April 03, 2019

eZTrust: Network-Independent Zero-Trust Perimeterization for Microservices

  • Chang H.
  • Mukherjee S.
  • Van Der Merwe J.
  • Zaheer Z.

Emerging microservices-based workloads introduce new security risks in today's data centers as attacks can propagate laterally within the data center relatively easily by exploiting cross-service dependencies. As countermeasures for such attacks, traditional perimeterization approaches, such as network-endpoint-based access control, do not fare well in highly dynamic microservices environments (especially considering the management complexity, scalability and policy granularity of these earlier approaches). In this paper, we propose eZTrust, a network-independent perimeterization approach for microservices. eZTrust allows data center tenants to express access control policies based on fine-grained workload identities, and enables data center operators to enforce such policies reliably and efficiently in a purely network-independent fashion. To this end, we leverage eBPF, the extended Berkeley Packet Filter framework, to trace authentic workload identities and apply per-packet tagging and verification. We demonstrate the feasibility of our approach through extensive evaluation of our proofof- concept prototype implementation. We find that, when comparable policies are enforced, eZTrust incurs 3-6 times lower packet lantency and 1.5-2.5 times lower CPU overhead than traditional perimeterization schemes.

View Original Article

Recent Publications

August 01, 2019

Protecting photonic quantum states using topology

  • Blanco-Redondo A.

The use of topology to protect quantum information is well-known to the condensed-matter community and, indeed, topological quantum computing is a bursting field of research and one of the competing avenues to demonstrate that quantum computers can complete certain problems that classical computers cannot. In photonics, however, we are only ...

May 01, 2019

Digital networks at the nexus of productivity growth

  • Kamat S.
  • Prakash S.
  • Saniee I.
  • Weldon M.

This paper takes a fresh look at the debate over the relationship between digital technology and productivity. The argument of economic historian Robert J. Gordon is that digital technology will not lead to increases in productivity such as we saw in the last century, based on his analysis of the ...

January 01, 2019

Friendly, appealing or both? Characterising user experience in sponsored search landing pages

  • Bron M.
  • Chute M.
  • Evans H.
  • Lalmas M.
  • Redi M.
  • Silvestri F.

© 2017 International World Wide Web Conference Committee (IW3C2), published under Creative Commons CC BY 4.0 License. Many of today's websites have recognised the importance of mobile friendly pages to keep users engaged and to provide a satisfying user experience. However, next to the experience provided by the sites themselves, ...