Search papers, labs, and topics across Lattice.
This paper introduces eMicro, a path-aware defense system designed to enhance access control in microservices by preventing multi-hop attacks that exploit legitimate service interactions. By employing history-based access control, efficient deterministic finite automaton (DFA) for policy encoding, and eBPF-based in-kernel request tracing, eMicro achieves rapid policy checks and low overhead enforcement. Evaluation results indicate that eMicro can handle millions of request workflows with minimal performance impact, demonstrating its scalability and practicality for large-scale deployments.
eMicro achieves real-time multi-hop access control for microservices, processing policy checks in just 1 microsecond while storing 50 million policies in only 100 MB.
Modern cloud applications often comprise thousands of microservices whose interactions form complex request paths. Traditional inter-service access control restricts individual service-to-service requests, but fails to prevent multi-hop attacks, where each hop appears legitimate yet the overall path violates security intent. This gap leaves systems exposed to unauthorized access and data exfiltration. In this paper, we present eMicro, a path-aware defense system for microservices that prevents such attacks while remaining efficient and deployable. eMicro enforces real-time multi-hop access control through three key techniques: (1) history-based access control extended to capture service invocation sequences; (2) security policies encoded as efficient deterministic finite automaton (DFA), supporting constant-time lookups and compact label propagation; (3) eBPF-based in-kernel request tracing for transparent, low-overhead enforcement without code changes. Evaluations on DeathStarBench and production cloud traces from Uber, Alibaba, and ByteDance, covering 12 million request workflows and thousands of services, demonstrate the scalability of eMicro. eMicro performs policy checks in 1 microsecond, stores 50 million policies in only 100 MB, and reduces propagation overhead by 90% with negligible runtime impact. These results show that eMicro delivers scalable and efficient protection against multi-hop attacks, making it practical for deployment in large-scale microservice environments.
