Using attribute-based access control and mTLS in microservice architecture

Abstract

This paper explores the possibilities of using mutual TLS authentication (mTLS) together with attribute-based access control (ABAC) in a microservice architecture. The paper discusses the basic principles of mTLS, its role in providing secure authentication between services, and ways to integrate TLS certificates into ABAC for making access decisions. The proposed model involves using TLS certificates to identify and authorize subjects. An architectural approach is considered in which ABAC is implemented as microservices that provide flexibility, scalability, and compatibility with modern distributed systems Integration of mTLS and ABAC will allow building a secure and holistic authentication and authorization model that protects critical data and transactions in microservice systems. The main idea of the proposed model is to use TLS certificates not only as an authentication tool in the mTLS process, but also as a reliable source of attributes for the attribute-based access control (ABAC) system. Traditionally, tokens such as JWT have been used for authorization, and X.509 certificates are used exclusively to confirm the authenticity of the client and server when establishing a TLS connection. However, JWT tokens are vulnerable to interception and require additional validation mechanisms. In the proposed approach, all information required for authorization is embedded in X.509 certificates and verified cryptographically for each connection. A practical implementation of the attribute-based access control (ABAC) model using the mutual TLS (mTLS) mechanism in the Kubernetes infrastructure is performed. Ingress-NGINX is used as a PEP, Open Policy Agent (OPA) as a PDP, Rego as a language for describing policies in OPA are used as architectural components.