eMicro prevents microservice attacks with real-time path checks

Researchers from IBM, Tsinghua University, and other institutions have developed **eMicro**, a path-aware defense system designed to prevent multi-hop attacks in large-scale microservice environments. Traditional access control systems focus on individual service-to-service requests but fail to detect attacks where each hop appears legitimate while the overall path violates security policies. eMicro addresses this gap by enforcing real-time multi-hop access control through three key innovations: history-based access control that captures service invocation sequences, security policies encoded as deterministic finite automata (DFA) for constant-time lookups and compact label propagation, and eBPF-based in-kernel request tracing for transparent, low-overhead enforcement without requiring code modifications.

Evaluations on DeathStarBench and production cloud traces from Uber, Alibaba, and ByteDance—covering 12 million request workflows and thousands of services—demonstrate eMicro’s scalability and efficiency. The system performs policy checks in just 1 microsecond, stores 50 million policies in only 100 MB of memory, and reduces propagation overhead by 90% with negligible runtime impact. These results highlight eMicro’s practicality for deployment in large-scale microservice environments, offering a scalable solution to prevent multi-hop attacks while maintaining performance.