NIST SP 800-204A Building Secure Microservices-based Applications Using Service-Mesh Architecture

こんにちは、丸山満彦です。

NIST がマイクロサービスベースのアプリケーションをサポートするための堅牢なセキュリティインフラストラクチャを形成するプロキシベースのサービスメッシュコンポーネントの導入ガイダンスと公表していますね。。。

● NIST - ITL - Computer Security Resource Center

・2020.05.27 SP 800-204A Building Secure Microservices-based Applications Using Service-Mesh Architecture

・[PDF]  SP 800-204A (DOI)

・Other Parts of this Publication: SP 800-204

Abstract

The increasing trend in building microservices-based applications calls for addressing security in all aspects of service-to-service interactions due to their unique characteristics. The distributed cross-domain nature of microservices needs secure token service (STS), key management and encryption services for authentication and authorization, and secure communication protocols. The ephemeral nature of clustered containers (by which microservices are implemented) calls for secure service discovery. The availability requirement calls for: (a) resiliency techniques, such as load balancing, circuit breaking, and throttling, and (b) continuous monitoring (for the health of the service). The service mesh is the best-known approach that can facilitate specification of these requirements at a level of abstraction such that it can be uniformly and consistently defined while also being effectively implemented without making changes to individual microservice code. The purpose of this document is to provide deployment guidance for proxy-based Service Mesh components that collectively form a robust security infrastructure for supporting microservices-based applications.

	Executive Summary	概要
1	Introduction	はじめに
1.1	Why Service Mesh	なぜサービスメッシュなのか
1.2	Scope	範囲
1.3	Target Audience	想定読者
1.4	Relationship to other NIST Guidance Documents	他の NIST ガイダンス文書との関係
1.5	Organization of this Document	本書の構成
2	Microservices-based Application – Background and Security Requirements	マイクロサービスベースのアプリケーション - 背景とセキュリティ要件
2.1	Authentication and Authorization Requirements	認証と認可の要件
2.2	Service Discovery	サービスの発見
2.3	Improving Availability through Network Resilience Techniques	ネットワーク・レジリエンス技術による可用性の向上
2.4	Application Monitoring Requirement	アプリケーション監視要件
3	Service Mesh – Definitions and Technology Background	サービスメッシュ - 定義と技術背景
3.1	Service Mesh Components & Capabilities	サービスメッシュのコンポーネントと機能
3.1.1	Ingress Controller	イングレスコントローラ
3.1.2	Egress Controller	エグレスコントローラ
3.2	Service Mesh as Communication Middleware: What is Different	通信ミドルウェアとしてのサービスメッシュ。何が違うのか
3.3	Service Mesh: State of the Art	サービスメッシュ：最先端の技術
4	Service Mesh Deployment Recommendations	サービスメッシュ展開の推奨事項
4.1	Communication Configuration for Service Proxies	サービスプロキシの通信構成
4.2	Configuration for Ingress Proxies	イングレスプロキシの設定
4.3	Configuration for Access to External Services	外部サービスへのアクセス設定
4.4	Configuration for Identity and Access Management	アイデンティティとアクセス管理の設定
4.5	Configuration for Monitoring Capabilities	監視機能の設定
4.6	Configuration for Network Resilience Techniques	ネットワーク・レジリエンス技術のための設定
4.7	Configuration for Cross-Origin Resource Sharing (CORS)	CORS（Cross-Origin Resource Sharing）の設定
4.8	Configuration of Permissions for Administrative Operations	管理業務の権限設定
5	Summary and Conclusions	まとめと結論
	References	参考文献