Stateless Microservice Security via QCON SP JWT, TomEE and - PowerPoint PPT Presentation

Stateless Microservice Security via QCON SP JWT, TomEE and MicroProfile Jean-Louis Monteiro Tomitribe #RESTSecurityWithMP-JWT @JLouisMonteiro @tomitribe

Why am I here today? QCON SP Microservices architecture case Security opEons OAuth2 with JWT HTTP Signatures Demo with MP-JWT and TomEE #RESTSecurityWithMP-JWT @JLouisMonteiro @tomitribe

Microservices QCON SP (SOA with a sexy name) #RESTSecurityWithMP-JWT @JLouisMonteiro @tomitribe

TradiEonal system Component A Component B QCON SP System (Monolithic) Component D Component C #RESTSecurityWithMP-JWT @JLouisMonteiro @tomitribe @dblevins @tomitribe

… with tradiEonal scalability QCON SP #RESTSecurityWithMP-JWT @JLouisMonteiro @tomitribe @dblevins @tomitribe

… and its tradiEonal security QCON SP #RESTSecurityWithMP-JWT @JLouisMonteiro @tomitribe @dblevins @tomitribe

What to expect from microservices? • The technical perspec/ve QCON SP • The organiza/onal perspec/ve #RESTSecurityWithMP-JWT @JLouisMonteiro @tomitribe @dblevins @tomitribe

Microservices - the technical perspecEve • Cloud QCON SP • Containers • Virtualiza/on • Large scale #RESTSecurityWithMP-JWT @JLouisMonteiro @tomitribe @dblevins @tomitribe

The organizaEonal perspecEve • Agile methodology QCON SP • Small teams • HR / organiza/onal changes free #RESTSecurityWithMP-JWT @JLouisMonteiro @tomitribe @dblevins @tomitribe

But there are new challenges • Scalability QCON SP • Cost reduc/on • Resilience • Monitoring • Security #RESTSecurityWithMP-JWT @JLouisMonteiro @tomitribe @dblevins @tomitribe

Baseline Architecture QCON SP 1000 users 4 hops x 3 TPS 3000 TPS 12000 TPS frontend backend #RESTSecurityWithMP-JWT @JLouisMonteiro @tomitribe @dblevins @tomitribe

Microservices security opEons QCON SP #RESTSecurityWithMP-JWT @JLouisMonteiro @tomitribe

OpEons • Basic Auth QCON SP • OAuth2 • OpenID Connect • JWT - Facebook / Google way • HTTP Signatures - Amazon way • « In-house » solu/ons • And many more … #RESTSecurityWithMP-JWT @JLouisMonteiro @tomitribe @dblevins @tomitribe

“The nice thing about standards is you have so many to choose from .” QCON SP - Andrew S. Tanenbaum #RESTSecurityWithMP-JWT @JLouisMonteiro @tomitribe

Basic Auth QCON SP (and its problems) #RESTSecurityWithMP-JWT @JLouisMonteiro @tomitribe

Basic Auth Message POST /painter/color/object HTTP/1.1 Host: localhost:8443 QCON SP Authorization: Basic c25vb3B5OnBhc3M= User-Agent: curl/7.43.0 Accept: */* Content-Type: application/json Content-Length: 45 {"color":{"b":255,"g":0,"name":"blue","r":0}} #RESTSecurityWithMP-JWT @JLouisMonteiro @tomitribe @dblevins @tomitribe

Basic Auth QCON SP username+password (no auth) Base64 Password Sent 3000 TPS 12000 TPS (HTTP+SSL) (HTTP) 3000 TPS (LDAP) #RESTSecurityWithMP-JWT @JLouisMonteiro @tomitribe

Basic Auth QCON SP username+password username+password Base64 Base64 Password Sent Password Sent 3000 TPS 12000 TPS (HTTP+SSL) (HTTP) 15000 TPS (LDAP) #RESTSecurityWithMP-JWT @JLouisMonteiro @tomitribe

Basic Auth - ATacks Valid QCON SP Password Sent 3000 TPS (HTTP+SSL) No auth Invalid 12000 TPS Password Sent 6000 TPS (HTTP) (HTTP+SSL) 9000 TPS (LDAP) #RESTSecurityWithMP-JWT @JLouisMonteiro @tomitribe

OAuth 2.0 QCON SP (and its problems) #RESTSecurityWithMP-JWT @JLouisMonteiro @tomitribe

