Microservices based Security Arch Doc Cheat Sheet / 基于微服务的安全架构文档速查表¶
Introduction / 介绍¶
The microservice architecture is being increasingly used for designing and implementing application systems in both cloud-based and on-premise infrastructures. There are many security challenges need to be addressed in the application design and implementation phases. In order to address some security challenges it is necessity to collect security-specific information on application architecture. The goal of this article is to provide a concrete proposal of approach to collect microservice-based architecture information to securing application.
微服务架构正越来越多地被用于设计和实现基于云和本地基础设施的应用系统。在应用设计和实施阶段需要解决许多安全挑战。为了解决一些安全挑战，有必要收集关于应用架构的安全特定信息。本文的目的是提供一个具体的方案，用于收集基于微服务的架构信息以确保应用安全。
Context / 上下文¶
During securing applications based on microservices architecture, security architects/engineers usually face with the following questions (mostly referenced in the OWASP Application Security Verification Standard Project under the section V1 "Architecture, Design and Threat Modeling Requirements"):
在基于微服务架构的安全应用过程中，安全架构师/工程师通常面临以下问题（大部分参考自OWASP应用安全验证标准项目下的V1 "架构、设计和威胁建模要求"部分)：
- Threat modeling and enforcement of the principle of least privilege:
中文：威胁建模和最小权限原则的实施：- What scopes or API keys does microservice minimally need to access other microservice APIs?
中文：微服务最少需要访问哪些范围或API密钥以访问其他微服务的API？ - What grants does microservice minimally need to access database or message queue?
中文：微服务最少需要哪些权限才能访问数据库或消息队列？
- What scopes or API keys does microservice minimally need to access other microservice APIs?
- Data leakage analysis:
中文：数据泄露分析：- What storages or message queues do contain sensitive data?
中文：哪些存储或消息队列包含敏感数据？ - Does microservice read/write date from/to specific database or message queue?
中文：微服务是否从/向特定数据库或消息队列读取/写入日期？ - What microservices are invoked by dedicated microservice? What data is passed between microservices?
中文：由专用微服务调用的微服务有哪些？微服务之间传递了哪些数据？
- What storages or message queues do contain sensitive data?
- Attack surface analysis:
中文：攻击面分析：- What microservices endpoints need to be tested during security testing?
中文：在安全测试期间需要测试哪些微服务端点？
- What microservices endpoints need to be tested during security testing?
In most cases, existing application architecture documentation is not suitable to answer those questions. Next sections propose what architecture security-specific information can be collected to answer the questions above.
在大多数情况下，现有的应用程序架构文档不适用于回答上述问题。下一节提出可以收集哪些特定于架构安全的信息来回答上述问题。
Objective / 客观的¶
The objectives of the cheat sheet are to explain what architecture security-specific information can be collected to answer the questions above and provide concrete proposal of approach to collect microservice-based architecture information to securing application.
本速查表的目的是解释可以收集哪些特定于架构安全的信息来回答上述问题，并提供收集基于微服务架构信息的具体方法，以保障应用程序的安全。
Proposition / 命题¶
Collect information on the building blocks / 收集构建块信息¶
Identify and describe application-functionality services / 识别和描述应用程序功能服务¶
Application-functionality services implement one or several business process or functionality (e.g., storing customer details, storing and displaying product catalog). Collect information on the parameters listed below related to each application-functionality service.
