KubeRM: a distributed rule-based security management system in cloud native environment

Abstract

Recently, Microservice orchestration has attracted a great deal of attention in IT community. As a breaking technique to redefine our cloud, Microservice orchestration service, such as Kubernetes [1], As development teams have rapidly embraced the technique, the importance of securing the orchestration service has become the focal point. Hence, security practitioners are facing great challenges from the new eco-system. In this paper, we propose a distributed security management system, KubeRM, for cloud native environment. One of the greatest challenges we are facing is how to effectively and efficiently synchronize security detecting abilities across all machines in our large Kubernetes cluster. Hence, instead of implementing a centralized management system, our proposal focuses on designing a distributed security management system, which achieves seconds level security enforcement across all machines. In further, we also demonstrate our prototype system, KubeRM, which can effectively enforce not only the exploits detection on vulnerable K8s servers but also detect abnormal network traffic against the orchestrator. It leverages a rules-based detection strategies to profile all orchestrator behaviors.