Abstract
IoT application providers increasingly use MicroService Architecture (MSA) to develop applications that convert IoT data into valuable information. The independently deployable and scalable nature of microservices enables dynamic utilization of edge and cloud resources provided by various service providers, thus improving performance. However, IoT data security should be ensured during multi-domain data processing and transmission among distributed and dynamically composed microservices. The ability to implement granular security controls at the microservices level has the potential to solve this. To this end, edge-cloud environments require intricate and scalable security frameworks that operate across multi-domain environments to enforce various security policies during the management of microservices (i.e., initial placement, scaling, migration, and dynamic composition), considering the sensitivity of the IoT data. To address the lack of such a framework, we propose an architectural framework that uses Policy-as-Code to ensure secure microservice management within multi-domain edge-cloud environments. The proposed framework contains a “control plane” to intelligently and dynamically utilise and configure cloud-native (i.e., container orchestrators and service mesh) technologies to enforce security policies. We implement a prototype of the proposed framework using open-source cloud-native technologies such as Docker, Kubernetes, Istio, and Open Policy Agent to validate the framework. Evaluations verify our proposed framework’s ability to enforce security policies for distributed microservices management, thus harvesting the MSA characteristics to ensure IoT application security needs.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
Data Availability Statement
As this project is funded by an industry partner, we are unable to publish the source code at this stage. To increase reproducibility, we extended an open-source framework along with open-source tools and explained the implementation of our framework in detail. High quality images of all figures used in the manuscript are available at https://doi.org/10.5281/zenodo.12524961.
Notes
- 1.
- 2.
- 3.
- 4.
- 5.
- 6.
- 7.
- 8.
- 9.
- 10.
- 11.
References
Al-Doghman, F., Moustafa, N., Khalil, I., Tari, Z., Zomaya, A.: AI-enabled secure microservices in edge computing: opportunities and challenges. IEEE Trans. Serv. Comput. 16, 1485–1504 (2022)
Atieh, A.T.: The next generation cloud technologies: a review on distributed cloud, fog and edge computing and their opportunities and challenges. ResearchBerg Rev. Sci. Technol. 1(1), 1–15 (2021)
Chandramouli, R.: Implementation of DevSecOps for a microservices-based application with service mesh. NIST Spec. Publ. 800, 204C (2022)
Deng, Q., Goudarzi, M., Buyya, R.: FogBus2: a lightweight and distributed container-based framework for integration of IoT-enabled systems with edge and cloud computing. In: Proceedings of the International Workshop on Big Data in Emergent Distributed Environments, pp. 1–8 (2021)
Ermolenko, D., Kilicheva, C., Muthanna, A., Khakimov, A.: Internet of things services orchestration framework based on kubernetes and edge computing. In: Proceedings of the 2021 IEEE Conference of Russian Young Researchers in Electrical and Electronic Engineering (ElConRus), pp. 12–17. IEEE (2021)
Farzin, P., Azizi, S., Shojafar, M., Rana, O., Singhal, M.: FLEX: a platform for scalable service placement in multi-fog and multi-cloud environments. In: Proceedings of the 2022 Australasian Computer Science Week, pp. 106–114 (2022)
Faticanti, F., De Pellegrini, F., Siracusa, D., Santoro, D., Cretti, S.: Throughput-aware partitioning and placement of applications in fog computing. IEEE Trans. Netw. Serv. Manage. 17(4), 2436–2450 (2020)
Faticanti, F., Savi, M., De Pellegrini, F., Siracusa, D.: Locality-aware deployment of application microservices for multi-domain fog computing. Comput. Commun. 203, 180–191 (2023)
https://fogatlas.fbk.eu/. Accessed January 2024