应用程序功能服务实现一个或多个业务流程或功能（例如，存储客户详情，存储和显示产品目录）。收集与每个应用程序功能服务相关的以下参数信息。
| Parameter name / 参数名称 | Description / 描述 |
|---|---|
| Service name (ID) 服务名称（ID） |
Unique service name or ID 唯一服务名称或ID |
| Short description 简短描述 |
Short description of business process or functionality implemented by the microservice 描述由微服务实现的企业流程或功能 |
| Link to source code repository 源代码仓库链接 |
Specify a link to service source code repository 指定服务源代码仓库的链接 |
| Development Team 开发团队 |
Specify development team which develops the microservice 指定开发微服务的团队 |
| API definition API 定义 |
If microservice exposes external interface specify a link to the interface description (e.g., OpenAPI specification). It is advisable to define used security scheme, e.g. define scopes or API keys needed to invoke dedicated endpoint (e.g., see). 如果微服务暴露了外部接口，请指定接口描述的链接（例如，OpenAPI 规范）。建议定义使用的安全方案，例如定义作用域或调用特定端点所需的 API 密钥（例如，查看）。 |
| The microservice architecture description 微服务架构描述 |
Specify a link to the microservice architecture diagram, description (if available) 指定微服务架构图的链接，描述（如果可用） |
| Link to runbook 运行手册链接 |
Specify a link to the microservice runbook 指定微服务的运行手册链接 |
Identify and describe infrastructure services / 识别和描述基础设施服务¶
Infrastructure services including remote services may implement authentication, authorization, service registration and discovery, security monitoring, logging etc. Collect information on the parameters listed below related to each infrastructure service.
包括远程服务在内的基础设施服务可能实现身份验证、授权、服务注册和发现、安全监控、日志记录等。收集以下参数列表中与每个基础设施服务相关的信息。
| Parameter name / 参数名称 | Description / 描述 |
|---|---|
| Service name (ID) 服务名称（ID） |
Unique service name or ID 唯一服务名称或ID |
| Short description 简短描述 |
Short description of functionality implemented by the service (e.g., authentication, authorization, service registration and discovery, logging, security monitoring, API gateway). 服务实现的功能的简短描述（例如，身份验证、授权、服务注册和发现、日志记录、安全监控、API 网关） |
| Link to source code repository 源代码仓库链接 |
Specify a link to service source code repository (if applicable) 指定服务源代码仓库的链接（如果适用） |
| Link to the service documentation 服务文档链接 |
Specify a link to the service documentation that includes service API definition, operational guidance/runbook, etc. 指定包含服务API定义、操作指南/运行手册等的服务文档链接 |
Identify and describe data storages / 识别和描述数据存储¶
Collect information on the parameters listed below related to each data storage.
收集以下参数列表中与每个数据存储相关的信息。
| Parameter name / 参数名称 | Description / 描述 |
|---|---|
| Storage name (ID) 存储名称（ID） |
Unique storage name or ID 唯一的存储名称或ID |
| Software type 软件类型 |
Specify software that implements the data storage (e.g., PostgreSQL, Redis, Apache Cassandra). 指定实现数据存储的软件（例如，PostgreSQL、Redis、Apache Cassandra） |
Identify and describe message queues / 识别和描述消息队列¶
Messaging systems (e.g., RabbitMQ or Apache Kafka) are used to implement asynchronous microservices communication mechanism. Collect information on the parameters listed below related to each message queue.
| Parameter name / 参数名称 | Description / 描述 |
|---|---|
| Message queue (ID) 消息队列（ID） |
Unique message queue name or ID 唯一的消息队列名称或ID |
| Software type 软件类型 |
Specify software that implements the message queue (e.g., RabbitMQ, Apache Kafka). 指定实现消息队列的软件（例如，RabbitMQ、Apache Kafka）。 |
Identify and describe data assets¶
Identify and describe data assets that processed by system microservices/services. It is advisable firstly to identify assets, which are valuable from a security perspective (e.g., "User information", "Payment"). Collect information on the parameters listed below related to each asset.
| Parameter name / 参数名称 | Description / 描述 |
|---|---|
| Asset name (ID) 资产名称（ID） |
Unique asset name or ID 唯一的资产名称或ID |
| Protection level 保护级别 |
Specify asset protection level (e.g., PII, confidential) 指定资产保护级别（例如，PII、机密） |
| Additional info 附加信息 |
Add clarifying information 添加说明信息 |
Collect information on relations between building blocks¶
Identify "service-to-storage" relations¶
Collect information on the parameters listed below related to each "service-to-storage" relation.
| Parameter name / 参数名称 | Description / 描述 |
|---|---|
| Service name (ID) 服务名称（ID） |
Specify service name (ID) defined above 指定上述定义的服务名称（ID） |
| Storage name (ID) 存储名称（ID） |
Specify storage name (ID) defined above 指定上述定义的存储名称（ID） |
| Access type 访问类型 |
Specify access type, e.g. "Read" or "Read/Write" 指定访问类型，例如 "读取" 或 "读取/写入" |
Identify "service-to-service" synchronous communications / 识别“服务间”同步通信¶
Collect information on the parameters listed below related to each "service-to-service" synchronous communication.