The theory behind it QCON SP #RESTSecurityWithMP-JWT @JLouisMonteiro @tomitribe @dblevins @tomitribe

Based on tokens QCON SP #RESTSecurityWithMP-JWT @JLouisMonteiro @tomitribe @dblevins @tomitribe

OAuth 2 - Password Grant (LDAP) POST /oauth2/token Verify Host: api.superbiz.io User-Agent: curl/7.43.0 Password QCON SP Accept: */* Content-Type: application/x-www-form-urlencoded Content-Length: 54 grant_type=password&username=snoopy&password=woodstock HTTP/1.1 200 OK Content-Type: application/json;charset=UTF-8 Generate Cache-Control: no-store Token Pragma: no-cache { "access_token":"2YotnFZFEjr1zCsicMWpAA", "expires_in":3600, (Token Store) "refresh_token":"tGzv3JOkF0XG5Qx2TlKWIA", } #RESTSecurityWithMP-JWT @JLouisMonteiro @tomitribe @dblevins @tomitribe

OAuth 2.0 Message POST /painter/color/object HTTP/1.1 Host: api.superbiz.io QCON SP Authorization: Bearer 2YotnFZFEjr1zCsicMWpAA User-Agent: curl/7.43.0 Accept: */* Content-Type: application/json Content-Length: 45 {"color":{"r":0,"g":0,"b":255,"name":"blue"}} #RESTSecurityWithMP-JWT @JLouisMonteiro @tomitribe @dblevins @tomitribe

OAuth 2.0 Message POST /painter/color/palette HTTP/1.1 Host: api.superbiz.io QCON SP Authorization: Bearer 2YotnFZFEjr1zCsicMWpAA User-Agent: curl/7.43.0 Accept: */* Content-Type: application/json Content-Length: 45 {"color":{"r":0,"g":255,"b":0,"name":"green"}} #RESTSecurityWithMP-JWT @JLouisMonteiro @tomitribe @dblevins @tomitribe

OAuth 2.0 Message POST /painter/color/select HTTP/1.1 Host: api.superbiz.io QCON SP Authorization: Bearer 2YotnFZFEjr1zCsicMWpAA User-Agent: curl/7.43.0 Accept: */* Content-Type: application/json Content-Length: 44 {"color":{"r":255,"g":0,"b":0,"name":"red"}} #RESTSecurityWithMP-JWT @JLouisMonteiro @tomitribe @dblevins @tomitribe

OAuth 2.0 Message POST /painter/color/fill HTTP/1.1 Host: api.superbiz.io QCON SP Authorization: Bearer 2YotnFZFEjr1zCsicMWpAA User-Agent: curl/7.43.0 Accept: */* Content-Type: application/json Content-Length: 49 {"color":{"r":0,"g":255,"b":255,"name":"yellow"}} #RESTSecurityWithMP-JWT @JLouisMonteiro @tomitribe @dblevins @tomitribe

OAuth 2.0 Message POST /painter/color/stroke HTTP/1.1 Host: api.superbiz.io QCON SP Authorization: Bearer 2YotnFZFEjr1zCsicMWpAA User-Agent: curl/7.43.0 Accept: */* Content-Type: application/json Content-Length: 49 {"color":{"r":255,"g":200,"b":255,"name":"orange"}} #RESTSecurityWithMP-JWT @JLouisMonteiro @tomitribe @dblevins @tomitribe

QCON SP 401 #RESTSecurityWithMP-JWT @JLouisMonteiro @tomitribe @dblevins @tomitribe

OAuth 2 - Refresh Grant (LDAP) POST /oauth2/token Host: api.superbiz.io User-Agent: curl/7.43.0 QCON SP Accept: */* Content-Type: application/x-www-form-urlencoded Content-Length: 54 grant_type=refresh_token&refresh_token=tGzv3JOkF0XG5Qx2TlKWIA HTTP/1.1 200 OK Verify and Content-Type: application/json;charset=UTF-8 Cache-Control: no-store Generate Pragma: no-cache Token { "access_token":"6Fe4jd7TmdE5yW2q0y6W2w", "expires_in":3600, (Token Store) "refresh_token":"hyT5rw1QNh5Ttg2hdtR54e", } #RESTSecurityWithMP-JWT @JLouisMonteiro @tomitribe @dblevins @tomitribe

Old pair • Access Token 2YotnFZFEjr1zCsicMWpAA QCON SP • Refresh Token tGzv3JOkF0XG5Qx2TlKWIA New pair • Access Token 6Fe4jd7TmdE5yW2q0y6W2w • Refresh Token hyT5rw1QNh5Ttg2hdtR54e #RESTSecurityWithMP-JWT @JLouisMonteiro @tomitribe @dblevins @tomitribe

