An Experimental Evaluation of Layered Security Controls for Inter-Service Communication in Containerised Microservices

In recent years, there have been a number of new application architectures developed (examples include microservices and containerisation) that introduce significant security challenges for inter-service communication. Whereas internal calls made within a monolithic application are generally considered to be trusted, inter-service communication tends to occur over networks, which expands the attack surface of the application significantly. As a result, there are many types of vulnerabilities (token forgery, replay attacks, brute force credential guessing, inadequate validation, and man-in-the-middle (MitM) interception) that could be exploited in a poorly configured deployment of a microservice architecture. This research describes the controlled experimental evaluation of these types of vulnerabilities within the context of a realistic, containerised microservice environment, which was implemented using Node.js and Docker. The environment consisted of an authentication service, order service, and API Gateway. This environment was deliberately configured to be vulnerable; this included hard-coded JWT secrets, no claim validation, no rate limiting, and plain HTTP. All five original attack types were demonstrated successfully within the context of this testbed. Within a zero-trust architectural framework aligned with NIST SP 800-207, a defence-in-depth approach was used to incrementally implement seven technical controls: JWT hardening; environment-based secret externalisation; rate limiting; token tracking and replay protection; API gateway enforcement; HTTPS edge encryption; and mutual TLS (mTLS) between the gateway and the order service. Verification of re-executed attack(s) against the secured system determined successful blocking during experimental testing: forged tokens resulted in a response of HTTP 401; brute-force attempts were limited in their attempt rate, resulting in HTTP 429; replayed tokens were blocked following their first use; claims that were manipulated were rejected; and man-in-the-middle interception was prevented via encryption and certificate-based authentication (CBA). Quantitative performance measurements showed that although the additional security technical controls created measurable, but acceptable operational overhead, with respect to end-to-end latency of JWT-based requests, it increased from 12.4 ms to 18.7 ms—through the use of mTLS it increased from 12.4 ms to 45.3 ms. This indicates that, within the described experimental environment, combining application-level security technical controls with transport layer security (TLS) in a manner that aligns with NIST’s zero-trust architectural principles can secure communications between microservices deployed inside containers. These findings are specific to the described Docker Compose testbed and threat model and should not be read as general claims about production microservice deployments.