收集以下参数列表中与每个“服务间”同步通信相关的信息。
| Parameter name / 参数名称 | Description / 描述 |
|---|---|
| Caller service name (ID) 调用者服务名称（ID） |
Specify caller service name (ID) defined above 指定上述定义的调用者服务名称（ID） |
| Called service name (ID) 被调用服务名称（ID） |
Specify called service name (ID) defined above 指定上述定义的被调用服务名称（ID） |
| Protocol/framework used 使用的协议/框架 |
Specify protocol/framework used for communication, e.g. HTTP (REST, SOAP), Apache Thrift, gRPC 指定用于通信的协议/框架，例如 HTTP (REST, SOAP)、Apache Thrift、gRPC |
| Short description 简短描述 |
Shortly describe the purpose of communication (requests for query of information or request/commands for a state-changing business function) and data passed between services (if possible, in therms of assets defined above) 简要描述通信的目的（查询信息的请求或改变业务状态的功能请求/命令）以及服务间传递的数据（如果可能，以上述定义的资产为术语） |
Identify "service-to-service" asynchronous communications / 识别“服务间”异步通信¶
Collect information on the parameters listed below related to each "service-to-service" asynchronous communication.
收集以下参数列表中与每个“服务间”异步通信相关的信息。
| Parameter name / 参数名称 | Description / 描述 |
|---|---|
| Publisher service name (ID) 发布者服务名称（ID） |
Specify publisher service name (ID) defined above 指定上述定义的发布者服务名称（ID） |
| Subscriber service name (ID) 订阅者服务名称（ID） |
Specify subscriber service name (ID) defined above 指定上述定义的订阅者服务名称（ID） |
| Message queue (ID) 消息队列（ID） |
Specify message queue (ID) defined above 指定消息队列（ID） |
| Short description 简短描述 |
Shortly describe the purpose of communication (receiving of information or commands for a state-changing business function) and data passed between services (if possible, in therms of assets defined above) 简要描述通信的目的（接收信息或改变业务状态的功能命令）以及服务间传递的数据（如果可能，以上述定义的资产为术语） |
Identify "asset-to-storage" relations / 识别“资产-存储”关系¶
Collect information on the parameters listed below related to each "asset-to-storage" relation.
收集以下参数列表中与每个“资产-存储”关系相关的信息。
| Parameter name / 参数名称 | Description / 描述 |
|---|---|
| Asset name (ID) 资产名称（ID） |
Asset name (ID) defined above 资产名称（ID）定义在上文 |
| Storage name (ID) 存储名称（ID） |
Specify storage name (ID) defined above 指定上述定义的存储名称（ID） |
| Storage type 存储类型 |
Specify storage type for the asset, e.g. "golden source" or "cache" 指定资产的存储类型，例如“金库”或“缓存” |
Create a graphical presentation of application architecture / 创建应用架构的图形表示¶
It is advisable to create graphical presentation of application architecture (building blocks and relations defined above) in form of services call graph or data flow diagram. In order to do that one can use special software tools (e.g. Enterprise Architect) or DOT language. See example of using DOT language here.
建议以服务调用图或数据流图的形式创建应用架构（上文定义的构建块和关系）的图形表示。为此，可以使用专门的软件工具（例如Enterprise Architect）或DOT语言。请参阅使用DOT语言的示例这里。
Use collected information in secure software development practices / 在安全的软件开发实践中使用收集到的信息¶
Collected information may be useful for doing application security practices, e.g. during defining security requirements, threat modeling or security testing. Sections below contains examples of activities related to securing application architecture (as well as its mapping to OWASP projects) and tips for their implementation using information collected above.
