SafePar monitors safe concurrent calls in cloud microservices
SafePar: Monitoring Asynchrony in Microservices
Programming LanguagesFormal Languages and Automata TheoryNetworking and Internet Architecture
Summary
Cloud applications often have parts that talk to each other through APIs, sometimes in order and sometimes all at once. When these calls happen in parallel, it can be hard to make sure they follow security or safety rules. The authors created SafePar, a tool that watches these calls to check the order and which ones run at the same time, without needing to change the app itself. It uses a new method to describe all the possible ways calls can happen together, and it works by monitoring the network traffic between services. SafePar can catch unsafe or disallowed patterns while adding only a small delay.
What this means in practice
- •For cloud security teams: Enforce complex security policies on concurrent API calls without access to internal service code.
- •For service mesh operators: Deploy SafePar monitoring to detect unsafe parallel API call patterns directly in the service mesh layer.
Authors
Karuna Grewal, P. Brighten Godfrey, Justin Hsu, Umang Mathur
Abstract
Modern cloud applications are built from loosely-coupled microservices that coordinate through well-defined APIs to service user requests. A single API request often triggers multiple downstream API calls, some executed sequentially and others spawned asynchronously in parallel. To certify safe and secure inter-service interactions in such applications, security and compliance teams must enforce policies not only over nested call/return structure, but also over the parallel structure of an execution: which calls may run concurrently, how many parallel branches can be spawned, and what combination of branch outcomes are allowed. However, existing runtime enforcement mechanisms typically model executions as sequential or purely nested traces, and cannot capture the parallel structure introduced by asynchronous API calls. Furthermore, since application implementations may not be accessible to security and compliance teams, the policy enforcement mechanism should be decoupled from the service implementation. We introduce SafePar, a specification and monitoring framework for policies over concurrent microservice executions. A SafePar policy constrains both the order of API calls and their series-parallel structure. To support seamless deployments, each policy is compiled into a series-parallel visibly pushdown automaton, a new model of computation we propose in this work, that drives a distributed runtime monitor implemented on top of the servicemesh layer. Our technique is blackbox and non-invasive: it requires no access or changes to the service implementation. Our experiments show that SafePar enforces rich concurrency-aware policies while incurring only millisecond-scale latency overhead.