2026-09-19T03:47:53Zhttps://dspace.mit.edu/server/oai/request

oai:dspace.mit.edu:1721.1/1569832024-09-25T03:59:34Zcom_1721.1_7582com_1721.1_7581col_1721.1_131023

Alizadeh, Mohammad Belsky, David Sinha, Varnika Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science 2024-09-24T18:24:51Z 2024-09-24T18:24:51Z 2024-05 2024-07-11T14:37:32.236Z https://hdl.handle.net/1721.1/156983 https://orcid.org/0009-0002-6015-4303 As cloud adoption increases, cloud providers are competing to build more robust and secure platforms to keep growing and attract more users by ensuring their data is highly available but not susceptible to malicious attacks. Many cloud platforms are distributed systems based on a microservices architecture where many services communicate with one another. Communication among services should be authenticated to implement security in depth and not just rely on the security of networks and infrastructure. However, these services can be on the order of hundreds or thousands, which increases the number of specialized secrets needed to provide authentication. This means that systems like these involve a large number of secrets. These large numbers of secrets are hard to manage and track in the case of exposure, which leads to a risk of misconfiguration and leaks. We implement a framework that accounts for these secrets by managing the creation, rotation, and deletion in accordance with the existing architecture of the platform with a Kubernetes custom resource and controller and ensure that a secret with the correct permissions is always present when needed. M.Eng. Massachusetts Institute of Technology Attribution-NonCommercial-NoDerivatives 4.0 International (CC BY-NC-ND 4.0) Copyright retained by author(s) https://creativecommons.org/licenses/by-nc-nd/4.0/ Enforcing Identification and Authentication Policies at Scale in a Cloud Microservices Architecture Thesis application/pdf Master Master of Engineering in Electrical Engineering and Computer Science Publication unknown unknown <Publication xmlns="https://www.openaire.eu/cerif-profile/1.1/" id="21533a8d-2b2d-4616-8742-d9db6cb75980"> <Type xmlns="https://www.openaire.eu/cerif-profile/vocab/COAR_Publication_Types">http://purl.org/coar/resource_type/c_1843</Type> <Title>Enforcing Identification and Authentication Policies at Scale in a Cloud Microservices Architecture</Title> <PublishedIn> <Publication> </Publication> </PublishedIn> <PublicationDate>2024-05</PublicationDate> <Authors> <Author> <DisplayName>Sinha, Varnika</DisplayName> <Affiliation> <OrgUnit> </OrgUnit> </Affiliation> </Author> </Authors> <Editors> </Editors> <Publishers> <Publisher> <DisplayName>Massachusetts Institute of Technology</DisplayName> <OrgUnit /> </Publisher> </Publishers> <License>https://creativecommons.org/licenses/by-nc-nd/4.0/</License> <Abstract>As cloud adoption increases, cloud providers are competing to build more robust and secure platforms to keep growing and attract more users by ensuring their data is highly available but not susceptible to malicious attacks. Many cloud platforms are distributed systems based on a microservices architecture where many services communicate with one another. Communication among services should be authenticated to implement security in depth and not just rely on the security of networks and infrastructure. However, these services can be on the order of hundreds or thousands, which increases the number of specialized secrets needed to provide authentication. This means that systems like these involve a large number of secrets. These large numbers of secrets are hard to manage and track in the case of exposure, which leads to a risk of misconfiguration and leaks. We implement a framework that accounts for these secrets by managing the creation, rotation, and deletion in accordance with the existing architecture of the platform with a Kubernetes custom resource and controller and ensure that a secret with the correct permissions is always present when needed.</Abstract> <Access xmlns="http://purl.org/coar/access_right" > </Access> </Publication>