Privacy-Risk Detection in Microservices Composition Using Distributed Tracing

It is a common task when employing the microservices architecture to integrate a number of loosely coupled entities that communicate with each other resulting in service requests that disseminate through a number of service endpoints. As the number of service endpoints increases, identifying the path to which a service request passes through the network becomes a time consuming and challenging task. In addition, as part of service requests, personal data may be shared across a number of service providers without end-users' knowledge. Hence, tracing service requests and the extent to which data is flowing from one service endpoint to another becomes inevitable. In this paper, we introduce a distributed tracing Privacy Risk Detection (dtPRD) framework for identifying potential privacy and security risks associated with the dissemination of data through the path a service request undergoes. Identifying any risks associated with data sharing across a service path or plan can help in classifying service endpoints that are vulnerable or have the potential of exposing data without the end user's knowledge. Throughout the paper, we present experimental and validation results of our proposed approach which show the effectiveness and usefulness of the dtPRD framework.