收集到的信息可能对进行应用安全实践很有用，例如在定义安全需求、威胁建模或安全测试期间。下文包含与确保应用架构（以及其映射到OWASP项目）相关的活动示例以及使用上述收集到的信息实施这些活动的技巧。
Attack surface analysis / 攻击面分析¶
Implementation tips / 实施技巧¶
To enumerate microservices endpoints that need to be tested during security testing and analyzed during threat modeling analyze data collected under the following sections:
在安全测试期间需要测试的微服务端点和在威胁建模期间需要分析的数据，请分析以下部分收集的数据：
- Identify and describe application-functionality services (parameter "API definition")
中文：识别并描述应用程序功能服务（参数“API定义”） - Identify and describe infrastructure services (parameter "Link to the service documentation")
中文：识别并描述基础设施服务（参数“服务文档链接”）
Mapping to OWASP projects / 映射到OWASP项目¶
- OWASP ASVS, V1 "Architecture, Design and Threat Modeling Requirements", #1.1.2) （OWASP ASVS V1 “架构、设计和威胁建模要求”，#1.1.2）
- OWASP Attack Surface Analysis Cheat Sheet （OWASP攻击面分析速查表）
Data leakage analysis / 数据泄露分析¶
Implementation tips / 实施技巧¶
To analyze possible data leakage analyze data collected under the following sections:
为了分析可能的数据泄露，请分析以下部分收集的数据：
- Identify and describe data assets
- Identify "service-to-storage" relations
- Identify "service-to-service" synchronous communications
中文：识别“服务间”同步通信 - Identify "service-to-service" asynchronous communications
中文：识别“服务间”异步通信 - Identify "asset-to-storage" relations
中文：识别“资产-存储”关系
Mapping to OWASP projects / 映射到OWASP项目¶
- OWASP ASVS, V1 "Architecture, Design and Threat Modeling Requirements", #1.1.2) （OWASP ASVS V1 “架构、设计和威胁建模要求”，#1.1.2）
- OWASP Top 10-2017 A3-Sensitive Data Exposure) （OWASP Top 10-2017 A3-敏感数据泄露）
Application's trust boundaries, components, and significant data flows justification / 应用信任边界、组件和重要数据流合理性说明¶
Implementation tips / 实施技巧¶
Start the review of the application's trust boundaries, components, and significant data flows with the inventories from these sections:
从以下部分开始审查应用的信任边界、组件和重要数据流：
- Identify and describe application-functionality services
中文：识别和描述应用程序功能服务 - Identify and describe infrastructure services
中文：识别和描述基础设施服务 - Identify and describe data storages
中文：识别和描述数据存储 - Identify and describe message queues
中文：识别和描述消息队列 - Identify "service-to-storage" relations
- Identify "service-to-service" synchronous communications
中文：识别“服务间”同步通信 - Identify "service-to-service" asynchronous communications
中文：识别“服务间”异步通信
Use these inventories as inputs to a system model. Mark the trust boundaries and the flows that cross them, and justify each crossing. Record the endpoint identities, authentication and authorization enforcement points, and protections for data in transit (see NIST SP 800-204, sections 4.1 and 4.3). Check these controls against the deployed configuration and behavior; the inventories alone do not verify enforcement.
