU utilization in large scale cloud systems. In Proceedings of the 13th ACM Symposium on Cloud Computing (pp. 16–30). Association for Computing Machinery.
[14] Wang, X., He, H., Li, Y., Li, C., Hou, X., Wang, J., Chen, Q., Leng, J., Guo, M., & Wang, L. (2023). Not all resources are visible: Exploiting fragmented shadow resources in shared-state scheduler architecture. In Proceedings of the ACM Symposium on Cloud Computing (pp. 109–124). Association for Computing Machinery. https://doi.org/10.1145/3620678.3624650
[15] Lim, S. Y., Stelea, B., Han, X., & Pasquier, T. (2021). Secure namespaced kernel audit for containers. In Proceedings of the ACM Symposium on Cloud Computing (pp. 518–532). Association for Computing Machinery.