Security Considerations for Microservice Architectures

Security is an important and difficult topic in today’s complex computer systems. Cloud-based systems adopting microservice architectures complicate that analysis by introducing additional layers. In the test system analyzed, base layers are combined into three groups (compute provider, encapsulation technology, and deployment) and possible security risks introduced by technologies used in these layers are analyzed. The application layer focuses on security concerns that concern authorization and authentication. The analysis is based on a microservice-based rewritten version of the seat reservation system of the Deutsche Bahn using technologies such as Amazon Web Services, Docker, and Kubernetes. The comparison concludes that the security of communication in the test system could be significantly improved with little effort. If security is not considered as an integral part from the beginning of a project, it can easily be neglected and be expensive