将这些清单作为系统模型的输入。标记信任边界和跨越它们的流量，并说明每个跨越的合理性。记录端点标识、身份验证和授权执行点以及传输中数据的保护（参见NIST SP 800-204，第4.1和4.3节）。将这些控制措施与部署的配置和行为进行核对；仅清单本身不能验证执行情况。
Mapping to OWASP projects / 映射到OWASP项目¶
- OWASP ASVS, V1 "Architecture, Design and Threat Modeling Requirements", #1.1.4) （OWASP ASVS V1 "架构、设计和威胁建模要求"，#1.1.4）
Analysis of the application's high-level architecture / 应用高级架构分析¶
Implementation tips / 实施技巧¶
To verify definition and security analysis of the application's high-level architecture and all connected remote services analyze data collected under the following sections:
为了验证应用高级架构及其所有连接的远程服务的定义和安全分析，分析以下部分收集的数据：
- Identify and describe application-functionality services
中文：识别和描述应用程序功能服务 - Identify and describe infrastructure services
中文：识别和描述基础设施服务 - Identify and describe data storages
中文：识别和描述数据存储 - Identify and describe message queues
中文：识别和描述消息队列
Mapping to OWASP projects / 映射到OWASP项目¶
- OWASP ASVS, V1 "Architecture, Design and Threat Modeling Requirements", #1.1.5) （OWASP ASVS V1 "架构、设计和威胁建模要求"，#1.1.5）
Implementation of centralized security controls verification / 集中安全控制实施验证的实现¶
Implementation tips / 实施技巧¶
To verify implementation of centralized, simple (economy of design), vetted, secure, and reusable security controls to avoid duplicate, missing, ineffective, or insecure controls analyze data collected under the section "Identify and describe infrastructure services".
为验证集中、简单（设计经济性）、经过审查、安全且可重用的安全控制的实施，以避免重复、缺失、无效或不安全控制，分析以下章节下收集的数据：“识别和描述基础设施服务”。
Mapping to OWASP projects / 映射到OWASP项目¶
- OWASP ASVS, V1 "Architecture, Design and Threat Modeling Requirements", #1.1.6) （OWASP ASVS V1 “架构、设计和威胁建模要求”，#1.1.6）
Enforcement of the principle of least privilege / 最小权限原则的实施¶
Implementation tips / 实施技巧¶
To define minimally needed microservice permissions analyze data collected under the following sections:
为定义所需的最小微服务权限，分析以下章节下收集的数据：
- Identify and describe application-functionality services (parameter "API definition")
中文：识别并描述应用程序功能服务（参数“API定义”） - Identify "service-to-storage" relations
- Identify "service-to-service" synchronous communications
中文：识别“服务间”同步通信 - Identify "service-to-service" asynchronous communications
中文：识别“服务间”异步通信
Mapping to OWASP projects / 映射到OWASP项目¶
- OWASP ASVS 4.0.3, V4 "Access Control", #4.1.3) （OWASP ASVS 4.0.3，V4 “访问控制”，#4.1.3）
Sensitive data identification and classification / 敏感数据识别和分类¶
Implementation tips / 实施技巧¶
To verify that all sensitive data is identified and classified into protection levels analyze data collected under the following sections:
为验证所有敏感数据已被识别并分类到保护级别，分析以下章节下收集的数据：
- Identify and describe data assets
- Identify "asset-to-storage" relations
中文：识别“资产-存储”关系
Mapping to OWASP projects / 映射到OWASP项目¶
- OWASP ASVS, V1 "Architecture, Design and Threat Modeling Requirements", #1.8.1) （OWASP ASVS, V1 "架构、设计和威胁建模要求", #1.8.1）
Application components business/security functions verification¶
Implementation tips / 实施技巧¶
To verify the definition and documentation of all application components in terms of the business or security functions they provide analyze data collected under the following sections (parameter "Short description"):
为了验证所有应用组件的业务或安全功能定义和文档，分析以下部分收集的数据（参数"简短描述"）:
- Identify and describe application-functionality services
中文：识别和描述应用程序功能服务 - Identify and describe infrastructure services
中文：识别和描述基础设施服务
Mapping to OWASP projects / 映射到OWASP项目¶
- OWASP ASVS, V1 "Architecture, Design and Threat Modeling Requirements", #1.11.1) （OWASP ASVS, V1 "架构、设计和威胁建模要求", #1.11.1）
References / 参考¶
- NIST SP 800-204: Security Strategies for Microservices-based Application Systems) （NIST SP 800-204：基于微服务应用系统的安全策略）
- OWASP ASVS 4: Architecture, Design and Threat Modeling) （OWASP ASVS 4：架构、设计和威胁建模）