GitLab: What are the benefits of a microservices architecture? (2022). https://about.gitlab.com/blog/2022/09/29/what-are-the-benefits-of-a-microservices-architecture/
Guerrero, C., Lera, I., Juiz, C.: Evaluation and efficiency comparison of evolutionary algorithms for service placement optimization in fog architectures. Futur. Gener. Comput. Syst. 97, 131–144 (2019)
Haumer, P., Pohl, K., Weidenhaupt, K.: Requirements elicitation and validation with real world scenes. IEEE Trans. Softw. Eng. 24(12), 1036–1054 (1998)
IDC: Future of industry ecosystems: Shared data and insights (2021). https://blogs.idc.com/2021/01/06/future-of-industry-ecosystems-shared-data-and-insights/
Mahmud, R., Toosi, A.N.: Con-Pi: a distributed container-based edge and fog computing framework. IEEE Internet Things J. 9(6), 4125–4138 (2021)
Marchese, A., Tomarchio, O.: Sophos: a framework for application orchestration in the cloud-to-edge continuum. In: Proceedings of the 13th International Conference on Cloud Computing and Services Science, CLOSER 2023, pp. 261–268 (2023)
Miller, L., Mérindol, P., Gallais, A., Pelsser, C.: Towards secure and leak-free workflows using microservice isolation. In: 2021 IEEE 22nd International Conference on High Performance Switching and Routing (HPSR), pp. 1–5. IEEE (2021)
Pahl, C., El Ioini, N., Helmer, S., Lee, B.: An architecture pattern for trusted orchestration in IoT edge clouds. In: 2018 Third International Conference on Fog and Mobile Edge Computing (FMEC), pp. 63–70. IEEE (2018)
Pallewatta, S., Kostakos, V., Buyya, R.: Placement of microservices-based IoT applications in fog computing: a taxonomy and future directions. ACM Comput. Surv. 55, 1–43 (2023)
Pallewatta, S., Kostakos, V., Buyya, R.: MicroFog: a framework for scalable placement of microservices-based IoT applications in federated fog environments. J. Syst. Softw. 209, 111910 (2024)
Santoro, D., Zozin, D., Pizzolli, D., De Pellegrini, F., Cretti, S.: Foggy: a platform for workload orchestration in a fog computing environment. In: Proceedings of the 2017 IEEE International Conference on Cloud Computing Technology and Science (CloudCom), pp. 231–234. IEEE (2017)
Tuli, S., Mahmud, R., Tuli, S., Buyya, R.: FogBus: a blockchain-based lightweight framework for edge and fog computing. J. Syst. Softw. 154, 22–36 (2019)
Varadharajan, V., Bansal, S.: Data security and privacy in the internet of things (IoT) environment. In: Mahmood, Z. (ed.) Connectivity Frameworks for Smart Devices. CCN, pp. 261–281. Springer, Cham (2016). https://doi.org/10.1007/978-3-319-33124-9_11
Wang, Z., Goudarzi, M., Aryal, J., Buyya, R.: Container orchestration in edge and fog computing environments for real-time IoT applications. In: Buyya, R., Hernandez, S.M., Kovvur, R.M.R., Sarma, T.H. (eds.) Computational Intelligence and Data Analytics. LNDECT, vol. 142, pp. 1–21. Springer, Singapore (2022). https://doi.org/10.1007/978-981-19-3391-2_1
Xiong, J., et al.: Enhancing privacy and availability for data clustering in intelligent electrical service of IoT. IEEE Internet Things J. 6(2), 1530–1540 (2018)
Yousefpour, A., et al.: FOGPLAN: a lightweight QoS-aware dynamic fog service provisioning framework. IEEE Internet Things J. 6(3), 5080–5096 (2019)
Acknowledgments
This work has been supported by the Cyber Security Cooperative Research Centre Limited whose activities are partially funded by the Australian Government’s Cooperative Research Centre Program.
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2024 The Author(s), under exclusive license to Springer Nature Switzerland AG
About this paper
Cite this paper
Pallewatta, S., Babar, M.A. (2024). Towards Secure Management of Edge-Cloud IoT Microservices Using Policy as Code. In: Galster, M., Scandurra, P., Mikkonen, T., Oliveira Antonino, P., Nakagawa, E.Y., Navarro, E. (eds) Software Architecture. ECSA 2024. Lecture Notes in Computer Science, vol 14889. Springer, Cham. https://doi.org/10.1007/978-3-031-70797-1_18
Download citation
DOI: https://doi.org/10.1007/978-3-031-70797-1_18
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-031-70796-4
Online ISBN: 978-3-031-70797-1
eBook Packages: Computer ScienceComputer Science (R0)