OAuth 2.0 Message POST /painter/color/palette HTTP/1.1 Host: api.superbiz.io QCON SP Authorization: Bearer 6Fe4jd7TmdE5yW2q0y6W2w User-Agent: curl/7.43.0 Accept: */* Content-Type: application/json Content-Length: 46 {"color":{"r":0,"g":255,"b":0,"name":"green"}} #RESTSecurityWithMP-JWT @JLouisMonteiro @tomitribe @dblevins @tomitribe

OAuth 2.0 Message POST /painter/color/select HTTP/1.1 Host: api.superbiz.io QCON SP Authorization: Bearer 6Fe4jd7TmdE5yW2q0y6W2w User-Agent: curl/7.43.0 Accept: */* Content-Type: application/json Content-Length: 44 {"color":{"r":255,"g":0,"b":0,"name":"red"}} #RESTSecurityWithMP-JWT @JLouisMonteiro @tomitribe @dblevins @tomitribe

OAuth 2.0 Message POST /painter/color/fill HTTP/1.1 Host: api.superbiz.io QCON SP Authorization: Bearer 6Fe4jd7TmdE5yW2q0y6W2w User-Agent: curl/7.43.0 Accept: */* Content-Type: application/json Content-Length: 49 {"color":{"r":0,"g":255,"b":255,"name":"yellow"}} #RESTSecurityWithMP-JWT @JLouisMonteiro @tomitribe @dblevins @tomitribe

Stateless Microservice Security via QCON SP JWT, TomEE and - PowerPoint PPT Presentation

Stateless Microservice Security via QCON SP JWT, TomEE and MicroProfile Jean-Louis Monteiro Tomitribe #RESTSecurityWithMP-JWT @JLouisMonteiro @tomitribe Why am I here today? QCON SP Microservices architecture case Security opEons OAuth2

Stateless Microservice Security via JWT, TomEE and MicroProfile Jean-Louis Monteiro Tomitribe

Practical Microservice Security Laura Bell Practical Microservice security Laura Bell Founder

IPv6 Stateless Address Autoconfiguration: Balancing Between Security, Privacy and Usability Ahmad

A Safe and Stateless Platform - Introduction to Google Chrome OS Security model Google Chrome

Security Considerations for Microservice Architectures Daniel Richter, Tim Neumann, and Andreas

API security in a microservice architecture Matt McLarty VP, API Academy, CA Technologies Feb.

Enterprise Microservice Platform and Operation

CONTAINER AND MICROSERVICE SECURITY ADRIAN MOUAT Chief Scientist @ Container Solutions Wrote

CO 447 | LEC6 BLOCKCHAIN SECURITY Dr. Benjamin Livshits Stateless Fingerprinting 2 EFF

PRACTICAL MTLS Ying Li @cyli PROBLEM TYPICAL MICROSERVICE ARCHITECTURE VPC S1 DB S2 S1 S3

Data Distribution and Exploitation in a Global Microservice Arteract Observatory Panagiotis

Probably the worlds best stateless traffic generation and analysis platform 2 1 2 4 5 6

Probably the worlds best stateless Ethernet traffic generation and analysis platform 2 1 2

Towards TVF 4 TVF 3 TVF 2 TVF 1 r log(Packet Value) r + D 3 D 3 r + D 3 + D 2 Core-Stateless

Improving Stateless Hash-Based Signatures CT-RSA 2018 Jean-Philippe Aumasson 1 , Guillaume

Armeria Armeria A Microservice Framework A Microservice Framework Well-suited Everywhere

dIVI-pd: Dual-Stateless IPv4/IPv6 Translation with Prefix Delegation X. Li, C. Bao, W. Dec, R.

Stateless Reset QUIC Interim 2017-06, Paris Manifest Confusion What is the purpose of a

Stateless Determinis-c NAT (SD-NAT)

Highly-Available Applications on Unreliable Infrastructure: Microservice Architectures in

Wage Your Bets: Microservice, Monolith, or Serverless Presented

Microservice A B Evolution B B Adalberto R. Sampaio Jr, Harshavardhan Kadiyala, Bo

Microservice How to Model Services? Software Engineering II Sharif University of Technology

NDN: an Orchestrated Microservice Architecture for Named Data Networking Xavier MARCHAL,