FIELD OF THE DISCLOSURE

The present application generally relates to service graphs, including but not limited to systems and methods for applying security policies to use of microservices and application programming interfaces (APIs) to microservices.

BACKGROUND

Various services may be used, accessed, or otherwise provided to users. Such services may include microservices which perform a subset of tasks or functions which, collectively, provide the service to the user. Microservice(s) may have multiple application programming interfaces (APIs). Some programs or users may access such microservices via these APIs that should not access such microservices or use such APIs.

SUMMARY

This Summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. This Summary is not intended to identify key features or essential features, nor is it intended to limit the scope of the claims included herewith.

The present disclosure is directed to systems and methods of identifying security issues and applying security policies to the service(s) and/or microservices. Rather than a user (such as an administrator) reactively diagnosing security incidents, the systems and methods described herein may provide a tool by which the user can proactively monitor the use of the services and microservices for security issues and control the user of such microservices and services via policies. The systems and methods allow API granular policy control to determine which APIs may be granted or denies access based on a variety of criteria, such as but not limited to the source of the request, the specific API being called, temporal conditions, geography and so forth. The user can identify security concerns or issues on a per API basis.

Described herein is a method for applying a policy to an application programming interface of a microservice. In the method, a device intermediary to a plurality of microservices identifies a policy for accessing an application programming interface (API) of a microservice. The policy identifies which of the other microservices may access the API of the microservice. The device receives one or more requests from one or more microservices to access the API of the microservice. The device determines, responsive to the policy, that at least one request is from a microservice not allowed to access the API. The device prevents the request from accessing microservice.

The method may include receiving, by the device, a request from a source other than the plurality of microservices to access the API of the microservice. The source may be a device external to a network of the plurality of microservices. The method may include the device blocking the request responsive to the policy. The method may include the device identifying a request to access the API of the microservice from a second microservice as allowed, responsive to the policy. The method may include the device forwarding the second allowed request to the microservice.

The method may include generating, by the device, a service graph comprising a plurality of microservices and one or more links between one or more microservices and the microservice. The method may include displaying by the device the service graph identifying one or more device actions responsive to the policy and in association with a corresponding link to the microservice. The method may further include displaying the service graph with one or more user interface elements. The user interface elements may take an action with respect to the link with respect to one or more requests. The action may be quarantining, preventing access, releasing, or adding a second policy.

The method may include generating, by the device, a service graph. The service graph may include the plurality of microservices and one or more links allowed by the policy between one of the other microservices and the microservice. The method may include displaying, by the device, the service graph with an identification of the one or more links to the microservice allowed by the policy.

Described herein is a system for applying a policy to an application programming interface of a microservice. The system may include a device comprising one or more processors, coupled to memory, and intermediary to a plurality of microservices. The device may be configured to identify a policy for accessing an application programming interface (API) of a microservice of a plurality of microservices. The policy may identify which other of the plurality of microservices may access the API of the microservice. The device may be configured to receive one or more requests from one or more microservices of the plurality of microservices to access the API of the microservice. The device may be configured to determine, responsive to the policy, that at least one request of the one or more requests is from a microservice not allowed to access the API of the microservice. The device may be configured to prevent, responsive to the determination, access to the microservice by the at least one request.

The device may be further configured to receive a request from a source other than the plurality of microservices to access the API of the microservice. The source may comprise a device external to a network of the plurality of microservices. The device may be configured to block the request responsive to the policy.

The device may be configured to identify, responsive to the policy, that a second request to access the API of the microservice is from a second microservice identified as allowed to access the microservice. The device may be configured to forward the second request to the microservice.

The device may be configured to generate a service graph comprising the plurality of microservices and one or more links between the one or more of the other of the plurality of microservices and the microservice. The device may be configured to display the service graph with identification of one or more actions of the device responsive to the policy in association with a corresponding link to the microservice.

The device may be configured to display the service graph with one or more user interface elements to take an action with respect to the link with respect to the one or more requests. The action may be one of quarantining, preventing access, releasing or adding a second policy.

The device may be configured to generate a service graph comprising the plurality of microservices and one or more links allowed by the policy between the one or more of the other of the plurality of microservices and the microservice. The device may be configured to display the service graph with identification of the one or more links to the microservice allowed by the policy.

